{"report_id":"3589142f-a75f-4f53-85d6-aa27f570e60e","version":6,"status":"done","tags":[],"date":"2026-02-23T00:22:09Z","url":{"schema":"http","addr":"check.hotelsverifying.org","fqdn":"check.hotelsverifying.org","domain":"hotelsverifying.org","tld":"org"},"ip":{"addr":"62.60.226.85","port":0,"asn":215939,"as":"Valery Smoliar","country":"Iran","country_code":"IR"},"final":{"url":{"schema":"https","addr":"check.hotelsverifying.org/","fqdn":"check.hotelsverifying.org","domain":"hotelsverifying.org","tld":"org"},"title":"Booking Confirmation | Enter your reservation","dom":{"size":4486,"mime_type":"text/html; charset=utf-8","magic":"JavaScript source, Unicode text, UTF-8 text","md5":"2a8efceae715c0bf73271549596f1905","sha1":"40b5d9be69f2ee2ae4e87c14af974103f7b63522","sha256":"5af780b2aa358bb8f00b65ce12f36af5df1d7aa75ea04cafc7fd67a5d9cae3fc","sha512":"99997c0cf5352d9651073f9a49c48ecb12ea8e0c9ac19acb89ccc8452b915662d4731131deead810ecfd0545e44d46c9a303d7293066842c3acd06e4c338a067","ssdeep":"96:nCuILfjE95WWbpz52hk4BNmlo/ZfkMaiTQdyv:2rw95WWbpz52hFm2BfkMaiEdyv","tlshash":"6591987194f61a3b01a3826976eb661a7ee88407d50e81003dbd5b991fd2ed2cf372dc","dom_hash":"domhash8f91a5847dfcb14f48c9092e3fbc20a6","first_seen":"","last_seen":"","times_seen":0,"resource_available":false,"data":null}},"submit":{"url":{"schema":"http","addr":"check.hotelsverifying.org","fqdn":"check.hotelsverifying.org","domain":"hotelsverifying.org","tld":"org"},"ip":{"addr":"62.60.226.85","port":0,"asn":215939,"as":"Valery Smoliar","country":"Iran","country_code":"IR"},"tags":null,"meta":null},"settings":{"access":"public","device_type":"desktop","expires_at":"2027-03-30T00:22:09Z","useragent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0","referer":"","cookies":null,"exit_node":"z0yflva4pidy47h"},"stats":{"alert_count":{"ids":1,"urlquery":0,"analyzer":4}},"detection":{"ids":[{"sensor_name":"suricata","title":"Suricata IDS","description":"Suricata /w Emerging Threats Pro","date":"2026-02-23T00:21:40Z","timestamp":1771806100,"ip_dst":{"addr":"Client IP","port":39950,"asn":0,"as":"","country":"","country_code":"zz"},"ip_src":{"addr":"62.60.226.85","port":443,"asn":215939,"as":"Valery Smoliar","country":"Iran","country_code":"IR"},"severity":"medium","alert":"ET DROP Spamhaus DROP Listed Traffic Inbound group 8","source":"{\"timestamp\":\"2026-02-23T00:21:40.886413+0000\",\"flow_id\":1451568445794383,\"in_iface\":\"br-31613a7ed13b\",\"event_type\":\"alert\",\"src_ip\":\"62.60.226.85\",\"src_port\":443,\"dest_ip\":\"172.18.0.33\",\"dest_port\":39950,\"proto\":\"TCP\",\"metadata\":{\"flowbits\":[\"ET.Evil\",\"ET.DROPIP\"]},\"alert\":{\"action\":\"allowed\",\"gid\":1,\"signature_id\":2400007,\"rev\":4421,\"signature\":\"ET DROP Spamhaus DROP Listed Traffic Inbound group 8\",\"category\":\"Misc Attack\",\"severity\":2,\"metadata\":{\"affected_product\":[\"Any\"],\"attack_target\":[\"Any\"],\"created_at\":[\"2010_12_30\"],\"deployment\":[\"Perimeter\"],\"signature_severity\":[\"Minor\"],\"tag\":[\"Dshield\"],\"updated_at\":[\"2025_08_01\"]}},\"flow\":{\"pkts_toserver\":1,\"pkts_toclient\":1,\"bytes_toserver\":74,\"bytes_toclient\":74,\"start\":\"2026-02-23T00:21:40.862287+0000\"}}"}],"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-02-23","alert":"Sinkholed","trigger":"check.hotelsverifying.org","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-02-23","alert":"Phishing Block","trigger":"check.hotelsverifying.org","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-02-23","alert":"Sinkholed","trigger":"check.hotelsverifying.org","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-02-23","alert":"Sinkholed","trigger":"check.hotelsverifying.org","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null},"summary":[{"fqdn":"check.hotelsverifying.org","ip":{"addr":"62.60.226.85","port":443,"asn":215939,"as":"Valery Smoliar","country":"Iran","country_code":"IR"},"domain_registered":"2026-02-15","domain_rank":0,"first_seen":"2026-02-23T00:22:09.316485Z","last_seen":"2026-02-23T00:22:09.316485Z","alert_count":16,"request_count":4,"received_data":22987,"sent_data":2007,"comment":"","tags":null,"fingerprints":[{"name":"PHP","description":"PHP is a general-purpose scripting language used for web development.","website":"https://php.net","common_platform_enumeration":"cpe:2.3:a:php:php:*:*:*:*:*:*:*:*","icon":"PHP.svg","categories":["Programming languages"]},{"name":"Nginx:1.28.1","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}]}],"files":null,"artifacts":{"windows_shortcuts":null,"files":null,"telegram":null,"pdfs":null,"clipboard":null},"sensors":{"ids":null,"analyzer":null,"urlquery":null},"javascript":{"script":[{"url":{"schema":"https","addr":"check.hotelsverifying.org/","fqdn":"check.hotelsverifying.org","domain":"hotelsverifying.org","tld":"org"},"ip":{"addr":"62.60.226.85","port":443,"asn":215939,"as":"Valery Smoliar","country":"Iran","country_code":"IR"},"introduction_type":"scriptElement","is_inline":true,"md5":"2fa78d66321cda7d13709128a5c9d92e","sha1":"6e06d53caae635fe00e7b6a6eb7e3e2a6ab905dc","sha256":"14d51058cdd401fbc8354b792d3c8db74dccf3b0851034d2eb86c8b4c73d0a81","sha512":"ebc0ef498aa512441ad2c321787693423278ad410f7480b802d9b61929dcdcb58f0812dc05bd048502ccd9c30ea3bdf07bf56ba08502721e9f91af8d98e21546","ssdeep":"","tlshash":"14213daa29e71b3449fb613d77ef1114f13d60176808c9003e1c8b455fa1a659f39aac","size":1140,"data":"","first_seen":"2026-02-15T23:03:13.179243Z","last_seen":"2026-04-19T09:02:23.968676Z","times_seen":11,"alerts":{"ids":null,"analyzer":null,"urlquery":null}}],"eval":null,"write":null,"console":null},"http":[{"url":{"schema":"https","addr":"check.hotelsverifying.org/","fqdn":"check.hotelsverifying.org","domain":"hotelsverifying.org","tld":"org"},"ip":{"addr":"62.60.226.85","port":443,"asn":215939,"as":"Valery Smoliar","country":"Iran","country_code":"IR"},"is_navigation_request":true,"resource_type":"document","requested_by":"","date":"2026-02-23T00:21:40.742Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"check.hotelsverifying.org","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Thu, 19 Feb 2026 10:21:30 GMT","end":"Wed, 20 May 2026 10:21:29 GMT"},"fingerprint":{"sha1":"EC:09:B4:A9:C7:0B:58:9F:E6:F5:93:78:75:75:48:0A:87:D5:5A:BD","sha256":"D5:DA:33:5F:0C:1D:3C:49:D7:40:98:1E:50:6A:4A:51:B7:86:2A:2F:C7:B7:A8:36:57:8D:EC:84:0B:DF:1E:93"}}},"request":{"raw":"GET / HTTP/1.1\r\nHost: check.hotelsverifying.org\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nUpgrade-Insecure-Requests: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: document\r\nSec-Fetch-Mode: navigate\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nServer: nginx/1.28.1\r\nDate: Mon, 23 Feb 2026 00:21:40 GMT\r\nContent-Type: text/html; charset=UTF-8\r\nContent-Length: 1631\r\nConnection: keep-alive\r\nSet-Cookie: PHPSESSID=qift8kkfmi9a44jpt914f0vpni; path=/\r\nExpires: Thu, 19 Nov 1981 08:52:00 GMT\r\nCache-Control: no-store, no-cache, must-revalidate\r\nPragma: no-cache\r\nVary: Accept-Encoding\r\nContent-Encoding: gzip\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"PHP","description":"PHP is a general-purpose scripting language used for web development.","website":"https://php.net","common_platform_enumeration":"cpe:2.3:a:php:php:*:*:*:*:*:*:*:*","icon":"PHP.svg","categories":["Programming languages"]},{"name":"Nginx:1.28.1","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":4602,"size_decoded":0,"mime_type":"text/html; charset=UTF-8","magic":"HTML document, Unicode text, UTF-8 text, with CRLF line terminators","md5":"f2719b5c499d3f54ed39f526ebd81b68","sha1":"c236812c9f9e98df85515721676113458e283ff2","sha256":"279729258f8cafeff72a8f7342f20ca25a93525d45660bf30c01b88ee931ed20","sha512":"8af1747d471efb8489ad9c64b22ee6b9c17e503f89250dd6c35bf7bbaf71fb0076bc2877002c253f4ced97740061853f4490f59592736a310377f6fdc3c35a2b","ssdeep":"96:uuUXfcNEG51Wbaz53lvTDSmlBsfkenlJuc:ePcGG51Wbaz53lfSmrsfkenlkc","tlshash":"0091427194c52a3b01b38369a9ea6659ffe84113960681003ded679b1ff2e50cf236dc","first_seen":"2026-02-22T11:49:41.118228Z","last_seen":"2026-02-23T12:31:20.107765Z","times_seen":6,"resource_available":false,"data":null}},"time_used":384,"timings":{"blocked":177,"dns":120,"connect":24,"send":0,"wait":29,"receive":1,"ssl":29},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-02-23","alert":"Sinkholed","trigger":"check.hotelsverifying.org","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-02-23","alert":"Phishing Block","trigger":"check.hotelsverifying.org","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-02-23","alert":"Sinkholed","trigger":"check.hotelsverifying.org","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-02-23","alert":"Sinkholed","trigger":"check.hotelsverifying.org","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"check.hotelsverifying.org/main/main.css","fqdn":"check.hotelsverifying.org","domain":"hotelsverifying.org","tld":"org"},"ip":{"addr":"62.60.226.85","port":443,"asn":215939,"as":"Valery Smoliar","country":"Iran","country_code":"IR"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://check.hotelsverifying.org/","date":"2026-02-23T00:21:41.093Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"check.hotelsverifying.org","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Thu, 19 Feb 2026 10:21:30 GMT","end":"Wed, 20 May 2026 10:21:29 GMT"},"fingerprint":{"sha1":"EC:09:B4:A9:C7:0B:58:9F:E6:F5:93:78:75:75:48:0A:87:D5:5A:BD","sha256":"D5:DA:33:5F:0C:1D:3C:49:D7:40:98:1E:50:6A:4A:51:B7:86:2A:2F:C7:B7:A8:36:57:8D:EC:84:0B:DF:1E:93"}}},"request":{"raw":"GET /main/main.css HTTP/1.1\r\nHost: check.hotelsverifying.org\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://check.hotelsverifying.org/\r\nCookie: PHPSESSID=qift8kkfmi9a44jpt914f0vpni\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nServer: nginx/1.28.1\r\nDate: Mon, 23 Feb 2026 00:21:41 GMT\r\nContent-Type: text/css\r\nLast-Modified: Mon, 02 Feb 2026 14:50:12 GMT\r\nTransfer-Encoding: chunked\r\nConnection: keep-alive\r\nETag: W/\"6980b9a4-1c62\"\r\nContent-Encoding: gzip\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx:1.28.1","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":7266,"size_decoded":0,"mime_type":"text/css","magic":"Unicode text, UTF-8 text","md5":"70a82d2555b3a561ba5c6638528deca3","sha1":"2bd33db35416c9d029155d4ea192ab85f537a95f","sha256":"6682151e8b71f2641f9aea1f60d9f6bfe88eb1e9a86f4f9709c59f3bc19c65db","sha512":"521ac5acc071b82995e65e66cd96bfb2a558083c326b35548af181b4ec0df8b8817900ccb4ac771dffbff2a2d432e3f21e452975fd52e420b12bfbbb3af052c8","ssdeep":"192:W7NgQZ5rvG/9DJxnJEuMt+D4/NQtrkN1xAT34r/rRxv8hOZL2i7gahvN:YPAQCMd","tlshash":"e1e1d18b5b630405bd0aa9ac6ff55b8633998013a10ecd793ecc725ccf892d19db1b9c","first_seen":"2026-02-15T23:03:13.175758Z","last_seen":"2026-07-20T13:23:43.987593Z","times_seen":13,"resource_available":false,"data":null}},"time_used":24,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":24,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-02-23","alert":"Sinkholed","trigger":"check.hotelsverifying.org","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-02-23","alert":"Sinkholed","trigger":"check.hotelsverifying.org","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-02-23","alert":"Phishing Block","trigger":"check.hotelsverifying.org","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-02-23","alert":"Sinkholed","trigger":"check.hotelsverifying.org","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"check.hotelsverifying.org/img/booking-logo.svg","fqdn":"check.hotelsverifying.org","domain":"hotelsverifying.org","tld":"org"},"ip":{"addr":"62.60.226.85","port":443,"asn":215939,"as":"Valery Smoliar","country":"Iran","country_code":"IR"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://check.hotelsverifying.org/","date":"2026-02-23T00:21:41.094Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"check.hotelsverifying.org","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Thu, 19 Feb 2026 10:21:30 GMT","end":"Wed, 20 May 2026 10:21:29 GMT"},"fingerprint":{"sha1":"EC:09:B4:A9:C7:0B:58:9F:E6:F5:93:78:75:75:48:0A:87:D5:5A:BD","sha256":"D5:DA:33:5F:0C:1D:3C:49:D7:40:98:1E:50:6A:4A:51:B7:86:2A:2F:C7:B7:A8:36:57:8D:EC:84:0B:DF:1E:93"}}},"request":{"raw":"GET /img/booking-logo.svg HTTP/1.1\r\nHost: check.hotelsverifying.org\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://check.hotelsverifying.org/\r\nCookie: PHPSESSID=qift8kkfmi9a44jpt914f0vpni\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nServer: nginx/1.28.1\r\nDate: Mon, 23 Feb 2026 00:21:41 GMT\r\nContent-Type: image/svg+xml\r\nContent-Length: 9784\r\nLast-Modified: Thu, 12 Feb 2026 16:47:04 GMT\r\nConnection: keep-alive\r\nETag: \"698e0408-2638\"\r\nAccept-Ranges: bytes\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx:1.28.1","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":9784,"size_decoded":0,"mime_type":"image/svg+xml","magic":"SVG Scalable Vector Graphics image","md5":"918daa26e5af208fef7b7d606b2932de","sha1":"554f37fcaf6f57e91881aea9c53f1f35b8ea1a2d","sha256":"bd9f9cbd3b892b759f6a9f407c20f7edd679b879d2c8a2b72fdf0c8364c0b846","sha512":"1023c9762f16228737d046c2c98ff4b08251eefc1b47b28d642335cbb24f9c5139b7c8d5ec302053eddaf57562ceda4a16bba320ea75d9ef6a461ee81d0cfc60","ssdeep":"192:VkDzizR6t8h8gDOaDgbzfNXoN+eTeI4r3N4pXZkteE78:mX86aqYgzJoN+eyr3N4pXZO8","tlshash":"ba12c860e3a867f0f26d4790acfc3c0e5a5668fb3b41494eb59d86e58f25bc05684bc8","first_seen":"2024-10-13T06:23:54.401911Z","last_seen":"2026-06-04T14:42:25.404192Z","times_seen":15,"resource_available":false,"data":null}},"time_used":47,"timings":{"blocked":22,"dns":0,"connect":0,"send":0,"wait":25,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-02-23","alert":"Sinkholed","trigger":"check.hotelsverifying.org","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-02-23","alert":"Sinkholed","trigger":"check.hotelsverifying.org","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-02-23","alert":"Sinkholed","trigger":"check.hotelsverifying.org","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-02-23","alert":"Phishing Block","trigger":"check.hotelsverifying.org","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"check.hotelsverifying.org/favicon.ico","fqdn":"check.hotelsverifying.org","domain":"hotelsverifying.org","tld":"org"},"ip":{"addr":"62.60.226.85","port":443,"asn":215939,"as":"Valery Smoliar","country":"Iran","country_code":"IR"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://check.hotelsverifying.org/","date":"2026-02-23T00:21:41.160Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"check.hotelsverifying.org","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Thu, 19 Feb 2026 10:21:30 GMT","end":"Wed, 20 May 2026 10:21:29 GMT"},"fingerprint":{"sha1":"EC:09:B4:A9:C7:0B:58:9F:E6:F5:93:78:75:75:48:0A:87:D5:5A:BD","sha256":"D5:DA:33:5F:0C:1D:3C:49:D7:40:98:1E:50:6A:4A:51:B7:86:2A:2F:C7:B7:A8:36:57:8D:EC:84:0B:DF:1E:93"}}},"request":{"raw":"GET /favicon.ico HTTP/1.1\r\nHost: check.hotelsverifying.org\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://check.hotelsverifying.org/\r\nCookie: PHPSESSID=qift8kkfmi9a44jpt914f0vpni\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 404 Not Found\r\nServer: nginx/1.28.1\r\nDate: Mon, 23 Feb 2026 00:21:41 GMT\r\nContent-Type: text/html; charset=iso-8859-1\r\nContent-Length: 288\r\nConnection: keep-alive\r\n\r\n","headers":null,"cookies":null,"status_code":"404","status_text":"Not Found","fingerprints":[{"name":"Nginx:1.28.1","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":288,"size_decoded":0,"mime_type":"text/html; charset=iso-8859-1","magic":"HTML document, ASCII text","md5":"c472936c52f5ef5db661a76aec23bb3a","sha1":"4ce36ae7c26745204dd4f42e5d801468fa0323a5","sha256":"de2826c81be7fc447c2277c3e3a75fa460b0793b940b2732e7583f75ff3868dc","sha512":"e1047c61d6437ccad041245b10e481a9ca29678d07f2321fe2fb97eda7e10b7e6d363e549a1274af7deb8d96320bc1a4a61dcaf63f2c955b39c9a44a2756e428","ssdeep":"","tlshash":"4ad02befa1437387481124503dc665c2278d12f6a47a85a83ec6d887529c67eceabac8","first_seen":"2026-02-23T00:22:12.77572Z","last_seen":"2026-02-23T12:31:20.10933Z","times_seen":3,"resource_available":false,"data":null}},"time_used":28,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":28,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-02-23","alert":"Sinkholed","trigger":"check.hotelsverifying.org","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-02-23","alert":"Sinkholed","trigger":"check.hotelsverifying.org","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-02-23","alert":"Sinkholed","trigger":"check.hotelsverifying.org","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-02-23","alert":"Phishing Block","trigger":"check.hotelsverifying.org","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null}],"urlquery":null}}]}