{"report_id":"3060f02e-bf72-418e-92cc-2f11a0e68a73","version":6,"status":"done","tags":[],"date":"2025-10-21T09:59:13Z","url":{"schema":"https","addr":"whattusiapp.com/","fqdn":"whattusiapp.com","domain":"whattusiapp.com","tld":"com"},"ip":{"addr":"103.135.101.176","port":0,"asn":150452,"as":"LANDUPS LIMITED","country":"Hong Kong","country_code":"HK"},"final":{"url":{"schema":"https","addr":"whattusiapp.com/","fqdn":"whattusiapp.com","domain":"whattusiapp.com","tld":"com"},"title":"WhatsApp网页版"},"submit":{"url":{"schema":"https","addr":"whattusiapp.com/","fqdn":"whattusiapp.com","domain":"whattusiapp.com","tld":"com"},"ip":{"addr":"103.135.101.176","port":0,"asn":150452,"as":"LANDUPS LIMITED","country":"Hong Kong","country_code":"HK"},"tags":["openphish"],"meta":null},"settings":{"access":"public","device_type":"desktop","expires_at":"2026-11-25T09:59:13Z","useragent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0","referer":"","cookies":null,"exit_node":"z0yflva4pidy47h"},"stats":{"alert_count":{"ids":0,"urlquery":0,"analyzer":5}},"detection":{"ids":null,"analyzer":[{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2025-10-21","alert":"Sinkholed","trigger":"whattusiapp.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-10-21","alert":"Sinkholed","trigger":"whattusiapp.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2025-10-21","alert":"Phishing Block","trigger":"whattusiapp.com","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"cira_dns","sensor_type":"DNS","title":"CIRA Canadian Shield DNS","description":"CIRA Canadian Shield DNS","scan_date":"2025-10-21","alert":"Sinkholed","trigger":"whattusiapp.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cira.ca/en/canadian-shield/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2025-10-21","alert":"Sinkholed","trigger":"whattusiapp.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null},"summary":[{"fqdn":"whattusiapp.com","ip":{"addr":"103.135.101.176","port":443,"asn":150452,"as":"LANDUPS LIMITED","country":"Hong Kong","country_code":"HK"},"domain_registered":"2025-09-12","domain_rank":0,"first_seen":"2025-10-21T01:36:33.057875Z","last_seen":"2025-10-21T01:36:33.057875Z","alert_count":30,"request_count":6,"received_data":306272,"sent_data":2628,"comment":"","tags":null,"fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}]}],"files":null,"artifacts":{"windows_shortcuts":null,"files":null,"telegram":null,"pdfs":null,"clipboard":null},"sensors":{"ids":[{"sensor_name":"suricata","description":"Suricata /w Emerging Threats Pro","alerts":null}],"analyzer":null,"urlquery":null},"javascript":{"script":[{"url":{"schema":"https","addr":"whattusiapp.com/","fqdn":"whattusiapp.com","domain":"whattusiapp.com","tld":"com"},"ip":{"addr":"103.135.101.176","port":443,"asn":150452,"as":"LANDUPS LIMITED","country":"Hong Kong","country_code":"HK"},"introduction_type":"scriptElement","is_inline":true,"md5":"aa7cef1a904ca14647b37bd1ad51b269","sha1":"4b7f611f928f98a7335f38856fe63d59f879d858","sha256":"55aff3df3f40ed3e41acf52e0e6cac1a6e7199e751a50fbba9c06dcf4f8aa86b","sha512":"2f82622cf7b0e2cc1049b99ac94e13f6ea9bf33c77020931b535e158bba2f5cc9234732906ad7ae29a9d009e0144b4c0322527d0c74174df1c977f57df9c6f62","ssdeep":"","tlshash":"6490022218c61923942654699b174444e2a70901455aa79a7155079d1f4642960001c9","size":53,"data":"","first_seen":"2025-08-22T01:42:23.37034Z","last_seen":"2025-12-06T16:32:10.112233Z","times_seen":12,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"whattusiapp.com/index-SNpGiV69.js","fqdn":"whattusiapp.com","domain":"whattusiapp.com","tld":"com"},"ip":{"addr":"103.135.101.176","port":443,"asn":150452,"as":"LANDUPS LIMITED","country":"Hong Kong","country_code":"HK"},"introduction_type":"scriptElement","is_inline":false,"md5":"d36478e869ec212f9a88a6f7feacd01a","sha1":"f8f11a848e98885b3ae7de2bf307331ccd6e85f7","sha256":"637497d90e5a12dee24930ecd4f6b9ad4d948cf5186f0900143327b1c55d6a8d","sha512":"eb22742b707609e001d0e3a6131d8adf33fe7019e9c4c216bbecd23268ef4967c5a2fbf8f69538dba4e1088490fbb3cdeef64d13c4c02cd77d5ff63a58c16363","ssdeep":"1536:EF4a6kYrkousDg7Xbjwfav7WctTvpy2dHTEdQEpQsJwltXc7az:ERYMwfattTzjsJOZZ","tlshash":"d8e3a39522f630344117f1be4a1bc8197329681b3e89fe8a7a8c52945f0d53ca7f6fc9","size":147199,"data":"","first_seen":"2025-08-22T01:42:23.357664Z","last_seen":"2025-12-06T16:32:10.108351Z","times_seen":9,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"whattusiapp.com/qrcode.min.js","fqdn":"whattusiapp.com","domain":"whattusiapp.com","tld":"com"},"ip":{"addr":"103.135.101.176","port":443,"asn":150452,"as":"LANDUPS LIMITED","country":"Hong Kong","country_code":"HK"},"introduction_type":"scriptElement","is_inline":false,"md5":"5442b56f6455138fceb49a64081973b2","sha1":"3786748730cb2c7eeab92414874805956bef6c00","sha256":"68b0def204d75f4028112892c3061eb7a0719813b6bef4ea44c80764bf265dbf","sha512":"22d53514cb70abdef3bb02ebf5fbac2505479f650248bb58c28631776c1e7a72ebf1efb1aba127db11a30ef994273412de0774354fc2487c7178a9664b189f09","ssdeep":"768:xOWzO/7LTRkJF9F/D8CcgJ2Qv86JsF70DWjX81:K/PT6rRYMUQNu2DUM","tlshash":"b413110a6fe72138a223f07c4b5f9805b639a41b1e4dfd057e4c52909f5993c93b8eac","size":42323,"data":"","first_seen":"2025-08-22T01:42:23.366189Z","last_seen":"2025-12-06T16:32:10.104297Z","times_seen":12,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"whattusiapp.com/console.ban.min.js","fqdn":"whattusiapp.com","domain":"whattusiapp.com","tld":"com"},"ip":{"addr":"103.135.101.176","port":443,"asn":150452,"as":"LANDUPS LIMITED","country":"Hong Kong","country_code":"HK"},"introduction_type":"scriptElement","is_inline":false,"md5":"e7034982e625176579f875878637a896","sha1":"fb259a74ded030cc83f278c06f144e88fee9d883","sha256":"1d10ef600961cc2ca466d6033998d0eb2957bf4935775f4389f74db77ce20304","sha512":"5cd1255e690b155d932a2adbe5f33f7dc7952c58656ee216de6454a59f30dcf0eb40a41601746c7f2cd18b87775814974e15b7190cbb31bf5c5225609a044f85","ssdeep":"96:YUlsWg26K+S0Bvi75+eciwWVC3hZK/sMRTePiZI9Gn:M9MIviNxLoKEMQP5s","tlshash":"75b18999ab9460a0b533b372cc2fa505f972052f02aac2417dacd2e84f75529477dfec","size":5389,"data":"","first_seen":"2025-08-22T01:42:23.36357Z","last_seen":"2025-10-24T00:27:00.462494Z","times_seen":5,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"whattusiapp.com/","fqdn":"whattusiapp.com","domain":"whattusiapp.com","tld":"com"},"ip":{"addr":"103.135.101.176","port":443,"asn":150452,"as":"LANDUPS LIMITED","country":"Hong Kong","country_code":"HK"},"introduction_type":"Function","is_inline":false,"md5":"572cb94037fffc2a0a53b465972e15f1","sha1":"0d679b041a7c1ca45cc99e2d229fc2b86762838d","sha256":"6487e4bdd0f51bbfd9105810a41755847fdae2c274e2fc325cd22356d7707e35","sha512":"f7c4db7986d362b58ff4b4646cdeb71992c0ce28949773c4471915f2cc8828329445777e228ef248f508f721a33dfea3d5694bc7ec18dc6c00134ee23155ff32","ssdeep":"","tlshash":"e3800455714110004f57115050171c444030007155407cc011c0d4710d51030110545c","size":34,"data":"","first_seen":"2023-04-11T21:16:40Z","last_seen":"2026-08-08T06:08:34.61459Z","times_seen":91425,"alerts":{"ids":null,"analyzer":null,"urlquery":null}}],"eval":null,"write":null,"console":null},"http":[{"url":{"schema":"https","addr":"whattusiapp.com/","fqdn":"whattusiapp.com","domain":"whattusiapp.com","tld":"com"},"ip":{"addr":"103.135.101.176","port":443,"asn":150452,"as":"LANDUPS LIMITED","country":"Hong Kong","country_code":"HK"},"is_navigation_request":true,"resource_type":"document","requested_by":"","date":"2025-10-21T09:58:50.103Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"whattusiapp.com","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Mon, 13 Oct 2025 06:31:45 GMT","end":"Sun, 11 Jan 2026 06:31:44 GMT"},"fingerprint":{"sha1":"56:EF:05:6D:B5:DA:E3:9C:10:61:DF:82:DA:EE:77:FB:CD:8A:3F:C0","sha256":"0F:3B:A5:39:15:C0:20:ED:9C:73:F9:19:AA:D9:6C:AE:34:49:2E:3C:55:B2:0A:DB:CE:68:69:AD:30:EA:62:45"}}},"request":{"raw":"GET / HTTP/1.1\r\nHost: whattusiapp.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nUpgrade-Insecure-Requests: 1\r\nSec-Fetch-Dest: document\r\nSec-Fetch-Mode: navigate\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Tue, 21 Oct 2025 09:58:51 GMT\r\ncontent-type: text/html; charset=UTF-8\r\nvary: Accept-Encoding\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: quic=\":443\"; h3=\":443\"; h3-29=\":443\"; h3-27=\":443\";h3-25=\":443\"; h3-T050=\":443\"; h3-Q050=\":443\";h3-Q049=\":443\";h3-Q048=\":443\"; h3-Q046=\":443\"; h3-Q043=\":443\"\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":4957,"size_decoded":0,"mime_type":"text/html; charset=UTF-8","magic":"HTML document, Unicode text, UTF-8 text","md5":"ffede92503d570e5a61c6e3f90df530e","sha1":"60e19f14153c48169104a315b817e2d912a90a87","sha256":"46e54a77413841240b02755e6ea392d9323cf18e8fe01f69927449c6d745b5d6","sha512":"b4a9f9babc7f2cf194ff95bfe4a1d5885ad955444d3636ad7234ec3b97c549fe36302d060b8199ff6d722d85e4beab396d59f758ac75c5f7764572d065429ddc","ssdeep":"96:1mNbcKIDmnNXpzLfja3WyBVlB3ATOb8mmKAldo5cALul:INbcHDUpzLfjmBVlB3DUZkcAL2","tlshash":"1ea1749344b0b685493201662ca1a32e995ef94bf8696be1fde1483c3f846575c3374e","first_seen":"2025-10-21T01:36:37.38596Z","last_seen":"2025-10-21T09:59:14.813434Z","times_seen":2,"resource_available":false,"data":null}},"time_used":3777,"timings":{"blocked":1768,"dns":274,"connect":1251,"send":0,"wait":238,"receive":0,"ssl":244},"alerts":{"ids":null,"analyzer":[{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2025-10-21","alert":"Sinkholed","trigger":"whattusiapp.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-10-21","alert":"Sinkholed","trigger":"whattusiapp.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2025-10-21","alert":"Phishing Block","trigger":"whattusiapp.com","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"cira_dns","sensor_type":"DNS","title":"CIRA Canadian Shield DNS","description":"CIRA Canadian Shield DNS","scan_date":"2025-10-21","alert":"Sinkholed","trigger":"whattusiapp.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cira.ca/en/canadian-shield/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2025-10-21","alert":"Sinkholed","trigger":"whattusiapp.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"whattusiapp.com/index-SNpGiV69.js","fqdn":"whattusiapp.com","domain":"whattusiapp.com","tld":"com"},"ip":{"addr":"103.135.101.176","port":443,"asn":150452,"as":"LANDUPS LIMITED","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://whattusiapp.com/","date":"2025-10-21T09:58:52.281Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"whattusiapp.com","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Mon, 13 Oct 2025 06:31:45 GMT","end":"Sun, 11 Jan 2026 06:31:44 GMT"},"fingerprint":{"sha1":"56:EF:05:6D:B5:DA:E3:9C:10:61:DF:82:DA:EE:77:FB:CD:8A:3F:C0","sha256":"0F:3B:A5:39:15:C0:20:ED:9C:73:F9:19:AA:D9:6C:AE:34:49:2E:3C:55:B2:0A:DB:CE:68:69:AD:30:EA:62:45"}}},"request":{"raw":"GET /index-SNpGiV69.js HTTP/1.1\r\nHost: whattusiapp.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://whattusiapp.com/\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Tue, 21 Oct 2025 09:58:52 GMT\r\ncontent-type: application/javascript\r\nlast-modified: Mon, 13 Oct 2025 07:20:33 GMT\r\nvary: Accept-Encoding\r\netag: W/\"68eca841-23eff\"\r\nexpires: Tue, 21 Oct 2025 21:58:52 GMT\r\ncache-control: max-age=43200\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: quic=\":443\"; h3=\":443\"; h3-29=\":443\"; h3-27=\":443\";h3-25=\":443\"; h3-T050=\":443\"; h3-Q050=\":443\";h3-Q049=\":443\";h3-Q048=\":443\"; h3-Q046=\":443\"; h3-Q043=\":443\"\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":147199,"size_decoded":0,"mime_type":"application/javascript","magic":"JavaScript source, ASCII text","md5":"d36478e869ec212f9a88a6f7feacd01a","sha1":"f8f11a848e98885b3ae7de2bf307331ccd6e85f7","sha256":"637497d90e5a12dee24930ecd4f6b9ad4d948cf5186f0900143327b1c55d6a8d","sha512":"eb22742b707609e001d0e3a6131d8adf33fe7019e9c4c216bbecd23268ef4967c5a2fbf8f69538dba4e1088490fbb3cdeef64d13c4c02cd77d5ff63a58c16363","ssdeep":"1536:EF4a6kYrkousDg7Xbjwfav7WctTvpy2dHTEdQEpQsJwltXc7az:ERYMwfattTzjsJOZZ","tlshash":"d8e3a39522f630344117f1be4a1bc8197329681b3e89fe8a7a8c52945f0d53ca7f6fc9","first_seen":"2025-08-22T01:42:23.357664Z","last_seen":"2025-12-06T16:32:10.108351Z","times_seen":9,"resource_available":true,"data":null}},"time_used":484,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":484,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2025-10-21","alert":"Sinkholed","trigger":"whattusiapp.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2025-10-21","alert":"Phishing Block","trigger":"whattusiapp.com","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2025-10-21","alert":"Sinkholed","trigger":"whattusiapp.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"cira_dns","sensor_type":"DNS","title":"CIRA Canadian Shield DNS","description":"CIRA Canadian Shield DNS","scan_date":"2025-10-21","alert":"Sinkholed","trigger":"whattusiapp.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cira.ca/en/canadian-shield/","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-10-21","alert":"Sinkholed","trigger":"whattusiapp.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"whattusiapp.com/index-DdgEYXhi.css","fqdn":"whattusiapp.com","domain":"whattusiapp.com","tld":"com"},"ip":{"addr":"103.135.101.176","port":443,"asn":150452,"as":"LANDUPS LIMITED","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://whattusiapp.com/","date":"2025-10-21T09:58:52.282Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"whattusiapp.com","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Mon, 13 Oct 2025 06:31:45 GMT","end":"Sun, 11 Jan 2026 06:31:44 GMT"},"fingerprint":{"sha1":"56:EF:05:6D:B5:DA:E3:9C:10:61:DF:82:DA:EE:77:FB:CD:8A:3F:C0","sha256":"0F:3B:A5:39:15:C0:20:ED:9C:73:F9:19:AA:D9:6C:AE:34:49:2E:3C:55:B2:0A:DB:CE:68:69:AD:30:EA:62:45"}}},"request":{"raw":"GET /index-DdgEYXhi.css HTTP/1.1\r\nHost: whattusiapp.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://whattusiapp.com/\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Tue, 21 Oct 2025 09:58:52 GMT\r\ncontent-type: text/css\r\nlast-modified: Wed, 30 Apr 2025 02:13:36 GMT\r\nvary: Accept-Encoding\r\netag: W/\"68118750-18bec\"\r\nexpires: Tue, 21 Oct 2025 21:58:52 GMT\r\ncache-control: max-age=43200\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: quic=\":443\"; h3=\":443\"; h3-29=\":443\"; h3-27=\":443\";h3-25=\":443\"; h3-T050=\":443\"; h3-Q050=\":443\";h3-Q049=\":443\";h3-Q048=\":443\"; h3-Q046=\":443\"; h3-Q043=\":443\"\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":101356,"size_decoded":0,"mime_type":"text/css","magic":"Unicode text, UTF-8 text, with very long lines (47798), with CRLF line terminators","md5":"3f91e26b267bf48d2ada79f12f6458e3","sha1":"b0d546fbc6bdf98b3dcd33f3f8b88e7b070bf4d0","sha256":"79043051d2b46d04e3ba9bfb835b13e19bdafb29eb771be6da2bdf7f832db10a","sha512":"958fc6f2a5f3989b30486b65bcd28388a74862a077bf8864f492e7a319aa38a1210d6d4c2425c986f73b1bba9a20668c468329aee733ac116c145ea7fdcbcef7","ssdeep":"1536:ddM1MvMaMfMRQ6S81SOIdgJWt1U/Co3qpwhXX+hMmhNVbPuevg0aL:281S9M6+BX+9VbPxaL","tlshash":"d6a3a7216980265b74d28fbfc048bfb6edb3db5155a18087b13e0d427c998ad325fb36","first_seen":"2025-10-21T01:36:37.392534Z","last_seen":"2025-12-06T16:32:10.102756Z","times_seen":5,"resource_available":false,"data":null}},"time_used":719,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":719,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2025-10-21","alert":"Sinkholed","trigger":"whattusiapp.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2025-10-21","alert":"Sinkholed","trigger":"whattusiapp.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"cira_dns","sensor_type":"DNS","title":"CIRA Canadian Shield DNS","description":"CIRA Canadian Shield DNS","scan_date":"2025-10-21","alert":"Sinkholed","trigger":"whattusiapp.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cira.ca/en/canadian-shield/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2025-10-21","alert":"Phishing Block","trigger":"whattusiapp.com","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-10-21","alert":"Sinkholed","trigger":"whattusiapp.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"whattusiapp.com/console.ban.min.js","fqdn":"whattusiapp.com","domain":"whattusiapp.com","tld":"com"},"ip":{"addr":"103.135.101.176","port":443,"asn":150452,"as":"LANDUPS LIMITED","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://whattusiapp.com/","date":"2025-10-21T09:58:52.284Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"whattusiapp.com","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Mon, 13 Oct 2025 06:31:45 GMT","end":"Sun, 11 Jan 2026 06:31:44 GMT"},"fingerprint":{"sha1":"56:EF:05:6D:B5:DA:E3:9C:10:61:DF:82:DA:EE:77:FB:CD:8A:3F:C0","sha256":"0F:3B:A5:39:15:C0:20:ED:9C:73:F9:19:AA:D9:6C:AE:34:49:2E:3C:55:B2:0A:DB:CE:68:69:AD:30:EA:62:45"}}},"request":{"raw":"GET /console.ban.min.js HTTP/1.1\r\nHost: whattusiapp.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://whattusiapp.com/\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Tue, 21 Oct 2025 09:58:52 GMT\r\ncontent-type: application/javascript\r\nlast-modified: Wed, 30 Apr 2025 02:13:36 GMT\r\nvary: Accept-Encoding\r\netag: W/\"68118750-150d\"\r\nexpires: Tue, 21 Oct 2025 21:58:52 GMT\r\ncache-control: max-age=43200\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: quic=\":443\"; h3=\":443\"; h3-29=\":443\"; h3-27=\":443\";h3-25=\":443\"; h3-T050=\":443\"; h3-Q050=\":443\";h3-Q049=\":443\";h3-Q048=\":443\"; h3-Q046=\":443\"; h3-Q043=\":443\"\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":5389,"size_decoded":0,"mime_type":"application/javascript","magic":"JavaScript source, ASCII text, with CRLF line terminators","md5":"e7034982e625176579f875878637a896","sha1":"fb259a74ded030cc83f278c06f144e88fee9d883","sha256":"1d10ef600961cc2ca466d6033998d0eb2957bf4935775f4389f74db77ce20304","sha512":"5cd1255e690b155d932a2adbe5f33f7dc7952c58656ee216de6454a59f30dcf0eb40a41601746c7f2cd18b87775814974e15b7190cbb31bf5c5225609a044f85","ssdeep":"96:YUlsWg26K+S0Bvi75+eciwWVC3hZK/sMRTePiZI9Gn:M9MIviNxLoKEMQP5s","tlshash":"75b18999ab9460a0b533b372cc2fa505f972052f02aac2417dacd2e84f75529477dfec","first_seen":"2025-08-22T01:42:23.36357Z","last_seen":"2025-10-24T00:27:00.462494Z","times_seen":5,"resource_available":true,"data":null}},"time_used":718,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":718,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"cira_dns","sensor_type":"DNS","title":"CIRA Canadian Shield DNS","description":"CIRA Canadian Shield DNS","scan_date":"2025-10-21","alert":"Sinkholed","trigger":"whattusiapp.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cira.ca/en/canadian-shield/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2025-10-21","alert":"Sinkholed","trigger":"whattusiapp.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2025-10-21","alert":"Phishing Block","trigger":"whattusiapp.com","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2025-10-21","alert":"Sinkholed","trigger":"whattusiapp.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-10-21","alert":"Sinkholed","trigger":"whattusiapp.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"whattusiapp.com/qrcode.min.js","fqdn":"whattusiapp.com","domain":"whattusiapp.com","tld":"com"},"ip":{"addr":"103.135.101.176","port":443,"asn":150452,"as":"LANDUPS LIMITED","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://whattusiapp.com/","date":"2025-10-21T09:58:52.285Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"whattusiapp.com","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Mon, 13 Oct 2025 06:31:45 GMT","end":"Sun, 11 Jan 2026 06:31:44 GMT"},"fingerprint":{"sha1":"56:EF:05:6D:B5:DA:E3:9C:10:61:DF:82:DA:EE:77:FB:CD:8A:3F:C0","sha256":"0F:3B:A5:39:15:C0:20:ED:9C:73:F9:19:AA:D9:6C:AE:34:49:2E:3C:55:B2:0A:DB:CE:68:69:AD:30:EA:62:45"}}},"request":{"raw":"GET /qrcode.min.js HTTP/1.1\r\nHost: whattusiapp.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://whattusiapp.com/\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Tue, 21 Oct 2025 09:58:52 GMT\r\ncontent-type: application/javascript\r\nlast-modified: Wed, 30 Apr 2025 11:06:13 GMT\r\nvary: Accept-Encoding\r\netag: W/\"68120425-a553\"\r\nexpires: Tue, 21 Oct 2025 21:58:52 GMT\r\ncache-control: max-age=43200\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: quic=\":443\"; h3=\":443\"; h3-29=\":443\"; h3-27=\":443\";h3-25=\":443\"; h3-T050=\":443\"; h3-Q050=\":443\";h3-Q049=\":443\";h3-Q048=\":443\"; h3-Q046=\":443\"; h3-Q043=\":443\"\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":42323,"size_decoded":0,"mime_type":"application/javascript","magic":"JavaScript source, ASCII text","md5":"5442b56f6455138fceb49a64081973b2","sha1":"3786748730cb2c7eeab92414874805956bef6c00","sha256":"68b0def204d75f4028112892c3061eb7a0719813b6bef4ea44c80764bf265dbf","sha512":"22d53514cb70abdef3bb02ebf5fbac2505479f650248bb58c28631776c1e7a72ebf1efb1aba127db11a30ef994273412de0774354fc2487c7178a9664b189f09","ssdeep":"768:xOWzO/7LTRkJF9F/D8CcgJ2Qv86JsF70DWjX81:K/PT6rRYMUQNu2DUM","tlshash":"b413110a6fe72138a223f07c4b5f9805b639a41b1e4dfd057e4c52909f5993c93b8eac","first_seen":"2025-08-22T01:42:23.366189Z","last_seen":"2025-12-06T16:32:10.104297Z","times_seen":12,"resource_available":true,"data":null}},"time_used":718,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":718,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2025-10-21","alert":"Sinkholed","trigger":"whattusiapp.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2025-10-21","alert":"Sinkholed","trigger":"whattusiapp.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2025-10-21","alert":"Phishing Block","trigger":"whattusiapp.com","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"cira_dns","sensor_type":"DNS","title":"CIRA Canadian Shield DNS","description":"CIRA Canadian Shield DNS","scan_date":"2025-10-21","alert":"Sinkholed","trigger":"whattusiapp.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cira.ca/en/canadian-shield/","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-10-21","alert":"Sinkholed","trigger":"whattusiapp.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"whattusiapp.com/assets/iocn-C6ZmcESu.png","fqdn":"whattusiapp.com","domain":"whattusiapp.com","tld":"com"},"ip":{"addr":"103.135.101.176","port":443,"asn":150452,"as":"LANDUPS LIMITED","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://whattusiapp.com/","date":"2025-10-21T09:58:53.285Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"whattusiapp.com","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Mon, 13 Oct 2025 06:31:45 GMT","end":"Sun, 11 Jan 2026 06:31:44 GMT"},"fingerprint":{"sha1":"56:EF:05:6D:B5:DA:E3:9C:10:61:DF:82:DA:EE:77:FB:CD:8A:3F:C0","sha256":"0F:3B:A5:39:15:C0:20:ED:9C:73:F9:19:AA:D9:6C:AE:34:49:2E:3C:55:B2:0A:DB:CE:68:69:AD:30:EA:62:45"}}},"request":{"raw":"GET /assets/iocn-C6ZmcESu.png HTTP/1.1\r\nHost: whattusiapp.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://whattusiapp.com/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Tue, 21 Oct 2025 09:58:53 GMT\r\ncontent-type: image/png\r\nlast-modified: Wed, 30 Apr 2025 10:46:34 GMT\r\nvary: Accept-Encoding\r\netag: W/\"6811ff8a-7fb\"\r\nexpires: Thu, 20 Nov 2025 09:58:53 GMT\r\ncache-control: max-age=2592000\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: quic=\":443\"; h3=\":443\"; h3-29=\":443\"; h3-27=\":443\";h3-25=\":443\"; h3-T050=\":443\"; h3-Q050=\":443\";h3-Q049=\":443\";h3-Q048=\":443\"; h3-Q046=\":443\"; h3-Q043=\":443\"\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":2043,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 194 x 194, 8-bit colormap, non-interlaced","md5":"6bb288b8ba772471f23cee4f99b54c08","sha1":"f72bf6750892a25cc40b590bafb2038109bd77ad","sha256":"3899581abcfed9b40b7208bbbca8bdbfe3ae9655980dbf55f04dec9cb3309f27","sha512":"f63a442fd8a131c6b22d0a2a398d195dbc2a9c5a08a4d88c4959739df1be0df9aefa2605b11633d5ff58f40f8b8afdcc5a7b1caec31bf188a110691ec43c5350","ssdeep":"","tlshash":"26411825c7cdec6570e62c388961a3d4cc1481ed1601348a4d03d5168363e477ae82c7","first_seen":"2023-05-01T22:02:17Z","last_seen":"2026-07-30T22:20:57.335617Z","times_seen":3091,"resource_available":false,"data":null}},"time_used":237,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":237,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2025-10-21","alert":"Sinkholed","trigger":"whattusiapp.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2025-10-21","alert":"Sinkholed","trigger":"whattusiapp.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2025-10-21","alert":"Phishing Block","trigger":"whattusiapp.com","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"cira_dns","sensor_type":"DNS","title":"CIRA Canadian Shield DNS","description":"CIRA Canadian Shield DNS","scan_date":"2025-10-21","alert":"Sinkholed","trigger":"whattusiapp.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cira.ca/en/canadian-shield/","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-10-21","alert":"Sinkholed","trigger":"whattusiapp.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}}]}