{"report_id":"2a3ac5ae-a7fb-4c16-a8dd-7693a983a8d0","version":0,"status":"done","tags":[],"date":"2026-09-27T03:35:13Z","url":{"schema":"http","addr":"schwbai.com/","fqdn":"schwbai.com","domain":"schwbai.com","tld":"com"},"ip":{"addr":"103.122.177.57","port":0,"asn":21859,"as":"Zenlayer Inc","country":"Hong Kong","country_code":"HK"},"final":{"url":{"schema":"https","addr":"schwbai.com/","fqdn":"schwbai.com","domain":"schwbai.com","tld":"com"},"title":"कर दंड सूचना - भारत सरकार","dom":{"size":18072,"mime_type":"text/html; charset=utf-8","magic":"HTML document, Unicode text, UTF-8 text, with very long lines (415)","md5":"de34b2af6a5a5ec50cb298677c1c1b26","sha1":"886e203ddad9f20caab1a8872bd821c449373a17","sha256":"2400c8674aa022d455c0e605d182a2ae42a40ec9848a86b75e57ee96fca3704a","sha512":"978a41b649addd63c1f6e08b593f5373fb45f0ff13756c4614ce74e42d2199f8ba86ddbe0ec20d056b4958ab0419f79d41e6355fc59c1edfd70c48ed1a5a5a5b","ssdeep":"192:h3sNVU+hQhCv8s2VqXlXTQiD8VyJnTTuK3ayyMcmMy6rjTpkn4rPx1z+/b8mf2Xc:8O+6s3F3yM2pkn4bx1z+/b8tnSiYkn2","tlshash":"f082731ee7f322212417b46837a7473736a59023d60bc9253edca398df86de1996335c","dom_hash":"domhashadec9bebd9ec3b1160d0b2acc356dff3","first_seen":"2026-09-27T00:35:07.238028Z","last_seen":"2026-09-27T03:35:14.289479Z","times_seen":3,"resource_available":false,"data":null}},"submit":{"url":{"schema":"http","addr":"schwbai.com/","fqdn":"schwbai.com","domain":"schwbai.com","tld":"com"},"ip":{"addr":"103.122.177.57","port":0,"asn":21859,"as":"Zenlayer Inc","country":"Hong Kong","country_code":"HK"},"tags":null,"meta":null},"settings":{"access":"public","device_type":"desktop","expires_at":"2027-11-01T03:35:13Z","useragent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0","referer":"","cookies":null,"exit_node":"31pu2ilhjrkmwpf"},"stats":{"alert_count":{"ids":0,"urlquery":0,"analyzer":4}},"detection":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-09-27","alert":"Sinkholed","trigger":"schwbai.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-09-27","alert":"Phishing Block","trigger":"schwbai.com","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-27","alert":"Sinkholed","trigger":"schwbai.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-09-27","alert":"Sinkholed","trigger":"schwbai.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null}],"urlquery":null},"summary":[{"fqdn":"schwbai.com","ip":{"addr":"103.122.177.57","port":443,"asn":21859,"as":"ZEN-ECN","country":"Hong Kong","country_code":"HK"},"domain_registered":"2025-12-31","domain_rank":0,"first_seen":"2026-08-29T00:40:24.363409Z","last_seen":"2026-09-27T00:35:03.93013Z","alert_count":24,"request_count":6,"received_data":206268,"sent_data":2903,"comment":"","tags":null,"fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Vue.js","description":"Vue.js is an open-source model–view–viewmodel JavaScript framework for building user interfaces and single-page applications.","website":"https://vuejs.org","common_platform_enumeration":"","icon":"vue.svg","categories":["JavaScript frameworks"]},{"name":"Cloudflare Browser Insights","description":"Cloudflare Browser Insights is a tool that measures the performance of websites from the perspective of users.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["Analytics","RUM"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}]}],"files":null,"artifacts":{"windows_shortcuts":null,"files":null,"telegram":null,"pdfs":null,"clipboard":null},"sensors":{"ids":null,"analyzer":null,"urlquery":null},"javascript":{"script":[{"url":{"schema":"https","addr":"schwbai.com/","fqdn":"schwbai.com","domain":"schwbai.com","tld":"com"},"ip":{"addr":"103.122.177.57","port":443,"asn":21859,"as":"ZEN-ECN","country":"Hong Kong","country_code":"HK"},"introduction_type":"scriptElement","is_inline":true,"md5":"f7a3509932a150095ba643ea39e36b65","sha1":"beace326b16584e45ef23d4983c02901fccdccac","sha256":"6a0239f774db863280866ae1ea115bc95b480413f4bc5fc7a5e6033ed0e911b2","sha512":"fd49e8d38e0f808bb48e57f9e049ab6c4e50f48697b139b1de466c8cd6f96a43e124e567df5663b0f227d40a2e1375e1987bd769c85f95b2d677a8e168c65b5f","ssdeep":"","tlshash":"0461561ef1b3112241373869675f9261367190277885c982bf4d8bc07f83eb18573dad","size":3457,"data":"","first_seen":"2026-09-27T00:35:07.242639Z","last_seen":"2026-09-27T03:35:14.292251Z","times_seen":3,"alerts":{"ids":null,"analyzer":null,"urlquery":null}}],"eval":null,"write":null,"console":null},"http":[{"url":{"schema":"https","addr":"schwbai.com/","fqdn":"schwbai.com","domain":"schwbai.com","tld":"com"},"ip":{"addr":"103.122.177.57","port":443,"asn":21859,"as":"ZEN-ECN","country":"Hong Kong","country_code":"HK"},"is_navigation_request":true,"resource_type":"document","requested_by":"","date":"2026-09-27T03:34:43.734Z","timestamp":1790480083734,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"www.schwbai.com","organization":""},"issuer":{"commonName":"LiteSSL RSA CA 2025","organization":"TrustAsia Technologies, Inc."},"validity":{"start":"Thu, 20 Aug 2026 05:00:00 GMT","end":"Wed, 18 Nov 2026 04:59:59 GMT"},"fingerprint":{"sha1":"CB:12:FB:D5:F4:A1:85:76:0C:E3:73:6E:EA:92:FD:1F:9D:35:5F:BA","sha256":"17:9D:ED:B6:A5:B8:25:C1:6F:6D:C7:34:5E:B9:2E:34:34:BD:AE:64:05:BF:6E:02:D7:7E:3F:7F:E4:59:C5:2E"}}},"request":{"raw":"GET / HTTP/1.1\r\nHost: schwbai.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nUpgrade-Insecure-Requests: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: document\r\nSec-Fetch-Mode: navigate\r\nSec-Fetch-Site: none\r\nPriority: u=0, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nserver: nginx\r\ndate: Sun, 27 Sep 2026 03:34:41 GMT\r\ncontent-type: text/html\r\nlast-modified: Mon, 31 Aug 2026 03:44:59 GMT\r\nvary: Accept-Encoding\r\netag: W/\"6a94f8bb-31846\"\r\nstrict-transport-security: max-age=31536000\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Vue.js","description":"Vue.js is an open-source model–view–viewmodel JavaScript framework for building user interfaces and single-page applications.","website":"https://vuejs.org","common_platform_enumeration":"","icon":"vue.svg","categories":["JavaScript frameworks"]},{"name":"Cloudflare Browser Insights","description":"Cloudflare Browser Insights is a tool that measures the performance of websites from the perspective of users.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["Analytics","RUM"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":202822,"size_decoded":74508,"mime_type":"text/html","magic":"HTML document, Unicode text, UTF-8 text, with very long lines (47528)","md5":"bf659127518a917617d518777f2cd164","sha1":"b212bd98f4bb11cd805ac920aca24e0ff8187393","sha256":"757533a206011bac28377c60488ff95270bc1c1c320d64e0abf2a3faaed6f9c0","sha512":"e711751f1f09a2d1b42d1a6b744dbb6c7309417379e3559b6249bf9f759bb1746b101733cd1ad5f8349ba72c304ec246de657049b14e4e6141c976c7fd4df779","ssdeep":"3072:BzRxste4NKxyAkPw6nKdhQjEtwtLFLiM+k3W54:BFzt0AI3AhQjEtwtLgb54","tlshash":"92147e71636c111c786f917efa207059231fa0bbf64689e4356e63349f43edaea839d0","first_seen":"2026-09-27T00:35:07.241105Z","last_seen":"2026-09-27T03:35:14.290519Z","times_seen":3,"resource_available":true,"data":null}},"time_used":648,"timings":{"blocked":-1,"dns":3,"connect":210,"send":0,"wait":209,"receive":0,"ssl":225},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-09-27","alert":"Sinkholed","trigger":"schwbai.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-09-27","alert":"Phishing Block","trigger":"schwbai.com","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-27","alert":"Sinkholed","trigger":"schwbai.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-09-27","alert":"Sinkholed","trigger":"schwbai.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"schwbai.com/123.png","fqdn":"schwbai.com","domain":"schwbai.com","tld":"com"},"ip":{"addr":"103.122.177.57","port":443,"asn":21859,"as":"ZEN-ECN","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://schwbai.com/","date":"2026-09-27T03:34:45.069Z","timestamp":1790480085069,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"www.schwbai.com","organization":""},"issuer":{"commonName":"LiteSSL RSA CA 2025","organization":"TrustAsia Technologies, Inc."},"validity":{"start":"Thu, 20 Aug 2026 05:00:00 GMT","end":"Wed, 18 Nov 2026 04:59:59 GMT"},"fingerprint":{"sha1":"CB:12:FB:D5:F4:A1:85:76:0C:E3:73:6E:EA:92:FD:1F:9D:35:5F:BA","sha256":"17:9D:ED:B6:A5:B8:25:C1:6F:6D:C7:34:5E:B9:2E:34:34:BD:AE:64:05:BF:6E:02:D7:7E:3F:7F:E4:59:C5:2E"}}},"request":{"raw":"GET /123.png HTTP/1.1\r\nHost: schwbai.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://schwbai.com/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=4, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 404 \r\nserver: nginx\r\ndate: Sun, 27 Sep 2026 03:34:42 GMT\r\ncontent-type: text/html\r\ncontent-length: 479\r\netag: \"6a869b41-1df\"\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"404","status_text":"Not Found","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":479,"size_decoded":634,"mime_type":"text/html","magic":"HTML document, Unicode text, UTF-8 text","md5":"57dd7bfa6c07bfe5eeada45d4bdd78ec","sha1":"395c6ad5c3ae0e8ea47281f5007c369551b32ad7","sha256":"c870990950ca5802e260be6786d1e6a148b1acdfeed4fa9bb6acce744488c0b5","sha512":"c455d00381bde372d6016e7b01eb8682dcbc2fbb032ef522f01f0ea1cd85abeb962aeb8de621b49b138b614b14285686a2c432b4214630f23fda2ed19bf4b9d6","ssdeep":"","tlshash":"27f0dc93d243040e220c45702fb2702450877ddbcb9a0d028897e1bfccd5a698363bad","first_seen":"2023-04-28T05:56:14Z","last_seen":"2026-09-27T03:35:14.291503Z","times_seen":3753,"resource_available":true,"data":null}},"time_used":208,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":208,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-09-27","alert":"Phishing Block","trigger":"schwbai.com","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-27","alert":"Sinkholed","trigger":"schwbai.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-09-27","alert":"Sinkholed","trigger":"schwbai.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-09-27","alert":"Sinkholed","trigger":"schwbai.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"schwbai.com/visit_20260213.php?_t=1790480085281","fqdn":"schwbai.com","domain":"schwbai.com","tld":"com"},"ip":{"addr":"103.122.177.57","port":443,"asn":21859,"as":"ZEN-ECN","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"beacon","requested_by":"https://schwbai.com/","date":"2026-09-27T03:34:45.282Z","timestamp":1790480085282,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"www.schwbai.com","organization":""},"issuer":{"commonName":"LiteSSL RSA CA 2025","organization":"TrustAsia Technologies, Inc."},"validity":{"start":"Thu, 20 Aug 2026 05:00:00 GMT","end":"Wed, 18 Nov 2026 04:59:59 GMT"},"fingerprint":{"sha1":"CB:12:FB:D5:F4:A1:85:76:0C:E3:73:6E:EA:92:FD:1F:9D:35:5F:BA","sha256":"17:9D:ED:B6:A5:B8:25:C1:6F:6D:C7:34:5E:B9:2E:34:34:BD:AE:64:05:BF:6E:02:D7:7E:3F:7F:E4:59:C5:2E"}}},"request":{"raw":"POST /visit_20260213.php?_t=1790480085281 HTTP/1.1\r\nHost: schwbai.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nOrigin: https://schwbai.com\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://schwbai.com/\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=6\r\nContent-Length: 0\r\n\r\n","headers":null,"cookies":null,"method":"POST"},"response":{"raw":"HTTP/2 404 \r\nserver: nginx\r\ndate: Sun, 27 Sep 2026 03:34:42 GMT\r\ncontent-type: text/html\r\ncontent-length: 479\r\netag: \"6a869b41-1df\"\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"404","status_text":"Not Found","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":479,"size_decoded":634,"mime_type":"text/html","magic":"HTML document, Unicode text, UTF-8 text","md5":"57dd7bfa6c07bfe5eeada45d4bdd78ec","sha1":"395c6ad5c3ae0e8ea47281f5007c369551b32ad7","sha256":"c870990950ca5802e260be6786d1e6a148b1acdfeed4fa9bb6acce744488c0b5","sha512":"c455d00381bde372d6016e7b01eb8682dcbc2fbb032ef522f01f0ea1cd85abeb962aeb8de621b49b138b614b14285686a2c432b4214630f23fda2ed19bf4b9d6","ssdeep":"","tlshash":"27f0dc93d243040e220c45702fb2702450877ddbcb9a0d028897e1bfccd5a698363bad","first_seen":"2023-04-28T05:56:14Z","last_seen":"2026-09-27T03:35:14.291503Z","times_seen":3753,"resource_available":true,"data":null}},"time_used":208,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":208,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-27","alert":"Sinkholed","trigger":"schwbai.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-09-27","alert":"Sinkholed","trigger":"schwbai.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-09-27","alert":"Sinkholed","trigger":"schwbai.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-09-27","alert":"Phishing Block","trigger":"schwbai.com","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"schwbai.com/favicon.ico","fqdn":"schwbai.com","domain":"schwbai.com","tld":"com"},"ip":{"addr":"103.122.177.57","port":443,"asn":21859,"as":"ZEN-ECN","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://schwbai.com/","date":"2026-09-27T03:34:45.298Z","timestamp":1790480085298,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"www.schwbai.com","organization":""},"issuer":{"commonName":"LiteSSL RSA CA 2025","organization":"TrustAsia Technologies, Inc."},"validity":{"start":"Thu, 20 Aug 2026 05:00:00 GMT","end":"Wed, 18 Nov 2026 04:59:59 GMT"},"fingerprint":{"sha1":"CB:12:FB:D5:F4:A1:85:76:0C:E3:73:6E:EA:92:FD:1F:9D:35:5F:BA","sha256":"17:9D:ED:B6:A5:B8:25:C1:6F:6D:C7:34:5E:B9:2E:34:34:BD:AE:64:05:BF:6E:02:D7:7E:3F:7F:E4:59:C5:2E"}}},"request":{"raw":"GET /favicon.ico HTTP/1.1\r\nHost: schwbai.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://schwbai.com/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=6\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 404 \r\nserver: nginx\r\ndate: Sun, 27 Sep 2026 03:34:42 GMT\r\ncontent-type: text/html\r\ncontent-length: 479\r\netag: \"6a869b41-1df\"\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"404","status_text":"Not Found","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":479,"size_decoded":634,"mime_type":"text/html","magic":"HTML document, Unicode text, UTF-8 text","md5":"57dd7bfa6c07bfe5eeada45d4bdd78ec","sha1":"395c6ad5c3ae0e8ea47281f5007c369551b32ad7","sha256":"c870990950ca5802e260be6786d1e6a148b1acdfeed4fa9bb6acce744488c0b5","sha512":"c455d00381bde372d6016e7b01eb8682dcbc2fbb032ef522f01f0ea1cd85abeb962aeb8de621b49b138b614b14285686a2c432b4214630f23fda2ed19bf4b9d6","ssdeep":"","tlshash":"27f0dc93d243040e220c45702fb2702450877ddbcb9a0d028897e1bfccd5a698363bad","first_seen":"2023-04-28T05:56:14Z","last_seen":"2026-09-27T03:35:14.291503Z","times_seen":3753,"resource_available":true,"data":null}},"time_used":208,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":208,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-27","alert":"Sinkholed","trigger":"schwbai.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-09-27","alert":"Phishing Block","trigger":"schwbai.com","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-09-27","alert":"Sinkholed","trigger":"schwbai.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-09-27","alert":"Sinkholed","trigger":"schwbai.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"schwbai.com/cdn-cgi/scripts/5c5dd728/cloudflare-static/email-decode.min.js","fqdn":"schwbai.com","domain":"schwbai.com","tld":"com"},"ip":{"addr":"103.122.177.57","port":443,"asn":21859,"as":"ZEN-ECN","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://schwbai.com/","date":"2026-09-27T03:34:45.063Z","timestamp":1790480085063,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"www.schwbai.com","organization":""},"issuer":{"commonName":"LiteSSL RSA CA 2025","organization":"TrustAsia Technologies, Inc."},"validity":{"start":"Thu, 20 Aug 2026 05:00:00 GMT","end":"Wed, 18 Nov 2026 04:59:59 GMT"},"fingerprint":{"sha1":"CB:12:FB:D5:F4:A1:85:76:0C:E3:73:6E:EA:92:FD:1F:9D:35:5F:BA","sha256":"17:9D:ED:B6:A5:B8:25:C1:6F:6D:C7:34:5E:B9:2E:34:34:BD:AE:64:05:BF:6E:02:D7:7E:3F:7F:E4:59:C5:2E"}}},"request":{"raw":"GET /cdn-cgi/scripts/5c5dd728/cloudflare-static/email-decode.min.js HTTP/1.1\r\nHost: schwbai.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://schwbai.com/\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 404 \r\nserver: nginx\r\ndate: Sun, 27 Sep 2026 03:34:42 GMT\r\ncontent-type: text/html\r\ncontent-length: 479\r\netag: \"6a869b41-1df\"\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"404","status_text":"Not Found","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":479,"size_decoded":634,"mime_type":"text/html","magic":"HTML document, Unicode text, UTF-8 text","md5":"57dd7bfa6c07bfe5eeada45d4bdd78ec","sha1":"395c6ad5c3ae0e8ea47281f5007c369551b32ad7","sha256":"c870990950ca5802e260be6786d1e6a148b1acdfeed4fa9bb6acce744488c0b5","sha512":"c455d00381bde372d6016e7b01eb8682dcbc2fbb032ef522f01f0ea1cd85abeb962aeb8de621b49b138b614b14285686a2c432b4214630f23fda2ed19bf4b9d6","ssdeep":"","tlshash":"27f0dc93d243040e220c45702fb2702450877ddbcb9a0d028897e1bfccd5a698363bad","first_seen":"2023-04-28T05:56:14Z","last_seen":"2026-09-27T03:35:14.291503Z","times_seen":3753,"resource_available":true,"data":null}},"time_used":208,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":208,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-09-27","alert":"Sinkholed","trigger":"schwbai.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-09-27","alert":"Sinkholed","trigger":"schwbai.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-27","alert":"Sinkholed","trigger":"schwbai.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-09-27","alert":"Phishing Block","trigger":"schwbai.com","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"schwbai.com/111.png","fqdn":"schwbai.com","domain":"schwbai.com","tld":"com"},"ip":{"addr":"103.122.177.57","port":443,"asn":21859,"as":"ZEN-ECN","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://schwbai.com/","date":"2026-09-27T03:34:45.070Z","timestamp":1790480085070,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"www.schwbai.com","organization":""},"issuer":{"commonName":"LiteSSL RSA CA 2025","organization":"TrustAsia Technologies, Inc."},"validity":{"start":"Thu, 20 Aug 2026 05:00:00 GMT","end":"Wed, 18 Nov 2026 04:59:59 GMT"},"fingerprint":{"sha1":"CB:12:FB:D5:F4:A1:85:76:0C:E3:73:6E:EA:92:FD:1F:9D:35:5F:BA","sha256":"17:9D:ED:B6:A5:B8:25:C1:6F:6D:C7:34:5E:B9:2E:34:34:BD:AE:64:05:BF:6E:02:D7:7E:3F:7F:E4:59:C5:2E"}}},"request":{"raw":"GET /111.png HTTP/1.1\r\nHost: schwbai.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://schwbai.com/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=4, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 404 \r\nserver: nginx\r\ndate: Sun, 27 Sep 2026 03:34:42 GMT\r\ncontent-type: text/html\r\ncontent-length: 479\r\netag: \"6a869b41-1df\"\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"404","status_text":"Not Found","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":479,"size_decoded":634,"mime_type":"text/html","magic":"HTML document, Unicode text, UTF-8 text","md5":"57dd7bfa6c07bfe5eeada45d4bdd78ec","sha1":"395c6ad5c3ae0e8ea47281f5007c369551b32ad7","sha256":"c870990950ca5802e260be6786d1e6a148b1acdfeed4fa9bb6acce744488c0b5","sha512":"c455d00381bde372d6016e7b01eb8682dcbc2fbb032ef522f01f0ea1cd85abeb962aeb8de621b49b138b614b14285686a2c432b4214630f23fda2ed19bf4b9d6","ssdeep":"","tlshash":"27f0dc93d243040e220c45702fb2702450877ddbcb9a0d028897e1bfccd5a698363bad","first_seen":"2023-04-28T05:56:14Z","last_seen":"2026-09-27T03:35:14.291503Z","times_seen":3753,"resource_available":true,"data":null}},"time_used":216,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":216,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-09-27","alert":"Phishing Block","trigger":"schwbai.com","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-09-27","alert":"Sinkholed","trigger":"schwbai.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-27","alert":"Sinkholed","trigger":"schwbai.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-09-27","alert":"Sinkholed","trigger":"schwbai.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}}]}