{"report_id":"2742399c-149d-4534-814b-801cf5d6fb83","version":6,"status":"done","tags":[],"date":"2025-10-17T02:49:55Z","url":{"schema":"http","addr":"upshiftade.com","fqdn":"upshiftade.com","domain":"upshiftade.com","tld":"com"},"ip":{"addr":"104.18.20.48","port":0,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"final":{"url":{"schema":"https","addr":"upshiftade.com/#/login","fqdn":"upshiftade.com","domain":"upshiftade.com","tld":"com"},"title":"Login"},"submit":{"url":{"schema":"http","addr":"upshiftade.com","fqdn":"upshiftade.com","domain":"upshiftade.com","tld":"com"},"ip":{"addr":"104.18.20.48","port":0,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"tags":null,"meta":null,"user":{"user_id":"akbkyowd9geqr98"}},"settings":{"access":"public","device_type":"desktop","expires_at":"2026-11-21T02:49:55Z","useragent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0","referer":"","cookies":null,"exit_node":"z0yflva4pidy47h"},"stats":{"alert_count":{"ids":0,"urlquery":0,"analyzer":4}},"detection":{"ids":null,"analyzer":[{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2025-10-17","alert":"Sinkholed","trigger":"v4fuwb.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2025-10-17","alert":"Sinkholed","trigger":"upshiftade.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2025-10-17","alert":"Sinkholed","trigger":"upshiftade.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-10-17","alert":"Sinkholed","trigger":"upshift.rrz7ok.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null},"summary":[{"fqdn":"v4fuwb.com","ip":{"addr":"104.18.21.48","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"domain_registered":"2024-05-14","domain_rank":4250507,"first_seen":"2024-10-13T12:49:32.510762Z","last_seen":"2025-10-11T17:19:47.484849Z","alert_count":2,"request_count":2,"received_data":1270,"sent_data":964,"comment":"","tags":null,"fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}]},{"fqdn":"upshiftjobs.com","ip":{"addr":"104.18.20.48","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"domain_registered":"2025-09-06","domain_rank":0,"first_seen":"2025-10-17T02:49:56.754176Z","last_seen":"2025-10-17T02:49:56.754176Z","alert_count":0,"request_count":9,"received_data":221387,"sent_data":4137,"comment":"","tags":null,"fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"Cloudflare Browser Insights","description":"Cloudflare Browser Insights is a tool that measures the performance of websites from the perspective of users.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["Analytics","RUM"]}]},{"fqdn":"upshiftade.com","ip":{"addr":"104.18.21.48","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"domain_registered":"2025-09-06","domain_rank":0,"first_seen":"2025-10-17T02:49:56.764979Z","last_seen":"2025-10-17T02:49:56.764979Z","alert_count":68,"request_count":34,"received_data":2846758,"sent_data":15488,"comment":"","tags":null,"fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"Cloudflare Browser Insights","description":"Cloudflare Browser Insights is a tool that measures the performance of websites from the perspective of users.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["Analytics","RUM"]}]},{"fqdn":"upshift.rrz7ok.com","ip":{"addr":"104.18.13.89","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"domain_registered":"unknown","domain_rank":0,"first_seen":"No data","last_seen":"No data","alert_count":4,"request_count":4,"received_data":4322,"sent_data":2036,"comment":"","tags":null,"fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}]},{"fqdn":"static.cloudflareinsights.com","ip":{"addr":"104.16.80.73","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"domain_registered":"2019-08-30","domain_rank":4073,"first_seen":"2019-09-24T14:34:56Z","last_seen":"2025-10-12T22:13:55.789176Z","alert_count":0,"request_count":4,"received_data":80980,"sent_data":2026,"comment":"","tags":null,"fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}]},{"fqdn":"mwqyejli.com","ip":{"addr":"104.18.13.89","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"domain_registered":"2024-08-09","domain_rank":5332236,"first_seen":"2024-08-10T00:00:59Z","last_seen":"2025-10-08T16:49:31.896057Z","alert_count":0,"request_count":4,"received_data":2764,"sent_data":2133,"comment":"","tags":null,"fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}]}],"files":null,"artifacts":{"windows_shortcuts":null,"files":null,"telegram":null,"pdfs":null,"clipboard":null},"sensors":{"ids":[{"sensor_name":"suricata","description":"Suricata /w Emerging Threats Pro","alerts":null}],"analyzer":null,"urlquery":null},"javascript":{"script":[{"url":{"schema":"https","addr":"upshiftade.com/","fqdn":"upshiftade.com","domain":"upshiftade.com","tld":"com"},"ip":{"addr":"104.18.21.48","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"scriptElement","is_inline":true,"md5":"d38f284260e382ce5cc08a2185c8e79e","sha1":"b9f96a244cbb8b61d68973bfde209554400ab1a7","sha256":"ee8aecba59146b42d51a5e8846bdbba276d8583ff80270256f754af6e78b1c4e","sha512":"8624673790c02d8da204e2e54f9c2ca9850ffa7941e4f18624fa9f14dc90fda2ed238ebc2a306bc1f1ce8586e5a023af2df69fac87481e0576eaab6be59dbbf2","ssdeep":"","tlshash":"5ef0278a11a3281464f3a0bd4dcf9018b1b9805b254cdf2cbd2d6311ff4561e86fafc5","size":595,"data":"","first_seen":"2025-06-14T07:56:12.305917Z","last_seen":"2026-05-04T16:28:44.401912Z","times_seen":38,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"upshiftade.com/#/","fqdn":"upshiftade.com","domain":"upshiftade.com","tld":"com"},"ip":{"addr":"104.18.21.48","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"scriptElement","is_inline":true,"md5":"d38f284260e382ce5cc08a2185c8e79e","sha1":"b9f96a244cbb8b61d68973bfde209554400ab1a7","sha256":"ee8aecba59146b42d51a5e8846bdbba276d8583ff80270256f754af6e78b1c4e","sha512":"8624673790c02d8da204e2e54f9c2ca9850ffa7941e4f18624fa9f14dc90fda2ed238ebc2a306bc1f1ce8586e5a023af2df69fac87481e0576eaab6be59dbbf2","ssdeep":"","tlshash":"5ef0278a11a3281464f3a0bd4dcf9018b1b9805b254cdf2cbd2d6311ff4561e86fafc5","size":595,"data":"","first_seen":"2025-06-14T07:56:12.305917Z","last_seen":"2026-05-04T16:28:44.401912Z","times_seen":38,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"static.cloudflareinsights.com/beacon.min.js/vcd15cbe7772f49c399c6a5babf22c1241717689176015","fqdn":"static.cloudflareinsights.com","domain":"cloudflareinsights.com","tld":"com"},"ip":{"addr":"104.16.80.73","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"scriptElement","is_inline":false,"md5":"ec18af6d41f6f278b6aed3bdabffa7bc","sha1":"62c9e2cab76b888829f3c5335e91c320b22329ae","sha256":"8a18d13015336bc184819a5a768447462202ef3105ec511bf42ed8304a7ed94f","sha512":"669b0e9a545057acbdd3b4c8d1d2811eaf4c776f679da1083e591ff38ae7684467abacef5af3d4aabd9fb7c335692dbca0def63ddac2cd28d8e14e95680c3511","ssdeep":"384:XriNpnjyMkg8XMtExRN1w29JIOzahXtO2nJ65:GijgSWuanfJ65","tlshash":"8d92d7def645723613f76076913f220b733b35a528068459812adbc22c3d98f6267f6e","size":19948,"data":"","first_seen":"2024-06-07T09:21:23Z","last_seen":"2026-07-24T14:35:42.207329Z","times_seen":337593,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"upshiftade.com/assets/index-5b499674.js","fqdn":"upshiftade.com","domain":"upshiftade.com","tld":"com"},"ip":{"addr":"104.18.21.48","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"importedModule","is_inline":false,"md5":"ee3e2a1973f334bcc4a2babc5c983f53","sha1":"c790a75a6813fa287ef61b24331948600c1bc0c3","sha256":"c3d0cfad886be829cc02f31bc61b02a559a3ca93424ecc818477cb841dd71617","sha512":"cf9e19a1c27ed457785164b751888c65f7cc8fbebd19c6ca8d45550018d043aa9efebb6ce9a79859fff789f6f1076551bc9a131a66ca3fbd81c69d4866e842c9","ssdeep":"","tlshash":"d8f0e12d700de7b2550b0c58e36e78069514465d7b3b8df1d385887297e20fa763db88","size":601,"data":"","first_seen":"2025-10-17T02:50:03.24987Z","last_seen":"2025-10-17T02:50:03.24987Z","times_seen":1,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"upshiftjobs.com/assets/index-d0961c08.js","fqdn":"upshiftjobs.com","domain":"upshiftjobs.com","tld":"com"},"ip":{"addr":"104.18.20.48","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"scriptElement","is_inline":false,"md5":"137b3aeafeb202e8d2ca33d53613e44b","sha1":"dcc6ebb10e632740e7b7c8a215844e004996593d","sha256":"508de462990aeee01ebc18135a36cb57ea02f83f97bbbde8de2ca052e0dfe91a","sha512":"12b312e4e6225250fd0d9848a40c9a32b7df272b98c8002102f67556658839270bfdf4a25a797f9504190bef910c2459f36d5ba177437a5cbedb095d534384e6","ssdeep":"1536:qKcS3kN2SA8AM0K/6lTIIdFOVhNmupgHCTUejnBVBuu7FlJzytkCFLWha/9NiIus:q83m2j20KSlTdgVTm0fx5V7A8IaFagvG","tlshash":"0a0429e47192746613ba19e6507b000af33e2919380ed4d8f06deceb3e6685941bbf7d","size":173133,"data":"","first_seen":"2024-05-15T00:53:40Z","last_seen":"2026-04-28T17:23:00.610461Z","times_seen":137,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"static.cloudflareinsights.com/beacon.min.js/vcd15cbe7772f49c399c6a5babf22c1241717689176015","fqdn":"static.cloudflareinsights.com","domain":"cloudflareinsights.com","tld":"com"},"ip":{"addr":"104.16.80.73","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"scriptElement","is_inline":false,"md5":"ec18af6d41f6f278b6aed3bdabffa7bc","sha1":"62c9e2cab76b888829f3c5335e91c320b22329ae","sha256":"8a18d13015336bc184819a5a768447462202ef3105ec511bf42ed8304a7ed94f","sha512":"669b0e9a545057acbdd3b4c8d1d2811eaf4c776f679da1083e591ff38ae7684467abacef5af3d4aabd9fb7c335692dbca0def63ddac2cd28d8e14e95680c3511","ssdeep":"384:XriNpnjyMkg8XMtExRN1w29JIOzahXtO2nJ65:GijgSWuanfJ65","tlshash":"8d92d7def645723613f76076913f220b733b35a528068459812adbc22c3d98f6267f6e","size":19948,"data":"","first_seen":"2024-06-07T09:21:23Z","last_seen":"2026-07-24T14:35:42.207329Z","times_seen":337593,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"upshiftjobs.com/assets/loading-79ceab2b.js","fqdn":"upshiftjobs.com","domain":"upshiftjobs.com","tld":"com"},"ip":{"addr":"104.18.20.48","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"scriptElement","is_inline":false,"md5":"125d2f28c698984b905ae47d871c1de3","sha1":"6392467b94aa096dfff86880216b5ccfb3cdb19b","sha256":"3693965abc5ef4f20dad9072bd427153e842b6b3e34d4da7c35a896953567751","sha512":"4c8873cc9fa7ee2112e236ce44eabee5b193a5159bc3594db040d77a4a973ff033c667856f4b80286003cabf4d04b70ada79d158fafe2d41f98a1ba87218ffa6","ssdeep":"","tlshash":"f0e0684e6481f9fda11b0c4820a9a802a06829f0b3bce888a45d846b729b069924eb20","size":374,"data":"","first_seen":"2025-02-26T18:09:28.956048Z","last_seen":"2026-04-28T17:23:00.598586Z","times_seen":108,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"upshiftade.com/assets/index-81ac7ae6.js","fqdn":"upshiftade.com","domain":"upshiftade.com","tld":"com"},"ip":{"addr":"104.18.21.48","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"scriptElement","is_inline":false,"md5":"cc146105157cc06970a4f98411391f9d","sha1":"b0e45f982da40cfa54899ee9d43092f951f85fc0","sha256":"bdbf9f5ae3e2c9616820b411e84f1f9dab50b6f9e8a88e265abaeccd5a7745f3","sha512":"d3f77cb06fb586d89fcf46d18fdfd30bd24d8d3cbb05ef1c66fa8eb7b2626ce3591e23d905959435a5f7432d568b690949747921fb1137d7799255b5bd1be41a","ssdeep":"6144:Y04QNdAHKHEz24fGW3T2kvGkH5ZWqiJWU+xF11bWvZhmxOLiGJSq:YSdAHwb4fGDkHHWqCWV1bRxOLiGJSq","tlshash":"0bb463a4b4c7f4918bc8959124aa20d0f2584e833059a5a3dcf8cc6fbdf6976c5b7f18","size":528788,"data":"","first_seen":"2025-10-17T02:50:03.255883Z","last_seen":"2025-10-17T02:50:03.255883Z","times_seen":1,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"upshiftade.com/assets/index-6bf217ff.js","fqdn":"upshiftade.com","domain":"upshiftade.com","tld":"com"},"ip":{"addr":"104.18.21.48","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"importedModule","is_inline":false,"md5":"8e511227be34fd84583aadcda3430494","sha1":"e1a256a14149915899279d5134b7c4f2169c4097","sha256":"36d1461ca20750f95ebcdae04ab14b3ebbe10a71d61818e7670e73e0f81cbd53","sha512":"7828515aa820c851bd6224dbbd93b608194af97a6fb8b3994a6747866589b31a166842d9f06bfac8c88d9da16a142fed2d5565647f08ea436d39975a55d344fb","ssdeep":"","tlshash":"01218cd9a02b17f491830068a964d402e0449ffce32ffed6b2df950366d7827d79a654","size":1385,"data":"","first_seen":"2025-10-17T02:50:03.20857Z","last_seen":"2025-10-17T02:50:03.20857Z","times_seen":1,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"upshiftade.com/assets/login-c8ba0a9a.js","fqdn":"upshiftade.com","domain":"upshiftade.com","tld":"com"},"ip":{"addr":"104.18.21.48","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"scriptElement","is_inline":false,"md5":"1c48796bd5f07e01916656ed990d401d","sha1":"09798e5c21d66b147ea0c8debdf422ff73ad89c1","sha256":"a783af3cd40e48c405e305dd8774570ceec6aea3cd4c3aff5b2612a3d0e30ad9","sha512":"8bed14d9b9141462cf5625a31d49c61489956a68382fe6c90cfa2620e387c736dd2e3526a0c9f6a7e247d8c4188dbdb0e20149519ba99f74cc89e39dba2600d8","ssdeep":"","tlshash":"fd81735ae0699af689430556795a68c0f01d7ff6c1268a00f3bc09263fd3df9db49721","size":3955,"data":"","first_seen":"2025-10-17T02:50:03.204743Z","last_seen":"2025-10-17T02:50:03.204743Z","times_seen":1,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"upshiftade.com/assets/index-81ac7ae6.js","fqdn":"upshiftade.com","domain":"upshiftade.com","tld":"com"},"ip":{"addr":"104.18.21.48","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"scriptElement","is_inline":false,"md5":"cc146105157cc06970a4f98411391f9d","sha1":"b0e45f982da40cfa54899ee9d43092f951f85fc0","sha256":"bdbf9f5ae3e2c9616820b411e84f1f9dab50b6f9e8a88e265abaeccd5a7745f3","sha512":"d3f77cb06fb586d89fcf46d18fdfd30bd24d8d3cbb05ef1c66fa8eb7b2626ce3591e23d905959435a5f7432d568b690949747921fb1137d7799255b5bd1be41a","ssdeep":"6144:Y04QNdAHKHEz24fGW3T2kvGkH5ZWqiJWU+xF11bWvZhmxOLiGJSq:YSdAHwb4fGDkHHWqCWV1bRxOLiGJSq","tlshash":"0bb463a4b4c7f4918bc8959124aa20d0f2584e833059a5a3dcf8cc6fbdf6976c5b7f18","size":528788,"data":"","first_seen":"2025-10-17T02:50:03.255883Z","last_seen":"2025-10-17T02:50:03.255883Z","times_seen":1,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"static.cloudflareinsights.com/beacon.min.js/vcd15cbe7772f49c399c6a5babf22c1241717689176015","fqdn":"static.cloudflareinsights.com","domain":"cloudflareinsights.com","tld":"com"},"ip":{"addr":"104.16.80.73","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"scriptElement","is_inline":false,"md5":"ec18af6d41f6f278b6aed3bdabffa7bc","sha1":"62c9e2cab76b888829f3c5335e91c320b22329ae","sha256":"8a18d13015336bc184819a5a768447462202ef3105ec511bf42ed8304a7ed94f","sha512":"669b0e9a545057acbdd3b4c8d1d2811eaf4c776f679da1083e591ff38ae7684467abacef5af3d4aabd9fb7c335692dbca0def63ddac2cd28d8e14e95680c3511","ssdeep":"384:XriNpnjyMkg8XMtExRN1w29JIOzahXtO2nJ65:GijgSWuanfJ65","tlshash":"8d92d7def645723613f76076913f220b733b35a528068459812adbc22c3d98f6267f6e","size":19948,"data":"","first_seen":"2024-06-07T09:21:23Z","last_seen":"2026-07-24T14:35:42.207329Z","times_seen":337593,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"upshiftade.com/assets/loading-b3425b05.js","fqdn":"upshiftade.com","domain":"upshiftade.com","tld":"com"},"ip":{"addr":"104.18.21.48","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"scriptElement","is_inline":false,"md5":"08aea8b1131c5a0f1f9fec96ac741b49","sha1":"5a1ea98933f29a0d75bc4dc0b6cc3ae3a6093c99","sha256":"a447a40f6b1fc8c63a43dd58eb00b079a7af0c3260e247881534ea02cb1be2a4","sha512":"b623c3d300671272a0adbe1f843652b6990e56ba02f724ce2ef394f3f536949578d08d2d2d81f73af184c46f5436d7da76e6da436445d4ab32b76a6e3a8c1beb","ssdeep":"","tlshash":"cbe0688d2445f9bda19b188875a55903e0682de137bce8c9a48d886ba69a079824eb20","size":380,"data":"","first_seen":"2025-10-17T02:50:03.258582Z","last_seen":"2025-10-17T02:50:03.258582Z","times_seen":1,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"upshiftjobs.com/assets/default-1717d27a.js","fqdn":"upshiftjobs.com","domain":"upshiftjobs.com","tld":"com"},"ip":{"addr":"104.18.20.48","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"scriptElement","is_inline":false,"md5":"6c4b0d57e52b3fc7b490765de48b9081","sha1":"40162686db14e2a2ccbfebbf9934684606ff4929","sha256":"fa80b0c48928003d2991e14d7ced48b67fc381f324f753be22420b20b8630331","sha512":"d0987d49f0d71cb1f3a24defb04bc5f1e31d90076b71fbf419b7a4ae1122d35053ea103d7e00fcbd1e5408597b8eac028ac42e8e072a57589b70b12cb3c0e401","ssdeep":"","tlshash":"ff01fe9e3081ac779bcf289a21268b82b4551fc57734b88894ac8871b21a90cc19db60","size":684,"data":"","first_seen":"2025-03-03T03:20:33.954636Z","last_seen":"2026-04-28T17:23:00.600481Z","times_seen":102,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"upshiftade.com/assets/use-id-68745ac1.js","fqdn":"upshiftade.com","domain":"upshiftade.com","tld":"com"},"ip":{"addr":"104.18.21.48","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"importedModule","is_inline":false,"md5":"3c385c18fc0fa2347184a05ef7acfa5c","sha1":"05590525bb0e1f2f3d4b3b0befd7b994b3903806","sha256":"ad7b68893010908b2ad231a5d5bc58a294cbd9c50292da68afd442635ed755c5","sha512":"64d8a10d73844ef44f6f6f33a4dbcb5c45667a441bcd4581e2759cce13a1b16a4c541d15e2ae756fc66f3358d120ab7bee4ae33900e792c357d3e5b0864a4973","ssdeep":"","tlshash":"06c08c89784910f0260a08d8e227566a812a3810231a99b0f2a40b1705a12b683bae20","size":151,"data":"","first_seen":"2025-10-17T02:50:03.230844Z","last_seen":"2025-10-17T02:50:03.230844Z","times_seen":1,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"upshiftjobs.com/","fqdn":"upshiftjobs.com","domain":"upshiftjobs.com","tld":"com"},"ip":{"addr":"104.18.20.48","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"scriptElement","is_inline":true,"md5":"c1077041ffd72153295301c70bfa43ee","sha1":"176f0fba72a4b910d75185e49f9aa20124fa0ec5","sha256":"9a998ad0f598883d15d1b9093576fa4d667a07224da599dbe248675eb084b719","sha512":"5a2c6034fe1439f14886dfeca2671bf5f72e69edd91f2ea5024d2b4cce6e2691cedb824a92023f7eb9401e4ad0be5068ead63fe6332bae11ab4665b0a45bf5a7","ssdeep":"","tlshash":"86b002f71901456107cf4b653565c39f7d71014f6382600df33c059c8594d715502c75","size":98,"data":"","first_seen":"2025-03-03T03:20:33.945333Z","last_seen":"2026-04-28T17:23:00.622904Z","times_seen":106,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"upshiftjobs.com/assets/index-b999148a.js","fqdn":"upshiftjobs.com","domain":"upshiftjobs.com","tld":"com"},"ip":{"addr":"104.18.20.48","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"scriptElement","is_inline":false,"md5":"a5c15e325f4a67db6cac2e2d4c2d77d8","sha1":"19e1dfd663dc91871ad031ef3d1a2bbae8620899","sha256":"b684223bb53bbf298d784a651ac5b9dc36e61810e82611b0a8b6afdb77e052e5","sha512":"1aba407f3adbe20504e20b5c225f04528a1e7b89dcca24312045cdca4b335451d1e19748c4aa7fdc2a3f6f575fd090736b541497e8746dd768d87d5d21960e21","ssdeep":"768:X+XYSWd2cAKpAZin5y3ozC7Qc5p+pLS5XUahJtphWUCWHGTL0nytWFD+n1UDhR8P:XJNyAEJkP","tlshash":"89d2f9c5b6d2b06243aa20f5407b4806f3399a25748d44e4f16c9cdb3cb650a97bbfbd","size":30410,"data":"","first_seen":"2024-05-15T00:53:40Z","last_seen":"2026-04-28T17:23:00.590185Z","times_seen":138,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"upshiftade.com/?code=YXRmUmRYQnphR2xtZEM1eWNubzNiMnN1WTI5dFhYWFhYWFhY","fqdn":"upshiftade.com","domain":"upshiftade.com","tld":"com"},"ip":{"addr":"104.18.21.48","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"scriptElement","is_inline":true,"md5":"d38f284260e382ce5cc08a2185c8e79e","sha1":"b9f96a244cbb8b61d68973bfde209554400ab1a7","sha256":"ee8aecba59146b42d51a5e8846bdbba276d8583ff80270256f754af6e78b1c4e","sha512":"8624673790c02d8da204e2e54f9c2ca9850ffa7941e4f18624fa9f14dc90fda2ed238ebc2a306bc1f1ce8586e5a023af2df69fac87481e0576eaab6be59dbbf2","ssdeep":"","tlshash":"5ef0278a11a3281464f3a0bd4dcf9018b1b9805b254cdf2cbd2d6311ff4561e86fafc5","size":595,"data":"","first_seen":"2025-06-14T07:56:12.305917Z","last_seen":"2026-05-04T16:28:44.401912Z","times_seen":38,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"upshiftade.com/assets/index-7ad1962d.js","fqdn":"upshiftade.com","domain":"upshiftade.com","tld":"com"},"ip":{"addr":"104.18.21.48","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"importedModule","is_inline":false,"md5":"b8d72b63a6c8e2b161ab57140c18ce97","sha1":"44838412363eb377a998702944f6670a142fceac","sha256":"05a10bcf395955adfd3d9bcb3384cd99ed25ab6bed499dfc13d73f9794a82d44","sha512":"1f14930ee96b1b86bab11416c2e2881ae00e335ea24b09f77e2ffe339063ed8f407be5f49924fc057729ee95fa895ba27732dd72b678e8d6f677864fc527ac23","ssdeep":"192:O90sNryMNOuFASDJ5D0lk4j4BjkKem3P8LiuAS5lbWZ+nlTdBzj:7MyzuFJIlTj4BjkKem/8OuAS5S+nlTHj","tlshash":"2f12d6c5b4c2a2b59beb60d5f0e58060e51c8b45e11e90e2e03f8d142bde9c4ba79f3d","size":9049,"data":"","first_seen":"2025-10-17T02:50:03.246689Z","last_seen":"2025-10-17T02:50:03.246689Z","times_seen":1,"alerts":{"ids":null,"analyzer":null,"urlquery":null}}],"eval":null,"write":null,"console":null},"http":[{"url":{"schema":"https","addr":"v4fuwb.com/d.json?time=1760669371226","fqdn":"v4fuwb.com","domain":"v4fuwb.com","tld":"com"},"ip":{"addr":"104.18.21.48","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"https://upshiftade.com/","date":"2025-10-17T02:49:31.231Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.2","cert":{"subject":{"commonName":"v4fuwb.com","organization":""},"issuer":{"commonName":"E8","organization":"Let's Encrypt"},"validity":{"start":"Sat, 30 Aug 2025 01:20:14 GMT","end":"Fri, 28 Nov 2025 01:20:13 GMT"},"fingerprint":{"sha1":"7E:3D:74:78:CD:F9:C8:B1:50:2E:B6:8C:E9:E7:CF:4E:7F:D6:C4:D5","sha256":"8A:43:D0:7D:81:B2:68:35:43:7D:3A:8B:2C:97:D3:E3:5D:A2:4C:02:72:47:BA:57:27:CD:13:FE:1B:63:B1:8C"}}},"request":{"raw":"GET /d.json?time=1760669371226 HTTP/1.1\r\nHost: v4fuwb.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/json, text/plain, */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nOrigin: https://upshiftade.com\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://upshiftade.com/\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ndate: Fri, 17 Oct 2025 02:49:31 GMT\r\ncontent-type: application/json\r\nserver: cloudflare\r\nlast-modified: Sun, 10 Aug 2025 16:05:58 GMT\r\naccess-control-allow-origin: *\r\naccess-control-allow-credentials: true\r\naccess-control-allow-methods: GET, POST, OPTIONS\r\ncf-cache-status: DYNAMIC\r\netag: W/\"6898c366-ee\"\r\ncontent-encoding: gzip\r\ncf-ray: 98fc7bb2c963c272-OSL\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":238,"size_decoded":0,"mime_type":"application/json","magic":"ASCII text, with no line terminators","md5":"543c7fae6451b96a9f332b65ffce2155","sha1":"957bc1071b7c430c95a91eb76d58248795985606","sha256":"834838a9c1b459353b7f28b62ec1490d1f167971557cc3b8dc3d3a80f69c2d43","sha512":"a488ed19579a4a99d65f2d8d79590d62d8a260d06ed5ac07f2dbe9d34bfe110c908e0f6440aa8df7233ac274f50e1b9f39656be6908f5130f824e7ff747e25e6","ssdeep":"","tlshash":"00d023fb36cc8b48b1493b9c5114d1845b10850fade843745938c21fc3dd450509f57c","first_seen":"2025-08-11T20:53:12.260833Z","last_seen":"2026-04-28T17:23:00.580319Z","times_seen":59,"resource_available":false,"data":null}},"time_used":394,"timings":{"blocked":100,"dns":77,"connect":6,"send":0,"wait":194,"receive":0,"ssl":14},"alerts":{"ids":null,"analyzer":[{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2025-10-17","alert":"Sinkholed","trigger":"v4fuwb.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"upshiftjobs.com/assets/index-77c92c5a.css","fqdn":"upshiftjobs.com","domain":"upshiftjobs.com","tld":"com"},"ip":{"addr":"104.18.20.48","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://upshiftjobs.com/","date":"2025-10-17T02:49:32.658Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.2","cert":{"subject":{"commonName":"upshiftjobs.com","organization":""},"issuer":{"commonName":"E8","organization":"Let's Encrypt"},"validity":{"start":"Sat, 06 Sep 2025 10:59:41 GMT","end":"Fri, 05 Dec 2025 10:59:40 GMT"},"fingerprint":{"sha1":"4A:07:8A:14:3B:83:0A:2E:7E:72:5C:D7:FD:6F:D2:6A:87:80:D8:81","sha256":"CC:3E:49:5A:BB:C8:CB:B8:1E:5B:AA:AC:E0:E9:60:86:E2:DF:7E:74:33:98:B7:E6:E8:73:66:A2:D8:C5:13:F2"}}},"request":{"raw":"GET /assets/index-77c92c5a.css HTTP/1.1\r\nHost: upshiftjobs.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://upshiftjobs.com/\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ndate: Fri, 17 Oct 2025 02:49:32 GMT\r\ncontent-type: text/css\r\nserver: cloudflare\r\nlast-modified: Tue, 14 May 2024 04:01:47 GMT\r\nvary: Accept-Encoding\r\netag: W/\"6642e22b-2f88\"\r\nexpires: Fri, 17 Oct 2025 14:49:32 GMT\r\ncache-control: public, max-age=43200\r\ncontent-encoding: gzip\r\ncf-cache-status: MISS\r\ncf-ray: 98fc7bbb1cc1b4ee-OSL\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":12168,"size_decoded":0,"mime_type":"text/css","magic":"ASCII text, with very long lines (12167)","md5":"363de45a85dffa2f08f15ea3bad3c8f4","sha1":"1411f00c84cc4054aa29809ba7c98c4da14e5601","sha256":"77c92c5a1a825d3cfc9b86175a90ee296e7d02cd466042ba427abaec3de1ec85","sha512":"35640e1a0e63545f7591cbe8fcce6e24b6655b03f24ec87a592969dbef7d2ecec6836745ef038ad87ce1114d671c564864808382e167c315afe3399a3e099939","ssdeep":"192:vbdW9QyQ9QyANTql2sfKZzZLZp3ZDZBZjZrZbZ3ZzZnZ3ZzZjZXZlZvZLZXZXZrY:zQFlFz3V7dVdZ1BRVlZfJ9h597vFVNDO","tlshash":"7d42ca545ba921af7d1bc4f2f97ee349b50f1dc6d231cf6aae2e32b181594d920b3014","first_seen":"2024-04-29T04:15:39Z","last_seen":"2026-04-28T17:23:00.583439Z","times_seen":142,"resource_available":false,"data":null}},"time_used":224,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":224,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"upshiftade.com/assets/login-c8ba0a9a.js","fqdn":"upshiftade.com","domain":"upshiftade.com","tld":"com"},"ip":{"addr":"104.18.21.48","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"fetch","requested_by":"https://upshiftade.com/#/","date":"2025-10-17T02:49:35.397Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.2","cert":{"subject":{"commonName":"upshiftade.com","organization":""},"issuer":{"commonName":"E7","organization":"Let's Encrypt"},"validity":{"start":"Sat, 06 Sep 2025 09:58:39 GMT","end":"Fri, 05 Dec 2025 09:58:38 GMT"},"fingerprint":{"sha1":"96:16:27:FD:01:A0:76:97:49:14:35:FA:49:D9:D0:EF:42:EA:50:27","sha256":"91:72:FC:27:76:8B:44:11:34:D1:C0:74:09:7E:A0:C9:80:65:A8:C9:26:F2:5E:FD:FE:64:C9:87:BE:C4:DB:62"}}},"request":{"raw":"GET /assets/login-c8ba0a9a.js HTTP/1.1\r\nHost: upshiftade.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://upshiftade.com/\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ndate: Fri, 17 Oct 2025 02:49:35 GMT\r\ncontent-type: application/javascript\r\nserver: cloudflare\r\nlast-modified: Sat, 27 Sep 2025 13:58:42 GMT\r\nvary: Accept-Encoding\r\netag: W/\"68d7ed92-f73\"\r\nexpires: Fri, 17 Oct 2025 14:49:35 GMT\r\ncache-control: public, max-age=43200\r\ncontent-encoding: gzip\r\ncf-cache-status: MISS\r\ncf-ray: 98fc7bcc3d9a56a2-OSL\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":3955,"size_decoded":0,"mime_type":"application/javascript","magic":"Java source, ASCII text, with very long lines (3954)","md5":"1c48796bd5f07e01916656ed990d401d","sha1":"09798e5c21d66b147ea0c8debdf422ff73ad89c1","sha256":"a783af3cd40e48c405e305dd8774570ceec6aea3cd4c3aff5b2612a3d0e30ad9","sha512":"8bed14d9b9141462cf5625a31d49c61489956a68382fe6c90cfa2620e387c736dd2e3526a0c9f6a7e247d8c4188dbdb0e20149519ba99f74cc89e39dba2600d8","ssdeep":"","tlshash":"fd81735ae0699af689430556795a68c0f01d7ff6c1268a00f3bc09263fd3df9db49721","first_seen":"2025-10-17T02:50:03.204743Z","last_seen":"2025-10-17T02:50:03.204743Z","times_seen":1,"resource_available":true,"data":null}},"time_used":223,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":223,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2025-10-17","alert":"Sinkholed","trigger":"upshiftade.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2025-10-17","alert":"Sinkholed","trigger":"upshiftade.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"upshiftade.com/assets/index-6bf217ff.js","fqdn":"upshiftade.com","domain":"upshiftade.com","tld":"com"},"ip":{"addr":"104.18.21.48","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"fetch","requested_by":"https://upshiftade.com/#/","date":"2025-10-17T02:49:35.398Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.2","cert":{"subject":{"commonName":"upshiftade.com","organization":""},"issuer":{"commonName":"E7","organization":"Let's Encrypt"},"validity":{"start":"Sat, 06 Sep 2025 09:58:39 GMT","end":"Fri, 05 Dec 2025 09:58:38 GMT"},"fingerprint":{"sha1":"96:16:27:FD:01:A0:76:97:49:14:35:FA:49:D9:D0:EF:42:EA:50:27","sha256":"91:72:FC:27:76:8B:44:11:34:D1:C0:74:09:7E:A0:C9:80:65:A8:C9:26:F2:5E:FD:FE:64:C9:87:BE:C4:DB:62"}}},"request":{"raw":"GET /assets/index-6bf217ff.js HTTP/1.1\r\nHost: upshiftade.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://upshiftade.com/\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ndate: Fri, 17 Oct 2025 02:49:35 GMT\r\ncontent-type: application/javascript\r\nserver: cloudflare\r\nlast-modified: Sat, 27 Sep 2025 13:58:42 GMT\r\nvary: Accept-Encoding\r\netag: W/\"68d7ed92-569\"\r\nexpires: Fri, 17 Oct 2025 14:49:35 GMT\r\ncache-control: public, max-age=43200\r\ncontent-encoding: gzip\r\ncf-cache-status: MISS\r\ncf-ray: 98fc7bcc3d9d56a2-OSL\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":1385,"size_decoded":0,"mime_type":"application/javascript","magic":"Java source, Unicode text, UTF-8 text, with very long lines (1383)","md5":"8e511227be34fd84583aadcda3430494","sha1":"e1a256a14149915899279d5134b7c4f2169c4097","sha256":"36d1461ca20750f95ebcdae04ab14b3ebbe10a71d61818e7670e73e0f81cbd53","sha512":"7828515aa820c851bd6224dbbd93b608194af97a6fb8b3994a6747866589b31a166842d9f06bfac8c88d9da16a142fed2d5565647f08ea436d39975a55d344fb","ssdeep":"","tlshash":"01218cd9a02b17f491830068a964d402e0449ffce32ffed6b2df950366d7827d79a654","first_seen":"2025-10-17T02:50:03.20857Z","last_seen":"2025-10-17T02:50:03.20857Z","times_seen":1,"resource_available":true,"data":null}},"time_used":220,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":220,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2025-10-17","alert":"Sinkholed","trigger":"upshiftade.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2025-10-17","alert":"Sinkholed","trigger":"upshiftade.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"upshiftade.com/cdn-cgi/rum?","fqdn":"upshiftade.com","domain":"upshiftade.com","tld":"com"},"ip":{"addr":"104.18.21.48","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"https://upshiftade.com/#/","date":"2025-10-17T02:49:35.796Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.2","cert":{"subject":{"commonName":"upshiftade.com","organization":""},"issuer":{"commonName":"E7","organization":"Let's Encrypt"},"validity":{"start":"Sat, 06 Sep 2025 09:58:39 GMT","end":"Fri, 05 Dec 2025 09:58:38 GMT"},"fingerprint":{"sha1":"96:16:27:FD:01:A0:76:97:49:14:35:FA:49:D9:D0:EF:42:EA:50:27","sha256":"91:72:FC:27:76:8B:44:11:34:D1:C0:74:09:7E:A0:C9:80:65:A8:C9:26:F2:5E:FD:FE:64:C9:87:BE:C4:DB:62"}}},"request":{"raw":"POST /cdn-cgi/rum? HTTP/1.1\r\nHost: upshiftade.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\ncontent-type: application/json\r\nContent-Length: 1079\r\nOrigin: https://upshiftade.com\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://upshiftade.com/\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"POST"},"response":{"raw":"HTTP/2 204 No Content\r\ndate: Fri, 17 Oct 2025 02:49:35 GMT\r\ncontent-type: text/plain\r\naccess-control-allow-origin: https://upshiftade.com\r\naccess-control-allow-methods: POST,OPTIONS\r\naccess-control-max-age: 86400\r\nvary: Origin, accept-encoding\r\naccess-control-allow-credentials: true\r\nserver: cloudflare\r\ncf-ray: 98fc7bcebe7756a2-OSL\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"204","status_text":"No Content","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":0,"size_decoded":0,"mime_type":"text/plain","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-07-25T01:51:47.226353Z","times_seen":17518204,"resource_available":true,"data":null}},"time_used":2,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":2,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2025-10-17","alert":"Sinkholed","trigger":"upshiftade.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2025-10-17","alert":"Sinkholed","trigger":"upshiftade.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"upshiftjobs.com/cdn-cgi/rum?","fqdn":"upshiftjobs.com","domain":"upshiftjobs.com","tld":"com"},"ip":{"addr":"104.18.20.48","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"https://upshiftjobs.com/","date":"2025-10-17T02:49:33.449Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.2","cert":{"subject":{"commonName":"upshiftjobs.com","organization":""},"issuer":{"commonName":"E8","organization":"Let's Encrypt"},"validity":{"start":"Sat, 06 Sep 2025 10:59:41 GMT","end":"Fri, 05 Dec 2025 10:59:40 GMT"},"fingerprint":{"sha1":"4A:07:8A:14:3B:83:0A:2E:7E:72:5C:D7:FD:6F:D2:6A:87:80:D8:81","sha256":"CC:3E:49:5A:BB:C8:CB:B8:1E:5B:AA:AC:E0:E9:60:86:E2:DF:7E:74:33:98:B7:E6:E8:73:66:A2:D8:C5:13:F2"}}},"request":{"raw":"POST /cdn-cgi/rum? HTTP/1.1\r\nHost: upshiftjobs.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\ncontent-type: application/json\r\nContent-Length: 1033\r\nOrigin: https://upshiftjobs.com\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://upshiftjobs.com/\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"POST"},"response":{"raw":"HTTP/2 204 No Content\r\ndate: Fri, 17 Oct 2025 02:49:33 GMT\r\ncontent-type: text/plain\r\naccess-control-allow-origin: https://upshiftjobs.com\r\naccess-control-allow-methods: POST,OPTIONS\r\naccess-control-max-age: 86400\r\nvary: Origin, accept-encoding\r\naccess-control-allow-credentials: true\r\nserver: cloudflare\r\ncf-ray: 98fc7bc01de4b4ee-OSL\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"204","status_text":"No Content","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":0,"size_decoded":0,"mime_type":"text/plain","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-07-25T01:51:47.226353Z","times_seen":17518204,"resource_available":true,"data":null}},"time_used":13,"timings":{"blocked":5,"dns":0,"connect":0,"send":0,"wait":5,"receive":3,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"upshiftade.com/assets/index-81ac7ae6.js","fqdn":"upshiftade.com","domain":"upshiftade.com","tld":"com"},"ip":{"addr":"104.18.21.48","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://upshiftade.com/?code=YXRmUmRYQnphR2xtZEM1eWNubzNiMnN1WTI5dFhYWFhYWFhY","date":"2025-10-17T02:49:34.800Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.2","cert":{"subject":{"commonName":"upshiftade.com","organization":""},"issuer":{"commonName":"E7","organization":"Let's Encrypt"},"validity":{"start":"Sat, 06 Sep 2025 09:58:39 GMT","end":"Fri, 05 Dec 2025 09:58:38 GMT"},"fingerprint":{"sha1":"96:16:27:FD:01:A0:76:97:49:14:35:FA:49:D9:D0:EF:42:EA:50:27","sha256":"91:72:FC:27:76:8B:44:11:34:D1:C0:74:09:7E:A0:C9:80:65:A8:C9:26:F2:5E:FD:FE:64:C9:87:BE:C4:DB:62"}}},"request":{"raw":"GET /assets/index-81ac7ae6.js HTTP/1.1\r\nHost: upshiftade.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://upshiftade.com/?code=YXRmUmRYQnphR2xtZEM1eWNubzNiMnN1WTI5dFhYWFhYWFhY\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ndate: Fri, 17 Oct 2025 02:49:34 GMT\r\ncontent-type: application/javascript\r\nserver: cloudflare\r\nage: 4\r\nlast-modified: Sat, 27 Sep 2025 13:58:42 GMT\r\nvary: Accept-Encoding\r\netag: W/\"68d7ed92-81194\"\r\nexpires: Fri, 17 Oct 2025 14:49:34 GMT\r\ncache-control: public, max-age=43200\r\ncontent-encoding: gzip\r\ncf-cache-status: HIT\r\ncf-ray: 98fc7bc87c7256a2-OSL\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":0,"size_decoded":0,"mime_type":"","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-07-25T01:51:47.226353Z","times_seen":17518204,"resource_available":true,"data":null}},"time_used":0,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":0,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2025-10-17","alert":"Sinkholed","trigger":"upshiftade.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2025-10-17","alert":"Sinkholed","trigger":"upshiftade.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"upshift.rrz7ok.com/api/business_config","fqdn":"upshift.rrz7ok.com","domain":"rrz7ok.com","tld":"com"},"ip":{"addr":"104.18.13.89","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"https://upshiftade.com/#/","date":"2025-10-17T02:49:35.934Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"rrz7ok.com","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Thu, 09 Oct 2025 18:00:04 GMT","end":"Wed, 07 Jan 2026 19:00:02 GMT"},"fingerprint":{"sha1":"90:8D:82:FB:F3:72:88:CC:A1:90:86:64:B0:FC:D7:10:78:E0:C3:B6","sha256":"9D:8C:32:C6:33:8B:82:77:C1:0B:A5:77:A7:42:5A:A1:08:28:1A:2E:C9:81:37:70:16:92:6C:AD:51:01:53:00"}}},"request":{"raw":"GET /api/business_config HTTP/1.1\r\nHost: upshift.rrz7ok.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/json, text/plain, */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nlang: en\r\nOrigin: https://upshiftade.com\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://upshiftade.com/\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ndate: Fri, 17 Oct 2025 02:49:36 GMT\r\ncontent-type: application/text;charset=utf-8\r\ncontent-length: 435\r\nserver: cloudflare\r\naccess-control-allow-origin: *\r\naccess-control-allow-credentials: true\r\naccess-control-allow-headers: *\r\naccess-control-allow-methods: GET, POST, PUT, DELETE, OPTIONS\r\ncontent-encoding: br\r\ncache-control: no-cache\r\nvary: accept-encoding\r\ncf-cache-status: DYNAMIC\r\nset-cookie: _cfuvid=gwQcGngTZKIJa0c1vl83e5lKn3emAiu.y3JH8zKOtZI-1760669375.9015844-1.0.1.1-OHRHnWQQBuYeU7s_n0hgQIUAu6DHtr7RSjXegyqj5Dc; HttpOnly; SameSite=None; Secure; Path=/; Domain=upshift.rrz7ok.com\r\ncf-ray: 98fc7bcf6f877129-OSL\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":984,"size_decoded":0,"mime_type":"application/text; charset=utf-8","magic":"ASCII text, with very long lines (984), with no line terminators","md5":"954c2fa4252e8710e121ea25726627ef","sha1":"e4a1c543a38c697358e15e32d83356950bfae1ed","sha256":"37e91a9edf835371aa45ff7557a19156476e5bd49812edad0971c44be75303b4","sha512":"87acf150fca53e130bf704c86be9c6ab909fe62d21c9e8172a985fe28ba9b001712153fb826f7a670d49518a4252b5875bb64a7c15ccd70452a45aff4b64e4d7","ssdeep":"","tlshash":"b8119ec350ac1f56ea3d31d5d51726deca04544437144cc837b7e067d7af1e2498a60a","first_seen":"2025-06-18T17:25:40.625952Z","last_seen":"2025-10-17T02:50:03.213325Z","times_seen":2,"resource_available":false,"data":null}},"time_used":192,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":192,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-10-17","alert":"Sinkholed","trigger":"upshift.rrz7ok.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"static.cloudflareinsights.com/beacon.min.js/vcd15cbe7772f49c399c6a5babf22c1241717689176015","fqdn":"static.cloudflareinsights.com","domain":"cloudflareinsights.com","tld":"com"},"ip":{"addr":"104.16.80.73","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://upshiftjobs.com/","date":"2025-10-17T02:49:32.661Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"cloudflareinsights.com","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Sun, 24 Aug 2025 02:39:12 GMT","end":"Sat, 22 Nov 2025 03:39:06 GMT"},"fingerprint":{"sha1":"B4:6C:D2:16:CA:52:EE:BD:22:D7:B4:2C:64:FF:A5:EF:67:D8:E1:F8","sha256":"FF:3A:23:84:D6:B2:73:DF:50:6E:1A:45:A4:AB:03:37:0B:C4:4A:8E:82:12:99:10:80:A2:F7:FC:71:E3:BA:1D"}}},"request":{"raw":"GET /beacon.min.js/vcd15cbe7772f49c399c6a5babf22c1241717689176015 HTTP/1.1\r\nHost: static.cloudflareinsights.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nOrigin: https://upshiftjobs.com\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://upshiftjobs.com/\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ndate: Fri, 17 Oct 2025 02:49:32 GMT\r\ncontent-type: text/javascript;charset=UTF-8\r\ncontent-encoding: gzip\r\naccess-control-allow-origin: *\r\ncache-control: public, max-age=86400\r\netag: W/\"2024.6.1\"\r\nlast-modified: Thu, 06 Jun 2024 15:52:56 GMT\r\ncross-origin-resource-policy: cross-origin\r\nvary: Accept-Encoding\r\nserver: cloudflare\r\ncf-ray: 98fc7bbb586449c5-OSL\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":19948,"size_decoded":0,"mime_type":"text/javascript; charset=UTF-8","magic":"JavaScript source, ASCII text, with very long lines (19948), with no line terminators","md5":"ec18af6d41f6f278b6aed3bdabffa7bc","sha1":"62c9e2cab76b888829f3c5335e91c320b22329ae","sha256":"8a18d13015336bc184819a5a768447462202ef3105ec511bf42ed8304a7ed94f","sha512":"669b0e9a545057acbdd3b4c8d1d2811eaf4c776f679da1083e591ff38ae7684467abacef5af3d4aabd9fb7c335692dbca0def63ddac2cd28d8e14e95680c3511","ssdeep":"384:XriNpnjyMkg8XMtExRN1w29JIOzahXtO2nJ65:GijgSWuanfJ65","tlshash":"8d92d7def645723613f76076913f220b733b35a528068459812adbc22c3d98f6267f6e","first_seen":"2024-06-07T09:21:23Z","last_seen":"2026-07-24T14:35:42.207329Z","times_seen":337593,"resource_available":true,"data":null}},"time_used":96,"timings":{"blocked":38,"dns":1,"connect":1,"send":0,"wait":16,"receive":0,"ssl":38},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"upshiftjobs.com/assets/loading-79ceab2b.js","fqdn":"upshiftjobs.com","domain":"upshiftjobs.com","tld":"com"},"ip":{"addr":"104.18.20.48","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://upshiftjobs.com/","date":"2025-10-17T02:49:33.218Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.2","cert":{"subject":{"commonName":"upshiftjobs.com","organization":""},"issuer":{"commonName":"E8","organization":"Let's Encrypt"},"validity":{"start":"Sat, 06 Sep 2025 10:59:41 GMT","end":"Fri, 05 Dec 2025 10:59:40 GMT"},"fingerprint":{"sha1":"4A:07:8A:14:3B:83:0A:2E:7E:72:5C:D7:FD:6F:D2:6A:87:80:D8:81","sha256":"CC:3E:49:5A:BB:C8:CB:B8:1E:5B:AA:AC:E0:E9:60:86:E2:DF:7E:74:33:98:B7:E6:E8:73:66:A2:D8:C5:13:F2"}}},"request":{"raw":"GET /assets/loading-79ceab2b.js HTTP/1.1\r\nHost: upshiftjobs.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://upshiftjobs.com/assets/index-d0961c08.js\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ndate: Fri, 17 Oct 2025 02:49:33 GMT\r\ncontent-type: application/javascript\r\nserver: cloudflare\r\nvary: accept-encoding\r\nlast-modified: Tue, 14 May 2024 04:01:47 GMT\r\nexpires: Fri, 17 Oct 2025 14:49:33 GMT\r\ncache-control: public, max-age=43200\r\ncf-cache-status: MISS\r\netag: W/\"6642e22b-176\"\r\ncontent-encoding: gzip\r\ncf-ray: 98fc7bbe9d92b4ee-OSL\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":374,"size_decoded":0,"mime_type":"application/javascript","magic":"Java source, ASCII text, with very long lines (373)","md5":"125d2f28c698984b905ae47d871c1de3","sha1":"6392467b94aa096dfff86880216b5ccfb3cdb19b","sha256":"3693965abc5ef4f20dad9072bd427153e842b6b3e34d4da7c35a896953567751","sha512":"4c8873cc9fa7ee2112e236ce44eabee5b193a5159bc3594db040d77a4a973ff033c667856f4b80286003cabf4d04b70ada79d158fafe2d41f98a1ba87218ffa6","ssdeep":"","tlshash":"f0e0684e6481f9fda11b0c4820a9a802a06829f0b3bce888a45d846b729b069924eb20","first_seen":"2025-02-26T18:09:28.956048Z","last_seen":"2026-04-28T17:23:00.598586Z","times_seen":108,"resource_available":true,"data":null}},"time_used":218,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":218,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"upshiftjobs.com/assets/default-1717d27a.js","fqdn":"upshiftjobs.com","domain":"upshiftjobs.com","tld":"com"},"ip":{"addr":"104.18.20.48","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://upshiftjobs.com/","date":"2025-10-17T02:49:34.276Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.2","cert":{"subject":{"commonName":"upshiftjobs.com","organization":""},"issuer":{"commonName":"E8","organization":"Let's Encrypt"},"validity":{"start":"Sat, 06 Sep 2025 10:59:41 GMT","end":"Fri, 05 Dec 2025 10:59:40 GMT"},"fingerprint":{"sha1":"4A:07:8A:14:3B:83:0A:2E:7E:72:5C:D7:FD:6F:D2:6A:87:80:D8:81","sha256":"CC:3E:49:5A:BB:C8:CB:B8:1E:5B:AA:AC:E0:E9:60:86:E2:DF:7E:74:33:98:B7:E6:E8:73:66:A2:D8:C5:13:F2"}}},"request":{"raw":"GET /assets/default-1717d27a.js HTTP/1.1\r\nHost: upshiftjobs.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://upshiftjobs.com/assets/index-d0961c08.js\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ndate: Fri, 17 Oct 2025 02:49:34 GMT\r\ncontent-type: application/javascript\r\nserver: cloudflare\r\nvary: accept-encoding\r\nlast-modified: Tue, 14 May 2024 04:01:47 GMT\r\nexpires: Fri, 17 Oct 2025 14:49:34 GMT\r\ncache-control: public, max-age=43200\r\ncf-cache-status: MISS\r\netag: W/\"6642e22b-2ac\"\r\ncontent-encoding: gzip\r\ncf-ray: 98fc7bc53f53b4ee-OSL\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":684,"size_decoded":0,"mime_type":"application/javascript","magic":"Java source, ASCII text, with very long lines (683)","md5":"6c4b0d57e52b3fc7b490765de48b9081","sha1":"40162686db14e2a2ccbfebbf9934684606ff4929","sha256":"fa80b0c48928003d2991e14d7ced48b67fc381f324f753be22420b20b8630331","sha512":"d0987d49f0d71cb1f3a24defb04bc5f1e31d90076b71fbf419b7a4ae1122d35053ea103d7e00fcbd1e5408597b8eac028ac42e8e072a57589b70b12cb3c0e401","ssdeep":"","tlshash":"ff01fe9e3081ac779bcf289a21268b82b4551fc57734b88894ac8871b21a90cc19db60","first_seen":"2025-03-03T03:20:33.954636Z","last_seen":"2026-04-28T17:23:00.600481Z","times_seen":102,"resource_available":true,"data":null}},"time_used":221,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":221,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"upshiftade.com/","fqdn":"upshiftade.com","domain":"upshiftade.com","tld":"com"},"ip":{"addr":"104.18.21.48","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":true,"resource_type":"document","requested_by":"","date":"2025-10-17T02:49:29.684Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.2","cert":{"subject":{"commonName":"upshiftade.com","organization":""},"issuer":{"commonName":"E7","organization":"Let's Encrypt"},"validity":{"start":"Sat, 06 Sep 2025 09:58:39 GMT","end":"Fri, 05 Dec 2025 09:58:38 GMT"},"fingerprint":{"sha1":"96:16:27:FD:01:A0:76:97:49:14:35:FA:49:D9:D0:EF:42:EA:50:27","sha256":"91:72:FC:27:76:8B:44:11:34:D1:C0:74:09:7E:A0:C9:80:65:A8:C9:26:F2:5E:FD:FE:64:C9:87:BE:C4:DB:62"}}},"request":{"raw":"GET / HTTP/1.1\r\nHost: upshiftade.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nUpgrade-Insecure-Requests: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: document\r\nSec-Fetch-Mode: navigate\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ndate: Fri, 17 Oct 2025 02:49:30 GMT\r\ncontent-type: text/html\r\nserver: cloudflare\r\nlast-modified: Sat, 27 Sep 2025 13:58:42 GMT\r\nserver-timing: cfCacheStatus;desc=\"DYNAMIC\", cfEdge;dur=10,cfOrigin;dur=545\r\nvary: Accept-Encoding\r\ncf-cache-status: DYNAMIC\r\ncontent-encoding: gzip\r\ncf-ray: 98fc7ba92b3456a2-OSL\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare Browser Insights","description":"Cloudflare Browser Insights is a tool that measures the performance of websites from the perspective of users.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["Analytics","RUM"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":2026,"size_decoded":0,"mime_type":"text/html","magic":"HTML document, ASCII text, with very long lines (497)","md5":"901507e50b2e2e8f0c8a7410f9eebf72","sha1":"a307ab2f15e385e54d3334af17542107881cf713","sha256":"290b07a1934dddcad864d5eb665dabe02d1c06c0dfb0bd42fa44057ffc1b3514","sha512":"13655d00c3e15e527b32323cc3a30d93d53a55b4bff7042b4f9c9dc8efd144001edceb359fde2e0a9a301f3c8feb9787c72cb04c2bbc7bf880c8460a5ff105ae","ssdeep":"","tlshash":"e641674a48f34455a173616c5df7f6583ab980574308dd247fadb320cf4075d84bbb85","first_seen":"2025-10-17T02:50:03.225964Z","last_seen":"2025-10-17T02:50:03.225964Z","times_seen":1,"resource_available":false,"data":null}},"time_used":759,"timings":{"blocked":100,"dns":82,"connect":1,"send":0,"wait":559,"receive":0,"ssl":15},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2025-10-17","alert":"Sinkholed","trigger":"upshiftade.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2025-10-17","alert":"Sinkholed","trigger":"upshiftade.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"upshiftjobs.com/","fqdn":"upshiftjobs.com","domain":"upshiftjobs.com","tld":"com"},"ip":{"addr":"104.18.20.48","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":true,"resource_type":"document","requested_by":"","date":"2025-10-17T02:49:32.279Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.2","cert":{"subject":{"commonName":"upshiftjobs.com","organization":""},"issuer":{"commonName":"E8","organization":"Let's Encrypt"},"validity":{"start":"Sat, 06 Sep 2025 10:59:41 GMT","end":"Fri, 05 Dec 2025 10:59:40 GMT"},"fingerprint":{"sha1":"4A:07:8A:14:3B:83:0A:2E:7E:72:5C:D7:FD:6F:D2:6A:87:80:D8:81","sha256":"CC:3E:49:5A:BB:C8:CB:B8:1E:5B:AA:AC:E0:E9:60:86:E2:DF:7E:74:33:98:B7:E6:E8:73:66:A2:D8:C5:13:F2"}}},"request":{"raw":"GET / HTTP/1.1\r\nHost: upshiftjobs.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://upshiftade.com/\r\nUpgrade-Insecure-Requests: 1\r\nSec-Fetch-Dest: document\r\nSec-Fetch-Mode: navigate\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ndate: Fri, 17 Oct 2025 02:49:32 GMT\r\ncontent-type: text/html\r\nserver: cloudflare\r\nserver-timing: cfCacheStatus;desc=\"DYNAMIC\", cfEdge;dur=195,cfOrigin;dur=3\r\nlast-modified: Tue, 14 May 2024 04:01:47 GMT\r\ncf-cache-status: DYNAMIC\r\ncontent-encoding: gzip\r\ncf-ray: 98fc7bb95c4cb4ee-OSL\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare Browser Insights","description":"Cloudflare Browser Insights is a tool that measures the performance of websites from the perspective of users.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["Analytics","RUM"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":1249,"size_decoded":0,"mime_type":"text/html","magic":"HTML document, ASCII text, with very long lines (497)","md5":"769d26b2910c26194f3fd1dc6ccb0842","sha1":"682577a2df948dfbbaceb22a1fd5a48d1b996215","sha256":"a1e3d10839b4dcbebdacf7c8452fb88fef42556280af79224caa9bca8947a86a","sha512":"afd7bff5618375bdc3aeef1e1d29a51204b5e138e8b806f1113d7209e94d66e5851768582c5a0f611635d290d6c7e5d0dfee954dfd1a842c38957d2166d64263","ssdeep":"","tlshash":"fd21748b4c61405a8257031828f1fb0d3eb691abc34afd407beef5a9cf84f99805b655","first_seen":"2025-10-08T16:49:35.430441Z","last_seen":"2026-02-19T01:41:58.790244Z","times_seen":43,"resource_available":false,"data":null}},"time_used":391,"timings":{"blocked":94,"dns":79,"connect":1,"send":0,"wait":202,"receive":0,"ssl":12},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"upshift.rrz7ok.com/api/business_config","fqdn":"upshift.rrz7ok.com","domain":"rrz7ok.com","tld":"com"},"ip":{"addr":"104.18.13.89","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"https://upshiftade.com/#/","date":"2025-10-17T02:49:35.383Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"rrz7ok.com","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Thu, 09 Oct 2025 18:00:04 GMT","end":"Wed, 07 Jan 2026 19:00:02 GMT"},"fingerprint":{"sha1":"90:8D:82:FB:F3:72:88:CC:A1:90:86:64:B0:FC:D7:10:78:E0:C3:B6","sha256":"9D:8C:32:C6:33:8B:82:77:C1:0B:A5:77:A7:42:5A:A1:08:28:1A:2E:C9:81:37:70:16:92:6C:AD:51:01:53:00"}}},"request":{"raw":"OPTIONS /api/business_config HTTP/1.1\r\nHost: upshift.rrz7ok.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nAccess-Control-Request-Method: GET\r\nAccess-Control-Request-Headers: lang\r\nReferer: https://upshiftade.com/\r\nOrigin: https://upshiftade.com\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"OPTIONS"},"response":{"raw":"HTTP/2 200 OK\r\ndate: Fri, 17 Oct 2025 02:49:35 GMT\r\ncontent-type: text/html\r\nserver: cloudflare\r\naccess-control-allow-origin: *\r\naccess-control-allow-credentials: true\r\naccess-control-allow-headers: *\r\naccess-control-allow-methods: GET, POST, PUT, DELETE, OPTIONS\r\ncache-control: no-cache\r\ncf-cache-status: DYNAMIC\r\ncontent-encoding: gzip\r\nset-cookie: _cfuvid=jpteUHbVasONdQbbaxUZsWb38JYsPEUs8haR9zoyFyM-1760669375.6706364-1.0.1.1-EUFhnMV7RTrIYRP3ZhFSQi2orEge0dX78sYjzbrtzH8; HttpOnly; SameSite=None; Secure; Path=/; Domain=upshift.rrz7ok.com\r\ncf-ray: 98fc7bcdeefb7129-OSL\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":0,"size_decoded":0,"mime_type":"text/html","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-07-25T01:51:47.226353Z","times_seen":17518204,"resource_available":true,"data":null}},"time_used":790,"timings":{"blocked":287,"dns":103,"connect":4,"send":0,"wait":214,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-10-17","alert":"Sinkholed","trigger":"upshift.rrz7ok.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"upshiftade.com/assets/use-id-68745ac1.js","fqdn":"upshiftade.com","domain":"upshiftade.com","tld":"com"},"ip":{"addr":"104.18.21.48","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://upshiftade.com/#/","date":"2025-10-17T02:49:35.640Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.2","cert":{"subject":{"commonName":"upshiftade.com","organization":""},"issuer":{"commonName":"E7","organization":"Let's Encrypt"},"validity":{"start":"Sat, 06 Sep 2025 09:58:39 GMT","end":"Fri, 05 Dec 2025 09:58:38 GMT"},"fingerprint":{"sha1":"96:16:27:FD:01:A0:76:97:49:14:35:FA:49:D9:D0:EF:42:EA:50:27","sha256":"91:72:FC:27:76:8B:44:11:34:D1:C0:74:09:7E:A0:C9:80:65:A8:C9:26:F2:5E:FD:FE:64:C9:87:BE:C4:DB:62"}}},"request":{"raw":"GET /assets/use-id-68745ac1.js HTTP/1.1\r\nHost: upshiftade.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://upshiftade.com/assets/login-c8ba0a9a.js\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ndate: Fri, 17 Oct 2025 02:49:35 GMT\r\ncontent-type: application/javascript\r\nserver: cloudflare\r\nvary: accept-encoding\r\nlast-modified: Sat, 27 Sep 2025 13:58:42 GMT\r\nage: 0\r\nexpires: Fri, 17 Oct 2025 14:49:35 GMT\r\ncache-control: public, max-age=43200\r\ncf-cache-status: HIT\r\netag: W/\"68d7ed92-97\"\r\ncontent-encoding: gzip\r\ncf-ray: 98fc7bcdbe3556a2-OSL\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":151,"size_decoded":0,"mime_type":"application/javascript","magic":"Java source, ASCII text","md5":"3c385c18fc0fa2347184a05ef7acfa5c","sha1":"05590525bb0e1f2f3d4b3b0befd7b994b3903806","sha256":"ad7b68893010908b2ad231a5d5bc58a294cbd9c50292da68afd442635ed755c5","sha512":"64d8a10d73844ef44f6f6f33a4dbcb5c45667a441bcd4581e2759cce13a1b16a4c541d15e2ae756fc66f3358d120ab7bee4ae33900e792c357d3e5b0864a4973","ssdeep":"","tlshash":"06c08c89784910f0260a08d8e227566a812a3810231a99b0f2a40b1705a12b683bae20","first_seen":"2025-10-17T02:50:03.230844Z","last_seen":"2025-10-17T02:50:03.230844Z","times_seen":1,"resource_available":true,"data":null}},"time_used":5,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":5,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2025-10-17","alert":"Sinkholed","trigger":"upshiftade.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2025-10-17","alert":"Sinkholed","trigger":"upshiftade.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"upshiftade.com/assets/index-5748f3e0.css","fqdn":"upshiftade.com","domain":"upshiftade.com","tld":"com"},"ip":{"addr":"104.18.21.48","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://upshiftade.com/","date":"2025-10-17T02:49:30.581Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.2","cert":{"subject":{"commonName":"upshiftade.com","organization":""},"issuer":{"commonName":"E7","organization":"Let's Encrypt"},"validity":{"start":"Sat, 06 Sep 2025 09:58:39 GMT","end":"Fri, 05 Dec 2025 09:58:38 GMT"},"fingerprint":{"sha1":"96:16:27:FD:01:A0:76:97:49:14:35:FA:49:D9:D0:EF:42:EA:50:27","sha256":"91:72:FC:27:76:8B:44:11:34:D1:C0:74:09:7E:A0:C9:80:65:A8:C9:26:F2:5E:FD:FE:64:C9:87:BE:C4:DB:62"}}},"request":{"raw":"GET /assets/index-5748f3e0.css HTTP/1.1\r\nHost: upshiftade.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://upshiftade.com/\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ndate: Fri, 17 Oct 2025 02:49:30 GMT\r\ncontent-type: text/css\r\nserver: cloudflare\r\nlast-modified: Sat, 27 Sep 2025 13:58:42 GMT\r\nvary: Accept-Encoding\r\netag: W/\"68d7ed92-3a77c\"\r\nexpires: Fri, 17 Oct 2025 14:49:30 GMT\r\ncache-control: public, max-age=43200\r\ncontent-encoding: gzip\r\ncf-cache-status: HIT\r\ncf-ray: 98fc7bae1ce056a2-OSL\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":239484,"size_decoded":0,"mime_type":"text/css","magic":"ASCII text, with very long lines (65536), with no line terminators","md5":"94fc120aa67465778422be4a0f8aadaf","sha1":"418c00f1f8040eb8d584a3036050dd13a78b2343","sha256":"5748f3e0d6e7c9c1aa23bc123019a5490a305cdfef79a741fc10b91a13b5ab94","sha512":"676979194ec3ffe47e4c111da8a82f13bee435be9ea2f51549dc0bc4cbf5a3f8493c3824842ccda9d0ecfcc1350b693abbea2fd4b6958e2520f9181470857d91","ssdeep":"1536:dJ66OlpVwwsgiOz48RN5J+jOkiHcplpVwwsgiOz45qGObEZ1Ab5a4zxTVqVoIs:/BO5w9sz/+5w9szZnpEs","tlshash":"4e34e669aa9091bd7f17f175eb8b96dcf23cf960ed01caa4f10051184ec7bf50623a1a","first_seen":"2025-10-17T02:50:03.236038Z","last_seen":"2025-10-17T02:50:03.236038Z","times_seen":1,"resource_available":false,"data":null}},"time_used":46,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":46,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2025-10-17","alert":"Sinkholed","trigger":"upshiftade.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2025-10-17","alert":"Sinkholed","trigger":"upshiftade.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"v4fuwb.com/d.json?time=1760669373219","fqdn":"v4fuwb.com","domain":"v4fuwb.com","tld":"com"},"ip":{"addr":"104.18.21.48","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"https://upshiftjobs.com/","date":"2025-10-17T02:49:33.223Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.2","cert":{"subject":{"commonName":"v4fuwb.com","organization":""},"issuer":{"commonName":"E8","organization":"Let's Encrypt"},"validity":{"start":"Sat, 30 Aug 2025 01:20:14 GMT","end":"Fri, 28 Nov 2025 01:20:13 GMT"},"fingerprint":{"sha1":"7E:3D:74:78:CD:F9:C8:B1:50:2E:B6:8C:E9:E7:CF:4E:7F:D6:C4:D5","sha256":"8A:43:D0:7D:81:B2:68:35:43:7D:3A:8B:2C:97:D3:E3:5D:A2:4C:02:72:47:BA:57:27:CD:13:FE:1B:63:B1:8C"}}},"request":{"raw":"GET /d.json?time=1760669373219 HTTP/1.1\r\nHost: v4fuwb.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/json, text/plain, */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nOrigin: https://upshiftjobs.com\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://upshiftjobs.com/\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ndate: Fri, 17 Oct 2025 02:49:33 GMT\r\ncontent-type: application/json\r\nserver: cloudflare\r\nlast-modified: Sun, 10 Aug 2025 16:05:58 GMT\r\naccess-control-allow-origin: *\r\naccess-control-allow-credentials: true\r\naccess-control-allow-methods: GET, POST, OPTIONS\r\ncf-cache-status: DYNAMIC\r\netag: W/\"6898c366-ee\"\r\ncontent-encoding: gzip\r\ncf-ray: 98fc7bbec94c120a-OSL\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":238,"size_decoded":0,"mime_type":"application/json","magic":"ASCII text, with no line terminators","md5":"543c7fae6451b96a9f332b65ffce2155","sha1":"957bc1071b7c430c95a91eb76d58248795985606","sha256":"834838a9c1b459353b7f28b62ec1490d1f167971557cc3b8dc3d3a80f69c2d43","sha512":"a488ed19579a4a99d65f2d8d79590d62d8a260d06ed5ac07f2dbe9d34bfe110c908e0f6440aa8df7233ac274f50e1b9f39656be6908f5130f824e7ff747e25e6","ssdeep":"","tlshash":"00d023fb36cc8b48b1493b9c5114d1845b10850fade843745938c21fc3dd450509f57c","first_seen":"2025-08-11T20:53:12.260833Z","last_seen":"2026-04-28T17:23:00.580319Z","times_seen":59,"resource_available":false,"data":null}},"time_used":221,"timings":{"blocked":17,"dns":1,"connect":1,"send":0,"wait":186,"receive":0,"ssl":12},"alerts":{"ids":null,"analyzer":[{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2025-10-17","alert":"Sinkholed","trigger":"v4fuwb.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"upshiftade.com/#/","fqdn":"upshiftade.com","domain":"upshiftade.com","tld":"com"},"ip":{"addr":"104.18.21.48","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":true,"resource_type":"document","requested_by":"","date":"2025-10-17T02:49:34.889Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.2","cert":{"subject":{"commonName":"upshiftade.com","organization":""},"issuer":{"commonName":"E7","organization":"Let's Encrypt"},"validity":{"start":"Sat, 06 Sep 2025 09:58:39 GMT","end":"Fri, 05 Dec 2025 09:58:38 GMT"},"fingerprint":{"sha1":"96:16:27:FD:01:A0:76:97:49:14:35:FA:49:D9:D0:EF:42:EA:50:27","sha256":"91:72:FC:27:76:8B:44:11:34:D1:C0:74:09:7E:A0:C9:80:65:A8:C9:26:F2:5E:FD:FE:64:C9:87:BE:C4:DB:62"}}},"request":{"raw":"GET / HTTP/1.1\r\nHost: upshiftade.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://upshiftade.com/?code=YXRmUmRYQnphR2xtZEM1eWNubzNiMnN1WTI5dFhYWFhYWFhY\r\nUpgrade-Insecure-Requests: 1\r\nSec-Fetch-Dest: document\r\nSec-Fetch-Mode: navigate\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ndate: Fri, 17 Oct 2025 02:49:35 GMT\r\ncontent-type: text/html\r\nserver: cloudflare\r\nlast-modified: Sat, 27 Sep 2025 13:58:42 GMT\r\nserver-timing: cfCacheStatus;desc=\"DYNAMIC\", cfEdge;dur=4,cfOrigin;dur=272\r\nvary: Accept-Encoding\r\ncf-cache-status: DYNAMIC\r\ncontent-encoding: gzip\r\ncf-ray: 98fc7bc90cc256a2-OSL\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare Browser Insights","description":"Cloudflare Browser Insights is a tool that measures the performance of websites from the perspective of users.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["Analytics","RUM"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":2026,"size_decoded":0,"mime_type":"text/html","magic":"HTML document, ASCII text, with very long lines (497)","md5":"901507e50b2e2e8f0c8a7410f9eebf72","sha1":"a307ab2f15e385e54d3334af17542107881cf713","sha256":"290b07a1934dddcad864d5eb665dabe02d1c06c0dfb0bd42fa44057ffc1b3514","sha512":"13655d00c3e15e527b32323cc3a30d93d53a55b4bff7042b4f9c9dc8efd144001edceb359fde2e0a9a301f3c8feb9787c72cb04c2bbc7bf880c8460a5ff105ae","ssdeep":"","tlshash":"e641674a48f34455a173616c5df7f6583ab980574308dd247fadb320cf4075d84bbb85","first_seen":"2025-10-17T02:50:03.225964Z","last_seen":"2025-10-17T02:50:03.225964Z","times_seen":1,"resource_available":false,"data":null}},"time_used":280,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":280,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2025-10-17","alert":"Sinkholed","trigger":"upshiftade.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2025-10-17","alert":"Sinkholed","trigger":"upshiftade.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"upshift.rrz7ok.com/api/webConfig","fqdn":"upshift.rrz7ok.com","domain":"rrz7ok.com","tld":"com"},"ip":{"addr":"104.18.13.89","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"https://upshiftade.com/#/","date":"2025-10-17T02:49:35.898Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"rrz7ok.com","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Thu, 09 Oct 2025 18:00:04 GMT","end":"Wed, 07 Jan 2026 19:00:02 GMT"},"fingerprint":{"sha1":"90:8D:82:FB:F3:72:88:CC:A1:90:86:64:B0:FC:D7:10:78:E0:C3:B6","sha256":"9D:8C:32:C6:33:8B:82:77:C1:0B:A5:77:A7:42:5A:A1:08:28:1A:2E:C9:81:37:70:16:92:6C:AD:51:01:53:00"}}},"request":{"raw":"GET /api/webConfig HTTP/1.1\r\nHost: upshift.rrz7ok.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/json, text/plain, */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nlang: en\r\nOrigin: https://upshiftade.com\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://upshiftade.com/\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ndate: Fri, 17 Oct 2025 02:49:36 GMT\r\ncontent-type: application/text;charset=utf-8\r\ncontent-length: 534\r\nserver: cloudflare\r\naccess-control-allow-origin: *\r\naccess-control-allow-credentials: true\r\naccess-control-allow-headers: *\r\naccess-control-allow-methods: GET, POST, PUT, DELETE, OPTIONS\r\ncontent-encoding: br\r\ncache-control: no-cache\r\nvary: accept-encoding\r\ncf-cache-status: DYNAMIC\r\nset-cookie: _cfuvid=sqwtucS5NZFtOakYWTOO7aerpEKKDCi6T19KvM3VYrs-1760669375.8759437-1.0.1.1-Aw1SloJe_XA6najeemBi_P8c92hcP0UMBpXAn4mMOTE; HttpOnly; SameSite=None; Secure; Path=/; Domain=upshift.rrz7ok.com\r\ncf-ray: 98fc7bcf3f767129-OSL\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":828,"size_decoded":0,"mime_type":"application/text; charset=utf-8","magic":"ASCII text, with very long lines (828), with no line terminators","md5":"0f6acf06da06e71b78087ecfdb740154","sha1":"1fa918b3587edb68d1929c7cb0a4519107dd6f76","sha256":"f2d265524dd96a3d697985d36462becf1fc228969134020833b6ce1578026357","sha512":"aa1a6999f3b2d08a7d138b88cf53a163cc37fd841051dad1a88c47738c12159f254973aae655a9c33465f20c4b54fa30c2fb2eb7d93cd05b454a9a8d7945dd1d","ssdeep":"","tlshash":"5f011ed3228c27a1e37a3260e22222cc5b00844e2ab0419d338bc07f83be1f14ded421","first_seen":"2025-10-17T02:50:03.23951Z","last_seen":"2025-10-17T02:50:03.23951Z","times_seen":1,"resource_available":false,"data":null}},"time_used":188,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":188,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-10-17","alert":"Sinkholed","trigger":"upshift.rrz7ok.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"upshiftade.com/cdn-cgi/rum?","fqdn":"upshiftade.com","domain":"upshiftade.com","tld":"com"},"ip":{"addr":"104.18.21.48","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"https://upshiftade.com/","date":"2025-10-17T02:49:31.475Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.2","cert":{"subject":{"commonName":"upshiftade.com","organization":""},"issuer":{"commonName":"E7","organization":"Let's Encrypt"},"validity":{"start":"Sat, 06 Sep 2025 09:58:39 GMT","end":"Fri, 05 Dec 2025 09:58:38 GMT"},"fingerprint":{"sha1":"96:16:27:FD:01:A0:76:97:49:14:35:FA:49:D9:D0:EF:42:EA:50:27","sha256":"91:72:FC:27:76:8B:44:11:34:D1:C0:74:09:7E:A0:C9:80:65:A8:C9:26:F2:5E:FD:FE:64:C9:87:BE:C4:DB:62"}}},"request":{"raw":"POST /cdn-cgi/rum? HTTP/1.1\r\nHost: upshiftade.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\ncontent-type: application/json\r\nContent-Length: 1019\r\nOrigin: https://upshiftade.com\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://upshiftade.com/\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"POST"},"response":{"raw":"HTTP/2 204 No Content\r\ndate: Fri, 17 Oct 2025 02:49:31 GMT\r\ncontent-type: text/plain\r\naccess-control-allow-origin: https://upshiftade.com\r\naccess-control-allow-methods: POST,OPTIONS\r\naccess-control-max-age: 86400\r\nvary: Origin, accept-encoding\r\naccess-control-allow-credentials: true\r\nserver: cloudflare\r\ncf-ray: 98fc7bb3be6956a2-OSL\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"204","status_text":"No Content","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":0,"size_decoded":0,"mime_type":"text/plain","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-07-25T01:51:47.226353Z","times_seen":17518204,"resource_available":true,"data":null}},"time_used":4,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":4,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2025-10-17","alert":"Sinkholed","trigger":"upshiftade.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2025-10-17","alert":"Sinkholed","trigger":"upshiftade.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"mwqyejli.com/api/get_url","fqdn":"mwqyejli.com","domain":"mwqyejli.com","tld":"com"},"ip":{"addr":"104.18.13.89","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"https://upshiftjobs.com/","date":"2025-10-17T02:49:33.715Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"mwqyejli.com","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Wed, 08 Oct 2025 00:39:54 GMT","end":"Tue, 06 Jan 2026 01:39:53 GMT"},"fingerprint":{"sha1":"91:0B:DC:2F:65:8F:91:80:EC:5C:C4:56:2A:A2:CA:8B:B7:B1:D3:AE","sha256":"4C:FD:8C:01:AC:64:DD:E5:5F:C9:4A:77:45:6A:47:9F:CB:B2:8A:BB:9B:E1:8B:B8:9B:70:E5:C4:D1:FF:28:17"}}},"request":{"raw":"POST /api/get_url HTTP/1.1\r\nHost: mwqyejli.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/json, text/plain, */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nContent-Type: application/json\r\nContent-Length: 28\r\nOrigin: https://upshiftjobs.com\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://upshiftjobs.com/\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"POST"},"response":{"raw":"HTTP/2 200 OK\r\ndate: Fri, 17 Oct 2025 02:49:34 GMT\r\ncontent-type: application/text;charset=utf-8\r\ncontent-length: 180\r\nserver: cloudflare\r\nvary: accept-encoding\r\naccess-control-allow-origin: *\r\naccess-control-allow-credentials: true\r\naccess-control-allow-headers: *\r\naccess-control-allow-methods: GET, POST, PUT, DELETE, OPTIONS\r\ncontent-encoding: br\r\ncache-control: no-cache\r\ncf-cache-status: DYNAMIC\r\nset-cookie: _cfuvid=k4v4aMWyf_Bw6ZLcevdOPC9YYqWnWjqHtw_ea3JNjGU-1760669373.713804-1.0.1.1-0cfyE1TBeJsJaatRW9PNCfIMFQzTNuyWLDRg6vAm1.0; HttpOnly; SameSite=None; Secure; Path=/; Domain=mwqyejli.com\r\ncf-ray: 98fc7bc1baa2b512-OSL\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":200,"size_decoded":0,"mime_type":"application/text; charset=utf-8","magic":"ASCII text, with no line terminators","md5":"2141c2f08424f6e0ebd73af79f9d5a73","sha1":"a0724ae58978ed14027b8a0e223398632beb7e05","sha256":"163251775811a00821c454a2422368c25426c6dbbc857f29f4ef22c273383248","sha512":"cc3e5bb00579d22d75933d45eff902d741ee3b50db187963d5c05400ca652e2603b13484395dfd1367be619bc7a157b3b0f351febd7548fe1e1ded4a69ac9c3b","ssdeep":"","tlshash":"b9d0234166ac1365e21437c501c9516c5f39893a1e10d15c5174d9dd47070c4258753c","first_seen":"2025-10-17T02:50:03.243699Z","last_seen":"2025-10-17T02:50:03.243699Z","times_seen":1,"resource_available":false,"data":null}},"time_used":554,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":554,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"upshiftade.com/assets/index-7ad1962d.js","fqdn":"upshiftade.com","domain":"upshiftade.com","tld":"com"},"ip":{"addr":"104.18.21.48","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"fetch","requested_by":"https://upshiftade.com/#/","date":"2025-10-17T02:49:35.404Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.2","cert":{"subject":{"commonName":"upshiftade.com","organization":""},"issuer":{"commonName":"E7","organization":"Let's Encrypt"},"validity":{"start":"Sat, 06 Sep 2025 09:58:39 GMT","end":"Fri, 05 Dec 2025 09:58:38 GMT"},"fingerprint":{"sha1":"96:16:27:FD:01:A0:76:97:49:14:35:FA:49:D9:D0:EF:42:EA:50:27","sha256":"91:72:FC:27:76:8B:44:11:34:D1:C0:74:09:7E:A0:C9:80:65:A8:C9:26:F2:5E:FD:FE:64:C9:87:BE:C4:DB:62"}}},"request":{"raw":"GET /assets/index-7ad1962d.js HTTP/1.1\r\nHost: upshiftade.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://upshiftade.com/\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ndate: Fri, 17 Oct 2025 02:49:35 GMT\r\ncontent-type: application/javascript\r\nserver: cloudflare\r\nlast-modified: Sat, 27 Sep 2025 13:58:42 GMT\r\nvary: Accept-Encoding\r\netag: W/\"68d7ed92-2359\"\r\nexpires: Fri, 17 Oct 2025 14:49:35 GMT\r\ncache-control: public, max-age=43200\r\ncontent-encoding: gzip\r\ncf-cache-status: MISS\r\ncf-ray: 98fc7bcc3da156a2-OSL\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":9049,"size_decoded":0,"mime_type":"application/javascript","magic":"JavaScript source, ASCII text, with very long lines (9048)","md5":"b8d72b63a6c8e2b161ab57140c18ce97","sha1":"44838412363eb377a998702944f6670a142fceac","sha256":"05a10bcf395955adfd3d9bcb3384cd99ed25ab6bed499dfc13d73f9794a82d44","sha512":"1f14930ee96b1b86bab11416c2e2881ae00e335ea24b09f77e2ffe339063ed8f407be5f49924fc057729ee95fa895ba27732dd72b678e8d6f677864fc527ac23","ssdeep":"192:O90sNryMNOuFASDJ5D0lk4j4BjkKem3P8LiuAS5lbWZ+nlTdBzj:7MyzuFJIlTj4BjkKem/8OuAS5S+nlTHj","tlshash":"2f12d6c5b4c2a2b59beb60d5f0e58060e51c8b45e11e90e2e03f8d142bde9c4ba79f3d","first_seen":"2025-10-17T02:50:03.246689Z","last_seen":"2025-10-17T02:50:03.246689Z","times_seen":1,"resource_available":true,"data":null}},"time_used":372,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":372,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2025-10-17","alert":"Sinkholed","trigger":"upshiftade.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2025-10-17","alert":"Sinkholed","trigger":"upshiftade.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"upshiftade.com/assets/index-5b499674.js","fqdn":"upshiftade.com","domain":"upshiftade.com","tld":"com"},"ip":{"addr":"104.18.21.48","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"fetch","requested_by":"https://upshiftade.com/#/","date":"2025-10-17T02:49:35.401Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.2","cert":{"subject":{"commonName":"upshiftade.com","organization":""},"issuer":{"commonName":"E7","organization":"Let's Encrypt"},"validity":{"start":"Sat, 06 Sep 2025 09:58:39 GMT","end":"Fri, 05 Dec 2025 09:58:38 GMT"},"fingerprint":{"sha1":"96:16:27:FD:01:A0:76:97:49:14:35:FA:49:D9:D0:EF:42:EA:50:27","sha256":"91:72:FC:27:76:8B:44:11:34:D1:C0:74:09:7E:A0:C9:80:65:A8:C9:26:F2:5E:FD:FE:64:C9:87:BE:C4:DB:62"}}},"request":{"raw":"GET /assets/index-5b499674.js HTTP/1.1\r\nHost: upshiftade.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://upshiftade.com/\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ndate: Fri, 17 Oct 2025 02:49:35 GMT\r\ncontent-type: application/javascript\r\nserver: cloudflare\r\nvary: accept-encoding\r\nlast-modified: Sat, 27 Sep 2025 13:58:42 GMT\r\nexpires: Fri, 17 Oct 2025 14:49:35 GMT\r\ncache-control: public, max-age=43200\r\ncf-cache-status: MISS\r\netag: W/\"68d7ed92-259\"\r\ncontent-encoding: gzip\r\ncf-ray: 98fc7bcc3da056a2-OSL\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":601,"size_decoded":0,"mime_type":"application/javascript","magic":"Java source, Unicode text, UTF-8 text, with very long lines (599)","md5":"ee3e2a1973f334bcc4a2babc5c983f53","sha1":"c790a75a6813fa287ef61b24331948600c1bc0c3","sha256":"c3d0cfad886be829cc02f31bc61b02a559a3ca93424ecc818477cb841dd71617","sha512":"cf9e19a1c27ed457785164b751888c65f7cc8fbebd19c6ca8d45550018d043aa9efebb6ce9a79859fff789f6f1076551bc9a131a66ca3fbd81c69d4866e842c9","ssdeep":"","tlshash":"d8f0e12d700de7b2550b0c58e36e78069514465d7b3b8df1d385887297e20fa763db88","first_seen":"2025-10-17T02:50:03.24987Z","last_seen":"2025-10-17T02:50:03.24987Z","times_seen":1,"resource_available":true,"data":null}},"time_used":212,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":212,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2025-10-17","alert":"Sinkholed","trigger":"upshiftade.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2025-10-17","alert":"Sinkholed","trigger":"upshiftade.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"upshiftjobs.com/favicon.ico","fqdn":"upshiftjobs.com","domain":"upshiftjobs.com","tld":"com"},"ip":{"addr":"104.18.20.48","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://upshiftjobs.com/","date":"2025-10-17T02:49:33.088Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.2","cert":{"subject":{"commonName":"upshiftjobs.com","organization":""},"issuer":{"commonName":"E8","organization":"Let's Encrypt"},"validity":{"start":"Sat, 06 Sep 2025 10:59:41 GMT","end":"Fri, 05 Dec 2025 10:59:40 GMT"},"fingerprint":{"sha1":"4A:07:8A:14:3B:83:0A:2E:7E:72:5C:D7:FD:6F:D2:6A:87:80:D8:81","sha256":"CC:3E:49:5A:BB:C8:CB:B8:1E:5B:AA:AC:E0:E9:60:86:E2:DF:7E:74:33:98:B7:E6:E8:73:66:A2:D8:C5:13:F2"}}},"request":{"raw":"GET /favicon.ico HTTP/1.1\r\nHost: upshiftjobs.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://upshiftjobs.com/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 404 Not Found\r\ndate: Fri, 17 Oct 2025 02:49:33 GMT\r\ncontent-type: text/html\r\nserver: cloudflare\r\nvary: accept-encoding\r\ncache-control: public, max-age=10800\r\ncf-cache-status: MISS\r\nexpires: Fri, 17 Oct 2025 05:49:33 GMT\r\ncontent-encoding: gzip\r\ncf-ray: 98fc7bbdcd6cb4ee-OSL\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"404","status_text":"Not Found","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":138,"size_decoded":0,"mime_type":"text/html","magic":"HTML document, ASCII text","md5":"7389d931c86b3d7bb6b8af46d8c4172b","sha1":"8d2a4760aa0b47984d11cd1a66448719177fb791","sha256":"301bd9f16f94feedfae7a946a14bac38cb73c43efe6117bc5586835af03d7d6f","sha512":"dd6d1511e4fcd5bc09d821ffe091fb5946ac9654c48664aed504e479e9ac20c1cad44b6df90f42190d47e28f5f96bfb09d24056df6b950243d68ee8100a9a889","ssdeep":"","tlshash":"d9c09b5d755366449913155167c33641d196837f689a84510941c593f0cf69ac4c73a9","first_seen":"2023-03-13T12:56:15Z","last_seen":"2026-07-25T01:51:28.140807Z","times_seen":316019,"resource_available":true,"data":null}},"time_used":223,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":223,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"upshiftade.com/cdn-cgi/rum?","fqdn":"upshiftade.com","domain":"upshiftade.com","tld":"com"},"ip":{"addr":"104.18.21.48","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"beacon","requested_by":"https://upshiftade.com/","date":"2025-10-17T02:49:32.611Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.2","cert":{"subject":{"commonName":"upshiftade.com","organization":""},"issuer":{"commonName":"E7","organization":"Let's Encrypt"},"validity":{"start":"Sat, 06 Sep 2025 09:58:39 GMT","end":"Fri, 05 Dec 2025 09:58:38 GMT"},"fingerprint":{"sha1":"96:16:27:FD:01:A0:76:97:49:14:35:FA:49:D9:D0:EF:42:EA:50:27","sha256":"91:72:FC:27:76:8B:44:11:34:D1:C0:74:09:7E:A0:C9:80:65:A8:C9:26:F2:5E:FD:FE:64:C9:87:BE:C4:DB:62"}}},"request":{"raw":"POST /cdn-cgi/rum? HTTP/1.1\r\nHost: upshiftade.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nContent-Type: application/json\r\nContent-Length: 498\r\nOrigin: https://upshiftade.com\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://upshiftade.com/\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\n\r\n","headers":null,"cookies":null,"method":"POST"},"response":{"raw":"HTTP/2 204 No Content\r\ndate: Fri, 17 Oct 2025 02:49:32 GMT\r\ncontent-type: text/plain\r\naccess-control-allow-origin: https://upshiftade.com\r\naccess-control-allow-methods: POST,OPTIONS\r\naccess-control-max-age: 86400\r\nvary: Origin, accept-encoding\r\naccess-control-allow-credentials: true\r\nserver: cloudflare\r\ncf-ray: 98fc7bbad86156a2-OSL\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"204","status_text":"No Content","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":0,"size_decoded":0,"mime_type":"text/plain","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-07-25T01:51:47.226353Z","times_seen":17518204,"resource_available":true,"data":null}},"time_used":2,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":2,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2025-10-17","alert":"Sinkholed","trigger":"upshiftade.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2025-10-17","alert":"Sinkholed","trigger":"upshiftade.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"upshiftade.com/assets/index-81ac7ae6.js","fqdn":"upshiftade.com","domain":"upshiftade.com","tld":"com"},"ip":{"addr":"104.18.21.48","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://upshiftade.com/","date":"2025-10-17T02:49:30.580Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.2","cert":{"subject":{"commonName":"upshiftade.com","organization":""},"issuer":{"commonName":"E7","organization":"Let's Encrypt"},"validity":{"start":"Sat, 06 Sep 2025 09:58:39 GMT","end":"Fri, 05 Dec 2025 09:58:38 GMT"},"fingerprint":{"sha1":"96:16:27:FD:01:A0:76:97:49:14:35:FA:49:D9:D0:EF:42:EA:50:27","sha256":"91:72:FC:27:76:8B:44:11:34:D1:C0:74:09:7E:A0:C9:80:65:A8:C9:26:F2:5E:FD:FE:64:C9:87:BE:C4:DB:62"}}},"request":{"raw":"GET /assets/index-81ac7ae6.js HTTP/1.1\r\nHost: upshiftade.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://upshiftade.com/\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ndate: Fri, 17 Oct 2025 02:49:30 GMT\r\ncontent-type: application/javascript\r\nserver: cloudflare\r\nlast-modified: Sat, 27 Sep 2025 13:58:42 GMT\r\nvary: Accept-Encoding\r\netag: W/\"68d7ed92-81194\"\r\nexpires: Fri, 17 Oct 2025 14:49:30 GMT\r\ncache-control: public, max-age=43200\r\ncontent-encoding: gzip\r\ncf-cache-status: MISS\r\ncf-ray: 98fc7bae1cdf56a2-OSL\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":528788,"size_decoded":0,"mime_type":"application/javascript","magic":"JavaScript source, ASCII text, with very long lines (65536), with no line terminators","md5":"cc146105157cc06970a4f98411391f9d","sha1":"b0e45f982da40cfa54899ee9d43092f951f85fc0","sha256":"bdbf9f5ae3e2c9616820b411e84f1f9dab50b6f9e8a88e265abaeccd5a7745f3","sha512":"d3f77cb06fb586d89fcf46d18fdfd30bd24d8d3cbb05ef1c66fa8eb7b2626ce3591e23d905959435a5f7432d568b690949747921fb1137d7799255b5bd1be41a","ssdeep":"6144:Y04QNdAHKHEz24fGW3T2kvGkH5ZWqiJWU+xF11bWvZhmxOLiGJSq:YSdAHwb4fGDkHHWqCWV1bRxOLiGJSq","tlshash":"0bb463a4b4c7f4918bc8959124aa20d0f2584e833059a5a3dcf8cc6fbdf6976c5b7f18","first_seen":"2025-10-17T02:50:03.255883Z","last_seen":"2025-10-17T02:50:03.255883Z","times_seen":1,"resource_available":true,"data":null}},"time_used":232,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":232,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2025-10-17","alert":"Sinkholed","trigger":"upshiftade.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2025-10-17","alert":"Sinkholed","trigger":"upshiftade.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"static.cloudflareinsights.com/beacon.min.js/vcd15cbe7772f49c399c6a5babf22c1241717689176015","fqdn":"static.cloudflareinsights.com","domain":"cloudflareinsights.com","tld":"com"},"ip":{"addr":"104.16.80.73","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://upshiftade.com/","date":"2025-10-17T02:49:30.583Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"cloudflareinsights.com","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Sun, 24 Aug 2025 02:39:12 GMT","end":"Sat, 22 Nov 2025 03:39:06 GMT"},"fingerprint":{"sha1":"B4:6C:D2:16:CA:52:EE:BD:22:D7:B4:2C:64:FF:A5:EF:67:D8:E1:F8","sha256":"FF:3A:23:84:D6:B2:73:DF:50:6E:1A:45:A4:AB:03:37:0B:C4:4A:8E:82:12:99:10:80:A2:F7:FC:71:E3:BA:1D"}}},"request":{"raw":"GET /beacon.min.js/vcd15cbe7772f49c399c6a5babf22c1241717689176015 HTTP/1.1\r\nHost: static.cloudflareinsights.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nOrigin: https://upshiftade.com\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://upshiftade.com/\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ndate: Fri, 17 Oct 2025 02:49:30 GMT\r\ncontent-type: text/javascript;charset=UTF-8\r\ncontent-encoding: gzip\r\naccess-control-allow-origin: *\r\ncache-control: public, max-age=86400\r\netag: W/\"2024.6.1\"\r\nlast-modified: Thu, 06 Jun 2024 15:52:56 GMT\r\ncross-origin-resource-policy: cross-origin\r\nvary: Accept-Encoding\r\nserver: cloudflare\r\ncf-ray: 98fc7bae7ca2dfec-OSL\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":19948,"size_decoded":0,"mime_type":"text/javascript; charset=UTF-8","magic":"JavaScript source, ASCII text, with very long lines (19948), with no line terminators","md5":"ec18af6d41f6f278b6aed3bdabffa7bc","sha1":"62c9e2cab76b888829f3c5335e91c320b22329ae","sha256":"8a18d13015336bc184819a5a768447462202ef3105ec511bf42ed8304a7ed94f","sha512":"669b0e9a545057acbdd3b4c8d1d2811eaf4c776f679da1083e591ff38ae7684467abacef5af3d4aabd9fb7c335692dbca0def63ddac2cd28d8e14e95680c3511","ssdeep":"384:XriNpnjyMkg8XMtExRN1w29JIOzahXtO2nJ65:GijgSWuanfJ65","tlshash":"8d92d7def645723613f76076913f220b733b35a528068459812adbc22c3d98f6267f6e","first_seen":"2024-06-07T09:21:23Z","last_seen":"2026-07-24T14:35:42.207329Z","times_seen":337593,"resource_available":true,"data":null}},"time_used":126,"timings":{"blocked":55,"dns":0,"connect":1,"send":0,"wait":13,"receive":0,"ssl":55},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"upshiftade.com/assets/loading-b3425b05.js","fqdn":"upshiftade.com","domain":"upshiftade.com","tld":"com"},"ip":{"addr":"104.18.21.48","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://upshiftade.com/","date":"2025-10-17T02:49:31.234Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.2","cert":{"subject":{"commonName":"upshiftade.com","organization":""},"issuer":{"commonName":"E7","organization":"Let's Encrypt"},"validity":{"start":"Sat, 06 Sep 2025 09:58:39 GMT","end":"Fri, 05 Dec 2025 09:58:38 GMT"},"fingerprint":{"sha1":"96:16:27:FD:01:A0:76:97:49:14:35:FA:49:D9:D0:EF:42:EA:50:27","sha256":"91:72:FC:27:76:8B:44:11:34:D1:C0:74:09:7E:A0:C9:80:65:A8:C9:26:F2:5E:FD:FE:64:C9:87:BE:C4:DB:62"}}},"request":{"raw":"GET /assets/loading-b3425b05.js HTTP/1.1\r\nHost: upshiftade.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://upshiftade.com/assets/index-81ac7ae6.js\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ndate: Fri, 17 Oct 2025 02:49:31 GMT\r\ncontent-type: application/javascript\r\nserver: cloudflare\r\nvary: accept-encoding\r\nlast-modified: Sat, 27 Sep 2025 13:58:42 GMT\r\nexpires: Fri, 17 Oct 2025 14:49:31 GMT\r\ncache-control: public, max-age=43200\r\ncf-cache-status: MISS\r\netag: W/\"68d7ed92-17c\"\r\ncontent-encoding: gzip\r\ncf-ray: 98fc7bb23dd656a2-OSL\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":380,"size_decoded":0,"mime_type":"application/javascript","magic":"Java source, ASCII text, with very long lines (379)","md5":"08aea8b1131c5a0f1f9fec96ac741b49","sha1":"5a1ea98933f29a0d75bc4dc0b6cc3ae3a6093c99","sha256":"a447a40f6b1fc8c63a43dd58eb00b079a7af0c3260e247881534ea02cb1be2a4","sha512":"b623c3d300671272a0adbe1f843652b6990e56ba02f724ce2ef394f3f536949578d08d2d2d81f73af184c46f5436d7da76e6da436445d4ab32b76a6e3a8c1beb","ssdeep":"","tlshash":"cbe0688d2445f9bda19b188875a55903e0682de137bce8c9a48d886ba69a079824eb20","first_seen":"2025-10-17T02:50:03.258582Z","last_seen":"2025-10-17T02:50:03.258582Z","times_seen":1,"resource_available":true,"data":null}},"time_used":211,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":211,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2025-10-17","alert":"Sinkholed","trigger":"upshiftade.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2025-10-17","alert":"Sinkholed","trigger":"upshiftade.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"upshiftade.com/images/login/login_bg.png","fqdn":"upshiftade.com","domain":"upshiftade.com","tld":"com"},"ip":{"addr":"104.18.21.48","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://upshiftade.com/","date":"2025-10-17T02:49:31.250Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.2","cert":{"subject":{"commonName":"upshiftade.com","organization":""},"issuer":{"commonName":"E7","organization":"Let's Encrypt"},"validity":{"start":"Sat, 06 Sep 2025 09:58:39 GMT","end":"Fri, 05 Dec 2025 09:58:38 GMT"},"fingerprint":{"sha1":"96:16:27:FD:01:A0:76:97:49:14:35:FA:49:D9:D0:EF:42:EA:50:27","sha256":"91:72:FC:27:76:8B:44:11:34:D1:C0:74:09:7E:A0:C9:80:65:A8:C9:26:F2:5E:FD:FE:64:C9:87:BE:C4:DB:62"}}},"request":{"raw":"GET /images/login/login_bg.png HTTP/1.1\r\nHost: upshiftade.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://upshiftade.com/assets/index-5748f3e0.css\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ndate: Fri, 17 Oct 2025 02:49:31 GMT\r\ncontent-type: image/png\r\nserver: cloudflare\r\nlast-modified: Sat, 27 Sep 2025 13:58:42 GMT\r\nvary: Accept-Encoding\r\netag: W/\"68d7ed92-62fd7\"\r\nexpires: Sun, 16 Nov 2025 02:49:31 GMT\r\ncache-control: public, max-age=2592000\r\ncontent-encoding: gzip\r\ncf-cache-status: HIT\r\ncf-ray: 98fc7bb24dda56a2-OSL\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":405463,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 390 x 1823, 8-bit/color RGBA, non-interlaced","md5":"1ebc91230187906c80a1f8796a34f45e","sha1":"fd1d46c579d045cc7632f41d5ab96915bd682a81","sha256":"624300c90b49e4f6bff5fb56b08513e1d2b2df8fa050927bb110d012655c1b04","sha512":"8ed467b4d91cc47a3b44ee893f5b6d1a7a98d50c106b3168a145a72ad36525591f65ae5a95dae0eb31f8cede4bec4a1e24226dd457cca9bda66708034681f1d3","ssdeep":"6144:tE5QNCtJTCO+2G/bw7NXKFtaDqNackU35JoGB/y9L0ipsSEyZ7HuCwOYvWn:C59D+9w7N6COHkUpJD0TZzub3vWn","tlshash":"3e8423fc25d91b8afd41f0ca1679488c1596f65738861d775becb1310bc881aa2ff706","first_seen":"2025-06-15T10:57:14.274964Z","last_seen":"2026-04-10T12:19:58.765637Z","times_seen":15,"resource_available":false,"data":null}},"time_used":61,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":61,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2025-10-17","alert":"Sinkholed","trigger":"upshiftade.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2025-10-17","alert":"Sinkholed","trigger":"upshiftade.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"upshiftjobs.com/assets/index-b999148a.js","fqdn":"upshiftjobs.com","domain":"upshiftjobs.com","tld":"com"},"ip":{"addr":"104.18.20.48","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://upshiftjobs.com/","date":"2025-10-17T02:49:32.982Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.2","cert":{"subject":{"commonName":"upshiftjobs.com","organization":""},"issuer":{"commonName":"E8","organization":"Let's Encrypt"},"validity":{"start":"Sat, 06 Sep 2025 10:59:41 GMT","end":"Fri, 05 Dec 2025 10:59:40 GMT"},"fingerprint":{"sha1":"4A:07:8A:14:3B:83:0A:2E:7E:72:5C:D7:FD:6F:D2:6A:87:80:D8:81","sha256":"CC:3E:49:5A:BB:C8:CB:B8:1E:5B:AA:AC:E0:E9:60:86:E2:DF:7E:74:33:98:B7:E6:E8:73:66:A2:D8:C5:13:F2"}}},"request":{"raw":"GET /assets/index-b999148a.js HTTP/1.1\r\nHost: upshiftjobs.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://upshiftjobs.com/assets/index-d0961c08.js\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ndate: Fri, 17 Oct 2025 02:49:33 GMT\r\ncontent-type: application/javascript\r\nserver: cloudflare\r\nlast-modified: Tue, 14 May 2024 04:01:47 GMT\r\nvary: Accept-Encoding\r\netag: W/\"6642e22b-76ca\"\r\nexpires: Fri, 17 Oct 2025 14:49:33 GMT\r\ncache-control: public, max-age=43200\r\ncontent-encoding: gzip\r\ncf-cache-status: MISS\r\ncf-ray: 98fc7bbd2d3cb4ee-OSL\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":30410,"size_decoded":0,"mime_type":"application/javascript","magic":"JavaScript source, ASCII text, with very long lines (15024)","md5":"a5c15e325f4a67db6cac2e2d4c2d77d8","sha1":"19e1dfd663dc91871ad031ef3d1a2bbae8620899","sha256":"b684223bb53bbf298d784a651ac5b9dc36e61810e82611b0a8b6afdb77e052e5","sha512":"1aba407f3adbe20504e20b5c225f04528a1e7b89dcca24312045cdca4b335451d1e19748c4aa7fdc2a3f6f575fd090736b541497e8746dd768d87d5d21960e21","ssdeep":"768:X+XYSWd2cAKpAZin5y3ozC7Qc5p+pLS5XUahJtphWUCWHGTL0nytWFD+n1UDhR8P:XJNyAEJkP","tlshash":"89d2f9c5b6d2b06243aa20f5407b4806f3399a25748d44e4f16c9cdb3cb650a97bbfbd","first_seen":"2024-05-15T00:53:40Z","last_seen":"2026-04-28T17:23:00.590185Z","times_seen":138,"resource_available":true,"data":null}},"time_used":216,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":216,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"upshiftjobs.com/cdn-cgi/rum?","fqdn":"upshiftjobs.com","domain":"upshiftjobs.com","tld":"com"},"ip":{"addr":"104.18.20.48","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"beacon","requested_by":"https://upshiftjobs.com/","date":"2025-10-17T02:49:34.726Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.2","cert":{"subject":{"commonName":"upshiftjobs.com","organization":""},"issuer":{"commonName":"E8","organization":"Let's Encrypt"},"validity":{"start":"Sat, 06 Sep 2025 10:59:41 GMT","end":"Fri, 05 Dec 2025 10:59:40 GMT"},"fingerprint":{"sha1":"4A:07:8A:14:3B:83:0A:2E:7E:72:5C:D7:FD:6F:D2:6A:87:80:D8:81","sha256":"CC:3E:49:5A:BB:C8:CB:B8:1E:5B:AA:AC:E0:E9:60:86:E2:DF:7E:74:33:98:B7:E6:E8:73:66:A2:D8:C5:13:F2"}}},"request":{"raw":"POST /cdn-cgi/rum? HTTP/1.1\r\nHost: upshiftjobs.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nContent-Type: application/json\r\nContent-Length: 522\r\nOrigin: https://upshiftjobs.com\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://upshiftjobs.com/\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\n\r\n","headers":null,"cookies":null,"method":"POST"},"response":{"raw":"HTTP/2 204 No Content\r\ndate: Fri, 17 Oct 2025 02:49:34 GMT\r\ncontent-type: text/plain\r\naccess-control-allow-origin: https://upshiftjobs.com\r\naccess-control-allow-methods: POST,OPTIONS\r\naccess-control-max-age: 86400\r\nvary: Origin, accept-encoding\r\naccess-control-allow-credentials: true\r\nserver: cloudflare\r\ncf-ray: 98fc7bc8080cb4ee-OSL\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"204","status_text":"No Content","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":0,"size_decoded":0,"mime_type":"text/plain","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-07-25T01:51:47.226353Z","times_seen":17518204,"resource_available":true,"data":null}},"time_used":5,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":5,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"upshiftade.com/assets/index-530dc1e2.css","fqdn":"upshiftade.com","domain":"upshiftade.com","tld":"com"},"ip":{"addr":"104.18.21.48","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://upshiftade.com/#/","date":"2025-10-17T02:49:35.389Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.2","cert":{"subject":{"commonName":"upshiftade.com","organization":""},"issuer":{"commonName":"E7","organization":"Let's Encrypt"},"validity":{"start":"Sat, 06 Sep 2025 09:58:39 GMT","end":"Fri, 05 Dec 2025 09:58:38 GMT"},"fingerprint":{"sha1":"96:16:27:FD:01:A0:76:97:49:14:35:FA:49:D9:D0:EF:42:EA:50:27","sha256":"91:72:FC:27:76:8B:44:11:34:D1:C0:74:09:7E:A0:C9:80:65:A8:C9:26:F2:5E:FD:FE:64:C9:87:BE:C4:DB:62"}}},"request":{"raw":"GET /assets/index-530dc1e2.css HTTP/1.1\r\nHost: upshiftade.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://upshiftade.com/\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ndate: Fri, 17 Oct 2025 02:49:35 GMT\r\ncontent-type: text/css\r\nserver: cloudflare\r\nlast-modified: Sat, 27 Sep 2025 13:58:42 GMT\r\nvary: accept-encoding\r\nexpires: Fri, 17 Oct 2025 14:49:35 GMT\r\ncache-control: public, max-age=43200\r\ncf-cache-status: HIT\r\netag: W/\"68d7ed92-38\"\r\ncontent-encoding: gzip\r\ncf-ray: 98fc7bcc2d9356a2-OSL\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":56,"size_decoded":0,"mime_type":"text/css","magic":"ASCII text","md5":"03cda1adac24cbc76a78bb9e937e7b8f","sha1":"ced9869893008314e4c2266f3ae273e7965e59f4","sha256":"530dc1e29ab71a52576ceeb5a5867305111f5db72b29f2e913ab780f6dd2a786","sha512":"5124b9065ed02bee80990f7e387708758d85a6a216d478753875ddd2bd18009a0c906aa2be1a3eccf31bbcc0092b1527cbf114e9f487bf9590a319285b4e51ad","ssdeep":"","tlshash":"8890026570c85046213bd1f4e55113b5055a310591400f681465b3f00a831865616524","first_seen":"2025-10-17T02:50:03.26686Z","last_seen":"2026-04-10T12:19:58.790051Z","times_seen":7,"resource_available":false,"data":null}},"time_used":43,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":43,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2025-10-17","alert":"Sinkholed","trigger":"upshiftade.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2025-10-17","alert":"Sinkholed","trigger":"upshiftade.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"upshiftade.com/images/login/login_bg.png","fqdn":"upshiftade.com","domain":"upshiftade.com","tld":"com"},"ip":{"addr":"104.18.21.48","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://upshiftade.com/#/","date":"2025-10-17T02:49:35.411Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.2","cert":{"subject":{"commonName":"upshiftade.com","organization":""},"issuer":{"commonName":"E7","organization":"Let's Encrypt"},"validity":{"start":"Sat, 06 Sep 2025 09:58:39 GMT","end":"Fri, 05 Dec 2025 09:58:38 GMT"},"fingerprint":{"sha1":"96:16:27:FD:01:A0:76:97:49:14:35:FA:49:D9:D0:EF:42:EA:50:27","sha256":"91:72:FC:27:76:8B:44:11:34:D1:C0:74:09:7E:A0:C9:80:65:A8:C9:26:F2:5E:FD:FE:64:C9:87:BE:C4:DB:62"}}},"request":{"raw":"GET /images/login/login_bg.png HTTP/1.1\r\nHost: upshiftade.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://upshiftade.com/assets/index-5748f3e0.css\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ndate: Fri, 17 Oct 2025 02:49:35 GMT\r\ncontent-type: image/png\r\nserver: cloudflare\r\nage: 4\r\nlast-modified: Sat, 27 Sep 2025 13:58:42 GMT\r\nvary: Accept-Encoding\r\netag: W/\"68d7ed92-62fd7\"\r\nexpires: Sun, 16 Nov 2025 02:49:35 GMT\r\ncache-control: public, max-age=2592000\r\ncontent-encoding: gzip\r\ncf-cache-status: HIT\r\ncf-ray: 98fc7bcc5dac56a2-OSL\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":405463,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 390 x 1823, 8-bit/color RGBA, non-interlaced","md5":"1ebc91230187906c80a1f8796a34f45e","sha1":"fd1d46c579d045cc7632f41d5ab96915bd682a81","sha256":"624300c90b49e4f6bff5fb56b08513e1d2b2df8fa050927bb110d012655c1b04","sha512":"8ed467b4d91cc47a3b44ee893f5b6d1a7a98d50c106b3168a145a72ad36525591f65ae5a95dae0eb31f8cede4bec4a1e24226dd457cca9bda66708034681f1d3","ssdeep":"6144:tE5QNCtJTCO+2G/bw7NXKFtaDqNackU35JoGB/y9L0ipsSEyZ7HuCwOYvWn:C59D+9w7N6COHkUpJD0TZzub3vWn","tlshash":"3e8423fc25d91b8afd41f0ca1679488c1596f65738861d775becb1310bc881aa2ff706","first_seen":"2025-06-15T10:57:14.274964Z","last_seen":"2026-04-10T12:19:58.765637Z","times_seen":15,"resource_available":false,"data":null}},"time_used":6,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":6,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2025-10-17","alert":"Sinkholed","trigger":"upshiftade.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2025-10-17","alert":"Sinkholed","trigger":"upshiftade.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"upshiftjobs.com/assets/index-d0961c08.js","fqdn":"upshiftjobs.com","domain":"upshiftjobs.com","tld":"com"},"ip":{"addr":"104.18.20.48","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://upshiftjobs.com/","date":"2025-10-17T02:49:32.657Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.2","cert":{"subject":{"commonName":"upshiftjobs.com","organization":""},"issuer":{"commonName":"E8","organization":"Let's Encrypt"},"validity":{"start":"Sat, 06 Sep 2025 10:59:41 GMT","end":"Fri, 05 Dec 2025 10:59:40 GMT"},"fingerprint":{"sha1":"4A:07:8A:14:3B:83:0A:2E:7E:72:5C:D7:FD:6F:D2:6A:87:80:D8:81","sha256":"CC:3E:49:5A:BB:C8:CB:B8:1E:5B:AA:AC:E0:E9:60:86:E2:DF:7E:74:33:98:B7:E6:E8:73:66:A2:D8:C5:13:F2"}}},"request":{"raw":"GET /assets/index-d0961c08.js HTTP/1.1\r\nHost: upshiftjobs.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://upshiftjobs.com/\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ndate: Fri, 17 Oct 2025 02:49:32 GMT\r\ncontent-type: application/javascript\r\nserver: cloudflare\r\nlast-modified: Tue, 14 May 2024 04:01:47 GMT\r\nvary: Accept-Encoding\r\netag: W/\"6642e22b-2a44d\"\r\nexpires: Fri, 17 Oct 2025 14:49:32 GMT\r\ncache-control: public, max-age=43200\r\ncontent-encoding: gzip\r\ncf-cache-status: MISS\r\ncf-ray: 98fc7bbb1cbfb4ee-OSL\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":173133,"size_decoded":0,"mime_type":"application/javascript","magic":"JavaScript source, ASCII text, with very long lines (65536), with no line terminators","md5":"137b3aeafeb202e8d2ca33d53613e44b","sha1":"dcc6ebb10e632740e7b7c8a215844e004996593d","sha256":"508de462990aeee01ebc18135a36cb57ea02f83f97bbbde8de2ca052e0dfe91a","sha512":"12b312e4e6225250fd0d9848a40c9a32b7df272b98c8002102f67556658839270bfdf4a25a797f9504190bef910c2459f36d5ba177437a5cbedb095d534384e6","ssdeep":"1536:qKcS3kN2SA8AM0K/6lTIIdFOVhNmupgHCTUejnBVBuu7FlJzytkCFLWha/9NiIus:q83m2j20KSlTdgVTm0fx5V7A8IaFagvG","tlshash":"0a0429e47192746613ba19e6507b000af33e2919380ed4d8f06deceb3e6685941bbf7d","first_seen":"2024-05-15T00:53:40Z","last_seen":"2026-04-28T17:23:00.610461Z","times_seen":137,"resource_available":true,"data":null}},"time_used":237,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":237,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"upshiftade.com/?code=YXRmUmRYQnphR2xtZEM1eWNubzNiMnN1WTI5dFhYWFhYWFhY","fqdn":"upshiftade.com","domain":"upshiftade.com","tld":"com"},"ip":{"addr":"104.18.21.48","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":true,"resource_type":"document","requested_by":"","date":"2025-10-17T02:49:34.527Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.2","cert":{"subject":{"commonName":"upshiftade.com","organization":""},"issuer":{"commonName":"E7","organization":"Let's Encrypt"},"validity":{"start":"Sat, 06 Sep 2025 09:58:39 GMT","end":"Fri, 05 Dec 2025 09:58:38 GMT"},"fingerprint":{"sha1":"96:16:27:FD:01:A0:76:97:49:14:35:FA:49:D9:D0:EF:42:EA:50:27","sha256":"91:72:FC:27:76:8B:44:11:34:D1:C0:74:09:7E:A0:C9:80:65:A8:C9:26:F2:5E:FD:FE:64:C9:87:BE:C4:DB:62"}}},"request":{"raw":"GET /?code=YXRmUmRYQnphR2xtZEM1eWNubzNiMnN1WTI5dFhYWFhYWFhY HTTP/1.1\r\nHost: upshiftade.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://upshiftjobs.com/\r\nUpgrade-Insecure-Requests: 1\r\nSec-Fetch-Dest: document\r\nSec-Fetch-Mode: navigate\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ndate: Fri, 17 Oct 2025 02:49:34 GMT\r\ncontent-type: text/html\r\nserver: cloudflare\r\nlast-modified: Sat, 27 Sep 2025 13:58:42 GMT\r\nserver-timing: cfCacheStatus;desc=\"DYNAMIC\", cfEdge;dur=181,cfOrigin;dur=3\r\nvary: Accept-Encoding\r\ncf-cache-status: DYNAMIC\r\ncontent-encoding: gzip\r\ncf-ray: 98fc7bc6cbb756a2-OSL\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"Cloudflare Browser Insights","description":"Cloudflare Browser Insights is a tool that measures the performance of websites from the perspective of users.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["Analytics","RUM"]}],"data":{"size":2026,"size_decoded":0,"mime_type":"text/html","magic":"HTML document, ASCII text, with very long lines (497)","md5":"901507e50b2e2e8f0c8a7410f9eebf72","sha1":"a307ab2f15e385e54d3334af17542107881cf713","sha256":"290b07a1934dddcad864d5eb665dabe02d1c06c0dfb0bd42fa44057ffc1b3514","sha512":"13655d00c3e15e527b32323cc3a30d93d53a55b4bff7042b4f9c9dc8efd144001edceb359fde2e0a9a301f3c8feb9787c72cb04c2bbc7bf880c8460a5ff105ae","ssdeep":"","tlshash":"e641674a48f34455a173616c5df7f6583ab980574308dd247fadb320cf4075d84bbb85","first_seen":"2025-10-17T02:50:03.225964Z","last_seen":"2025-10-17T02:50:03.225964Z","times_seen":1,"resource_available":false,"data":null}},"time_used":188,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":188,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2025-10-17","alert":"Sinkholed","trigger":"upshiftade.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2025-10-17","alert":"Sinkholed","trigger":"upshiftade.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"upshift.rrz7ok.com/api/webConfig","fqdn":"upshift.rrz7ok.com","domain":"rrz7ok.com","tld":"com"},"ip":{"addr":"104.18.13.89","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"https://upshiftade.com/#/","date":"2025-10-17T02:49:35.377Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"rrz7ok.com","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Thu, 09 Oct 2025 18:00:04 GMT","end":"Wed, 07 Jan 2026 19:00:02 GMT"},"fingerprint":{"sha1":"90:8D:82:FB:F3:72:88:CC:A1:90:86:64:B0:FC:D7:10:78:E0:C3:B6","sha256":"9D:8C:32:C6:33:8B:82:77:C1:0B:A5:77:A7:42:5A:A1:08:28:1A:2E:C9:81:37:70:16:92:6C:AD:51:01:53:00"}}},"request":{"raw":"OPTIONS /api/webConfig HTTP/1.1\r\nHost: upshift.rrz7ok.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nAccess-Control-Request-Method: GET\r\nAccess-Control-Request-Headers: lang\r\nReferer: https://upshiftade.com/\r\nOrigin: https://upshiftade.com\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"OPTIONS"},"response":{"raw":"HTTP/2 200 OK\r\ndate: Fri, 17 Oct 2025 02:49:35 GMT\r\ncontent-type: text/html\r\nserver: cloudflare\r\naccess-control-allow-origin: *\r\naccess-control-allow-credentials: true\r\naccess-control-allow-headers: *\r\naccess-control-allow-methods: GET, POST, PUT, DELETE, OPTIONS\r\ncache-control: no-cache\r\ncf-cache-status: DYNAMIC\r\ncontent-encoding: gzip\r\nset-cookie: _cfuvid=cUZncAlgpec6JwTLKHrmbG6tDDcuNU3nkK0zqhOtgAs-1760669375.6717143-1.0.1.1-COr3fpK78doER3uPahmydekegZpMhe7LnWkl9UCPafA; HttpOnly; SameSite=None; Secure; Path=/; Domain=upshift.rrz7ok.com\r\ncf-ray: 98fc7bcdfefe7129-OSL\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":0,"size_decoded":0,"mime_type":"text/html","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-07-25T01:51:47.226353Z","times_seen":17518204,"resource_available":true,"data":null}},"time_used":793,"timings":{"blocked":295,"dns":108,"connect":1,"send":0,"wait":202,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-10-17","alert":"Sinkholed","trigger":"upshift.rrz7ok.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"upshiftade.com/assets/index-27e78800.css","fqdn":"upshiftade.com","domain":"upshiftade.com","tld":"com"},"ip":{"addr":"104.18.21.48","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://upshiftade.com/#/","date":"2025-10-17T02:49:35.391Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.2","cert":{"subject":{"commonName":"upshiftade.com","organization":""},"issuer":{"commonName":"E7","organization":"Let's Encrypt"},"validity":{"start":"Sat, 06 Sep 2025 09:58:39 GMT","end":"Fri, 05 Dec 2025 09:58:38 GMT"},"fingerprint":{"sha1":"96:16:27:FD:01:A0:76:97:49:14:35:FA:49:D9:D0:EF:42:EA:50:27","sha256":"91:72:FC:27:76:8B:44:11:34:D1:C0:74:09:7E:A0:C9:80:65:A8:C9:26:F2:5E:FD:FE:64:C9:87:BE:C4:DB:62"}}},"request":{"raw":"GET /assets/index-27e78800.css HTTP/1.1\r\nHost: upshiftade.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://upshiftade.com/\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ndate: Fri, 17 Oct 2025 02:49:35 GMT\r\ncontent-type: text/css\r\nserver: cloudflare\r\nlast-modified: Sat, 27 Sep 2025 13:58:42 GMT\r\nvary: Accept-Encoding\r\netag: W/\"68d7ed92-1bae\"\r\nexpires: Fri, 17 Oct 2025 14:49:35 GMT\r\ncache-control: public, max-age=43200\r\ncontent-encoding: gzip\r\ncf-cache-status: HIT\r\ncf-ray: 98fc7bcc2d9456a2-OSL\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":7086,"size_decoded":0,"mime_type":"text/css","magic":"ASCII text, with very long lines (7085)","md5":"e8443f35ff17e36f333c4a1dac060c28","sha1":"13588ce1f36602f4b095f68b587c0b6d45b74c57","sha256":"27e788005b6e7838aa0a70c2596897dec75c9672b20b36b3c5055a19f4afce5d","sha512":"bef88b429b5f6101586f56b97ef66e93d10bc235d8a143a5c381771ca9a5549c3f8a3682f53890e2c2352b8ad14b3839bdeaaa4c26b228eec896f22dab653c18","ssdeep":"96:RCpwB02ULbIQ4MbBtqkB72APGReFyKYSge5ytJMkJMXp/MRI:nKF2kyTKYM50TG","tlshash":"b1e15d8eebe8a576df0a79e96746d1e8f278d730cd02d3a2f30055990bc3af61602535","first_seen":"2023-12-06T15:43:58Z","last_seen":"2026-05-04T16:28:44.376614Z","times_seen":51,"resource_available":false,"data":null}},"time_used":52,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":52,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2025-10-17","alert":"Sinkholed","trigger":"upshiftade.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2025-10-17","alert":"Sinkholed","trigger":"upshiftade.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"upshiftade.com/assets/use-id-68745ac1.js","fqdn":"upshiftade.com","domain":"upshiftade.com","tld":"com"},"ip":{"addr":"104.18.21.48","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"fetch","requested_by":"https://upshiftade.com/#/","date":"2025-10-17T02:49:35.408Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.2","cert":{"subject":{"commonName":"upshiftade.com","organization":""},"issuer":{"commonName":"E7","organization":"Let's Encrypt"},"validity":{"start":"Sat, 06 Sep 2025 09:58:39 GMT","end":"Fri, 05 Dec 2025 09:58:38 GMT"},"fingerprint":{"sha1":"96:16:27:FD:01:A0:76:97:49:14:35:FA:49:D9:D0:EF:42:EA:50:27","sha256":"91:72:FC:27:76:8B:44:11:34:D1:C0:74:09:7E:A0:C9:80:65:A8:C9:26:F2:5E:FD:FE:64:C9:87:BE:C4:DB:62"}}},"request":{"raw":"GET /assets/use-id-68745ac1.js HTTP/1.1\r\nHost: upshiftade.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://upshiftade.com/\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ndate: Fri, 17 Oct 2025 02:49:35 GMT\r\ncontent-type: application/javascript\r\nserver: cloudflare\r\nvary: accept-encoding\r\nlast-modified: Sat, 27 Sep 2025 13:58:42 GMT\r\nexpires: Fri, 17 Oct 2025 14:49:35 GMT\r\ncache-control: public, max-age=43200\r\ncf-cache-status: MISS\r\netag: W/\"68d7ed92-97\"\r\ncontent-encoding: gzip\r\ncf-ray: 98fc7bcc3da256a2-OSL\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":151,"size_decoded":0,"mime_type":"application/javascript","magic":"Java source, ASCII text","md5":"3c385c18fc0fa2347184a05ef7acfa5c","sha1":"05590525bb0e1f2f3d4b3b0befd7b994b3903806","sha256":"ad7b68893010908b2ad231a5d5bc58a294cbd9c50292da68afd442635ed755c5","sha512":"64d8a10d73844ef44f6f6f33a4dbcb5c45667a441bcd4581e2759cce13a1b16a4c541d15e2ae756fc66f3358d120ab7bee4ae33900e792c357d3e5b0864a4973","ssdeep":"","tlshash":"06c08c89784910f0260a08d8e227566a812a3810231a99b0f2a40b1705a12b683bae20","first_seen":"2025-10-17T02:50:03.230844Z","last_seen":"2025-10-17T02:50:03.230844Z","times_seen":1,"resource_available":true,"data":null}},"time_used":221,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":221,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2025-10-17","alert":"Sinkholed","trigger":"upshiftade.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2025-10-17","alert":"Sinkholed","trigger":"upshiftade.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"upshiftade.com/favicon.ico","fqdn":"upshiftade.com","domain":"upshiftade.com","tld":"com"},"ip":{"addr":"104.18.21.48","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://upshiftade.com/","date":"2025-10-17T02:49:31.554Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.2","cert":{"subject":{"commonName":"upshiftade.com","organization":""},"issuer":{"commonName":"E7","organization":"Let's Encrypt"},"validity":{"start":"Sat, 06 Sep 2025 09:58:39 GMT","end":"Fri, 05 Dec 2025 09:58:38 GMT"},"fingerprint":{"sha1":"96:16:27:FD:01:A0:76:97:49:14:35:FA:49:D9:D0:EF:42:EA:50:27","sha256":"91:72:FC:27:76:8B:44:11:34:D1:C0:74:09:7E:A0:C9:80:65:A8:C9:26:F2:5E:FD:FE:64:C9:87:BE:C4:DB:62"}}},"request":{"raw":"GET /favicon.ico HTTP/1.1\r\nHost: upshiftade.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://upshiftade.com/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 404 Not Found\r\ndate: Fri, 17 Oct 2025 02:49:31 GMT\r\ncontent-type: text/html\r\nserver: cloudflare\r\ncache-control: public, max-age=10800\r\nvary: Accept-Encoding\r\nexpires: Fri, 17 Oct 2025 05:49:31 GMT\r\ncf-cache-status: MISS\r\ncontent-encoding: gzip\r\ncf-ray: 98fc7bb43e9256a2-OSL\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"404","status_text":"Not Found","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":58288,"size_decoded":0,"mime_type":"text/html","magic":"HTML document, ASCII text, with very long lines (56756)","md5":"b6305f53b4d3432d561eb748f4af25fd","sha1":"e01e5117f6fa0d6b1a82ae3c45839d8097d119b5","sha256":"dc676cc52046a252ee86c463e49bce5b517c932ab100f21cb62e231cb3d7ed7a","sha512":"18f3435e92ce082fc5d52e8c8b3e3186c86bd499afdf405b842d1b0aef771a4d14359bf39d142b591469cc4c4a2016c2f4c6fd646662318cee2ad0f966470b83","ssdeep":"768:cHJYDDQHVZHIs91TXESJBjgBSp00yCqJ3Z+IYM3WiesRQiULO0bpD9tcNQEfdomx:cmDD6oeFUycwpk06hWp1b99c7Vz","tlshash":"0443021803de40a2cd9978d9426f2f3d842a1863da1c94bd1f5b6df4ca0d8a4767f1ea","first_seen":"2024-05-06T13:26:20Z","last_seen":"2026-07-24T20:55:06.245594Z","times_seen":1918,"resource_available":true,"data":null}},"time_used":231,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":231,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2025-10-17","alert":"Sinkholed","trigger":"upshiftade.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2025-10-17","alert":"Sinkholed","trigger":"upshiftade.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"upshiftade.com/images/kf.png","fqdn":"upshiftade.com","domain":"upshiftade.com","tld":"com"},"ip":{"addr":"104.18.21.48","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://upshiftade.com/#/","date":"2025-10-17T02:49:36.110Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.2","cert":{"subject":{"commonName":"upshiftade.com","organization":""},"issuer":{"commonName":"E7","organization":"Let's Encrypt"},"validity":{"start":"Sat, 06 Sep 2025 09:58:39 GMT","end":"Fri, 05 Dec 2025 09:58:38 GMT"},"fingerprint":{"sha1":"96:16:27:FD:01:A0:76:97:49:14:35:FA:49:D9:D0:EF:42:EA:50:27","sha256":"91:72:FC:27:76:8B:44:11:34:D1:C0:74:09:7E:A0:C9:80:65:A8:C9:26:F2:5E:FD:FE:64:C9:87:BE:C4:DB:62"}}},"request":{"raw":"GET /images/kf.png HTTP/1.1\r\nHost: upshiftade.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://upshiftade.com/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ndate: Fri, 17 Oct 2025 02:49:36 GMT\r\ncontent-type: image/png\r\nserver: cloudflare\r\nlast-modified: Sat, 27 Sep 2025 13:58:42 GMT\r\nvary: Accept-Encoding\r\netag: W/\"68d7ed92-a5e\"\r\nexpires: Sun, 16 Nov 2025 02:49:36 GMT\r\ncache-control: public, max-age=2592000\r\ncontent-encoding: gzip\r\ncf-cache-status: HIT\r\ncf-ray: 98fc7bd0af2756a2-OSL\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":2654,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 48 x 48, 8-bit/color RGBA, non-interlaced","md5":"82807da5e84e212bddd97fe255fd2089","sha1":"d873f7ebbbcb1391132401fbac1ed1487c266ac0","sha256":"b00e91f46a25ac569ff4bafc9285bff5399c16d0bae28c288169e0d4b062396c","sha512":"1a92bc4e30511040125f043456cce4d5562cf6cc405f16d2b78396308c34136d2e1e64e00b2015654e78422e1b6dc7fb96d5613747b6c73d8c2a804d80352d84","ssdeep":"","tlshash":"75513c13e26a67c8fd6b4704125af230266b20446b0fa88ec9e50f25c90ef5d36fda09","first_seen":"2025-10-17T02:50:03.27693Z","last_seen":"2026-01-18T23:11:11.289611Z","times_seen":4,"resource_available":false,"data":null}},"time_used":18,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":18,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2025-10-17","alert":"Sinkholed","trigger":"upshiftade.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2025-10-17","alert":"Sinkholed","trigger":"upshiftade.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"mwqyejli.com/api/get_url","fqdn":"mwqyejli.com","domain":"mwqyejli.com","tld":"com"},"ip":{"addr":"104.18.13.89","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"https://upshiftjobs.com/","date":"2025-10-17T02:49:33.450Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"mwqyejli.com","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Wed, 08 Oct 2025 00:39:54 GMT","end":"Tue, 06 Jan 2026 01:39:53 GMT"},"fingerprint":{"sha1":"91:0B:DC:2F:65:8F:91:80:EC:5C:C4:56:2A:A2:CA:8B:B7:B1:D3:AE","sha256":"4C:FD:8C:01:AC:64:DD:E5:5F:C9:4A:77:45:6A:47:9F:CB:B2:8A:BB:9B:E1:8B:B8:9B:70:E5:C4:D1:FF:28:17"}}},"request":{"raw":"OPTIONS /api/get_url HTTP/1.1\r\nHost: mwqyejli.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nAccess-Control-Request-Method: POST\r\nAccess-Control-Request-Headers: content-type\r\nReferer: https://upshiftjobs.com/\r\nOrigin: https://upshiftjobs.com\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"OPTIONS"},"response":{"raw":"HTTP/2 200 OK\r\ndate: Fri, 17 Oct 2025 02:49:33 GMT\r\ncontent-type: text/html\r\nserver: cloudflare\r\naccess-control-allow-origin: *\r\naccess-control-allow-credentials: true\r\naccess-control-allow-headers: *\r\naccess-control-allow-methods: GET, POST, PUT, DELETE, OPTIONS\r\ncache-control: no-cache\r\ncf-cache-status: DYNAMIC\r\ncontent-encoding: gzip\r\nset-cookie: _cfuvid=QypwMU1K6udsY0VHECzTvTL.Ed2NSBJ_cZrDH6CjQfY-1760669373.5043886-1.0.1.1-cKLDXuaQeLRFNs.h7G6ZId3p_drtvTlAxUHaWT7cvQc; HttpOnly; SameSite=None; Secure; Path=/; Domain=mwqyejli.com\r\ncf-ray: 98fc7bc06a66b512-OSL\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":0,"size_decoded":0,"mime_type":"text/html","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-07-25T01:51:47.226353Z","times_seen":17518204,"resource_available":true,"data":null}},"time_used":311,"timings":{"blocked":53,"dns":1,"connect":1,"send":0,"wait":208,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"upshiftade.com/assets/index-81ac7ae6.js","fqdn":"upshiftade.com","domain":"upshiftade.com","tld":"com"},"ip":{"addr":"104.18.21.48","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://upshiftade.com/#/","date":"2025-10-17T02:49:35.197Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.2","cert":{"subject":{"commonName":"upshiftade.com","organization":""},"issuer":{"commonName":"E7","organization":"Let's Encrypt"},"validity":{"start":"Sat, 06 Sep 2025 09:58:39 GMT","end":"Fri, 05 Dec 2025 09:58:38 GMT"},"fingerprint":{"sha1":"96:16:27:FD:01:A0:76:97:49:14:35:FA:49:D9:D0:EF:42:EA:50:27","sha256":"91:72:FC:27:76:8B:44:11:34:D1:C0:74:09:7E:A0:C9:80:65:A8:C9:26:F2:5E:FD:FE:64:C9:87:BE:C4:DB:62"}}},"request":{"raw":"GET /assets/index-81ac7ae6.js HTTP/1.1\r\nHost: upshiftade.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://upshiftade.com/\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ndate: Fri, 17 Oct 2025 02:49:35 GMT\r\ncontent-type: application/javascript\r\nserver: cloudflare\r\nage: 5\r\nlast-modified: Sat, 27 Sep 2025 13:58:42 GMT\r\nvary: Accept-Encoding\r\netag: W/\"68d7ed92-81194\"\r\nexpires: Fri, 17 Oct 2025 14:49:35 GMT\r\ncache-control: public, max-age=43200\r\ncontent-encoding: gzip\r\ncf-cache-status: HIT\r\ncf-ray: 98fc7bcafd2f56a2-OSL\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":528788,"size_decoded":0,"mime_type":"application/javascript","magic":"JavaScript source, ASCII text, with very long lines (65536), with no line terminators","md5":"cc146105157cc06970a4f98411391f9d","sha1":"b0e45f982da40cfa54899ee9d43092f951f85fc0","sha256":"bdbf9f5ae3e2c9616820b411e84f1f9dab50b6f9e8a88e265abaeccd5a7745f3","sha512":"d3f77cb06fb586d89fcf46d18fdfd30bd24d8d3cbb05ef1c66fa8eb7b2626ce3591e23d905959435a5f7432d568b690949747921fb1137d7799255b5bd1be41a","ssdeep":"6144:Y04QNdAHKHEz24fGW3T2kvGkH5ZWqiJWU+xF11bWvZhmxOLiGJSq:YSdAHwb4fGDkHHWqCWV1bRxOLiGJSq","tlshash":"0bb463a4b4c7f4918bc8959124aa20d0f2584e833059a5a3dcf8cc6fbdf6976c5b7f18","first_seen":"2025-10-17T02:50:03.255883Z","last_seen":"2025-10-17T02:50:03.255883Z","times_seen":1,"resource_available":true,"data":null}},"time_used":7,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":7,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2025-10-17","alert":"Sinkholed","trigger":"upshiftade.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2025-10-17","alert":"Sinkholed","trigger":"upshiftade.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"upshiftade.com/assets/index-6bf217ff.js","fqdn":"upshiftade.com","domain":"upshiftade.com","tld":"com"},"ip":{"addr":"104.18.21.48","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://upshiftade.com/#/","date":"2025-10-17T02:49:35.636Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.2","cert":{"subject":{"commonName":"upshiftade.com","organization":""},"issuer":{"commonName":"E7","organization":"Let's Encrypt"},"validity":{"start":"Sat, 06 Sep 2025 09:58:39 GMT","end":"Fri, 05 Dec 2025 09:58:38 GMT"},"fingerprint":{"sha1":"96:16:27:FD:01:A0:76:97:49:14:35:FA:49:D9:D0:EF:42:EA:50:27","sha256":"91:72:FC:27:76:8B:44:11:34:D1:C0:74:09:7E:A0:C9:80:65:A8:C9:26:F2:5E:FD:FE:64:C9:87:BE:C4:DB:62"}}},"request":{"raw":"GET /assets/index-6bf217ff.js HTTP/1.1\r\nHost: upshiftade.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://upshiftade.com/assets/login-c8ba0a9a.js\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ndate: Fri, 17 Oct 2025 02:49:35 GMT\r\ncontent-type: application/javascript\r\nserver: cloudflare\r\nage: 0\r\nlast-modified: Sat, 27 Sep 2025 13:58:42 GMT\r\nvary: Accept-Encoding\r\netag: W/\"68d7ed92-569\"\r\nexpires: Fri, 17 Oct 2025 14:49:35 GMT\r\ncache-control: public, max-age=43200\r\ncontent-encoding: gzip\r\ncf-cache-status: HIT\r\ncf-ray: 98fc7bcdbe3156a2-OSL\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":1385,"size_decoded":0,"mime_type":"application/javascript","magic":"Java source, Unicode text, UTF-8 text, with very long lines (1383)","md5":"8e511227be34fd84583aadcda3430494","sha1":"e1a256a14149915899279d5134b7c4f2169c4097","sha256":"36d1461ca20750f95ebcdae04ab14b3ebbe10a71d61818e7670e73e0f81cbd53","sha512":"7828515aa820c851bd6224dbbd93b608194af97a6fb8b3994a6747866589b31a166842d9f06bfac8c88d9da16a142fed2d5565647f08ea436d39975a55d344fb","ssdeep":"","tlshash":"01218cd9a02b17f491830068a964d402e0449ffce32ffed6b2df950366d7827d79a654","first_seen":"2025-10-17T02:50:03.20857Z","last_seen":"2025-10-17T02:50:03.20857Z","times_seen":1,"resource_available":true,"data":null}},"time_used":5,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":5,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2025-10-17","alert":"Sinkholed","trigger":"upshiftade.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2025-10-17","alert":"Sinkholed","trigger":"upshiftade.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"upshiftade.com/assets/index-5748f3e0.css","fqdn":"upshiftade.com","domain":"upshiftade.com","tld":"com"},"ip":{"addr":"104.18.21.48","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://upshiftade.com/?code=YXRmUmRYQnphR2xtZEM1eWNubzNiMnN1WTI5dFhYWFhYWFhY","date":"2025-10-17T02:49:34.801Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.2","cert":{"subject":{"commonName":"upshiftade.com","organization":""},"issuer":{"commonName":"E7","organization":"Let's Encrypt"},"validity":{"start":"Sat, 06 Sep 2025 09:58:39 GMT","end":"Fri, 05 Dec 2025 09:58:38 GMT"},"fingerprint":{"sha1":"96:16:27:FD:01:A0:76:97:49:14:35:FA:49:D9:D0:EF:42:EA:50:27","sha256":"91:72:FC:27:76:8B:44:11:34:D1:C0:74:09:7E:A0:C9:80:65:A8:C9:26:F2:5E:FD:FE:64:C9:87:BE:C4:DB:62"}}},"request":{"raw":"GET /assets/index-5748f3e0.css HTTP/1.1\r\nHost: upshiftade.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://upshiftade.com/?code=YXRmUmRYQnphR2xtZEM1eWNubzNiMnN1WTI5dFhYWFhYWFhY\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ndate: Fri, 17 Oct 2025 02:49:34 GMT\r\ncontent-type: text/css\r\nserver: cloudflare\r\nage: 4\r\nlast-modified: Sat, 27 Sep 2025 13:58:42 GMT\r\nvary: Accept-Encoding\r\netag: W/\"68d7ed92-3a77c\"\r\nexpires: Fri, 17 Oct 2025 14:49:34 GMT\r\ncache-control: public, max-age=43200\r\ncontent-encoding: gzip\r\ncf-cache-status: HIT\r\ncf-ray: 98fc7bc87c7356a2-OSL\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":239484,"size_decoded":0,"mime_type":"text/css","magic":"ASCII text, with very long lines (65536), with no line terminators","md5":"94fc120aa67465778422be4a0f8aadaf","sha1":"418c00f1f8040eb8d584a3036050dd13a78b2343","sha256":"5748f3e0d6e7c9c1aa23bc123019a5490a305cdfef79a741fc10b91a13b5ab94","sha512":"676979194ec3ffe47e4c111da8a82f13bee435be9ea2f51549dc0bc4cbf5a3f8493c3824842ccda9d0ecfcc1350b693abbea2fd4b6958e2520f9181470857d91","ssdeep":"1536:dJ66OlpVwwsgiOz48RN5J+jOkiHcplpVwwsgiOz45qGObEZ1Ab5a4zxTVqVoIs:/BO5w9sz/+5w9szZnpEs","tlshash":"4e34e669aa9091bd7f17f175eb8b96dcf23cf960ed01caa4f10051184ec7bf50623a1a","first_seen":"2025-10-17T02:50:03.236038Z","last_seen":"2025-10-17T02:50:03.236038Z","times_seen":1,"resource_available":false,"data":null}},"time_used":8,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":8,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2025-10-17","alert":"Sinkholed","trigger":"upshiftade.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2025-10-17","alert":"Sinkholed","trigger":"upshiftade.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"upshiftade.com/assets/index-5b499674.js","fqdn":"upshiftade.com","domain":"upshiftade.com","tld":"com"},"ip":{"addr":"104.18.21.48","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://upshiftade.com/#/","date":"2025-10-17T02:49:35.637Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.2","cert":{"subject":{"commonName":"upshiftade.com","organization":""},"issuer":{"commonName":"E7","organization":"Let's Encrypt"},"validity":{"start":"Sat, 06 Sep 2025 09:58:39 GMT","end":"Fri, 05 Dec 2025 09:58:38 GMT"},"fingerprint":{"sha1":"96:16:27:FD:01:A0:76:97:49:14:35:FA:49:D9:D0:EF:42:EA:50:27","sha256":"91:72:FC:27:76:8B:44:11:34:D1:C0:74:09:7E:A0:C9:80:65:A8:C9:26:F2:5E:FD:FE:64:C9:87:BE:C4:DB:62"}}},"request":{"raw":"GET /assets/index-5b499674.js HTTP/1.1\r\nHost: upshiftade.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://upshiftade.com/assets/login-c8ba0a9a.js\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ndate: Fri, 17 Oct 2025 02:49:35 GMT\r\ncontent-type: application/javascript\r\nserver: cloudflare\r\nvary: accept-encoding\r\nlast-modified: Sat, 27 Sep 2025 13:58:42 GMT\r\nage: 0\r\nexpires: Fri, 17 Oct 2025 14:49:35 GMT\r\ncache-control: public, max-age=43200\r\ncf-cache-status: HIT\r\netag: W/\"68d7ed92-259\"\r\ncontent-encoding: gzip\r\ncf-ray: 98fc7bcdbe3356a2-OSL\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":601,"size_decoded":0,"mime_type":"application/javascript","magic":"Java source, Unicode text, UTF-8 text, with very long lines (599)","md5":"ee3e2a1973f334bcc4a2babc5c983f53","sha1":"c790a75a6813fa287ef61b24331948600c1bc0c3","sha256":"c3d0cfad886be829cc02f31bc61b02a559a3ca93424ecc818477cb841dd71617","sha512":"cf9e19a1c27ed457785164b751888c65f7cc8fbebd19c6ca8d45550018d043aa9efebb6ce9a79859fff789f6f1076551bc9a131a66ca3fbd81c69d4866e842c9","ssdeep":"","tlshash":"d8f0e12d700de7b2550b0c58e36e78069514465d7b3b8df1d385887297e20fa763db88","first_seen":"2025-10-17T02:50:03.24987Z","last_seen":"2025-10-17T02:50:03.24987Z","times_seen":1,"resource_available":true,"data":null}},"time_used":6,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":6,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2025-10-17","alert":"Sinkholed","trigger":"upshiftade.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2025-10-17","alert":"Sinkholed","trigger":"upshiftade.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"upshiftade.com/images/home/lang.png","fqdn":"upshiftade.com","domain":"upshiftade.com","tld":"com"},"ip":{"addr":"104.18.21.48","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://upshiftade.com/#/","date":"2025-10-17T02:49:36.112Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.2","cert":{"subject":{"commonName":"upshiftade.com","organization":""},"issuer":{"commonName":"E7","organization":"Let's Encrypt"},"validity":{"start":"Sat, 06 Sep 2025 09:58:39 GMT","end":"Fri, 05 Dec 2025 09:58:38 GMT"},"fingerprint":{"sha1":"96:16:27:FD:01:A0:76:97:49:14:35:FA:49:D9:D0:EF:42:EA:50:27","sha256":"91:72:FC:27:76:8B:44:11:34:D1:C0:74:09:7E:A0:C9:80:65:A8:C9:26:F2:5E:FD:FE:64:C9:87:BE:C4:DB:62"}}},"request":{"raw":"GET /images/home/lang.png HTTP/1.1\r\nHost: upshiftade.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://upshiftade.com/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ndate: Fri, 17 Oct 2025 02:49:36 GMT\r\ncontent-type: image/png\r\nserver: cloudflare\r\nlast-modified: Sat, 27 Sep 2025 13:58:42 GMT\r\nvary: Accept-Encoding\r\netag: W/\"68d7ed92-4edc\"\r\nexpires: Sun, 16 Nov 2025 02:49:36 GMT\r\ncache-control: public, max-age=2592000\r\ncontent-encoding: gzip\r\ncf-cache-status: HIT\r\ncf-ray: 98fc7bd0af2856a2-OSL\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":20188,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 512 x 512, 16-bit gray+alpha, non-interlaced","md5":"c3a04428c28357adf638a9200198e98f","sha1":"c744606c35f02f27203e36c43bd6224c0977710d","sha256":"85244ed861f70db2c4ae45de55c5d365a649fd3e3f58b437aec81dc69f036cb0","sha512":"04e736f5de493b58bd9e58ddfb795312f1f31bd23112180401864e55c8b41b66019b517dda7023b825afb9c25500d972f6d655e657e1f01feb05e93701198736","ssdeep":"384:cFpve/38+P49B88MerzT8blcqH6zPzxfUKWVGidnNZl8rV:Uv6C9BhX0lcqGVidNIrV","tlshash":"d092e0b3da7ae6f8ad372ac1fce3001bb9140720d66514727520b77336ac56de637980","first_seen":"2023-11-10T15:57:53Z","last_seen":"2026-05-03T10:23:48.673793Z","times_seen":34,"resource_available":false,"data":null}},"time_used":64,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":64,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2025-10-17","alert":"Sinkholed","trigger":"upshiftade.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2025-10-17","alert":"Sinkholed","trigger":"upshiftade.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"upshiftade.com/assets/login-c081e68b.css","fqdn":"upshiftade.com","domain":"upshiftade.com","tld":"com"},"ip":{"addr":"104.18.21.48","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://upshiftade.com/#/","date":"2025-10-17T02:49:35.394Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.2","cert":{"subject":{"commonName":"upshiftade.com","organization":""},"issuer":{"commonName":"E7","organization":"Let's Encrypt"},"validity":{"start":"Sat, 06 Sep 2025 09:58:39 GMT","end":"Fri, 05 Dec 2025 09:58:38 GMT"},"fingerprint":{"sha1":"96:16:27:FD:01:A0:76:97:49:14:35:FA:49:D9:D0:EF:42:EA:50:27","sha256":"91:72:FC:27:76:8B:44:11:34:D1:C0:74:09:7E:A0:C9:80:65:A8:C9:26:F2:5E:FD:FE:64:C9:87:BE:C4:DB:62"}}},"request":{"raw":"GET /assets/login-c081e68b.css HTTP/1.1\r\nHost: upshiftade.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://upshiftade.com/\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ndate: Fri, 17 Oct 2025 02:49:35 GMT\r\ncontent-type: text/css\r\nserver: cloudflare\r\nvary: accept-encoding\r\nlast-modified: Sat, 27 Sep 2025 13:58:42 GMT\r\nexpires: Fri, 17 Oct 2025 14:49:35 GMT\r\ncache-control: public, max-age=43200\r\ncf-cache-status: HIT\r\netag: W/\"68d7ed92-1b9\"\r\ncontent-encoding: gzip\r\ncf-ray: 98fc7bcc2d9556a2-OSL\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":441,"size_decoded":0,"mime_type":"text/css","magic":"ASCII text, with very long lines (440)","md5":"e5aaac0b34b3db4f9179f186942a1d40","sha1":"b5387aabe038f23c331b0473205c786e85b032e2","sha256":"c081e68b36ef99acad9a9ca42d087b501908157c29f021e510037021f9208cd0","sha512":"a8d03e64e7c70c789a44dfcfd080f656518c81a430ee7fecf905d2c0cb2748ae62550906c1233ef667ed22f31820a827aa8ef6f197ba8188d6e9e24a2dd3ba48","ssdeep":"","tlshash":"d0f0e55bfbdd25209017d2a82221febc193cb3a38a010b32e731b3721e035d3e253966","first_seen":"2025-10-17T02:50:03.283705Z","last_seen":"2025-10-17T02:50:03.283705Z","times_seen":1,"resource_available":false,"data":null}},"time_used":69,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":69,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2025-10-17","alert":"Sinkholed","trigger":"upshiftade.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2025-10-17","alert":"Sinkholed","trigger":"upshiftade.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"upshiftade.com/images/login/logo.png","fqdn":"upshiftade.com","domain":"upshiftade.com","tld":"com"},"ip":{"addr":"104.18.21.48","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://upshiftade.com/#/","date":"2025-10-17T02:49:36.113Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.2","cert":{"subject":{"commonName":"upshiftade.com","organization":""},"issuer":{"commonName":"E7","organization":"Let's Encrypt"},"validity":{"start":"Sat, 06 Sep 2025 09:58:39 GMT","end":"Fri, 05 Dec 2025 09:58:38 GMT"},"fingerprint":{"sha1":"96:16:27:FD:01:A0:76:97:49:14:35:FA:49:D9:D0:EF:42:EA:50:27","sha256":"91:72:FC:27:76:8B:44:11:34:D1:C0:74:09:7E:A0:C9:80:65:A8:C9:26:F2:5E:FD:FE:64:C9:87:BE:C4:DB:62"}}},"request":{"raw":"GET /images/login/logo.png HTTP/1.1\r\nHost: upshiftade.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://upshiftade.com/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ndate: Fri, 17 Oct 2025 02:49:36 GMT\r\ncontent-type: image/png\r\nserver: cloudflare\r\nlast-modified: Sat, 27 Sep 2025 13:58:42 GMT\r\nvary: Accept-Encoding\r\netag: W/\"68d7ed92-150a\"\r\nexpires: Sun, 16 Nov 2025 02:49:36 GMT\r\ncache-control: public, max-age=2592000\r\ncontent-encoding: gzip\r\ncf-cache-status: HIT\r\ncf-ray: 98fc7bd0af2956a2-OSL\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":5386,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 277 x 275, 8-bit/color RGBA, non-interlaced","md5":"0982ed117b38325ceb84f06ca45a4d98","sha1":"88e4e8e474fe7bebc2e6b4aaac8d23c96a9c6b2d","sha256":"b39f9c8e004da6ea72d44f4327f580266bc0d815f1fea23ab00dc30afe83e6b4","sha512":"01cc51831eb68e1e5ffc640a44ef6e6164764b0cd905b12a31acd67f9b476ff0d0b712a79f27ff9065b1c30fbe11ea23da173ae4d03b6f2d09b7147d63261c26","ssdeep":"96:h2V9MhoGpgggg6FfqPyg/QVwRLJEwKrzHhKueKat48FN++QQNQsKJlsW+/capXPD:hW9Cchq6g/qwRVxKrzH0uCttN++QQC3+","tlshash":"4eb1afc79b8bfbf6cfcc14f4634a442958b2456bfffa12452b00a693485d01982ced04","first_seen":"2025-10-17T02:50:03.286951Z","last_seen":"2025-10-17T02:50:03.286951Z","times_seen":1,"resource_available":false,"data":null}},"time_used":43,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":43,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2025-10-17","alert":"Sinkholed","trigger":"upshiftade.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2025-10-17","alert":"Sinkholed","trigger":"upshiftade.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"static.cloudflareinsights.com/beacon.min.js/vcd15cbe7772f49c399c6a5babf22c1241717689176015","fqdn":"static.cloudflareinsights.com","domain":"cloudflareinsights.com","tld":"com"},"ip":{"addr":"104.16.80.73","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://upshiftade.com/?code=YXRmUmRYQnphR2xtZEM1eWNubzNiMnN1WTI5dFhYWFhYWFhY","date":"2025-10-17T02:49:34.803Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"cloudflareinsights.com","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Sun, 24 Aug 2025 02:39:12 GMT","end":"Sat, 22 Nov 2025 03:39:06 GMT"},"fingerprint":{"sha1":"B4:6C:D2:16:CA:52:EE:BD:22:D7:B4:2C:64:FF:A5:EF:67:D8:E1:F8","sha256":"FF:3A:23:84:D6:B2:73:DF:50:6E:1A:45:A4:AB:03:37:0B:C4:4A:8E:82:12:99:10:80:A2:F7:FC:71:E3:BA:1D"}}},"request":{"raw":"GET /beacon.min.js/vcd15cbe7772f49c399c6a5babf22c1241717689176015 HTTP/1.1\r\nHost: static.cloudflareinsights.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nOrigin: https://upshiftade.com\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://upshiftade.com/\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":null,"data":{"size":19948,"size_decoded":0,"mime_type":"text/javascript; charset=UTF-8","magic":"JavaScript source, ASCII text, with very long lines (19948), with no line terminators","md5":"ec18af6d41f6f278b6aed3bdabffa7bc","sha1":"62c9e2cab76b888829f3c5335e91c320b22329ae","sha256":"8a18d13015336bc184819a5a768447462202ef3105ec511bf42ed8304a7ed94f","sha512":"669b0e9a545057acbdd3b4c8d1d2811eaf4c776f679da1083e591ff38ae7684467abacef5af3d4aabd9fb7c335692dbca0def63ddac2cd28d8e14e95680c3511","ssdeep":"384:XriNpnjyMkg8XMtExRN1w29JIOzahXtO2nJ65:GijgSWuanfJ65","tlshash":"8d92d7def645723613f76076913f220b733b35a528068459812adbc22c3d98f6267f6e","first_seen":"2024-06-07T09:21:23Z","last_seen":"2026-07-24T14:35:42.207329Z","times_seen":337593,"resource_available":true,"data":null}},"time_used":0,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":0,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"upshiftade.com/favicon.ico","fqdn":"upshiftade.com","domain":"upshiftade.com","tld":"com"},"ip":{"addr":"104.18.21.48","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://upshiftade.com/#/","date":"2025-10-17T02:49:36.001Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.2","cert":{"subject":{"commonName":"upshiftade.com","organization":""},"issuer":{"commonName":"E7","organization":"Let's Encrypt"},"validity":{"start":"Sat, 06 Sep 2025 09:58:39 GMT","end":"Fri, 05 Dec 2025 09:58:38 GMT"},"fingerprint":{"sha1":"96:16:27:FD:01:A0:76:97:49:14:35:FA:49:D9:D0:EF:42:EA:50:27","sha256":"91:72:FC:27:76:8B:44:11:34:D1:C0:74:09:7E:A0:C9:80:65:A8:C9:26:F2:5E:FD:FE:64:C9:87:BE:C4:DB:62"}}},"request":{"raw":"GET /favicon.ico HTTP/1.1\r\nHost: upshiftade.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://upshiftade.com/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 404 Not Found\r\ndate: Fri, 17 Oct 2025 02:49:36 GMT\r\ncontent-type: text/html\r\nserver: cloudflare\r\ncache-control: public, max-age=10800\r\nvary: Accept-Encoding\r\nage: 5\r\nexpires: Fri, 17 Oct 2025 05:49:36 GMT\r\ncf-cache-status: HIT\r\ncontent-encoding: gzip\r\ncf-ray: 98fc7bd00f0556a2-OSL\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"404","status_text":"Not Found","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":58288,"size_decoded":0,"mime_type":"text/html","magic":"HTML document, ASCII text, with very long lines (56756)","md5":"b6305f53b4d3432d561eb748f4af25fd","sha1":"e01e5117f6fa0d6b1a82ae3c45839d8097d119b5","sha256":"dc676cc52046a252ee86c463e49bce5b517c932ab100f21cb62e231cb3d7ed7a","sha512":"18f3435e92ce082fc5d52e8c8b3e3186c86bd499afdf405b842d1b0aef771a4d14359bf39d142b591469cc4c4a2016c2f4c6fd646662318cee2ad0f966470b83","ssdeep":"768:cHJYDDQHVZHIs91TXESJBjgBSp00yCqJ3Z+IYM3WiesRQiULO0bpD9tcNQEfdomx:cmDD6oeFUycwpk06hWp1b99c7Vz","tlshash":"0443021803de40a2cd9978d9426f2f3d842a1863da1c94bd1f5b6df4ca0d8a4767f1ea","first_seen":"2024-05-06T13:26:20Z","last_seen":"2026-07-24T20:55:06.245594Z","times_seen":1918,"resource_available":true,"data":null}},"time_used":10,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":10,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2025-10-17","alert":"Sinkholed","trigger":"upshiftade.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2025-10-17","alert":"Sinkholed","trigger":"upshiftade.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"upshiftade.com/assets/login-c8ba0a9a.js","fqdn":"upshiftade.com","domain":"upshiftade.com","tld":"com"},"ip":{"addr":"104.18.21.48","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://upshiftade.com/#/","date":"2025-10-17T02:49:35.480Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.2","cert":{"subject":{"commonName":"upshiftade.com","organization":""},"issuer":{"commonName":"E7","organization":"Let's Encrypt"},"validity":{"start":"Sat, 06 Sep 2025 09:58:39 GMT","end":"Fri, 05 Dec 2025 09:58:38 GMT"},"fingerprint":{"sha1":"96:16:27:FD:01:A0:76:97:49:14:35:FA:49:D9:D0:EF:42:EA:50:27","sha256":"91:72:FC:27:76:8B:44:11:34:D1:C0:74:09:7E:A0:C9:80:65:A8:C9:26:F2:5E:FD:FE:64:C9:87:BE:C4:DB:62"}}},"request":{"raw":"GET /assets/login-c8ba0a9a.js HTTP/1.1\r\nHost: upshiftade.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://upshiftade.com/assets/index-81ac7ae6.js\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ndate: Fri, 17 Oct 2025 02:49:35 GMT\r\ncontent-type: application/javascript\r\nserver: cloudflare\r\nage: 0\r\nlast-modified: Sat, 27 Sep 2025 13:58:42 GMT\r\nvary: Accept-Encoding\r\netag: W/\"68d7ed92-f73\"\r\nexpires: Fri, 17 Oct 2025 14:49:35 GMT\r\ncache-control: public, max-age=43200\r\ncontent-encoding: gzip\r\ncf-cache-status: HIT\r\ncf-ray: 98fc7bccbdd256a2-OSL\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":3955,"size_decoded":0,"mime_type":"application/javascript","magic":"Java source, ASCII text, with very long lines (3954)","md5":"1c48796bd5f07e01916656ed990d401d","sha1":"09798e5c21d66b147ea0c8debdf422ff73ad89c1","sha256":"a783af3cd40e48c405e305dd8774570ceec6aea3cd4c3aff5b2612a3d0e30ad9","sha512":"8bed14d9b9141462cf5625a31d49c61489956a68382fe6c90cfa2620e387c736dd2e3526a0c9f6a7e247d8c4188dbdb0e20149519ba99f74cc89e39dba2600d8","ssdeep":"","tlshash":"fd81735ae0699af689430556795a68c0f01d7ff6c1268a00f3bc09263fd3df9db49721","first_seen":"2025-10-17T02:50:03.204743Z","last_seen":"2025-10-17T02:50:03.204743Z","times_seen":1,"resource_available":true,"data":null}},"time_used":148,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":148,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2025-10-17","alert":"Sinkholed","trigger":"upshiftade.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2025-10-17","alert":"Sinkholed","trigger":"upshiftade.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"upshiftade.com/assets/index-7ad1962d.js","fqdn":"upshiftade.com","domain":"upshiftade.com","tld":"com"},"ip":{"addr":"104.18.21.48","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://upshiftade.com/#/","date":"2025-10-17T02:49:35.639Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.2","cert":{"subject":{"commonName":"upshiftade.com","organization":""},"issuer":{"commonName":"E7","organization":"Let's Encrypt"},"validity":{"start":"Sat, 06 Sep 2025 09:58:39 GMT","end":"Fri, 05 Dec 2025 09:58:38 GMT"},"fingerprint":{"sha1":"96:16:27:FD:01:A0:76:97:49:14:35:FA:49:D9:D0:EF:42:EA:50:27","sha256":"91:72:FC:27:76:8B:44:11:34:D1:C0:74:09:7E:A0:C9:80:65:A8:C9:26:F2:5E:FD:FE:64:C9:87:BE:C4:DB:62"}}},"request":{"raw":"GET /assets/index-7ad1962d.js HTTP/1.1\r\nHost: upshiftade.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://upshiftade.com/assets/login-c8ba0a9a.js\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ndate: Fri, 17 Oct 2025 02:49:35 GMT\r\ncontent-type: application/javascript\r\nserver: cloudflare\r\nlast-modified: Sat, 27 Sep 2025 13:58:42 GMT\r\nvary: Accept-Encoding\r\netag: W/\"68d7ed92-2359\"\r\nexpires: Fri, 17 Oct 2025 14:49:35 GMT\r\ncache-control: public, max-age=43200\r\ncontent-encoding: gzip\r\nage: 0\r\ncf-cache-status: HIT\r\ncf-ray: 98fc7bcdbe3456a2-OSL\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":9049,"size_decoded":0,"mime_type":"application/javascript","magic":"JavaScript source, ASCII text, with very long lines (9048)","md5":"b8d72b63a6c8e2b161ab57140c18ce97","sha1":"44838412363eb377a998702944f6670a142fceac","sha256":"05a10bcf395955adfd3d9bcb3384cd99ed25ab6bed499dfc13d73f9794a82d44","sha512":"1f14930ee96b1b86bab11416c2e2881ae00e335ea24b09f77e2ffe339063ed8f407be5f49924fc057729ee95fa895ba27732dd72b678e8d6f677864fc527ac23","ssdeep":"192:O90sNryMNOuFASDJ5D0lk4j4BjkKem3P8LiuAS5lbWZ+nlTdBzj:7MyzuFJIlTj4BjkKem/8OuAS5S+nlTHj","tlshash":"2f12d6c5b4c2a2b59beb60d5f0e58060e51c8b45e11e90e2e03f8d142bde9c4ba79f3d","first_seen":"2025-10-17T02:50:03.246689Z","last_seen":"2025-10-17T02:50:03.246689Z","times_seen":1,"resource_available":true,"data":null}},"time_used":133,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":133,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2025-10-17","alert":"Sinkholed","trigger":"upshiftade.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2025-10-17","alert":"Sinkholed","trigger":"upshiftade.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"mwqyejli.com/api/get_entrance_url","fqdn":"mwqyejli.com","domain":"mwqyejli.com","tld":"com"},"ip":{"addr":"104.18.12.89","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"https://upshiftade.com/","date":"2025-10-17T02:49:31.560Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"mwqyejli.com","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Wed, 08 Oct 2025 00:39:54 GMT","end":"Tue, 06 Jan 2026 01:39:53 GMT"},"fingerprint":{"sha1":"91:0B:DC:2F:65:8F:91:80:EC:5C:C4:56:2A:A2:CA:8B:B7:B1:D3:AE","sha256":"4C:FD:8C:01:AC:64:DD:E5:5F:C9:4A:77:45:6A:47:9F:CB:B2:8A:BB:9B:E1:8B:B8:9B:70:E5:C4:D1:FF:28:17"}}},"request":{"raw":"OPTIONS /api/get_entrance_url HTTP/1.1\r\nHost: mwqyejli.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nAccess-Control-Request-Method: POST\r\nAccess-Control-Request-Headers: content-type,lang\r\nReferer: https://upshiftade.com/\r\nOrigin: https://upshiftade.com\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"OPTIONS"},"response":{"raw":"HTTP/2 200 OK\r\ndate: Fri, 17 Oct 2025 02:49:32 GMT\r\ncontent-type: text/html\r\nserver: cloudflare\r\naccess-control-allow-origin: *\r\naccess-control-allow-credentials: true\r\naccess-control-allow-headers: *\r\naccess-control-allow-methods: GET, POST, PUT, DELETE, OPTIONS\r\ncache-control: no-cache\r\ncf-cache-status: DYNAMIC\r\ncontent-encoding: gzip\r\nset-cookie: _cfuvid=36HFno.nDDxnpTlbmGgaUwESj_ExLOWtg53v5e4P730-1760669371.8458016-1.0.1.1-jIQi5Ua9CbrRoQYjZb7rmSReBKysYe0FGcfWD3fMbjg; HttpOnly; SameSite=None; Secure; Path=/; Domain=mwqyejli.com\r\ncf-ray: 98fc7bb60e7c32fa-OSL\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":0,"size_decoded":0,"mime_type":"text/html","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-07-25T01:51:47.226353Z","times_seen":17518204,"resource_available":true,"data":null}},"time_used":777,"timings":{"blocked":285,"dns":110,"connect":1,"send":0,"wait":204,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"mwqyejli.com/api/get_entrance_url","fqdn":"mwqyejli.com","domain":"mwqyejli.com","tld":"com"},"ip":{"addr":"104.18.12.89","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"https://upshiftade.com/","date":"2025-10-17T02:49:32.074Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"mwqyejli.com","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Wed, 08 Oct 2025 00:39:54 GMT","end":"Tue, 06 Jan 2026 01:39:53 GMT"},"fingerprint":{"sha1":"91:0B:DC:2F:65:8F:91:80:EC:5C:C4:56:2A:A2:CA:8B:B7:B1:D3:AE","sha256":"4C:FD:8C:01:AC:64:DD:E5:5F:C9:4A:77:45:6A:47:9F:CB:B2:8A:BB:9B:E1:8B:B8:9B:70:E5:C4:D1:FF:28:17"}}},"request":{"raw":"POST /api/get_entrance_url HTTP/1.1\r\nHost: mwqyejli.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/json, text/plain, */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nContent-Type: application/json\r\nlang: en\r\nContent-Length: 27\r\nOrigin: https://upshiftade.com\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://upshiftade.com/\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"POST"},"response":{"raw":"HTTP/2 200 OK\r\ndate: Fri, 17 Oct 2025 02:49:32 GMT\r\ncontent-type: application/text;charset=utf-8\r\ncontent-length: 84\r\nserver: cloudflare\r\naccess-control-allow-origin: *\r\naccess-control-allow-credentials: true\r\naccess-control-allow-headers: *\r\naccess-control-allow-methods: GET, POST, PUT, DELETE, OPTIONS\r\ncontent-encoding: br\r\ncache-control: no-cache\r\nvary: accept-encoding\r\ncf-cache-status: DYNAMIC\r\nset-cookie: _cfuvid=JT3c.jGWXjiOpL2ngO_WnvlfC6gklfrg4geBCqYf6Q4-1760669372.0535567-1.0.1.1-YVVDJEkmnWfLhkHKOYU3nijsHJhnkP2iOC_8xFfkKmk; HttpOnly; SameSite=None; Secure; Path=/; Domain=mwqyejli.com\r\ncf-ray: 98fc7bb75f2f32fa-OSL\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":80,"size_decoded":0,"mime_type":"application/text; charset=utf-8","magic":"ASCII text, with no line terminators","md5":"ec37cad8ef4f596f61d1ef568db5cd2e","sha1":"6f8185da1a537d6a08094f093803a0fb218290a9","sha256":"52e44caa07da2adfe25ed705df996691cf8b2550dd35ae480a1460e9461a244d","sha512":"150d4f877b7c7ec13355eeff03524f8c401ac35bb2e10d061ac8d2867a2cd96645afbdc9a50ac6fa7646da5f5da8fd3496d3b0b5e6f883dbfcc9932f90833322","ssdeep":"","tlshash":"bda01212435c2370322033450140a0982a2c19351715d05c0130da91020d484111a070","first_seen":"2025-10-17T02:50:03.289866Z","last_seen":"2025-10-17T02:50:03.289866Z","times_seen":1,"resource_available":false,"data":null}},"time_used":195,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":195,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"upshiftade.com/null","fqdn":"upshiftade.com","domain":"upshiftade.com","tld":"com"},"ip":{"addr":"104.18.21.48","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://upshiftade.com/#/","date":"2025-10-17T02:49:36.232Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.2","cert":{"subject":{"commonName":"upshiftade.com","organization":""},"issuer":{"commonName":"E7","organization":"Let's Encrypt"},"validity":{"start":"Sat, 06 Sep 2025 09:58:39 GMT","end":"Fri, 05 Dec 2025 09:58:38 GMT"},"fingerprint":{"sha1":"96:16:27:FD:01:A0:76:97:49:14:35:FA:49:D9:D0:EF:42:EA:50:27","sha256":"91:72:FC:27:76:8B:44:11:34:D1:C0:74:09:7E:A0:C9:80:65:A8:C9:26:F2:5E:FD:FE:64:C9:87:BE:C4:DB:62"}}},"request":{"raw":"GET /null HTTP/1.1\r\nHost: upshiftade.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://upshiftade.com/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 404 Not Found\r\ndate: Fri, 17 Oct 2025 02:49:36 GMT\r\ncontent-type: text/html\r\nserver: cloudflare\r\nvary: Accept-Encoding\r\ncf-cache-status: DYNAMIC\r\ncontent-encoding: gzip\r\ncf-ray: 98fc7bd17f5d56a2-OSL\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"404","status_text":"Not Found","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":58288,"size_decoded":0,"mime_type":"text/html","magic":"HTML document, ASCII text, with very long lines (56756)","md5":"b6305f53b4d3432d561eb748f4af25fd","sha1":"e01e5117f6fa0d6b1a82ae3c45839d8097d119b5","sha256":"dc676cc52046a252ee86c463e49bce5b517c932ab100f21cb62e231cb3d7ed7a","sha512":"18f3435e92ce082fc5d52e8c8b3e3186c86bd499afdf405b842d1b0aef771a4d14359bf39d142b591469cc4c4a2016c2f4c6fd646662318cee2ad0f966470b83","ssdeep":"768:cHJYDDQHVZHIs91TXESJBjgBSp00yCqJ3Z+IYM3WiesRQiULO0bpD9tcNQEfdomx:cmDD6oeFUycwpk06hWp1b99c7Vz","tlshash":"0443021803de40a2cd9978d9426f2f3d842a1863da1c94bd1f5b6df4ca0d8a4767f1ea","first_seen":"2024-05-06T13:26:20Z","last_seen":"2026-07-24T20:55:06.245594Z","times_seen":1918,"resource_available":true,"data":null}},"time_used":189,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":189,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2025-10-17","alert":"Sinkholed","trigger":"upshiftade.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2025-10-17","alert":"Sinkholed","trigger":"upshiftade.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"upshiftade.com/assets/index-5748f3e0.css","fqdn":"upshiftade.com","domain":"upshiftade.com","tld":"com"},"ip":{"addr":"104.18.21.48","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://upshiftade.com/#/","date":"2025-10-17T02:49:35.198Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.2","cert":{"subject":{"commonName":"upshiftade.com","organization":""},"issuer":{"commonName":"E7","organization":"Let's Encrypt"},"validity":{"start":"Sat, 06 Sep 2025 09:58:39 GMT","end":"Fri, 05 Dec 2025 09:58:38 GMT"},"fingerprint":{"sha1":"96:16:27:FD:01:A0:76:97:49:14:35:FA:49:D9:D0:EF:42:EA:50:27","sha256":"91:72:FC:27:76:8B:44:11:34:D1:C0:74:09:7E:A0:C9:80:65:A8:C9:26:F2:5E:FD:FE:64:C9:87:BE:C4:DB:62"}}},"request":{"raw":"GET /assets/index-5748f3e0.css HTTP/1.1\r\nHost: upshiftade.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://upshiftade.com/\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ndate: Fri, 17 Oct 2025 02:49:35 GMT\r\ncontent-type: text/css\r\nserver: cloudflare\r\nage: 5\r\nlast-modified: Sat, 27 Sep 2025 13:58:42 GMT\r\nvary: Accept-Encoding\r\netag: W/\"68d7ed92-3a77c\"\r\nexpires: Fri, 17 Oct 2025 14:49:35 GMT\r\ncache-control: public, max-age=43200\r\ncontent-encoding: gzip\r\ncf-cache-status: HIT\r\ncf-ray: 98fc7bcafd3056a2-OSL\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":239484,"size_decoded":0,"mime_type":"text/css","magic":"ASCII text, with very long lines (65536), with no line terminators","md5":"94fc120aa67465778422be4a0f8aadaf","sha1":"418c00f1f8040eb8d584a3036050dd13a78b2343","sha256":"5748f3e0d6e7c9c1aa23bc123019a5490a305cdfef79a741fc10b91a13b5ab94","sha512":"676979194ec3ffe47e4c111da8a82f13bee435be9ea2f51549dc0bc4cbf5a3f8493c3824842ccda9d0ecfcc1350b693abbea2fd4b6958e2520f9181470857d91","ssdeep":"1536:dJ66OlpVwwsgiOz48RN5J+jOkiHcplpVwwsgiOz45qGObEZ1Ab5a4zxTVqVoIs:/BO5w9sz/+5w9szZnpEs","tlshash":"4e34e669aa9091bd7f17f175eb8b96dcf23cf960ed01caa4f10051184ec7bf50623a1a","first_seen":"2025-10-17T02:50:03.236038Z","last_seen":"2025-10-17T02:50:03.236038Z","times_seen":1,"resource_available":false,"data":null}},"time_used":9,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":9,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2025-10-17","alert":"Sinkholed","trigger":"upshiftade.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2025-10-17","alert":"Sinkholed","trigger":"upshiftade.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"static.cloudflareinsights.com/beacon.min.js/vcd15cbe7772f49c399c6a5babf22c1241717689176015","fqdn":"static.cloudflareinsights.com","domain":"cloudflareinsights.com","tld":"com"},"ip":{"addr":"104.16.80.73","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://upshiftade.com/#/","date":"2025-10-17T02:49:35.199Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"cloudflareinsights.com","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Sun, 24 Aug 2025 02:39:12 GMT","end":"Sat, 22 Nov 2025 03:39:06 GMT"},"fingerprint":{"sha1":"B4:6C:D2:16:CA:52:EE:BD:22:D7:B4:2C:64:FF:A5:EF:67:D8:E1:F8","sha256":"FF:3A:23:84:D6:B2:73:DF:50:6E:1A:45:A4:AB:03:37:0B:C4:4A:8E:82:12:99:10:80:A2:F7:FC:71:E3:BA:1D"}}},"request":{"raw":"GET /beacon.min.js/vcd15cbe7772f49c399c6a5babf22c1241717689176015 HTTP/1.1\r\nHost: static.cloudflareinsights.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nOrigin: https://upshiftade.com\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://upshiftade.com/\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ndate: Fri, 17 Oct 2025 02:49:35 GMT\r\ncontent-type: text/javascript;charset=UTF-8\r\ncontent-encoding: gzip\r\naccess-control-allow-origin: *\r\ncache-control: public, max-age=86400\r\netag: W/\"2024.6.1\"\r\nlast-modified: Thu, 06 Jun 2024 15:52:56 GMT\r\ncross-origin-resource-policy: cross-origin\r\nvary: Accept-Encoding\r\nserver: cloudflare\r\ncf-ray: 98fc7bcaf9e1dfec-OSL\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":19948,"size_decoded":0,"mime_type":"text/javascript; charset=UTF-8","magic":"JavaScript source, ASCII text, with very long lines (19948), with no line terminators","md5":"ec18af6d41f6f278b6aed3bdabffa7bc","sha1":"62c9e2cab76b888829f3c5335e91c320b22329ae","sha256":"8a18d13015336bc184819a5a768447462202ef3105ec511bf42ed8304a7ed94f","sha512":"669b0e9a545057acbdd3b4c8d1d2811eaf4c776f679da1083e591ff38ae7684467abacef5af3d4aabd9fb7c335692dbca0def63ddac2cd28d8e14e95680c3511","ssdeep":"384:XriNpnjyMkg8XMtExRN1w29JIOzahXtO2nJ65:GijgSWuanfJ65","tlshash":"8d92d7def645723613f76076913f220b733b35a528068459812adbc22c3d98f6267f6e","first_seen":"2024-06-07T09:21:23Z","last_seen":"2026-07-24T14:35:42.207329Z","times_seen":337593,"resource_available":true,"data":null}},"time_used":10,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":10,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}}]}