{"report_id":"367a26a6-0671-4d03-a1cb-90f76d0c4bb4","version":6,"status":"done","tags":[],"date":"2026-03-12T12:59:57Z","url":{"schema":"http","addr":"gbwhata.app","fqdn":"gbwhata.app","domain":"gbwhata.app","tld":"app"},"ip":{"addr":"37.49.227.147","port":0,"asn":3920,"as":"ESTOXY OU","country":"The Netherlands","country_code":"NL"},"final":{"url":{"schema":"https","addr":"gbwhata.app/","fqdn":"gbwhata.app","domain":"gbwhata.app","tld":"app"},"title":"GB WhatsApp Download APK Official Updated Version Mar, 2026","dom":{"size":323477,"mime_type":"text/html; charset=utf-8","magic":"HTML document, Unicode text, UTF-8 text, with very long lines (25166)","md5":"7988d09921f0cb3441ae4c3bfa1ae96f","sha1":"505c0d3794111091265819c331dbf72691a6bae4","sha256":"12d0e43862eeda4efe0a7f18afae991d1d6f3dd4acfc3f4ff8f526b8c3ae8f58","sha512":"7f345e43e6d238b48f29a4d7e4e7ddcf7485c159c43c6d67e6fe07919fc8749facbcb97333e67c553391fbb6d93033bec8413d072c3e2f2a6f93357ac21761c7","ssdeep":"6144:iPOcGKRj7JDD44ofF5pejZTXF3ft17CKgs9rw6ml:izj7JDD44Mjpevg6ml","tlshash":"df644ce3d33c88b9297f42d2640533a77895b44bdb1544faf0b9c178a5ac8a41ef3297","dom_hash":"domhash9a6a969f4946c2fef4196e2f820e68ad","first_seen":"2026-03-12T13:00:03.876791Z","last_seen":"2026-03-12T13:00:03.876791Z","times_seen":1,"resource_available":false,"data":null}},"submit":{"url":{"schema":"http","addr":"gbwhata.app","fqdn":"gbwhata.app","domain":"gbwhata.app","tld":"app"},"ip":{"addr":"37.49.227.147","port":0,"asn":3920,"as":"ESTOXY OU","country":"The Netherlands","country_code":"NL"},"tags":null,"meta":null},"settings":{"access":"public","device_type":"desktop","expires_at":"2027-04-16T12:59:57Z","useragent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0","referer":"","cookies":null,"exit_node":"z0yflva4pidy47h"},"stats":{"alert_count":{"ids":0,"urlquery":0,"analyzer":5}},"detection":{"ids":null,"analyzer":[{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-03-12","alert":"Phishing Block","trigger":"gbwhata.app","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-03-12","alert":"Sinkholed","trigger":"gbwhata.app","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-03-12","alert":"Sinkholed","trigger":"gbwhata.app","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-03-12","alert":"Sinkholed","trigger":"gbwhata.app","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-03-12","alert":"Sinkholed","trigger":"gbwhata.app","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null},"summary":[{"fqdn":"gbwhata.app","ip":{"addr":"37.49.227.147","port":443,"asn":3920,"as":"ESTOXY OU","country":"The Netherlands","country_code":"NL"},"domain_registered":"unknown","domain_rank":0,"first_seen":"2026-03-06T12:46:02.807026Z","last_seen":"2026-03-06T12:46:02.807026Z","alert_count":130,"request_count":26,"received_data":708356,"sent_data":12328,"comment":"","tags":null,"fingerprints":[{"name":"Google Analytics","description":"Google Analytics is a free web analytics service that tracks and reports website traffic.","website":"https://google.com/analytics","common_platform_enumeration":"","icon":"Google Analytics.svg","categories":["Analytics"]},{"name":"jQuery Migrate:3.4.1","description":"Query Migrate is a javascript library that allows you to preserve the compatibility of your jQuery code developed for versions of jQuery older than 1.9.","website":"https://github.com/jquery/jquery-migrate","common_platform_enumeration":"","icon":"jQuery.svg","categories":["JavaScript libraries"]},{"name":"WordPress:6.9.4","description":"WordPress is a free and open-source content management system written in PHP and paired with a MySQL or MariaDB database. Features include a plugin architecture and a template system.","website":"https://wordpress.org","common_platform_enumeration":"cpe:2.3:a:wordpress:wordpress:*:*:*:*:*:*:*:*","icon":"WordPress.svg","categories":["CMS","Blogs"]},{"name":"MySQL","description":"MySQL is an open-source relational database management system.","website":"https://mysql.com","common_platform_enumeration":"cpe:2.3:a:mysql:mysql:*:*:*:*:*:*:*:*","icon":"MySQL.svg","categories":["Databases"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"WP Rocket:3.13.2","description":"WP Rocket is a caching and performance optimisation plugin to improve the loading speed of WordPress websites.","website":"https://wp-rocket.me","common_platform_enumeration":"","icon":"WP Rocket.png","categories":["Caching","WordPress plugins"]},{"name":"Kadence WP Blocks","description":"Kadence Blocks is a plugin for WordPress that provides a collection of custom blocks for the WordPress Block Editor, allowing users to create custom layouts and designs for their website without needing to know how to code.","website":"https://www.kadencewp.com/kadence-blocks/","common_platform_enumeration":"","icon":"Kadence WP.svg","categories":["WordPress plugins"]},{"name":"Yoast SEO:27.1.1","description":"Yoast SEO is a search engine optimisation plugin for WordPress and other platforms.","website":"https://yoast.com/wordpress/plugins/seo/","common_platform_enumeration":"","icon":"Yoast SEO.png","categories":["SEO","WordPress plugins"]},{"name":"PHP","description":"PHP is a general-purpose scripting language used for web development.","website":"https://php.net","common_platform_enumeration":"cpe:2.3:a:php:php:*:*:*:*:*:*:*:*","icon":"PHP.svg","categories":["Programming languages"]},{"name":"Engintron","description":"Engintron is a plugin that integrates Nginx to cPanel/WHM server.","website":"https://github.com/engintron/engintron","common_platform_enumeration":"","icon":"engintron.png","categories":["Web server extensions"]},{"name":"jQuery","description":"jQuery is a JavaScript library which is a free, open-source software designed to simplify HTML DOM tree traversal and manipulation, as well as event handling, CSS animation, and Ajax.","website":"https://jquery.com","common_platform_enumeration":"cpe:2.3:a:jquery:jquery:*:*:*:*:*:*:*:*","icon":"jQuery.svg","categories":["JavaScript libraries"]},{"name":"WordPress Block Editor","description":"Sites using the WordPress Block Editor, also known as Gutenberg.","website":"https://wordpress.org/gutenberg/","common_platform_enumeration":"","icon":"WordPress.svg","categories":["Page builders"]},{"name":"Spectra:2.19.20","description":"Spectra is a WordPress plugin that provides a collection of new and enhanced blocks for the WordPress Block editor.","website":"https://wpspectra.com","common_platform_enumeration":"","icon":"Spectra.svg","categories":["WordPress plugins"]}]},{"fqdn":"www.googletagmanager.com","ip":{"addr":"192.178.203.97","port":443,"asn":15169,"as":"GOOGLE","country":"United States","country_code":"US"},"domain_registered":"2011-11-11","domain_rank":283,"first_seen":"2012-10-04T01:07:32Z","last_seen":"2026-03-08T22:22:58.987044Z","alert_count":0,"request_count":1,"received_data":459379,"sent_data":432,"comment":"","tags":null,"fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}]},{"fqdn":"vu.upshotspaolo.com","ip":{"addr":"172.241.53.157","port":443,"asn":7979,"as":"SERVERS-COM","country":"The Netherlands","country_code":"NL"},"domain_registered":"2025-12-05","domain_rank":0,"first_seen":"2026-01-02T15:52:18.755365Z","last_seen":"2026-03-06T22:58:34.506591Z","alert_count":0,"request_count":1,"received_data":1521,"sent_data":424,"comment":"","tags":null,"fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}]},{"fqdn":"s.w.org","ip":{"addr":"192.0.77.48","port":443,"asn":2635,"as":"AUTOMATTIC","country":"United States","country_code":"US"},"domain_registered":"1993-12-01","domain_rank":27695,"first_seen":"2017-01-30T04:56:16Z","last_seen":"2026-03-09T02:13:01.106895Z","alert_count":0,"request_count":1,"received_data":1479,"sent_data":451,"comment":"","tags":null,"fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}]},{"fqdn":"wh.balzadicyema.com","ip":{"addr":"23.109.253.230","port":443,"asn":7979,"as":"SERVERS-COM","country":"The Netherlands","country_code":"NL"},"domain_registered":"2025-07-21","domain_rank":0,"first_seen":"2025-11-25T10:25:20.092483Z","last_seen":"2026-03-06T12:46:03.400639Z","alert_count":0,"request_count":1,"received_data":1440,"sent_data":422,"comment":"","tags":null,"fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}]}],"files":null,"artifacts":{"windows_shortcuts":null,"files":null,"telegram":null,"pdfs":null,"clipboard":null},"sensors":{"ids":null,"analyzer":null,"urlquery":null},"javascript":{"script":[{"url":{"schema":"https","addr":"www.googletagmanager.com/gtag/js?id=G-M1PE9MY73C","fqdn":"www.googletagmanager.com","domain":"googletagmanager.com","tld":"com"},"ip":{"addr":"192.178.203.97","port":443,"asn":15169,"as":"GOOGLE","country":"United States","country_code":"US"},"introduction_type":"scriptElement","is_inline":false,"md5":"288aed1d73428a48ae3074392d9177c8","sha1":"e923d707e944c6a080fe41c73888cbced90dbd49","sha256":"cf7c8448efe2fa4b5ada4057d92554921bce4242937870b17ed8352aa2451d3f","sha512":"94195a6bf19b11793cd8001ed679b29bb667825bfdd297ca45b570b99d2358aeaf43c1b0e8fe2a6ac70a23310afdcd4e43972e0d9c2f23bc4a299f48c098b39f","ssdeep":"6144:tC8J5tq8191Gzb0mD8+t3Rnp/XAphEn22cf0NTNBg:drq81XJmD86n2Iu","tlshash":"a0a4faceb3d670629396f478503f018ba57b29a2b45cc89af189cce42d7469a4137f7c","size":458775,"data":"","first_seen":"2026-03-12T13:00:03.900581Z","last_seen":"2026-03-12T13:00:03.900581Z","times_seen":1,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"gbwhata.app/uagb-post-js-js-extra","fqdn":"gbwhata.app","domain":"gbwhata.app","tld":"app"},"ip":{"addr":"0.0.0.0","port":0,"asn":0,"as":"","country":"","country_code":"ZZ"},"introduction_type":"scriptElement","is_inline":false,"md5":"7d319d572a1b277c4f40daa5b0586e83","sha1":"b0a7bd462e5804e06011504fd2d7e698403827ec","sha256":"d29206ee6918b35967db7811d802e7d7df46fdf1989327106f0af2a8c5ee215b","sha512":"8751ffe8cf94346ba3300499603b2d5e30f77e9832491f84d5887a91688836132117b99c1f9938c97583569c556fd0c5e28a18ff7eb9b5d23a34bb7d8ee46472","ssdeep":"","tlshash":"73312645e1cc8fd63d887eb0002ca3330db67022fbc24cb18a6ad4050668142b8a424b","size":1818,"data":"","first_seen":"2026-03-12T13:00:03.913347Z","last_seen":"2026-03-12T13:00:03.913347Z","times_seen":1,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"gbwhata.app/generate-menu-js-before","fqdn":"gbwhata.app","domain":"gbwhata.app","tld":"app"},"ip":{"addr":"0.0.0.0","port":0,"asn":0,"as":"","country":"","country_code":"ZZ"},"introduction_type":"scriptElement","is_inline":false,"md5":"352ad51fb0b04b01c4ec935ba8ccb6a8","sha1":"9e8a0f6832671d6bcf45e06dc575c631e10a61e3","sha256":"8ec68506712afbfdbe2da42e2757aa871f407302aeb3ffc3bc67b45c8341d302","sha512":"da1a96ab88f3a2cba7e5abf8dff3355cc0da34dc5d53ec82945991d0cd7b61fecc3523074b6b16b8893f813cc700f04b04634ba967f8b17cdf462f0ce02045b9","ssdeep":"","tlshash":"b63180add1825632c1c15b705350e533d035085cc209481ff19d90dca835ca31ccd443","size":1693,"data":"","first_seen":"2026-03-06T12:46:09.072385Z","last_seen":"2026-03-12T13:00:03.914191Z","times_seen":4,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"gbwhata.app/wp-includes/js/jquery/jquery.min.js?ver=3.7.1","fqdn":"gbwhata.app","domain":"gbwhata.app","tld":"app"},"ip":{"addr":"37.49.227.147","port":443,"asn":3920,"as":"ESTOXY OU","country":"The Netherlands","country_code":"NL"},"introduction_type":"scriptElement","is_inline":false,"md5":"826eb77e86b02ab7724fe3d0141ff87c","sha1":"79cd3587d565afe290076a8d36c31c305a573d18","sha256":"cb6f2d32c49d1c2b25e9ffc9aaafa3f83075346c01bcd4ae6eb187392a4292cf","sha512":"fc79fdb76763025dc39fac045a215ff155ef2f492a0e9640079d6f089fa6218af2b3ab7c6eaf636827dee9294e6939a95ab24554e870c976679c25567ad6374c","ssdeep":"1536:0RUX9uDgwxcy2KVBNwchN6SLaHEk2BSrBESp+a/IEk4aAocVi8SMBQ47GKO:sHNwcv9VBQpLl88SMBQ47GKO","tlshash":"7483f8df77ca702247ab30b9006f550bf276199d684d4400f159d8e9bcb8a4a827bf7e","size":87553,"data":"","first_seen":"2023-11-03T09:26:43Z","last_seen":"2026-08-11T00:53:17.916724Z","times_seen":1013891,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"gbwhata.app/","fqdn":"gbwhata.app","domain":"gbwhata.app","tld":"app"},"ip":{"addr":"37.49.227.147","port":443,"asn":3920,"as":"ESTOXY OU","country":"The Netherlands","country_code":"NL"},"introduction_type":"scriptElement","is_inline":true,"md5":"1c30b3619bddb6a771dfee2a7cc59c44","sha1":"4e43bff20aef87ac609b24f9fcd8440985f3793a","sha256":"fb057aa82901f2b814ca810c1ad964686eef90474e60c2d82943b68934d196df","sha512":"2bbc1fc18e176172ef8da529e2b0244cccfb140ba4fc78c0f5ab5de85164d204a1e1374355e2a6687ae23b9728401bcb7533f9101b01338d77b8621a673a89e8","ssdeep":"","tlshash":"6bc08c89212a0c7041f627008b2fa604b002331498906921880e23044e21e03e744810","size":153,"data":"","first_seen":"2026-03-06T12:46:09.068656Z","last_seen":"2026-05-12T09:13:14.874434Z","times_seen":15,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"gbwhata.app/","fqdn":"gbwhata.app","domain":"gbwhata.app","tld":"app"},"ip":{"addr":"37.49.227.147","port":443,"asn":3920,"as":"ESTOXY OU","country":"The Netherlands","country_code":"NL"},"introduction_type":"scriptElement","is_inline":true,"md5":"9a6ea38295e2538b639a2db91c8f140c","sha1":"e86c7334818e9e843be84c4ec70114107a027130","sha256":"ffb7b4a1a779800a8f622ee78d11431a2cf5080b2325d0bbe65583b5413bbdde","sha512":"8b2b5dcc5fa89f5697808f2461eaf22089d21acb66f5a8fd7d958bb8aa9142347f3a725782d3bec96588c7555e408ab7716b97f6987c6c1fa81f18259a9e3121","ssdeep":"","tlshash":"5be0cd7b17561f3904d3729931efb7417b73075574c001076cb4c5492f645c581fa4c6","size":294,"data":"","first_seen":"2025-05-09T14:48:28.388204Z","last_seen":"2026-08-10T23:27:46.556489Z","times_seen":10091,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"gbwhata.app/wp-includes/js/wp-emoji-release.min.js?ver=6.9.4","fqdn":"gbwhata.app","domain":"gbwhata.app","tld":"app"},"ip":{"addr":"37.49.227.147","port":443,"asn":3920,"as":"ESTOXY OU","country":"The Netherlands","country_code":"NL"},"introduction_type":"scriptElement","is_inline":false,"md5":"f0cc9ba5cf46af0cd73d521803e3b07e","sha1":"7d2a74f87dc70a39eccce3bae1d4cc404cb134f4","sha256":"fd59b0ebf6282ed71647bf2f6e0d1925bbfd1f270865a832079ebb60259aabca","sha512":"7ec44f08676c195547a623504c7105ef3d0acea5839675599598043f3e0b5a3386452e3db6fbea90722f7be9e6effdae1b89c49e2b05b22b8c415616e07d471d","ssdeep":"384:WzevzApRZTbXU/3o//bEPhXgA5POkpJTX:Wsk9XU/3o//YpXgAs+hX","tlshash":"7fa2959ba33a4e8f343e3bd78d968f4dc9da555321c0e079dbefb6c169a00568274c80","size":22762,"data":"","first_seen":"2025-11-10T19:52:32.864936Z","last_seen":"2026-08-11T00:45:32.443827Z","times_seen":310847,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"gbwhata.app/uagb-timeline-js-js-extra","fqdn":"gbwhata.app","domain":"gbwhata.app","tld":"app"},"ip":{"addr":"0.0.0.0","port":0,"asn":0,"as":"","country":"","country_code":"ZZ"},"introduction_type":"scriptElement","is_inline":false,"md5":"b8d1da80f20ae36b425886db77df0a4b","sha1":"c8ec37ebcf17e74c8a28631a301b58548ee1e36d","sha256":"e92bfc8a9ea06360c9184741aeca73e854f932ed73ffeef027881a201c1e8971","sha512":"6ea94e05b6dff6dc753d22cc863b6e054395dd892a6ae2b0224573c14c61d1d1776ff9e46be7c9838098f02951ccad83b1eab94ddac2969a14f7dc395f37b553","ssdeep":"","tlshash":"70319b56d785179218d8dd38181233f3251f5c51c18544b6d595c510c5b16465771c92","size":1642,"data":"","first_seen":"2026-03-06T12:46:09.070654Z","last_seen":"2026-03-12T13:00:03.916095Z","times_seen":4,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"gbwhata.app/wp-content/plugins/ultimate-addons-for-gutenberg/assets/js/post.min.js?ver=2.19.20","fqdn":"gbwhata.app","domain":"gbwhata.app","tld":"app"},"ip":{"addr":"37.49.227.147","port":443,"asn":3920,"as":"ESTOXY OU","country":"The Netherlands","country_code":"NL"},"introduction_type":"scriptElement","is_inline":false,"md5":"b0953fd867945a970520868d934460b1","sha1":"b4905bab7382411fb994a54bcb4b24e6b3c70d27","sha256":"dd3ba112c64579b2f2962ed4dbc52beca7fd3cc59ed1dc88c36d757ce75d7759","sha512":"496958231fe76d4368c53eb7b05ae5b113804f8d3e3d8eac1fcee5d5df6cc1e6bedd93aa5798ad628c5351b58c404a754523f44cb9176362280dd521b42ba05a","ssdeep":"96:+1I291M3XdQqRnKy1k2lyOyxg131jXYwyDNtyBsnIAwjEa7dEFsh0YI:+1I291MndQq5Ky1k2lyOyx231jXZyDn/","tlshash":"b39175a05072ae71042a07db507b77857ca018afb80045dc2479cc9f7e9dce36bd1eba","size":4428,"data":"","first_seen":"2024-01-25T05:03:21Z","last_seen":"2026-08-10T14:02:55.585702Z","times_seen":2736,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"gbwhata.app/wp-includes/js/wp-emoji-loader.min.js","fqdn":"gbwhata.app","domain":"gbwhata.app","tld":"app"},"ip":{"addr":"0.0.0.0","port":0,"asn":0,"as":"","country":"","country_code":"ZZ"},"introduction_type":"scriptElement","is_inline":false,"md5":"2031bd3b88c9a5162c0301621ee3e275","sha1":"4e52e6701a6a2f3da0467d89425a511c0990e604","sha256":"02ad2e816a677bf808dad10f3e17a938dc01ba76de98e77f68a030d1e35ba28e","sha512":"bd922d2848b01ba63ee9c901eff7993ab66cf5c52bb218ffe09c001ed4638b43f33d42e28bf8d93880d9a23818fe11369a84f1a524b2ed4186ea3cc9afe1262d","ssdeep":"96:0vcHtHRA5NTDXnM2E0+1lfYsPHgRhR3Sn:BN0LE0+1lfYsvSO","tlshash":"ee91759ae77638dbb2f900f2697a0d47eb614435d6c8d438c9ada31418b58a3c274a46","size":4510,"data":"","first_seen":"2026-03-06T12:46:09.091468Z","last_seen":"2026-03-12T13:00:03.916916Z","times_seen":4,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"gbwhata.app/generate-back-to-top-js-before","fqdn":"gbwhata.app","domain":"gbwhata.app","tld":"app"},"ip":{"addr":"0.0.0.0","port":0,"asn":0,"as":"","country":"","country_code":"ZZ"},"introduction_type":"scriptElement","is_inline":false,"md5":"8a98124be2030b01e13bb6f188f4aba2","sha1":"3ce1c13011658bb7bec2bca207898c7badb76497","sha256":"e90f9a2931e56822629a2c40196e2f701d453d9b088678109d13429bf33ea89c","sha512":"e67be70574259ec628c3035aede27a5f537bea07672cb1201cd5f7788ca9955b87f1ea6a6f6f9b841222a96248754b9c3916067c2c3edaacb0c09fbd43e84131","ssdeep":"","tlshash":"403112efc488003040c3cc3026105730f0a8a028c1478051d0ce500bd173c01585d881","size":1624,"data":"","first_seen":"2026-03-06T12:46:09.073933Z","last_seen":"2026-03-12T13:00:03.917882Z","times_seen":4,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"gbwhata.app/wp-content/themes/generatepress/assets/js/back-to-top.min.js?ver=3.6.1","fqdn":"gbwhata.app","domain":"gbwhata.app","tld":"app"},"ip":{"addr":"37.49.227.147","port":443,"asn":3920,"as":"ESTOXY OU","country":"The Netherlands","country_code":"NL"},"introduction_type":"scriptElement","is_inline":false,"md5":"5fc35421139ef9851bc72d3edb90cfba","sha1":"0091cadf005c865d7c4ef093fac9d35566fd1e48","sha256":"3310986e26439bd35318188bd35b0c326bd3334e6699ca0469fd4f0b7d497098","sha512":"0fda88fda5b8a67c7b750712da3543e4572cb89565284cf1cbffb1ec0927f21626ff78d6fe9fa4ac13ce9f780ddc0c36ca46fedeb1c2e7f754573d7acddc7432","ssdeep":"","tlshash":"0401d0fd1190553514fb8695739fbf41393120a686039411812ccca0f5a8ce7f912bc7","size":737,"data":"","first_seen":"2024-09-02T00:59:07Z","last_seen":"2026-08-10T23:24:35.537804Z","times_seen":5450,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"gbwhata.app/wp-content/plugins/kadence-blocks/includes/assets/js/kb-table-of-contents.min.js?ver=3.6.6","fqdn":"gbwhata.app","domain":"gbwhata.app","tld":"app"},"ip":{"addr":"37.49.227.147","port":443,"asn":3920,"as":"ESTOXY OU","country":"The Netherlands","country_code":"NL"},"introduction_type":"scriptElement","is_inline":false,"md5":"85d689528824ee0d6c33926748d38a85","sha1":"78d51b247a0a0604f9354cc9199e3204bf6ce1e4","sha256":"b26a33e40fef02b91eab1747461f2c7755b266c51db7068d3000194fc8b1095f","sha512":"15714b2920be9d991c9229cdfd3169670011a19da07fe09af93916f03358da8381e0c79191a2d6d7aeb36d7f45bc3546d47f673c7a69d583886942e93f07fae7","ssdeep":"192:q7ZRKpAcsc04i0dWWTq7tuJOKFUnqoHyf3:4sq0dWW272jFUnZHA3","tlshash":"69e132ada10020f35ddf46c1d1bad79b7460b322b64348a15419edf61629ffb20c6fb9","size":6996,"data":"","first_seen":"2024-03-10T01:04:08Z","last_seen":"2026-08-09T17:59:33.214664Z","times_seen":857,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"gbwhata.app/kadence-blocks-tableofcontents-js-extra","fqdn":"gbwhata.app","domain":"gbwhata.app","tld":"app"},"ip":{"addr":"0.0.0.0","port":0,"asn":0,"as":"","country":"","country_code":"ZZ"},"introduction_type":"scriptElement","is_inline":false,"md5":"198fa57a8db8e79d572a039512b0289f","sha1":"6a347ef28de0ef726242df65f9d896826975365a","sha256":"c7f8ea5801d822952d74153c4a15e6da7e9b31e35ee0fd1a53620ec7bb5698bf","sha512":"1f44a2585bbfda7397cf8a8e092273508251822891c37cafae6d203a8c98f448b92feb6989f6473548f8bf71b3c26404053f8b8004f76efef546254b18bf8024","ssdeep":"192:MUyN5GqCxkvZ7pmn5kXOKUyN5GqCxkvZ7pmn5kXOq:NyN5XZdmn5kXOryN5XZdmn5kXOq","tlshash":"8d42f075e829d990fbc04d3d36bebe3690f5e854ca5338790863e17da8860342fe3642","size":12926,"data":"","first_seen":"2026-03-06T12:46:09.093673Z","last_seen":"2026-03-12T13:00:03.91869Z","times_seen":4,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"gbwhata.app/wp-content/uploads/uag-plugin/assets/0/uag-js-10.js?ver=1773307383","fqdn":"gbwhata.app","domain":"gbwhata.app","tld":"app"},"ip":{"addr":"37.49.227.147","port":443,"asn":3920,"as":"ESTOXY OU","country":"The Netherlands","country_code":"NL"},"introduction_type":"scriptElement","is_inline":false,"md5":"15c7c4d5f65c4761f5aaaec1c18e07a1","sha1":"99ed58c660ff2820c08185c1947760c3e01595df","sha256":"ab13bfe3d592587c1cdc7c5c1da3e3063fbb81d8ee156e2b37cf82868f289d4f","sha512":"c274194aa2fed0310849a0a7942bff9becdeec922e95eef29b0e2435239ea04c7f4650376e5724d23b0d3bf9332cad94ebe118a21a35944e308e20e86e77fa83","ssdeep":"","tlshash":"6c1126539b344de402edf13e912ea9f011ce0e1bb18959f2e801cf87793cd9622b1027","size":934,"data":"","first_seen":"2026-03-06T12:46:09.057999Z","last_seen":"2026-05-12T09:13:14.843597Z","times_seen":15,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"gbwhata.app/wp-content/plugins/ultimate-addons-for-gutenberg/assets/js/timeline.min.js?ver=2.19.20","fqdn":"gbwhata.app","domain":"gbwhata.app","tld":"app"},"ip":{"addr":"37.49.227.147","port":443,"asn":3920,"as":"ESTOXY OU","country":"The Netherlands","country_code":"NL"},"introduction_type":"scriptElement","is_inline":false,"md5":"013a03f767932f4438dc57d9f42a0274","sha1":"605b05c1f4d243311566daaeef00c356ef3d2fb2","sha256":"c7e3fb2726c86a4b4ece873e6b87bfd52c0e2d692d72aaa396abdd0646918e94","sha512":"4c9a98e0dc9d4cca4a0bf521c4735fcd66dfcd00f35b0b384e8062b89a06ac2251a5866774612b66d9efe8b668595578dcfd7e120c9dec324edaee72bfc261bd","ssdeep":"","tlshash":"dc81aa22292096fa01eeaa4f919777c477380d67e64110bbc9e8cd5b7e788c367903d7","size":4010,"data":"","first_seen":"2023-05-09T14:36:57Z","last_seen":"2026-08-02T15:45:30.461206Z","times_seen":95,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"gbwhata.app/wp-content/plugins/ultimate-addons-for-gutenberg/assets/js/spectra-block-positioning.min.js?ver=2.19.20","fqdn":"gbwhata.app","domain":"gbwhata.app","tld":"app"},"ip":{"addr":"37.49.227.147","port":443,"asn":3920,"as":"ESTOXY OU","country":"The Netherlands","country_code":"NL"},"introduction_type":"scriptElement","is_inline":false,"md5":"eb5d7efb1bc838480f4ca0d67c124249","sha1":"0292349ba263236243a33fb7fdded5527e17bf6a","sha256":"bac6add1bf7ec50484cc9c7336db1c6333b0f911675eb2a95c6af5d28b15adab","sha512":"4c7a0a52d7917f8387fefa7e266a9fd195fa28d077bcfb767bd985d197a32a09068cc58101d275d921d954b3f2edd390bba382ef8662ff27a6fdc3fc007da1db","ssdeep":"48:czXyS1kQcF8P32bUIP9I9s0nv2RGc+Auuk7XulA4MzU27XuTIo657XufNPh4gnzS:q/q8EI9sgv4COIUMiAqNPfEPonGik","tlshash":"0a91b08003021e3bd2a3279571dab9443330456dd7e6d47183fa9a2b6398cc768b3af9","size":4450,"data":"","first_seen":"2024-10-13T03:11:06.787751Z","last_seen":"2026-08-10T14:02:55.500942Z","times_seen":6964,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"gbwhata.app/wp-includes/js/jquery/jquery-migrate.min.js?ver=3.4.1","fqdn":"gbwhata.app","domain":"gbwhata.app","tld":"app"},"ip":{"addr":"37.49.227.147","port":443,"asn":3920,"as":"ESTOXY OU","country":"The Netherlands","country_code":"NL"},"introduction_type":"scriptElement","is_inline":false,"md5":"9ffeb32e2d9efbf8f70caabded242267","sha1":"3ad0c10e501ac2a9bfa18f9cd7e700219b378738","sha256":"5274f11e6fb32ae0cf2dfb9f8043272865c397a7c4223b4cfa7d50ea52fbde89","sha512":"8d6be545508a1c38278b8ad780c3758ae48a25e4e12eee443375aa56031d9b356f8c90f22d4f251140fa3f65603af40523165e33cae2e2d62fc78ec106e3d731","ssdeep":"192:5rprDN+sag6ifKIUpQI99P1tLm9kdgyq1+J3aCJQ+h4MPLORq:5rprxaefKI0LP19m4q1WW+h4Mjp","tlshash":"9952c8adb56679724eb721b8f03bd24f71b205de560d8940d19cc4f6282dc6e812bf78","size":13577,"data":"","first_seen":"2023-05-09T19:21:05Z","last_seen":"2026-08-11T00:53:17.905318Z","times_seen":928849,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"vu.upshotspaolo.com/smyJYhZULVGFU/133339","fqdn":"vu.upshotspaolo.com","domain":"upshotspaolo.com","tld":"com"},"ip":{"addr":"172.241.53.157","port":443,"asn":7979,"as":"SERVERS-COM","country":"The Netherlands","country_code":"NL"},"introduction_type":"scriptElement","is_inline":false,"md5":"f7a2939527fd9e68723da600e96d76bd","sha1":"a9e717b6364d2895ee0a716050db32ca0ef1bb42","sha256":"d810f5146f4cd1517512a6e31946e764a73c58fb01427aae88d42cc2ae28718a","sha512":"e6956ec633c76eb3ebc408528f950b81373238cd1d5b9fff5ddd97089ea14a1ff5934f23769bac5d93cc4cdb6a1fbc4ce69baebfb940a55d8a7a89caccaf92b5","ssdeep":"","tlshash":"ec300000003000000000000000000000000c0000000000000000000000000c00000000","size":5,"data":"","first_seen":"2023-03-07T01:14:39Z","last_seen":"2026-08-10T21:54:24.417642Z","times_seen":15866,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"gbwhata.app/wp-content/plugins/ultimate-addons-for-gutenberg/assets/js/faq.min.js?ver=2.19.20","fqdn":"gbwhata.app","domain":"gbwhata.app","tld":"app"},"ip":{"addr":"37.49.227.147","port":443,"asn":3920,"as":"ESTOXY OU","country":"The Netherlands","country_code":"NL"},"introduction_type":"scriptElement","is_inline":false,"md5":"8440185826d6eb907dd29131821eadc2","sha1":"9d8386225a777c48327b1bdb04fd48c0bef23c97","sha256":"128346e15870a3513fb1ae9665dd3f7cb2bea87b7a912f01e97ce3689b103d10","sha512":"4368d72e850ed5f465693e2ef0410e8736d5efd58b492a7f92af7e7f5c42d475852c314618bbb85e6d6005e5ceb03010d833704bbe5a02dcb1675d6db1aeb732","ssdeep":"96:LDyacrU6tdDG4woPMaqv4UryZi36lk5/DBX7:/yf/tdDG4Py4UryZS6lkrL","tlshash":"7d81046027003ff724d7628b844bb8c5b16068c99f65a8b4772c982f295dece21f17f5","size":4110,"data":"","first_seen":"2023-03-14T02:20:22Z","last_seen":"2026-08-10T13:56:43.163235Z","times_seen":1922,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"wh.balzadicyema.com/tQVTaVQGtTV/133338","fqdn":"wh.balzadicyema.com","domain":"balzadicyema.com","tld":"com"},"ip":{"addr":"23.109.253.230","port":443,"asn":7979,"as":"SERVERS-COM","country":"The Netherlands","country_code":"NL"},"introduction_type":"scriptElement","is_inline":false,"md5":"f7a2939527fd9e68723da600e96d76bd","sha1":"a9e717b6364d2895ee0a716050db32ca0ef1bb42","sha256":"d810f5146f4cd1517512a6e31946e764a73c58fb01427aae88d42cc2ae28718a","sha512":"e6956ec633c76eb3ebc408528f950b81373238cd1d5b9fff5ddd97089ea14a1ff5934f23769bac5d93cc4cdb6a1fbc4ce69baebfb940a55d8a7a89caccaf92b5","ssdeep":"","tlshash":"ec300000003000000000000000000000000c0000000000000000000000000c00000000","size":5,"data":"","first_seen":"2023-03-07T01:14:39Z","last_seen":"2026-08-10T21:54:24.417642Z","times_seen":15866,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"gbwhata.app/","fqdn":"gbwhata.app","domain":"gbwhata.app","tld":"app"},"ip":{"addr":"37.49.227.147","port":443,"asn":3920,"as":"ESTOXY OU","country":"The Netherlands","country_code":"NL"},"introduction_type":"scriptElement","is_inline":true,"md5":"2d2f734abdec8620433dbc0e3ddca617","sha1":"3f7432dd0cf9568ac5fea189e195603beb45bbb8","sha256":"44b89928571451d004b08757473ef65db36ec4d565721d2ea7f0fb9368756804","sha512":"2c49c996c42b5dee03fc3ebac3a665ea71afdb70e5e7d7ab5879c3e67a521df36fbb2946ea5451b2c81f4f21943c0986737ca52643fa46950f86608f0d3d6d92","ssdeep":"","tlshash":"3de0865565cd8fd63d887e84002ca3730d767126fbd25cb18a66d4450668546b8a424b","size":303,"data":"","first_seen":"2026-03-12T13:00:03.919584Z","last_seen":"2026-03-12T13:00:03.919584Z","times_seen":1,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"gbwhata.app/wp-content/themes/generatepress/assets/js/menu.min.js?ver=3.6.1","fqdn":"gbwhata.app","domain":"gbwhata.app","tld":"app"},"ip":{"addr":"37.49.227.147","port":443,"asn":3920,"as":"ESTOXY OU","country":"The Netherlands","country_code":"NL"},"introduction_type":"scriptElement","is_inline":false,"md5":"67148b2ff82038d0faf6385f182c5644","sha1":"7452d643e468caf6db8ecf07618f1cb7ff3f7651","sha256":"5af760e4297b064a2150dcd5f63d748a06dfa8b618c9e9d43a87c4ac74fa3974","sha512":"24cb8e3c4f17abc7cf1ba96407ac1eda4e6c5d7c669ac213024a9b428e19cef574cefdb06c4dd28c013f1f8d3c775fb8f98c5a15c142783ba0f25b46f0c6e7ad","ssdeep":"192:iQqHlWQZgROnqWgpkgJMhqDi92FY+alT/fnGtxTbvm:bqHngROnvgJUqDi9cNYTnGvTbvm","tlshash":"6ee112fa964412bb04ef29ca74e6e5c07b7568fdea0184302579c84d1fe8dc202e6bf5","size":7333,"data":"","first_seen":"2024-08-31T11:00:29Z","last_seen":"2026-08-10T23:27:46.5044Z","times_seen":19268,"alerts":{"ids":null,"analyzer":null,"urlquery":null}}],"eval":null,"write":null,"console":null},"http":[{"url":{"schema":"https","addr":"gbwhata.app/","fqdn":"gbwhata.app","domain":"gbwhata.app","tld":"app"},"ip":{"addr":"37.49.227.147","port":443,"asn":3920,"as":"ESTOXY OU","country":"The Netherlands","country_code":"NL"},"is_navigation_request":true,"resource_type":"document","requested_by":"","date":"2026-03-12T12:59:35.002Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"gbwhata.app","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Thu, 19 Feb 2026 08:00:05 GMT","end":"Wed, 20 May 2026 08:00:04 GMT"},"fingerprint":{"sha1":"F7:68:D7:CD:68:0C:05:00:13:71:A0:93:D1:77:B6:B1:41:5F:EC:8B","sha256":"D5:FF:3C:B4:A1:A4:55:FE:42:A5:38:44:C0:50:11:C9:E8:BC:48:0A:96:FE:1D:AE:92:4C:95:33:87:AD:31:B6"}}},"request":{"raw":"GET / HTTP/1.1\r\nHost: gbwhata.app\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nUpgrade-Insecure-Requests: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: document\r\nSec-Fetch-Mode: navigate\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Thu, 12 Mar 2026 12:59:35 GMT\r\ncontent-type: text/html; charset=UTF-8\r\nvary: Accept-Encoding\r\ncache-control: max-age=0, public\r\nexpires: Thu, 12 Mar 2026 12:59:35 GMT\r\nx-powered-by: WP Rocket/3.13.2\r\nx-xss-protection: 1; mode=block\r\nx-content-type-options: nosniff\r\nx-nginx-upstream-cache-status: EXPIRED\r\nx-server-powered-by: Engintron\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Google Analytics","description":"Google Analytics is a free web analytics service that tracks and reports website traffic.","website":"https://google.com/analytics","common_platform_enumeration":"","icon":"Google Analytics.svg","categories":["Analytics"]},{"name":"jQuery Migrate:3.4.1","description":"Query Migrate is a javascript library that allows you to preserve the compatibility of your jQuery code developed for versions of jQuery older than 1.9.","website":"https://github.com/jquery/jquery-migrate","common_platform_enumeration":"","icon":"jQuery.svg","categories":["JavaScript libraries"]},{"name":"WordPress:6.9.4","description":"WordPress is a free and open-source content management system written in PHP and paired with a MySQL or MariaDB database. Features include a plugin architecture and a template system.","website":"https://wordpress.org","common_platform_enumeration":"cpe:2.3:a:wordpress:wordpress:*:*:*:*:*:*:*:*","icon":"WordPress.svg","categories":["CMS","Blogs"]},{"name":"MySQL","description":"MySQL is an open-source relational database management system.","website":"https://mysql.com","common_platform_enumeration":"cpe:2.3:a:mysql:mysql:*:*:*:*:*:*:*:*","icon":"MySQL.svg","categories":["Databases"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"WP Rocket:3.13.2","description":"WP Rocket is a caching and performance optimisation plugin to improve the loading speed of WordPress websites.","website":"https://wp-rocket.me","common_platform_enumeration":"","icon":"WP Rocket.png","categories":["Caching","WordPress plugins"]},{"name":"Kadence WP Blocks","description":"Kadence Blocks is a plugin for WordPress that provides a collection of custom blocks for the WordPress Block Editor, allowing users to create custom layouts and designs for their website without needing to know how to code.","website":"https://www.kadencewp.com/kadence-blocks/","common_platform_enumeration":"","icon":"Kadence WP.svg","categories":["WordPress plugins"]},{"name":"Yoast SEO:27.1.1","description":"Yoast SEO is a search engine optimisation plugin for WordPress and other platforms.","website":"https://yoast.com/wordpress/plugins/seo/","common_platform_enumeration":"","icon":"Yoast SEO.png","categories":["SEO","WordPress plugins"]},{"name":"PHP","description":"PHP is a general-purpose scripting language used for web development.","website":"https://php.net","common_platform_enumeration":"cpe:2.3:a:php:php:*:*:*:*:*:*:*:*","icon":"PHP.svg","categories":["Programming languages"]},{"name":"Engintron","description":"Engintron is a plugin that integrates Nginx to cPanel/WHM server.","website":"https://github.com/engintron/engintron","common_platform_enumeration":"","icon":"engintron.png","categories":["Web server extensions"]},{"name":"jQuery","description":"jQuery is a JavaScript library which is a free, open-source software designed to simplify HTML DOM tree traversal and manipulation, as well as event handling, CSS animation, and Ajax.","website":"https://jquery.com","common_platform_enumeration":"cpe:2.3:a:jquery:jquery:*:*:*:*:*:*:*:*","icon":"jQuery.svg","categories":["JavaScript libraries"]},{"name":"WordPress Block Editor","description":"Sites using the WordPress Block Editor, also known as Gutenberg.","website":"https://wordpress.org/gutenberg/","common_platform_enumeration":"","icon":"WordPress.svg","categories":["Page builders"]},{"name":"Spectra:2.19.20","description":"Spectra is a WordPress plugin that provides a collection of new and enhanced blocks for the WordPress Block editor.","website":"https://wpspectra.com","common_platform_enumeration":"","icon":"Spectra.svg","categories":["WordPress plugins"]}],"data":{"size":321567,"size_decoded":0,"mime_type":"text/html; charset=UTF-8","magic":"HTML document, Unicode text, UTF-8 text, with very long lines (25084)","md5":"811649c811295b5c4030e930dd751067","sha1":"057128836b4640dc14f625c0778cd27eb30193a5","sha256":"58394709128e946dfac6616bc66332d80b6056283e4c2176fbcadea00fe85d8c","sha512":"f333257f24de9cfd33b586e25036181e95ae2a2f882127d202d64a62c4670361141bcf05495ddb552aa1a5c5122c77b271768c6941564cfa64523da35b448c64","ssdeep":"6144:LL2cGFn5sCDD44ofF5pejZTXF3ft17CKgs90w6mI:Le5sCDD44Mjpev56mI","tlshash":"7c644de3d33c88b9297f42d2640533a77899b40adb1544f6f0f9c17865ac8b51af32a7","first_seen":"2026-03-12T13:00:03.879167Z","last_seen":"2026-03-12T13:00:03.879167Z","times_seen":1,"resource_available":false,"data":null}},"time_used":282,"timings":{"blocked":103,"dns":59,"connect":17,"send":0,"wait":76,"receive":0,"ssl":23},"alerts":{"ids":null,"analyzer":[{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-03-12","alert":"Phishing Block","trigger":"gbwhata.app","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-03-12","alert":"Sinkholed","trigger":"gbwhata.app","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-03-12","alert":"Sinkholed","trigger":"gbwhata.app","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-03-12","alert":"Sinkholed","trigger":"gbwhata.app","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-03-12","alert":"Sinkholed","trigger":"gbwhata.app","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"gbwhata.app/wp-content/plugins/kadence-blocks/dist/style-blocks-iconlist.css?ver=3.6.6","fqdn":"gbwhata.app","domain":"gbwhata.app","tld":"app"},"ip":{"addr":"37.49.227.147","port":443,"asn":3920,"as":"ESTOXY OU","country":"The Netherlands","country_code":"NL"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://gbwhata.app/","date":"2026-03-12T12:59:35.503Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"gbwhata.app","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Thu, 19 Feb 2026 08:00:05 GMT","end":"Wed, 20 May 2026 08:00:04 GMT"},"fingerprint":{"sha1":"F7:68:D7:CD:68:0C:05:00:13:71:A0:93:D1:77:B6:B1:41:5F:EC:8B","sha256":"D5:FF:3C:B4:A1:A4:55:FE:42:A5:38:44:C0:50:11:C9:E8:BC:48:0A:96:FE:1D:AE:92:4C:95:33:87:AD:31:B6"}}},"request":{"raw":"GET /wp-content/plugins/kadence-blocks/dist/style-blocks-iconlist.css?ver=3.6.6 HTTP/1.1\r\nHost: gbwhata.app\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://gbwhata.app/\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Thu, 12 Mar 2026 12:59:35 GMT\r\ncontent-type: text/css; charset=utf-8\r\nvary: Accept-Encoding\r\nlast-modified: Thu, 12 Mar 2026 09:21:02 GMT\r\nexpires: Sat, 11 Apr 2026 12:59:35 GMT\r\ncache-control: max-age=2592000\r\nx-xss-protection: 1; mode=block\r\nx-content-type-options: nosniff\r\nx-nginx-upstream-cache-status: STALE\r\nx-server-powered-by: Engintron\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Engintron","description":"Engintron is a plugin that integrates Nginx to cPanel/WHM server.","website":"https://github.com/engintron/engintron","common_platform_enumeration":"","icon":"engintron.png","categories":["Web server extensions"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":3593,"size_decoded":0,"mime_type":"text/css; charset=utf-8","magic":"ASCII text, with very long lines (3592)","md5":"b0c7a946011b094fc3209441d0613034","sha1":"d100b212e04efa69baee7415213188a741225a0a","sha256":"a60a3aac97eef7b794fe0498e4e13bf01e479e89257936f0db913f382ce496be","sha512":"2a4af128abc0fab4373e738d2820b12acc1d27da147fb0a38644aff20a07007649ef1c4793f09f64a4ffff2508f4d6469b26c06a96277c416a3e2036ba0ab838","ssdeep":"","tlshash":"15711ad30239ca5857ee64134485156d5c0ae00acef5a8e3a16bc77134bb1c22da7aff","first_seen":"2024-12-09T02:25:39.619717Z","last_seen":"2026-08-08T01:20:48.198436Z","times_seen":1748,"resource_available":false,"data":null}},"time_used":23,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":23,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-03-12","alert":"Sinkholed","trigger":"gbwhata.app","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-03-12","alert":"Sinkholed","trigger":"gbwhata.app","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-03-12","alert":"Sinkholed","trigger":"gbwhata.app","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-03-12","alert":"Sinkholed","trigger":"gbwhata.app","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-03-12","alert":"Phishing Block","trigger":"gbwhata.app","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"gbwhata.app/wp-includes/js/jquery/jquery.min.js?ver=3.7.1","fqdn":"gbwhata.app","domain":"gbwhata.app","tld":"app"},"ip":{"addr":"37.49.227.147","port":443,"asn":3920,"as":"ESTOXY OU","country":"The Netherlands","country_code":"NL"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://gbwhata.app/","date":"2026-03-12T12:59:35.507Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"gbwhata.app","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Thu, 19 Feb 2026 08:00:05 GMT","end":"Wed, 20 May 2026 08:00:04 GMT"},"fingerprint":{"sha1":"F7:68:D7:CD:68:0C:05:00:13:71:A0:93:D1:77:B6:B1:41:5F:EC:8B","sha256":"D5:FF:3C:B4:A1:A4:55:FE:42:A5:38:44:C0:50:11:C9:E8:BC:48:0A:96:FE:1D:AE:92:4C:95:33:87:AD:31:B6"}}},"request":{"raw":"GET /wp-includes/js/jquery/jquery.min.js?ver=3.7.1 HTTP/1.1\r\nHost: gbwhata.app\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://gbwhata.app/\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Thu, 12 Mar 2026 12:59:35 GMT\r\ncontent-type: text/javascript\r\nvary: Accept-Encoding\r\nlast-modified: Mon, 28 Aug 2023 21:14:24 GMT\r\nexpires: Sat, 11 Apr 2026 12:59:35 GMT\r\ncache-control: max-age=2592000\r\nx-xss-protection: 1; mode=block\r\nx-content-type-options: nosniff\r\nx-nginx-upstream-cache-status: STALE\r\nx-server-powered-by: Engintron\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Engintron","description":"Engintron is a plugin that integrates Nginx to cPanel/WHM server.","website":"https://github.com/engintron/engintron","common_platform_enumeration":"","icon":"engintron.png","categories":["Web server extensions"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":87553,"size_decoded":0,"mime_type":"text/javascript","magic":"JavaScript source, ASCII text, with very long lines (65447)","md5":"826eb77e86b02ab7724fe3d0141ff87c","sha1":"79cd3587d565afe290076a8d36c31c305a573d18","sha256":"cb6f2d32c49d1c2b25e9ffc9aaafa3f83075346c01bcd4ae6eb187392a4292cf","sha512":"fc79fdb76763025dc39fac045a215ff155ef2f492a0e9640079d6f089fa6218af2b3ab7c6eaf636827dee9294e6939a95ab24554e870c976679c25567ad6374c","ssdeep":"1536:0RUX9uDgwxcy2KVBNwchN6SLaHEk2BSrBESp+a/IEk4aAocVi8SMBQ47GKO:sHNwcv9VBQpLl88SMBQ47GKO","tlshash":"7483f8df77ca702247ab30b9006f550bf276199d684d4400f159d8e9bcb8a4a827bf7e","first_seen":"2023-11-03T09:26:43Z","last_seen":"2026-08-11T00:53:17.916724Z","times_seen":1013891,"resource_available":true,"data":null}},"time_used":31,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":31,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-03-12","alert":"Sinkholed","trigger":"gbwhata.app","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-03-12","alert":"Sinkholed","trigger":"gbwhata.app","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-03-12","alert":"Sinkholed","trigger":"gbwhata.app","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-03-12","alert":"Phishing Block","trigger":"gbwhata.app","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-03-12","alert":"Sinkholed","trigger":"gbwhata.app","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"gbwhata.app/wp-content/plugins/ultimate-addons-for-gutenberg/assets/js/spectra-block-positioning.min.js?ver=2.19.20","fqdn":"gbwhata.app","domain":"gbwhata.app","tld":"app"},"ip":{"addr":"37.49.227.147","port":443,"asn":3920,"as":"ESTOXY OU","country":"The Netherlands","country_code":"NL"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://gbwhata.app/","date":"2026-03-12T12:59:35.519Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"gbwhata.app","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Thu, 19 Feb 2026 08:00:05 GMT","end":"Wed, 20 May 2026 08:00:04 GMT"},"fingerprint":{"sha1":"F7:68:D7:CD:68:0C:05:00:13:71:A0:93:D1:77:B6:B1:41:5F:EC:8B","sha256":"D5:FF:3C:B4:A1:A4:55:FE:42:A5:38:44:C0:50:11:C9:E8:BC:48:0A:96:FE:1D:AE:92:4C:95:33:87:AD:31:B6"}}},"request":{"raw":"GET /wp-content/plugins/ultimate-addons-for-gutenberg/assets/js/spectra-block-positioning.min.js?ver=2.19.20 HTTP/1.1\r\nHost: gbwhata.app\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://gbwhata.app/\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Thu, 12 Mar 2026 12:59:35 GMT\r\ncontent-type: text/javascript; charset=utf-8\r\nvary: Accept-Encoding\r\nlast-modified: Fri, 13 Feb 2026 06:11:00 GMT\r\nexpires: Sat, 11 Apr 2026 12:59:35 GMT\r\ncache-control: max-age=2592000\r\nx-xss-protection: 1; mode=block\r\nx-content-type-options: nosniff\r\nx-nginx-upstream-cache-status: STALE\r\nx-server-powered-by: Engintron\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Engintron","description":"Engintron is a plugin that integrates Nginx to cPanel/WHM server.","website":"https://github.com/engintron/engintron","common_platform_enumeration":"","icon":"engintron.png","categories":["Web server extensions"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":4450,"size_decoded":0,"mime_type":"text/javascript; charset=utf-8","magic":"JavaScript source, ASCII text, with very long lines (4450), with no line terminators","md5":"eb5d7efb1bc838480f4ca0d67c124249","sha1":"0292349ba263236243a33fb7fdded5527e17bf6a","sha256":"bac6add1bf7ec50484cc9c7336db1c6333b0f911675eb2a95c6af5d28b15adab","sha512":"4c7a0a52d7917f8387fefa7e266a9fd195fa28d077bcfb767bd985d197a32a09068cc58101d275d921d954b3f2edd390bba382ef8662ff27a6fdc3fc007da1db","ssdeep":"48:czXyS1kQcF8P32bUIP9I9s0nv2RGc+Auuk7XulA4MzU27XuTIo657XufNPh4gnzS:q/q8EI9sgv4COIUMiAqNPfEPonGik","tlshash":"0a91b08003021e3bd2a3279571dab9443330456dd7e6d47183fa9a2b6398cc768b3af9","first_seen":"2024-10-13T03:11:06.787751Z","last_seen":"2026-08-10T14:02:55.500942Z","times_seen":6964,"resource_available":true,"data":null}},"time_used":44,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":44,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-03-12","alert":"Sinkholed","trigger":"gbwhata.app","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-03-12","alert":"Phishing Block","trigger":"gbwhata.app","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-03-12","alert":"Sinkholed","trigger":"gbwhata.app","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-03-12","alert":"Sinkholed","trigger":"gbwhata.app","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-03-12","alert":"Sinkholed","trigger":"gbwhata.app","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"gbwhata.app/wp-content/plugins/ultimate-addons-for-gutenberg/assets/js/post.min.js?ver=2.19.20","fqdn":"gbwhata.app","domain":"gbwhata.app","tld":"app"},"ip":{"addr":"37.49.227.147","port":443,"asn":3920,"as":"ESTOXY OU","country":"The Netherlands","country_code":"NL"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://gbwhata.app/","date":"2026-03-12T12:59:35.535Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"gbwhata.app","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Thu, 19 Feb 2026 08:00:05 GMT","end":"Wed, 20 May 2026 08:00:04 GMT"},"fingerprint":{"sha1":"F7:68:D7:CD:68:0C:05:00:13:71:A0:93:D1:77:B6:B1:41:5F:EC:8B","sha256":"D5:FF:3C:B4:A1:A4:55:FE:42:A5:38:44:C0:50:11:C9:E8:BC:48:0A:96:FE:1D:AE:92:4C:95:33:87:AD:31:B6"}}},"request":{"raw":"GET /wp-content/plugins/ultimate-addons-for-gutenberg/assets/js/post.min.js?ver=2.19.20 HTTP/1.1\r\nHost: gbwhata.app\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://gbwhata.app/\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Thu, 12 Mar 2026 12:59:35 GMT\r\ncontent-type: text/javascript; charset=utf-8\r\nvary: Accept-Encoding\r\nlast-modified: Fri, 13 Feb 2026 06:11:00 GMT\r\nexpires: Sat, 11 Apr 2026 12:59:35 GMT\r\ncache-control: max-age=2592000\r\nx-xss-protection: 1; mode=block\r\nx-content-type-options: nosniff\r\nx-nginx-upstream-cache-status: STALE\r\nx-server-powered-by: Engintron\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Engintron","description":"Engintron is a plugin that integrates Nginx to cPanel/WHM server.","website":"https://github.com/engintron/engintron","common_platform_enumeration":"","icon":"engintron.png","categories":["Web server extensions"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":4428,"size_decoded":0,"mime_type":"text/javascript; charset=utf-8","magic":"JavaScript source, ASCII text, with very long lines (4428), with no line terminators","md5":"b0953fd867945a970520868d934460b1","sha1":"b4905bab7382411fb994a54bcb4b24e6b3c70d27","sha256":"dd3ba112c64579b2f2962ed4dbc52beca7fd3cc59ed1dc88c36d757ce75d7759","sha512":"496958231fe76d4368c53eb7b05ae5b113804f8d3e3d8eac1fcee5d5df6cc1e6bedd93aa5798ad628c5351b58c404a754523f44cb9176362280dd521b42ba05a","ssdeep":"96:+1I291M3XdQqRnKy1k2lyOyxg131jXYwyDNtyBsnIAwjEa7dEFsh0YI:+1I291MndQq5Ky1k2lyOyx231jXZyDn/","tlshash":"b39175a05072ae71042a07db507b77857ca018afb80045dc2479cc9f7e9dce36bd1eba","first_seen":"2024-01-25T05:03:21Z","last_seen":"2026-08-10T14:02:55.585702Z","times_seen":2736,"resource_available":true,"data":null}},"time_used":36,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":36,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-03-12","alert":"Sinkholed","trigger":"gbwhata.app","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-03-12","alert":"Sinkholed","trigger":"gbwhata.app","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-03-12","alert":"Phishing Block","trigger":"gbwhata.app","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-03-12","alert":"Sinkholed","trigger":"gbwhata.app","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-03-12","alert":"Sinkholed","trigger":"gbwhata.app","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"gbwhata.app/wp-content/plugins/ultimate-addons-for-gutenberg/assets/js/timeline.min.js?ver=2.19.20","fqdn":"gbwhata.app","domain":"gbwhata.app","tld":"app"},"ip":{"addr":"37.49.227.147","port":443,"asn":3920,"as":"ESTOXY OU","country":"The Netherlands","country_code":"NL"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://gbwhata.app/","date":"2026-03-12T12:59:35.539Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"gbwhata.app","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Thu, 19 Feb 2026 08:00:05 GMT","end":"Wed, 20 May 2026 08:00:04 GMT"},"fingerprint":{"sha1":"F7:68:D7:CD:68:0C:05:00:13:71:A0:93:D1:77:B6:B1:41:5F:EC:8B","sha256":"D5:FF:3C:B4:A1:A4:55:FE:42:A5:38:44:C0:50:11:C9:E8:BC:48:0A:96:FE:1D:AE:92:4C:95:33:87:AD:31:B6"}}},"request":{"raw":"GET /wp-content/plugins/ultimate-addons-for-gutenberg/assets/js/timeline.min.js?ver=2.19.20 HTTP/1.1\r\nHost: gbwhata.app\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://gbwhata.app/\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Thu, 12 Mar 2026 12:59:35 GMT\r\ncontent-type: text/javascript; charset=utf-8\r\nvary: Accept-Encoding\r\nlast-modified: Fri, 13 Feb 2026 06:11:00 GMT\r\nexpires: Sat, 11 Apr 2026 12:59:35 GMT\r\ncache-control: max-age=2592000\r\nx-xss-protection: 1; mode=block\r\nx-content-type-options: nosniff\r\nx-nginx-upstream-cache-status: STALE\r\nx-server-powered-by: Engintron\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Engintron","description":"Engintron is a plugin that integrates Nginx to cPanel/WHM server.","website":"https://github.com/engintron/engintron","common_platform_enumeration":"","icon":"engintron.png","categories":["Web server extensions"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":4010,"size_decoded":0,"mime_type":"text/javascript; charset=utf-8","magic":"ASCII text, with very long lines (4010), with no line terminators","md5":"013a03f767932f4438dc57d9f42a0274","sha1":"605b05c1f4d243311566daaeef00c356ef3d2fb2","sha256":"c7e3fb2726c86a4b4ece873e6b87bfd52c0e2d692d72aaa396abdd0646918e94","sha512":"4c9a98e0dc9d4cca4a0bf521c4735fcd66dfcd00f35b0b384e8062b89a06ac2251a5866774612b66d9efe8b668595578dcfd7e120c9dec324edaee72bfc261bd","ssdeep":"","tlshash":"dc81aa22292096fa01eeaa4f919777c477380d67e64110bbc9e8cd5b7e788c367903d7","first_seen":"2023-05-09T14:36:57Z","last_seen":"2026-08-02T15:45:30.461206Z","times_seen":95,"resource_available":true,"data":null}},"time_used":36,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":36,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-03-12","alert":"Sinkholed","trigger":"gbwhata.app","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-03-12","alert":"Sinkholed","trigger":"gbwhata.app","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-03-12","alert":"Sinkholed","trigger":"gbwhata.app","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-03-12","alert":"Phishing Block","trigger":"gbwhata.app","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-03-12","alert":"Sinkholed","trigger":"gbwhata.app","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"gbwhata.app/wp-content/uploads/2025/07/gb-whatsapp-150x150.webp","fqdn":"gbwhata.app","domain":"gbwhata.app","tld":"app"},"ip":{"addr":"37.49.227.147","port":443,"asn":3920,"as":"ESTOXY OU","country":"The Netherlands","country_code":"NL"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://gbwhata.app/","date":"2026-03-12T12:59:36.094Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"gbwhata.app","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Thu, 19 Feb 2026 08:00:05 GMT","end":"Wed, 20 May 2026 08:00:04 GMT"},"fingerprint":{"sha1":"F7:68:D7:CD:68:0C:05:00:13:71:A0:93:D1:77:B6:B1:41:5F:EC:8B","sha256":"D5:FF:3C:B4:A1:A4:55:FE:42:A5:38:44:C0:50:11:C9:E8:BC:48:0A:96:FE:1D:AE:92:4C:95:33:87:AD:31:B6"}}},"request":{"raw":"GET /wp-content/uploads/2025/07/gb-whatsapp-150x150.webp HTTP/1.1\r\nHost: gbwhata.app\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://gbwhata.app/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Thu, 12 Mar 2026 12:59:36 GMT\r\ncontent-type: image/webp\r\ncontent-length: 3284\r\nlast-modified: Thu, 29 Jan 2026 06:21:39 GMT\r\nexpires: Mon, 11 May 2026 12:59:36 GMT\r\ncache-control: max-age=5184000\r\nx-xss-protection: 1; mode=block\r\nx-content-type-options: nosniff\r\nx-nginx-upstream-cache-status: HIT\r\nx-server-powered-by: Engintron\r\naccept-ranges: bytes\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"Engintron","description":"Engintron is a plugin that integrates Nginx to cPanel/WHM server.","website":"https://github.com/engintron/engintron","common_platform_enumeration":"","icon":"engintron.png","categories":["Web server extensions"]}],"data":{"size":3284,"size_decoded":0,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image","md5":"1c965eb6de2a71df1934f4c5ab4cd8b0","sha1":"d820b2051552102ead655584356d5b00f4c2fba3","sha256":"818fcb9d4b7221b626e7bfe1ba71fec9089c317eba36b57bf35aa3f4c36be8f7","sha512":"948ef39664d4c9f7fb3cded22ecb7519692f492fe49e2e90eb5da1389379f193e7227699bce2e60e542623f83e596f9163a2c150fb6e506f705c286176250ff8","ssdeep":"","tlshash":"4e616cf62d231da49c2e24597872275e4c33aca59de3eda02f2b313043801ae4e5069c","first_seen":"2026-01-12T11:33:19.864664Z","last_seen":"2026-05-12T09:13:14.863823Z","times_seen":17,"resource_available":false,"data":null}},"time_used":20,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":20,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-03-12","alert":"Sinkholed","trigger":"gbwhata.app","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-03-12","alert":"Sinkholed","trigger":"gbwhata.app","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-03-12","alert":"Phishing Block","trigger":"gbwhata.app","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-03-12","alert":"Sinkholed","trigger":"gbwhata.app","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-03-12","alert":"Sinkholed","trigger":"gbwhata.app","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"gbwhata.app/wp-content/plugins/kadence-blocks/dist/style-blocks-advancedbtn.css?ver=3.6.6","fqdn":"gbwhata.app","domain":"gbwhata.app","tld":"app"},"ip":{"addr":"37.49.227.147","port":443,"asn":3920,"as":"ESTOXY OU","country":"The Netherlands","country_code":"NL"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://gbwhata.app/","date":"2026-03-12T12:59:35.500Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"gbwhata.app","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Thu, 19 Feb 2026 08:00:05 GMT","end":"Wed, 20 May 2026 08:00:04 GMT"},"fingerprint":{"sha1":"F7:68:D7:CD:68:0C:05:00:13:71:A0:93:D1:77:B6:B1:41:5F:EC:8B","sha256":"D5:FF:3C:B4:A1:A4:55:FE:42:A5:38:44:C0:50:11:C9:E8:BC:48:0A:96:FE:1D:AE:92:4C:95:33:87:AD:31:B6"}}},"request":{"raw":"GET /wp-content/plugins/kadence-blocks/dist/style-blocks-advancedbtn.css?ver=3.6.6 HTTP/1.1\r\nHost: gbwhata.app\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://gbwhata.app/\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Thu, 12 Mar 2026 12:59:35 GMT\r\ncontent-type: text/css; charset=utf-8\r\nvary: Accept-Encoding\r\nlast-modified: Thu, 12 Mar 2026 09:21:02 GMT\r\nexpires: Sat, 11 Apr 2026 12:59:35 GMT\r\ncache-control: max-age=2592000\r\nx-xss-protection: 1; mode=block\r\nx-content-type-options: nosniff\r\nx-nginx-upstream-cache-status: STALE\r\nx-server-powered-by: Engintron\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"Engintron","description":"Engintron is a plugin that integrates Nginx to cPanel/WHM server.","website":"https://github.com/engintron/engintron","common_platform_enumeration":"","icon":"engintron.png","categories":["Web server extensions"]}],"data":{"size":2974,"size_decoded":0,"mime_type":"text/css; charset=utf-8","magic":"ASCII text, with very long lines (2973)","md5":"269a25e36685ed62df8264049036ed1c","sha1":"d741cf5da11d365a287002bd348fc48118e03b93","sha256":"c727b0e23570780c9bf62a0f92ad53e6c8ae377c78c8c1cd0f3c98dc9c073b49","sha512":"a23617f58bf0682615c5df0799526a65b05de56f9b769e73a5a545227dfdfb9e2f6b41ef33fa04cf697d54526bc2ed2ee4eb8f41b61a7154de56f2b5c9af973b","ssdeep":"","tlshash":"1c51f1e57360926c6f3e8bdcd21b516b6118f4c3e50e2a85b15fc5e0a2ce2e32dd2593","first_seen":"2025-08-16T12:12:58.728005Z","last_seen":"2026-08-10T23:33:38.558396Z","times_seen":3716,"resource_available":false,"data":null}},"time_used":18,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":18,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-03-12","alert":"Sinkholed","trigger":"gbwhata.app","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-03-12","alert":"Sinkholed","trigger":"gbwhata.app","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-03-12","alert":"Phishing Block","trigger":"gbwhata.app","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-03-12","alert":"Sinkholed","trigger":"gbwhata.app","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-03-12","alert":"Sinkholed","trigger":"gbwhata.app","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"www.googletagmanager.com/gtag/js?id=G-M1PE9MY73C","fqdn":"www.googletagmanager.com","domain":"googletagmanager.com","tld":"com"},"ip":{"addr":"192.178.203.97","port":443,"asn":15169,"as":"GOOGLE","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://gbwhata.app/","date":"2026-03-12T12:59:35.510Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.google-analytics.com","organization":""},"issuer":{"commonName":"WR2","organization":"Google Trust Services"},"validity":{"start":"Mon, 02 Feb 2026 08:36:37 GMT","end":"Mon, 27 Apr 2026 08:36:36 GMT"},"fingerprint":{"sha1":"8B:BA:E2:19:5D:6C:81:59:ED:D8:AA:3B:2D:5F:A3:A2:C8:A1:E3:DF","sha256":"B0:8C:FC:C1:98:34:EB:0E:FF:AB:13:B4:9E:AA:B1:7E:02:11:9A:93:31:F2:A1:0F:23:9E:2B:C3:6F:EC:26:F8"}}},"request":{"raw":"GET /gtag/js?id=G-M1PE9MY73C HTTP/1.1\r\nHost: www.googletagmanager.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://gbwhata.app/\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ncontent-type: application/javascript; charset=UTF-8\r\naccess-control-allow-origin: *\r\naccess-control-allow-credentials: true\r\naccess-control-allow-headers: Cache-Control\r\ncontent-encoding: br\r\nvary: Accept-Encoding\r\ndate: Thu, 12 Mar 2026 12:59:35 GMT\r\nexpires: Thu, 12 Mar 2026 12:59:35 GMT\r\ncache-control: private, max-age=900\r\nstrict-transport-security: max-age=31536000; includeSubDomains\r\ncross-origin-resource-policy: cross-origin\r\nserver: Google Tag Manager\r\ncontent-length: 151799\r\nx-xss-protection: 0\r\nalt-svc: h3=\":443\"; ma=2592000,h3-29=\":443\"; ma=2592000\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":458775,"size_decoded":0,"mime_type":"application/javascript; charset=UTF-8","magic":"JavaScript source, ASCII text, with very long lines (6033)","md5":"288aed1d73428a48ae3074392d9177c8","sha1":"e923d707e944c6a080fe41c73888cbced90dbd49","sha256":"cf7c8448efe2fa4b5ada4057d92554921bce4242937870b17ed8352aa2451d3f","sha512":"94195a6bf19b11793cd8001ed679b29bb667825bfdd297ca45b570b99d2358aeaf43c1b0e8fe2a6ac70a23310afdcd4e43972e0d9c2f23bc4a299f48c098b39f","ssdeep":"6144:tC8J5tq8191Gzb0mD8+t3Rnp/XAphEn22cf0NTNBg:drq81XJmD86n2Iu","tlshash":"a0a4faceb3d670629396f478503f018ba57b29a2b45cc89af189cce42d7469a4137f7c","first_seen":"2026-03-12T13:00:03.900581Z","last_seen":"2026-03-12T13:00:03.900581Z","times_seen":1,"resource_available":true,"data":null}},"time_used":843,"timings":{"blocked":273,"dns":1,"connect":57,"send":0,"wait":97,"receive":168,"ssl":243},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"gbwhata.app/wp-content/uploads/2025/07/Anti-Delete.webp","fqdn":"gbwhata.app","domain":"gbwhata.app","tld":"app"},"ip":{"addr":"37.49.227.147","port":443,"asn":3920,"as":"ESTOXY OU","country":"The Netherlands","country_code":"NL"},"is_navigation_request":false,"resource_type":"imageset","requested_by":"https://gbwhata.app/","date":"2026-03-12T12:59:35.518Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"gbwhata.app","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Thu, 19 Feb 2026 08:00:05 GMT","end":"Wed, 20 May 2026 08:00:04 GMT"},"fingerprint":{"sha1":"F7:68:D7:CD:68:0C:05:00:13:71:A0:93:D1:77:B6:B1:41:5F:EC:8B","sha256":"D5:FF:3C:B4:A1:A4:55:FE:42:A5:38:44:C0:50:11:C9:E8:BC:48:0A:96:FE:1D:AE:92:4C:95:33:87:AD:31:B6"}}},"request":{"raw":"GET /wp-content/uploads/2025/07/Anti-Delete.webp HTTP/1.1\r\nHost: gbwhata.app\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://gbwhata.app/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Thu, 12 Mar 2026 12:59:35 GMT\r\ncontent-type: image/webp\r\ncontent-length: 28892\r\nlast-modified: Thu, 29 Jan 2026 06:21:39 GMT\r\nexpires: Mon, 11 May 2026 12:59:35 GMT\r\ncache-control: max-age=5184000\r\nx-xss-protection: 1; mode=block\r\nx-content-type-options: nosniff\r\nx-nginx-upstream-cache-status: STALE\r\nx-server-powered-by: Engintron\r\naccept-ranges: bytes\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Engintron","description":"Engintron is a plugin that integrates Nginx to cPanel/WHM server.","website":"https://github.com/engintron/engintron","common_platform_enumeration":"","icon":"engintron.png","categories":["Web server extensions"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":28892,"size_decoded":0,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image, VP8 encoding, 576x1024, Scaling: [none]x[none], YUV color, decoders should clamp","md5":"02afed10423dcfa3a1992ebc1db93ea0","sha1":"0ecf5306d8cd90bbe5f06147e694bbd7693ae18a","sha256":"f9b80159c152f4f1b9adf22ad02cadc38583f050ab1e9a0314b9e72a9c68cad8","sha512":"9709e2333d627dc30c21612bf6bfb19538f1abce9aca3d50053291786dc74926b74991c3589459ac34c7f93cad88357ca3a08565d1cc60e60a9c854bffe67523","ssdeep":"768:1PZ/e/0ziEluDJgdSbb4E4/XNELFczXp2hp:1B/eGiE6Q04E4v+hclw","tlshash":"ead2d18a360fa955e46ed162050e81952fc09c97872f05787f93a2c1ddac93b7b50ff0","first_seen":"2026-03-06T12:46:09.049259Z","last_seen":"2026-03-12T13:00:03.901305Z","times_seen":4,"resource_available":false,"data":null}},"time_used":44,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":43,"receive":1,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-03-12","alert":"Sinkholed","trigger":"gbwhata.app","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-03-12","alert":"Phishing Block","trigger":"gbwhata.app","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-03-12","alert":"Sinkholed","trigger":"gbwhata.app","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-03-12","alert":"Sinkholed","trigger":"gbwhata.app","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-03-12","alert":"Sinkholed","trigger":"gbwhata.app","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"gbwhata.app/wp-content/plugins/ultimate-addons-for-gutenberg/assets/js/faq.min.js?ver=2.19.20","fqdn":"gbwhata.app","domain":"gbwhata.app","tld":"app"},"ip":{"addr":"37.49.227.147","port":443,"asn":3920,"as":"ESTOXY OU","country":"The Netherlands","country_code":"NL"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://gbwhata.app/","date":"2026-03-12T12:59:35.521Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"gbwhata.app","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Thu, 19 Feb 2026 08:00:05 GMT","end":"Wed, 20 May 2026 08:00:04 GMT"},"fingerprint":{"sha1":"F7:68:D7:CD:68:0C:05:00:13:71:A0:93:D1:77:B6:B1:41:5F:EC:8B","sha256":"D5:FF:3C:B4:A1:A4:55:FE:42:A5:38:44:C0:50:11:C9:E8:BC:48:0A:96:FE:1D:AE:92:4C:95:33:87:AD:31:B6"}}},"request":{"raw":"GET /wp-content/plugins/ultimate-addons-for-gutenberg/assets/js/faq.min.js?ver=2.19.20 HTTP/1.1\r\nHost: gbwhata.app\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://gbwhata.app/\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Thu, 12 Mar 2026 12:59:35 GMT\r\ncontent-type: text/javascript; charset=utf-8\r\nvary: Accept-Encoding\r\nlast-modified: Fri, 13 Feb 2026 06:11:00 GMT\r\nexpires: Sat, 11 Apr 2026 12:59:35 GMT\r\ncache-control: max-age=2592000\r\nx-xss-protection: 1; mode=block\r\nx-content-type-options: nosniff\r\nx-nginx-upstream-cache-status: STALE\r\nx-server-powered-by: Engintron\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"Engintron","description":"Engintron is a plugin that integrates Nginx to cPanel/WHM server.","website":"https://github.com/engintron/engintron","common_platform_enumeration":"","icon":"engintron.png","categories":["Web server extensions"]}],"data":{"size":4110,"size_decoded":0,"mime_type":"text/javascript; charset=utf-8","magic":"JavaScript source, ASCII text, with very long lines (4110), with no line terminators","md5":"8440185826d6eb907dd29131821eadc2","sha1":"9d8386225a777c48327b1bdb04fd48c0bef23c97","sha256":"128346e15870a3513fb1ae9665dd3f7cb2bea87b7a912f01e97ce3689b103d10","sha512":"4368d72e850ed5f465693e2ef0410e8736d5efd58b492a7f92af7e7f5c42d475852c314618bbb85e6d6005e5ceb03010d833704bbe5a02dcb1675d6db1aeb732","ssdeep":"96:LDyacrU6tdDG4woPMaqv4UryZi36lk5/DBX7:/yf/tdDG4Py4UryZS6lkrL","tlshash":"7d81046027003ff724d7628b844bb8c5b16068c99f65a8b4772c982f295dece21f17f5","first_seen":"2023-03-14T02:20:22Z","last_seen":"2026-08-10T13:56:43.163235Z","times_seen":1922,"resource_available":true,"data":null}},"time_used":41,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":41,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-03-12","alert":"Sinkholed","trigger":"gbwhata.app","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-03-12","alert":"Sinkholed","trigger":"gbwhata.app","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-03-12","alert":"Sinkholed","trigger":"gbwhata.app","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-03-12","alert":"Phishing Block","trigger":"gbwhata.app","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-03-12","alert":"Sinkholed","trigger":"gbwhata.app","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"vu.upshotspaolo.com/smyJYhZULVGFU/133339","fqdn":"vu.upshotspaolo.com","domain":"upshotspaolo.com","tld":"com"},"ip":{"addr":"172.241.53.157","port":443,"asn":7979,"as":"SERVERS-COM","country":"The Netherlands","country_code":"NL"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://gbwhata.app/","date":"2026-03-12T12:59:35.512Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"vu.upshotspaolo.com","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Mon, 09 Feb 2026 16:10:51 GMT","end":"Sun, 10 May 2026 16:10:50 GMT"},"fingerprint":{"sha1":"1B:B0:21:6B:3C:5E:58:13:06:0A:F5:79:CD:C3:49:9A:1E:41:4A:E9","sha256":"41:40:A8:DC:C1:F0:F1:81:0E:A8:B9:2D:7F:48:C9:8F:CC:94:11:C1:2F:9F:ED:93:3E:FD:B9:BE:79:BF:62:4C"}}},"request":{"raw":"GET /smyJYhZULVGFU/133339 HTTP/1.1\r\nHost: vu.upshotspaolo.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://gbwhata.app/\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Thu, 12 Mar 2026 12:59:35 GMT\r\ncontent-type: application/javascript; charset=utf-8\r\ncontent-length: 5\r\nvary: Origin\r\naccess-control-expose-headers: *\r\naccess-control-allow-credentials: true\r\naccess-control-allow-origin: *\r\naccess-control-allow-headers: Accept, Content-Type, Content-Length, GYFR29QT4J80VDR0ZHSJ, X-Forwarded-For, X-Requested-With, Cache-Control, Pragma, Expires, Credentials\r\naccess-control-allow-methods: GET, HEAD, POST, PUT, OPTIONS\r\naccept-ch: sec-ch-ua-platform-version,sec-ch-ua-model,sec-ch-ua-full-version,sec-ch-ua-full-version-list\r\nset-cookie: GGI10=GxcBAMSqOZXNrL4QnWwrgcaH4b9A6y0/1PiHf0P6aBSRIJC8J9WEwuZV69W3UeMOT6Qv8v/BBqGZwQhNLTQ0x9JM1wGhKiYwjieVJ8P9e6UWMEAYY4Bh2M4p/ST6SdkZ7l1fGvnuQDv2iQS7oRYarifXaazApqH5TugQGjGVfdM3L+U29ffDZgQIYyEjHioYW6RN3932KDHRvE6vN/imiBJwEdMhIiqDzfZXJJtiBVsEMSdD9PvCxF+IUuCPog7hrv8/; max-age=3600000; path=/; secure; SameSite=None\nGUI42=G2EDAMTEuZQ//aRr5AuTQjos0ID8nlOfJ7bAPHf/skf3BB1TsCAV6dsyxMEegwZmXqU9o+qC/D+I3wuLggCaT8kFA9GtIC5oYowPyaD1x0rmq4YCIC6nZExtfXl9oLTzka3r+s/QLm7VFh/DoLxVzoOgOYZ1dEyjPz4vxKo5el5Ygj6NPFOHR9pDii4w1GrfMh3uIePnv1V8TCGsEGpSXIUZ1BbMLuyAmKEuShdEyt/s444G0SzskbUCYlN9o8XEmz8vmA/xI1dRS09pIh0OYuW6sqI1wlI7DJWI3iW9hchbitIUBiE5D4WvdKhVm7YC4qgWrysu4wUFSvYIS1oqVEW0AOI3HmcBs3bqPriMIhNZbWynZGfcAjxdaQ1GzwvlLCuSj8F/cpU0dgHrOdV3UQo3OAntCc7dYnGOLgm5YN0Rkv9SeKYVUwS93/MA; max-age=3600000; path=/; secure; SameSite=None\r\nstrict-transport-security: max-age=1\r\nx-content-type-options: nosniff\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":5,"size_decoded":0,"mime_type":"application/javascript; charset=utf-8","magic":"ASCII text, with no line terminators","md5":"f7a2939527fd9e68723da600e96d76bd","sha1":"a9e717b6364d2895ee0a716050db32ca0ef1bb42","sha256":"d810f5146f4cd1517512a6e31946e764a73c58fb01427aae88d42cc2ae28718a","sha512":"e6956ec633c76eb3ebc408528f950b81373238cd1d5b9fff5ddd97089ea14a1ff5934f23769bac5d93cc4cdb6a1fbc4ce69baebfb940a55d8a7a89caccaf92b5","ssdeep":"","tlshash":"ec300000003000000000000000000000000c0000000000000000000000000c00000000","first_seen":"2023-03-07T01:14:39Z","last_seen":"2026-08-10T21:54:24.417642Z","times_seen":15866,"resource_available":true,"data":null}},"time_used":513,"timings":{"blocked":230,"dns":214,"connect":18,"send":0,"wait":22,"receive":0,"ssl":26},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"gbwhata.app/wp-includes/js/wp-emoji-release.min.js?ver=6.9.4","fqdn":"gbwhata.app","domain":"gbwhata.app","tld":"app"},"ip":{"addr":"37.49.227.147","port":443,"asn":3920,"as":"ESTOXY OU","country":"The Netherlands","country_code":"NL"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://gbwhata.app/","date":"2026-03-12T12:59:35.939Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"gbwhata.app","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Thu, 19 Feb 2026 08:00:05 GMT","end":"Wed, 20 May 2026 08:00:04 GMT"},"fingerprint":{"sha1":"F7:68:D7:CD:68:0C:05:00:13:71:A0:93:D1:77:B6:B1:41:5F:EC:8B","sha256":"D5:FF:3C:B4:A1:A4:55:FE:42:A5:38:44:C0:50:11:C9:E8:BC:48:0A:96:FE:1D:AE:92:4C:95:33:87:AD:31:B6"}}},"request":{"raw":"GET /wp-includes/js/wp-emoji-release.min.js?ver=6.9.4 HTTP/1.1\r\nHost: gbwhata.app\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://gbwhata.app/\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Thu, 12 Mar 2026 12:59:35 GMT\r\ncontent-type: text/javascript; charset=utf-8\r\nvary: Accept-Encoding\r\nlast-modified: Wed, 03 Dec 2025 05:34:45 GMT\r\nexpires: Sat, 11 Apr 2026 12:59:35 GMT\r\ncache-control: max-age=2592000\r\nx-xss-protection: 1; mode=block\r\nx-content-type-options: nosniff\r\nx-nginx-upstream-cache-status: STALE\r\nx-server-powered-by: Engintron\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Engintron","description":"Engintron is a plugin that integrates Nginx to cPanel/WHM server.","website":"https://github.com/engintron/engintron","common_platform_enumeration":"","icon":"engintron.png","categories":["Web server extensions"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":22762,"size_decoded":0,"mime_type":"text/javascript; charset=utf-8","magic":"JavaScript source, ASCII text, with very long lines (19823)","md5":"f0cc9ba5cf46af0cd73d521803e3b07e","sha1":"7d2a74f87dc70a39eccce3bae1d4cc404cb134f4","sha256":"fd59b0ebf6282ed71647bf2f6e0d1925bbfd1f270865a832079ebb60259aabca","sha512":"7ec44f08676c195547a623504c7105ef3d0acea5839675599598043f3e0b5a3386452e3db6fbea90722f7be9e6effdae1b89c49e2b05b22b8c415616e07d471d","ssdeep":"384:WzevzApRZTbXU/3o//bEPhXgA5POkpJTX:Wsk9XU/3o//YpXgAs+hX","tlshash":"7fa2959ba33a4e8f343e3bd78d968f4dc9da555321c0e079dbefb6c169a00568274c80","first_seen":"2025-11-10T19:52:32.864936Z","last_seen":"2026-08-11T00:45:32.443827Z","times_seen":310847,"resource_available":true,"data":null}},"time_used":22,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":22,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-03-12","alert":"Phishing Block","trigger":"gbwhata.app","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-03-12","alert":"Sinkholed","trigger":"gbwhata.app","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-03-12","alert":"Sinkholed","trigger":"gbwhata.app","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-03-12","alert":"Sinkholed","trigger":"gbwhata.app","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-03-12","alert":"Sinkholed","trigger":"gbwhata.app","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"gbwhata.app/wp-content/plugins/ultimate-addons-for-gutenberg/assets/css/spectra-block-positioning.min.css?ver=2.19.20","fqdn":"gbwhata.app","domain":"gbwhata.app","tld":"app"},"ip":{"addr":"37.49.227.147","port":443,"asn":3920,"as":"ESTOXY OU","country":"The Netherlands","country_code":"NL"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://gbwhata.app/","date":"2026-03-12T12:59:35.485Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"gbwhata.app","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Thu, 19 Feb 2026 08:00:05 GMT","end":"Wed, 20 May 2026 08:00:04 GMT"},"fingerprint":{"sha1":"F7:68:D7:CD:68:0C:05:00:13:71:A0:93:D1:77:B6:B1:41:5F:EC:8B","sha256":"D5:FF:3C:B4:A1:A4:55:FE:42:A5:38:44:C0:50:11:C9:E8:BC:48:0A:96:FE:1D:AE:92:4C:95:33:87:AD:31:B6"}}},"request":{"raw":"GET /wp-content/plugins/ultimate-addons-for-gutenberg/assets/css/spectra-block-positioning.min.css?ver=2.19.20 HTTP/1.1\r\nHost: gbwhata.app\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://gbwhata.app/\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Thu, 12 Mar 2026 12:59:35 GMT\r\ncontent-type: text/css; charset=utf-8\r\nvary: Accept-Encoding\r\nlast-modified: Fri, 13 Feb 2026 06:11:00 GMT\r\nexpires: Sat, 11 Apr 2026 12:59:35 GMT\r\ncache-control: max-age=2592000\r\nx-xss-protection: 1; mode=block\r\nx-content-type-options: nosniff\r\nx-nginx-upstream-cache-status: STALE\r\nx-server-powered-by: Engintron\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"Engintron","description":"Engintron is a plugin that integrates Nginx to cPanel/WHM server.","website":"https://github.com/engintron/engintron","common_platform_enumeration":"","icon":"engintron.png","categories":["Web server extensions"]}],"data":{"size":335,"size_decoded":0,"mime_type":"text/css; charset=utf-8","magic":"ASCII text, with very long lines (335), with no line terminators","md5":"7b197104afdf6f3f918fd92a5aa1c657","sha1":"f40aef07a4afcbe679aaff6f3a8cef6a20cb1fe6","sha256":"edba0fcba74296c16b2ce9016b6fb6f20c7cf68f3d48665c6d5fd3947824b449","sha512":"24dd57053c08b906a9ebb9ca256b09fdd6ce2cd6e62b1a923fb163d5b992b5edf99717f05bffc820e3fe5abb6d420420d971eb44094773c64fb802b7b3c18304","ssdeep":"","tlshash":"58e0df5197007ea1d867b34925e658148230ce00dfd22cbd732ad383f2c309018b3bc8","first_seen":"2024-10-13T03:11:06.747915Z","last_seen":"2026-08-10T15:15:02.841671Z","times_seen":7147,"resource_available":false,"data":null}},"time_used":21,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":21,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-03-12","alert":"Sinkholed","trigger":"gbwhata.app","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-03-12","alert":"Sinkholed","trigger":"gbwhata.app","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-03-12","alert":"Sinkholed","trigger":"gbwhata.app","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-03-12","alert":"Sinkholed","trigger":"gbwhata.app","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-03-12","alert":"Phishing Block","trigger":"gbwhata.app","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"gbwhata.app/wp-content/themes/generatepress/assets/css/main.min.css?ver=3.6.1","fqdn":"gbwhata.app","domain":"gbwhata.app","tld":"app"},"ip":{"addr":"37.49.227.147","port":443,"asn":3920,"as":"ESTOXY OU","country":"The Netherlands","country_code":"NL"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://gbwhata.app/","date":"2026-03-12T12:59:35.495Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"gbwhata.app","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Thu, 19 Feb 2026 08:00:05 GMT","end":"Wed, 20 May 2026 08:00:04 GMT"},"fingerprint":{"sha1":"F7:68:D7:CD:68:0C:05:00:13:71:A0:93:D1:77:B6:B1:41:5F:EC:8B","sha256":"D5:FF:3C:B4:A1:A4:55:FE:42:A5:38:44:C0:50:11:C9:E8:BC:48:0A:96:FE:1D:AE:92:4C:95:33:87:AD:31:B6"}}},"request":{"raw":"GET /wp-content/themes/generatepress/assets/css/main.min.css?ver=3.6.1 HTTP/1.1\r\nHost: gbwhata.app\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://gbwhata.app/\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Thu, 12 Mar 2026 12:59:35 GMT\r\ncontent-type: text/css\r\nvary: Accept-Encoding\r\nlast-modified: Thu, 29 Jan 2026 06:21:39 GMT\r\nexpires: Sat, 11 Apr 2026 12:59:35 GMT\r\ncache-control: max-age=2592000\r\nx-xss-protection: 1; mode=block\r\nx-content-type-options: nosniff\r\nx-nginx-upstream-cache-status: STALE\r\nx-server-powered-by: Engintron\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Engintron","description":"Engintron is a plugin that integrates Nginx to cPanel/WHM server.","website":"https://github.com/engintron/engintron","common_platform_enumeration":"","icon":"engintron.png","categories":["Web server extensions"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":19512,"size_decoded":0,"mime_type":"text/css","magic":"ASCII text, with very long lines (19512), with no line terminators","md5":"b7e067012db6249774c29e4c56b4f2c0","sha1":"7523574074e98d492a8da515f0daf7446cc504e0","sha256":"c839222ec3a5037179749a843610820436bf575a591a3e0b45404f1970a2cc56","sha512":"c77b609b39ddf4ab8b6a89aba1b8daa2e8824312b1032eed8270c82167794dd438ec9878dc5e5e19853565f3f95c24315e3f164b5919cbed8c772e84f7078bba","ssdeep":"384:sk1JAWvwWZ34igipTh3dGr5PL3NatuylxQp9svaQW4M+ght5NsKa4TqSD6CE:hAWvwWZ34igipTh3dGr5PL3NatuylxQo","tlshash":"3f9209a2aaf1242cb177831ffbd0e16c3565d522d30b95dab897d700c9cab67026379c","first_seen":"2024-08-28T15:41:57Z","last_seen":"2026-08-10T23:24:35.545427Z","times_seen":17506,"resource_available":false,"data":null}},"time_used":21,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":21,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-03-12","alert":"Sinkholed","trigger":"gbwhata.app","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-03-12","alert":"Sinkholed","trigger":"gbwhata.app","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-03-12","alert":"Sinkholed","trigger":"gbwhata.app","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-03-12","alert":"Sinkholed","trigger":"gbwhata.app","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-03-12","alert":"Phishing Block","trigger":"gbwhata.app","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"gbwhata.app/wp-content/plugins/kadence-blocks/dist/style-blocks-image.css?ver=3.6.6","fqdn":"gbwhata.app","domain":"gbwhata.app","tld":"app"},"ip":{"addr":"37.49.227.147","port":443,"asn":3920,"as":"ESTOXY OU","country":"The Netherlands","country_code":"NL"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://gbwhata.app/","date":"2026-03-12T12:59:35.497Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"gbwhata.app","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Thu, 19 Feb 2026 08:00:05 GMT","end":"Wed, 20 May 2026 08:00:04 GMT"},"fingerprint":{"sha1":"F7:68:D7:CD:68:0C:05:00:13:71:A0:93:D1:77:B6:B1:41:5F:EC:8B","sha256":"D5:FF:3C:B4:A1:A4:55:FE:42:A5:38:44:C0:50:11:C9:E8:BC:48:0A:96:FE:1D:AE:92:4C:95:33:87:AD:31:B6"}}},"request":{"raw":"GET /wp-content/plugins/kadence-blocks/dist/style-blocks-image.css?ver=3.6.6 HTTP/1.1\r\nHost: gbwhata.app\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://gbwhata.app/\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Thu, 12 Mar 2026 12:59:35 GMT\r\ncontent-type: text/css; charset=utf-8\r\nvary: Accept-Encoding\r\nlast-modified: Thu, 12 Mar 2026 09:21:02 GMT\r\nexpires: Sat, 11 Apr 2026 12:59:35 GMT\r\ncache-control: max-age=2592000\r\nx-xss-protection: 1; mode=block\r\nx-content-type-options: nosniff\r\nx-nginx-upstream-cache-status: STALE\r\nx-server-powered-by: Engintron\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"Engintron","description":"Engintron is a plugin that integrates Nginx to cPanel/WHM server.","website":"https://github.com/engintron/engintron","common_platform_enumeration":"","icon":"engintron.png","categories":["Web server extensions"]}],"data":{"size":4610,"size_decoded":0,"mime_type":"text/css; charset=utf-8","magic":"ASCII text, with very long lines (4609)","md5":"2f90364edcb60044b1fd9532a4a985b0","sha1":"93b70d7e19873223de4ed0a1d4d49cd38580e6cb","sha256":"d09143fa935421f575c6afda3c9d1412e1262736aeb8d9067d1dc0704a31c0ab","sha512":"223f2a00acb83053da99cd882f832e944239fa77c44f97b3663da81b0ba7f98ca883c066d65a46e3c60fff9b0ff4018a6bc900df8512811bb58b92c65ea395c2","ssdeep":"48:90TWuKWzfwInzjnqKdWIz8JIR5feEX8Q0zANIv8/4pdQ2UjiVn0oiiq/l0QJ0TKV:eTTvmVyGAeakAGkQZxZM0fTbPFFI","tlshash":"c4913200632b0cfa483fcb89f5ca51652c19ad85535edfcba299d050738e5d78d23a2b","first_seen":"2024-10-21T15:58:43.037831Z","last_seen":"2026-08-10T23:33:38.563662Z","times_seen":4061,"resource_available":false,"data":null}},"time_used":21,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":21,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-03-12","alert":"Sinkholed","trigger":"gbwhata.app","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-03-12","alert":"Sinkholed","trigger":"gbwhata.app","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-03-12","alert":"Sinkholed","trigger":"gbwhata.app","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-03-12","alert":"Phishing Block","trigger":"gbwhata.app","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-03-12","alert":"Sinkholed","trigger":"gbwhata.app","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"gbwhata.app/wp-content/plugins/kadence-blocks/includes/assets/js/kb-table-of-contents.min.js?ver=3.6.6","fqdn":"gbwhata.app","domain":"gbwhata.app","tld":"app"},"ip":{"addr":"37.49.227.147","port":443,"asn":3920,"as":"ESTOXY OU","country":"The Netherlands","country_code":"NL"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://gbwhata.app/","date":"2026-03-12T12:59:35.551Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"gbwhata.app","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Thu, 19 Feb 2026 08:00:05 GMT","end":"Wed, 20 May 2026 08:00:04 GMT"},"fingerprint":{"sha1":"F7:68:D7:CD:68:0C:05:00:13:71:A0:93:D1:77:B6:B1:41:5F:EC:8B","sha256":"D5:FF:3C:B4:A1:A4:55:FE:42:A5:38:44:C0:50:11:C9:E8:BC:48:0A:96:FE:1D:AE:92:4C:95:33:87:AD:31:B6"}}},"request":{"raw":"GET /wp-content/plugins/kadence-blocks/includes/assets/js/kb-table-of-contents.min.js?ver=3.6.6 HTTP/1.1\r\nHost: gbwhata.app\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://gbwhata.app/\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Thu, 12 Mar 2026 12:59:35 GMT\r\ncontent-type: text/javascript; charset=utf-8\r\nvary: Accept-Encoding\r\nlast-modified: Thu, 12 Mar 2026 09:21:02 GMT\r\nexpires: Sat, 11 Apr 2026 12:59:35 GMT\r\ncache-control: max-age=2592000\r\nx-xss-protection: 1; mode=block\r\nx-content-type-options: nosniff\r\nx-nginx-upstream-cache-status: STALE\r\nx-server-powered-by: Engintron\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Engintron","description":"Engintron is a plugin that integrates Nginx to cPanel/WHM server.","website":"https://github.com/engintron/engintron","common_platform_enumeration":"","icon":"engintron.png","categories":["Web server extensions"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":6996,"size_decoded":0,"mime_type":"text/javascript; charset=utf-8","magic":"JavaScript source, Unicode text, UTF-8 text, with very long lines (6979), with no line terminators","md5":"85d689528824ee0d6c33926748d38a85","sha1":"78d51b247a0a0604f9354cc9199e3204bf6ce1e4","sha256":"b26a33e40fef02b91eab1747461f2c7755b266c51db7068d3000194fc8b1095f","sha512":"15714b2920be9d991c9229cdfd3169670011a19da07fe09af93916f03358da8381e0c79191a2d6d7aeb36d7f45bc3546d47f673c7a69d583886942e93f07fae7","ssdeep":"192:q7ZRKpAcsc04i0dWWTq7tuJOKFUnqoHyf3:4sq0dWW272jFUnZHA3","tlshash":"69e132ada10020f35ddf46c1d1bad79b7460b322b64348a15419edf61629ffb20c6fb9","first_seen":"2024-03-10T01:04:08Z","last_seen":"2026-08-09T17:59:33.214664Z","times_seen":857,"resource_available":true,"data":null}},"time_used":28,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":28,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-03-12","alert":"Sinkholed","trigger":"gbwhata.app","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-03-12","alert":"Sinkholed","trigger":"gbwhata.app","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-03-12","alert":"Sinkholed","trigger":"gbwhata.app","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-03-12","alert":"Sinkholed","trigger":"gbwhata.app","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-03-12","alert":"Phishing Block","trigger":"gbwhata.app","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"gbwhata.app/wp-content/uploads/uag-plugin/assets/0/uag-css-10.css?ver=1773307383","fqdn":"gbwhata.app","domain":"gbwhata.app","tld":"app"},"ip":{"addr":"37.49.227.147","port":443,"asn":3920,"as":"ESTOXY OU","country":"The Netherlands","country_code":"NL"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://gbwhata.app/","date":"2026-03-12T12:59:35.490Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"gbwhata.app","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Thu, 19 Feb 2026 08:00:05 GMT","end":"Wed, 20 May 2026 08:00:04 GMT"},"fingerprint":{"sha1":"F7:68:D7:CD:68:0C:05:00:13:71:A0:93:D1:77:B6:B1:41:5F:EC:8B","sha256":"D5:FF:3C:B4:A1:A4:55:FE:42:A5:38:44:C0:50:11:C9:E8:BC:48:0A:96:FE:1D:AE:92:4C:95:33:87:AD:31:B6"}}},"request":{"raw":"GET /wp-content/uploads/uag-plugin/assets/0/uag-css-10.css?ver=1773307383 HTTP/1.1\r\nHost: gbwhata.app\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://gbwhata.app/\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Thu, 12 Mar 2026 12:59:35 GMT\r\ncontent-type: text/css; charset=utf-8\r\nvary: Accept-Encoding\r\nlast-modified: Thu, 12 Mar 2026 09:23:05 GMT\r\nexpires: Sat, 11 Apr 2026 12:59:35 GMT\r\ncache-control: max-age=2592000\r\nx-xss-protection: 1; mode=block\r\nx-content-type-options: nosniff\r\nx-nginx-upstream-cache-status: STALE\r\nx-server-powered-by: Engintron\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Engintron","description":"Engintron is a plugin that integrates Nginx to cPanel/WHM server.","website":"https://github.com/engintron/engintron","common_platform_enumeration":"","icon":"engintron.png","categories":["Web server extensions"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":99763,"size_decoded":0,"mime_type":"text/css; charset=utf-8","magic":"ASCII text, with very long lines (24744)","md5":"c0ddb5674b3e7b486313359bf143c58a","sha1":"d767783b6e5f1c93526084e3bcd76ed960b55a16","sha256":"400ba364c966f92f4b367b60afb10a52f6255383b769397252e0deafc9179bf1","sha512":"b26aa4f6f5cd8104ba66ad9a4b4698ced953f6a65fab2a0e3ce1260686bc58a9d751f71a109ddc1ebcc86a269ea02bb726ffaae36952bb7295a65cc2aab61ff4","ssdeep":"768:te7Fyv4q/OSYXJRyjsmmmmmmm4W/0JLRdYrsUP:te7Fywq/OSYXJRyjfN","tlshash":"9ea397113e2597d824aed65e98633bd0572c9e239e4209fffd91d803fdaa0d14ae134b","first_seen":"2026-03-06T12:46:09.05461Z","last_seen":"2026-03-12T13:00:03.907771Z","times_seen":4,"resource_available":false,"data":null}},"time_used":22,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":22,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-03-12","alert":"Sinkholed","trigger":"gbwhata.app","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-03-12","alert":"Sinkholed","trigger":"gbwhata.app","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-03-12","alert":"Phishing Block","trigger":"gbwhata.app","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-03-12","alert":"Sinkholed","trigger":"gbwhata.app","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-03-12","alert":"Sinkholed","trigger":"gbwhata.app","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"gbwhata.app/wp-content/plugins/kadence-blocks/dist/style-blocks-tableofcontents.css?ver=3.6.6","fqdn":"gbwhata.app","domain":"gbwhata.app","tld":"app"},"ip":{"addr":"37.49.227.147","port":443,"asn":3920,"as":"ESTOXY OU","country":"The Netherlands","country_code":"NL"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://gbwhata.app/","date":"2026-03-12T12:59:35.502Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"gbwhata.app","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Thu, 19 Feb 2026 08:00:05 GMT","end":"Wed, 20 May 2026 08:00:04 GMT"},"fingerprint":{"sha1":"F7:68:D7:CD:68:0C:05:00:13:71:A0:93:D1:77:B6:B1:41:5F:EC:8B","sha256":"D5:FF:3C:B4:A1:A4:55:FE:42:A5:38:44:C0:50:11:C9:E8:BC:48:0A:96:FE:1D:AE:92:4C:95:33:87:AD:31:B6"}}},"request":{"raw":"GET /wp-content/plugins/kadence-blocks/dist/style-blocks-tableofcontents.css?ver=3.6.6 HTTP/1.1\r\nHost: gbwhata.app\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://gbwhata.app/\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Thu, 12 Mar 2026 12:59:35 GMT\r\ncontent-type: text/css; charset=utf-8\r\nvary: Accept-Encoding\r\nlast-modified: Thu, 12 Mar 2026 09:21:02 GMT\r\nexpires: Sat, 11 Apr 2026 12:59:35 GMT\r\ncache-control: max-age=2592000\r\nx-xss-protection: 1; mode=block\r\nx-content-type-options: nosniff\r\nx-nginx-upstream-cache-status: STALE\r\nx-server-powered-by: Engintron\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Engintron","description":"Engintron is a plugin that integrates Nginx to cPanel/WHM server.","website":"https://github.com/engintron/engintron","common_platform_enumeration":"","icon":"engintron.png","categories":["Web server extensions"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":8484,"size_decoded":0,"mime_type":"text/css; charset=utf-8","magic":"ASCII text, with very long lines (8483)","md5":"3285117b746e5692dbe08148387496a2","sha1":"054cff6c08d58197d4863f492a83299ecd91ccf6","sha256":"e8408b87a7ab943a5b572bc69af36ee3e8a4f999215e249df59085e90db62fb1","sha512":"28e6ec41de13d4d5e88375922211cffe0543fcf967af91490a448c627770a02ed0c4776886698ccd10fdca2c11bdd9b5c5f8d33aa0656b1bb4fec0a79e3eb519","ssdeep":"48:I/P/eKmID+sd3PwsYO3kow37ow373NF6T3y3/QnMnon+nx5NWl4rk7eR2EO8sRmW:zHIr0E2/zibwDT1tn3UA8pm/AOaYO8g/","tlshash":"5d02f6b1d20a21169faac124b1c531863a29f38bdd9b29ff5097c82e33fd3552585f27","first_seen":"2025-01-27T22:47:44.742194Z","last_seen":"2026-08-05T02:51:51.86738Z","times_seen":685,"resource_available":false,"data":null}},"time_used":23,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":23,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-03-12","alert":"Sinkholed","trigger":"gbwhata.app","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-03-12","alert":"Sinkholed","trigger":"gbwhata.app","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-03-12","alert":"Sinkholed","trigger":"gbwhata.app","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-03-12","alert":"Sinkholed","trigger":"gbwhata.app","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-03-12","alert":"Phishing Block","trigger":"gbwhata.app","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"gbwhata.app/wp-includes/js/jquery/jquery-migrate.min.js?ver=3.4.1","fqdn":"gbwhata.app","domain":"gbwhata.app","tld":"app"},"ip":{"addr":"37.49.227.147","port":443,"asn":3920,"as":"ESTOXY OU","country":"The Netherlands","country_code":"NL"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://gbwhata.app/","date":"2026-03-12T12:59:35.508Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"gbwhata.app","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Thu, 19 Feb 2026 08:00:05 GMT","end":"Wed, 20 May 2026 08:00:04 GMT"},"fingerprint":{"sha1":"F7:68:D7:CD:68:0C:05:00:13:71:A0:93:D1:77:B6:B1:41:5F:EC:8B","sha256":"D5:FF:3C:B4:A1:A4:55:FE:42:A5:38:44:C0:50:11:C9:E8:BC:48:0A:96:FE:1D:AE:92:4C:95:33:87:AD:31:B6"}}},"request":{"raw":"GET /wp-includes/js/jquery/jquery-migrate.min.js?ver=3.4.1 HTTP/1.1\r\nHost: gbwhata.app\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://gbwhata.app/\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Thu, 12 Mar 2026 12:59:35 GMT\r\ncontent-type: text/javascript\r\nvary: Accept-Encoding\r\nlast-modified: Fri, 09 Jun 2023 09:49:24 GMT\r\nexpires: Sat, 11 Apr 2026 12:59:35 GMT\r\ncache-control: max-age=2592000\r\nx-xss-protection: 1; mode=block\r\nx-content-type-options: nosniff\r\nx-nginx-upstream-cache-status: STALE\r\nx-server-powered-by: Engintron\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"Engintron","description":"Engintron is a plugin that integrates Nginx to cPanel/WHM server.","website":"https://github.com/engintron/engintron","common_platform_enumeration":"","icon":"engintron.png","categories":["Web server extensions"]}],"data":{"size":13577,"size_decoded":0,"mime_type":"text/javascript","magic":"JavaScript source, ASCII text, with very long lines (13479)","md5":"9ffeb32e2d9efbf8f70caabded242267","sha1":"3ad0c10e501ac2a9bfa18f9cd7e700219b378738","sha256":"5274f11e6fb32ae0cf2dfb9f8043272865c397a7c4223b4cfa7d50ea52fbde89","sha512":"8d6be545508a1c38278b8ad780c3758ae48a25e4e12eee443375aa56031d9b356f8c90f22d4f251140fa3f65603af40523165e33cae2e2d62fc78ec106e3d731","ssdeep":"192:5rprDN+sag6ifKIUpQI99P1tLm9kdgyq1+J3aCJQ+h4MPLORq:5rprxaefKI0LP19m4q1WW+h4Mjp","tlshash":"9952c8adb56679724eb721b8f03bd24f71b205de560d8940d19cc4f6282dc6e812bf78","first_seen":"2023-05-09T19:21:05Z","last_seen":"2026-08-11T00:53:17.905318Z","times_seen":928849,"resource_available":true,"data":null}},"time_used":31,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":31,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-03-12","alert":"Sinkholed","trigger":"gbwhata.app","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-03-12","alert":"Sinkholed","trigger":"gbwhata.app","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-03-12","alert":"Sinkholed","trigger":"gbwhata.app","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-03-12","alert":"Sinkholed","trigger":"gbwhata.app","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-03-12","alert":"Phishing Block","trigger":"gbwhata.app","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"gbwhata.app/wp-content/uploads/2025/07/gb-whatsapp-150x150.webp","fqdn":"gbwhata.app","domain":"gbwhata.app","tld":"app"},"ip":{"addr":"37.49.227.147","port":443,"asn":3920,"as":"ESTOXY OU","country":"The Netherlands","country_code":"NL"},"is_navigation_request":false,"resource_type":"imageset","requested_by":"https://gbwhata.app/","date":"2026-03-12T12:59:35.514Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"gbwhata.app","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Thu, 19 Feb 2026 08:00:05 GMT","end":"Wed, 20 May 2026 08:00:04 GMT"},"fingerprint":{"sha1":"F7:68:D7:CD:68:0C:05:00:13:71:A0:93:D1:77:B6:B1:41:5F:EC:8B","sha256":"D5:FF:3C:B4:A1:A4:55:FE:42:A5:38:44:C0:50:11:C9:E8:BC:48:0A:96:FE:1D:AE:92:4C:95:33:87:AD:31:B6"}}},"request":{"raw":"GET /wp-content/uploads/2025/07/gb-whatsapp-150x150.webp HTTP/1.1\r\nHost: gbwhata.app\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://gbwhata.app/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Thu, 12 Mar 2026 12:59:35 GMT\r\ncontent-type: image/webp\r\ncontent-length: 3284\r\nlast-modified: Thu, 29 Jan 2026 06:21:39 GMT\r\nexpires: Mon, 11 May 2026 12:59:35 GMT\r\ncache-control: max-age=5184000\r\nx-xss-protection: 1; mode=block\r\nx-content-type-options: nosniff\r\nx-nginx-upstream-cache-status: STALE\r\nx-server-powered-by: Engintron\r\naccept-ranges: bytes\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"Engintron","description":"Engintron is a plugin that integrates Nginx to cPanel/WHM server.","website":"https://github.com/engintron/engintron","common_platform_enumeration":"","icon":"engintron.png","categories":["Web server extensions"]}],"data":{"size":3284,"size_decoded":0,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image","md5":"1c965eb6de2a71df1934f4c5ab4cd8b0","sha1":"d820b2051552102ead655584356d5b00f4c2fba3","sha256":"818fcb9d4b7221b626e7bfe1ba71fec9089c317eba36b57bf35aa3f4c36be8f7","sha512":"948ef39664d4c9f7fb3cded22ecb7519692f492fe49e2e90eb5da1389379f193e7227699bce2e60e542623f83e596f9163a2c150fb6e506f705c286176250ff8","ssdeep":"","tlshash":"4e616cf62d231da49c2e24597872275e4c33aca59de3eda02f2b313043801ae4e5069c","first_seen":"2026-01-12T11:33:19.864664Z","last_seen":"2026-05-12T09:13:14.863823Z","times_seen":17,"resource_available":false,"data":null}},"time_used":29,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":29,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-03-12","alert":"Sinkholed","trigger":"gbwhata.app","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-03-12","alert":"Sinkholed","trigger":"gbwhata.app","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-03-12","alert":"Phishing Block","trigger":"gbwhata.app","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-03-12","alert":"Sinkholed","trigger":"gbwhata.app","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-03-12","alert":"Sinkholed","trigger":"gbwhata.app","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"gbwhata.app/wp-content/uploads/2025/07/Ghost-Mode.webp","fqdn":"gbwhata.app","domain":"gbwhata.app","tld":"app"},"ip":{"addr":"37.49.227.147","port":443,"asn":3920,"as":"ESTOXY OU","country":"The Netherlands","country_code":"NL"},"is_navigation_request":false,"resource_type":"imageset","requested_by":"https://gbwhata.app/","date":"2026-03-12T12:59:35.516Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"gbwhata.app","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Thu, 19 Feb 2026 08:00:05 GMT","end":"Wed, 20 May 2026 08:00:04 GMT"},"fingerprint":{"sha1":"F7:68:D7:CD:68:0C:05:00:13:71:A0:93:D1:77:B6:B1:41:5F:EC:8B","sha256":"D5:FF:3C:B4:A1:A4:55:FE:42:A5:38:44:C0:50:11:C9:E8:BC:48:0A:96:FE:1D:AE:92:4C:95:33:87:AD:31:B6"}}},"request":{"raw":"GET /wp-content/uploads/2025/07/Ghost-Mode.webp HTTP/1.1\r\nHost: gbwhata.app\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://gbwhata.app/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Thu, 12 Mar 2026 12:59:35 GMT\r\ncontent-type: image/webp\r\ncontent-length: 28038\r\nlast-modified: Thu, 29 Jan 2026 06:21:39 GMT\r\nexpires: Mon, 11 May 2026 12:59:35 GMT\r\ncache-control: max-age=5184000\r\nx-xss-protection: 1; mode=block\r\nx-content-type-options: nosniff\r\nx-nginx-upstream-cache-status: STALE\r\nx-server-powered-by: Engintron\r\naccept-ranges: bytes\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"Engintron","description":"Engintron is a plugin that integrates Nginx to cPanel/WHM server.","website":"https://github.com/engintron/engintron","common_platform_enumeration":"","icon":"engintron.png","categories":["Web server extensions"]}],"data":{"size":28038,"size_decoded":0,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image, VP8 encoding, 576x1024, Scaling: [none]x[none], YUV color, decoders should clamp","md5":"764ec4292a096e14d665b0b2ca4ed704","sha1":"e7c7087101776b062f720127269c251bd0f815b5","sha256":"18f0e63fffcb184da8d9a0093e4700f3bb1017ab95ac83f71ddb251424fb7b2b","sha512":"41ecc00019381d1f0a3659baf6afe098f5d8b1df574fe37334488a796935bd2c154a4c7153e62550d5218f9d645b3fdc3675e4d42c3d291a3fcc50dfafeeb74b","ssdeep":"384:cCzi/UenlfZ5RTye2Yr5P/HkebbF7FHiOryz91u1DYSMCgR4qgAWS/oa9UrPHDF1:G3nlZTye2S5VPFtiayKp+R4UZ/87F","tlshash":"0dc2d14542f3b415cf3692b76e1c9e666f80bd52979ac3f5e2cb0bbe634590e88d401c","first_seen":"2026-03-06T12:46:09.066313Z","last_seen":"2026-03-12T13:00:03.909426Z","times_seen":4,"resource_available":false,"data":null}},"time_used":38,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":34,"receive":4,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-03-12","alert":"Phishing Block","trigger":"gbwhata.app","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-03-12","alert":"Sinkholed","trigger":"gbwhata.app","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-03-12","alert":"Sinkholed","trigger":"gbwhata.app","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-03-12","alert":"Sinkholed","trigger":"gbwhata.app","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-03-12","alert":"Sinkholed","trigger":"gbwhata.app","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"gbwhata.app/wp-content/themes/generatepress/assets/js/menu.min.js?ver=3.6.1","fqdn":"gbwhata.app","domain":"gbwhata.app","tld":"app"},"ip":{"addr":"37.49.227.147","port":443,"asn":3920,"as":"ESTOXY OU","country":"The Netherlands","country_code":"NL"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://gbwhata.app/","date":"2026-03-12T12:59:35.544Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"gbwhata.app","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Thu, 19 Feb 2026 08:00:05 GMT","end":"Wed, 20 May 2026 08:00:04 GMT"},"fingerprint":{"sha1":"F7:68:D7:CD:68:0C:05:00:13:71:A0:93:D1:77:B6:B1:41:5F:EC:8B","sha256":"D5:FF:3C:B4:A1:A4:55:FE:42:A5:38:44:C0:50:11:C9:E8:BC:48:0A:96:FE:1D:AE:92:4C:95:33:87:AD:31:B6"}}},"request":{"raw":"GET /wp-content/themes/generatepress/assets/js/menu.min.js?ver=3.6.1 HTTP/1.1\r\nHost: gbwhata.app\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://gbwhata.app/\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Thu, 12 Mar 2026 12:59:35 GMT\r\ncontent-type: text/javascript\r\nvary: Accept-Encoding\r\nlast-modified: Thu, 29 Jan 2026 06:21:39 GMT\r\nexpires: Sat, 11 Apr 2026 12:59:35 GMT\r\ncache-control: max-age=2592000\r\nx-xss-protection: 1; mode=block\r\nx-content-type-options: nosniff\r\nx-nginx-upstream-cache-status: STALE\r\nx-server-powered-by: Engintron\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Engintron","description":"Engintron is a plugin that integrates Nginx to cPanel/WHM server.","website":"https://github.com/engintron/engintron","common_platform_enumeration":"","icon":"engintron.png","categories":["Web server extensions"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":7333,"size_decoded":0,"mime_type":"text/javascript","magic":"JavaScript source, ASCII text, with very long lines (7333), with no line terminators","md5":"67148b2ff82038d0faf6385f182c5644","sha1":"7452d643e468caf6db8ecf07618f1cb7ff3f7651","sha256":"5af760e4297b064a2150dcd5f63d748a06dfa8b618c9e9d43a87c4ac74fa3974","sha512":"24cb8e3c4f17abc7cf1ba96407ac1eda4e6c5d7c669ac213024a9b428e19cef574cefdb06c4dd28c013f1f8d3c775fb8f98c5a15c142783ba0f25b46f0c6e7ad","ssdeep":"192:iQqHlWQZgROnqWgpkgJMhqDi92FY+alT/fnGtxTbvm:bqHngROnvgJUqDi9cNYTnGvTbvm","tlshash":"6ee112fa964412bb04ef29ca74e6e5c07b7568fdea0184302579c84d1fe8dc202e6bf5","first_seen":"2024-08-31T11:00:29Z","last_seen":"2026-08-10T23:27:46.5044Z","times_seen":19268,"resource_available":true,"data":null}},"time_used":31,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":31,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-03-12","alert":"Sinkholed","trigger":"gbwhata.app","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-03-12","alert":"Phishing Block","trigger":"gbwhata.app","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-03-12","alert":"Sinkholed","trigger":"gbwhata.app","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-03-12","alert":"Sinkholed","trigger":"gbwhata.app","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-03-12","alert":"Sinkholed","trigger":"gbwhata.app","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"gbwhata.app/wp-content/uploads/2025/07/gb-whatsapp.webp","fqdn":"gbwhata.app","domain":"gbwhata.app","tld":"app"},"ip":{"addr":"37.49.227.147","port":443,"asn":3920,"as":"ESTOXY OU","country":"The Netherlands","country_code":"NL"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://gbwhata.app/","date":"2026-03-12T12:59:35.513Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"gbwhata.app","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Thu, 19 Feb 2026 08:00:05 GMT","end":"Wed, 20 May 2026 08:00:04 GMT"},"fingerprint":{"sha1":"F7:68:D7:CD:68:0C:05:00:13:71:A0:93:D1:77:B6:B1:41:5F:EC:8B","sha256":"D5:FF:3C:B4:A1:A4:55:FE:42:A5:38:44:C0:50:11:C9:E8:BC:48:0A:96:FE:1D:AE:92:4C:95:33:87:AD:31:B6"}}},"request":{"raw":"GET /wp-content/uploads/2025/07/gb-whatsapp.webp HTTP/1.1\r\nHost: gbwhata.app\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://gbwhata.app/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Thu, 12 Mar 2026 12:59:35 GMT\r\ncontent-type: image/webp\r\ncontent-length: 6370\r\nlast-modified: Thu, 29 Jan 2026 06:21:39 GMT\r\nexpires: Mon, 11 May 2026 12:59:35 GMT\r\ncache-control: max-age=5184000\r\nx-xss-protection: 1; mode=block\r\nx-content-type-options: nosniff\r\nx-nginx-upstream-cache-status: STALE\r\nx-server-powered-by: Engintron\r\naccept-ranges: bytes\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Engintron","description":"Engintron is a plugin that integrates Nginx to cPanel/WHM server.","website":"https://github.com/engintron/engintron","common_platform_enumeration":"","icon":"engintron.png","categories":["Web server extensions"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":6370,"size_decoded":0,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image","md5":"cb6941b4aecd7f2f692a0d8fa31b2025","sha1":"f3baa96c16f62cb87c864d93a088558d63996a74","sha256":"a31f350f552aab4e67b4e02f2f900ffe75261954be646895b52eaa7d93863430","sha512":"2320c93bb1dbafd81ec0312b2d73314099593dd4e8b55b91ed1e0f1ce4ef701d83589f87da87a6d005f2375e31cf7ecfe8b9adeb6be9e34b21fed66fbd595cd8","ssdeep":"96:kUCQCSe9rvF/1wVpAT/7k34QU75csWmTC7w10C+rmM8Ldq2r409J9qBzzTjPmTSt:D7Qrt+VA434RcsWmTCw10CTPJohYe","tlshash":"87d14a287cf322631caf33f50eda69c24d8286abcd914149bd9dddc79f019617a23943","first_seen":"2025-08-31T18:05:34.602045Z","last_seen":"2026-05-12T09:13:14.845011Z","times_seen":22,"resource_available":false,"data":null}},"time_used":29,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":29,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-03-12","alert":"Sinkholed","trigger":"gbwhata.app","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-03-12","alert":"Sinkholed","trigger":"gbwhata.app","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-03-12","alert":"Sinkholed","trigger":"gbwhata.app","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-03-12","alert":"Sinkholed","trigger":"gbwhata.app","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-03-12","alert":"Phishing Block","trigger":"gbwhata.app","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"gbwhata.app/wp-content/uploads/uag-plugin/assets/0/uag-js-10.js?ver=1773307383","fqdn":"gbwhata.app","domain":"gbwhata.app","tld":"app"},"ip":{"addr":"37.49.227.147","port":443,"asn":3920,"as":"ESTOXY OU","country":"The Netherlands","country_code":"NL"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://gbwhata.app/","date":"2026-03-12T12:59:35.541Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"gbwhata.app","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Thu, 19 Feb 2026 08:00:05 GMT","end":"Wed, 20 May 2026 08:00:04 GMT"},"fingerprint":{"sha1":"F7:68:D7:CD:68:0C:05:00:13:71:A0:93:D1:77:B6:B1:41:5F:EC:8B","sha256":"D5:FF:3C:B4:A1:A4:55:FE:42:A5:38:44:C0:50:11:C9:E8:BC:48:0A:96:FE:1D:AE:92:4C:95:33:87:AD:31:B6"}}},"request":{"raw":"GET /wp-content/uploads/uag-plugin/assets/0/uag-js-10.js?ver=1773307383 HTTP/1.1\r\nHost: gbwhata.app\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://gbwhata.app/\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Thu, 12 Mar 2026 12:59:35 GMT\r\ncontent-type: text/javascript; charset=utf-8\r\nvary: Accept-Encoding\r\nlast-modified: Thu, 12 Mar 2026 09:23:05 GMT\r\nexpires: Sat, 11 Apr 2026 12:59:35 GMT\r\ncache-control: max-age=2592000\r\nx-xss-protection: 1; mode=block\r\nx-content-type-options: nosniff\r\nx-nginx-upstream-cache-status: STALE\r\nx-server-powered-by: Engintron\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"Engintron","description":"Engintron is a plugin that integrates Nginx to cPanel/WHM server.","website":"https://github.com/engintron/engintron","common_platform_enumeration":"","icon":"engintron.png","categories":["Web server extensions"]}],"data":{"size":934,"size_decoded":0,"mime_type":"text/javascript; charset=utf-8","magic":"ASCII text","md5":"15c7c4d5f65c4761f5aaaec1c18e07a1","sha1":"99ed58c660ff2820c08185c1947760c3e01595df","sha256":"ab13bfe3d592587c1cdc7c5c1da3e3063fbb81d8ee156e2b37cf82868f289d4f","sha512":"c274194aa2fed0310849a0a7942bff9becdeec922e95eef29b0e2435239ea04c7f4650376e5724d23b0d3bf9332cad94ebe118a21a35944e308e20e86e77fa83","ssdeep":"","tlshash":"6c1126539b344de402edf13e912ea9f011ce0e1bb18959f2e801cf87793cd9622b1027","first_seen":"2026-03-06T12:46:09.057999Z","last_seen":"2026-05-12T09:13:14.843597Z","times_seen":15,"resource_available":true,"data":null}},"time_used":33,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":33,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-03-12","alert":"Sinkholed","trigger":"gbwhata.app","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-03-12","alert":"Sinkholed","trigger":"gbwhata.app","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-03-12","alert":"Sinkholed","trigger":"gbwhata.app","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-03-12","alert":"Phishing Block","trigger":"gbwhata.app","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-03-12","alert":"Sinkholed","trigger":"gbwhata.app","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"s.w.org/images/core/emoji/17.0.2/svg/1f4ce.svg","fqdn":"s.w.org","domain":"w.org","tld":"org"},"ip":{"addr":"192.0.77.48","port":443,"asn":2635,"as":"AUTOMATTIC","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://gbwhata.app/","date":"2026-03-12T12:59:36.010Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"s.w.org","organization":""},"issuer":{"commonName":"E8","organization":"Let's Encrypt"},"validity":{"start":"Mon, 23 Feb 2026 19:44:39 GMT","end":"Sun, 24 May 2026 19:44:38 GMT"},"fingerprint":{"sha1":"56:DE:8F:AC:F7:7D:09:E2:76:F8:9A:D7:5D:9D:16:D0:8A:77:E9:1B","sha256":"F4:65:F9:07:07:7E:3C:D6:2E:1F:02:76:FC:58:8D:E2:FE:E1:4B:A5:5A:D5:4C:AE:78:56:62:41:A7:28:80:CC"}}},"request":{"raw":"GET /images/core/emoji/17.0.2/svg/1f4ce.svg HTTP/1.1\r\nHost: s.w.org\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://gbwhata.app/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Thu, 12 Mar 2026 12:59:36 GMT\r\ncontent-type: image/svg+xml\r\nlast-modified: Fri, 07 Nov 2025 05:26:00 GMT\r\nvary: Accept-Encoding\r\nx-frame-options: SAMEORIGIN\r\ncontent-encoding: br\r\nexpires: Thu, 31 Dec 2037 23:55:55 GMT\r\ncache-control: max-age=315360000\r\naccess-control-allow-methods: GET, HEAD\r\naccess-control-allow-origin: *\r\nalt-svc: h3=\":443\"; ma=86400\r\nx-nc: HIT arn 10\r\nserver-timing: a8c-cdn, dc;desc=arn, cache;desc=HIT;dur=1.0\r\nx-content-type-options: nosniff\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":952,"size_decoded":0,"mime_type":"image/svg+xml","magic":"SVG Scalable Vector Graphics image","md5":"be2be087dbf2f58ac10f91f16b7e6b0a","sha1":"a5cadecc9a683a7a35b2d8403eb572a2cdcfc906","sha256":"9f2588001d33bbd832b3ceeb48dbe2ae15101d47a433bd40fbebaa7e8eac3a62","sha512":"1a23d771e70c9503cbb203f48d27c691679ea017de29af6cbd55c6f42ece1e98895b81e311d3cbc647e31f8c9d88a1dcada31ef6eccb252e1a027bdce54c3fb7","ssdeep":"","tlshash":"f1112ddb0f70e1c191dff689ee3628a6200ab0fe463226c196918f1d89c38d1d407f30","first_seen":"2025-05-10T18:35:54.04394Z","last_seen":"2026-08-09T11:17:03.477757Z","times_seen":102,"resource_available":false,"data":null}},"time_used":71,"timings":{"blocked":29,"dns":1,"connect":8,"send":0,"wait":11,"receive":0,"ssl":19},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"gbwhata.app/wp-content/uploads/2025/07/gb-whatsapp.webp","fqdn":"gbwhata.app","domain":"gbwhata.app","tld":"app"},"ip":{"addr":"37.49.227.147","port":443,"asn":3920,"as":"ESTOXY OU","country":"The Netherlands","country_code":"NL"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://gbwhata.app/","date":"2026-03-12T12:59:36.093Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"gbwhata.app","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Thu, 19 Feb 2026 08:00:05 GMT","end":"Wed, 20 May 2026 08:00:04 GMT"},"fingerprint":{"sha1":"F7:68:D7:CD:68:0C:05:00:13:71:A0:93:D1:77:B6:B1:41:5F:EC:8B","sha256":"D5:FF:3C:B4:A1:A4:55:FE:42:A5:38:44:C0:50:11:C9:E8:BC:48:0A:96:FE:1D:AE:92:4C:95:33:87:AD:31:B6"}}},"request":{"raw":"GET /wp-content/uploads/2025/07/gb-whatsapp.webp HTTP/1.1\r\nHost: gbwhata.app\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://gbwhata.app/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Thu, 12 Mar 2026 12:59:36 GMT\r\ncontent-type: image/webp\r\ncontent-length: 6370\r\nlast-modified: Thu, 29 Jan 2026 06:21:39 GMT\r\nexpires: Mon, 11 May 2026 12:59:36 GMT\r\ncache-control: max-age=5184000\r\nx-xss-protection: 1; mode=block\r\nx-content-type-options: nosniff\r\nx-nginx-upstream-cache-status: HIT\r\nx-server-powered-by: Engintron\r\naccept-ranges: bytes\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Engintron","description":"Engintron is a plugin that integrates Nginx to cPanel/WHM server.","website":"https://github.com/engintron/engintron","common_platform_enumeration":"","icon":"engintron.png","categories":["Web server extensions"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":6370,"size_decoded":0,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image","md5":"cb6941b4aecd7f2f692a0d8fa31b2025","sha1":"f3baa96c16f62cb87c864d93a088558d63996a74","sha256":"a31f350f552aab4e67b4e02f2f900ffe75261954be646895b52eaa7d93863430","sha512":"2320c93bb1dbafd81ec0312b2d73314099593dd4e8b55b91ed1e0f1ce4ef701d83589f87da87a6d005f2375e31cf7ecfe8b9adeb6be9e34b21fed66fbd595cd8","ssdeep":"96:kUCQCSe9rvF/1wVpAT/7k34QU75csWmTC7w10C+rmM8Ldq2r409J9qBzzTjPmTSt:D7Qrt+VA434RcsWmTCw10CTPJohYe","tlshash":"87d14a287cf322631caf33f50eda69c24d8286abcd914149bd9dddc79f019617a23943","first_seen":"2025-08-31T18:05:34.602045Z","last_seen":"2026-05-12T09:13:14.845011Z","times_seen":22,"resource_available":false,"data":null}},"time_used":21,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":20,"receive":1,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-03-12","alert":"Phishing Block","trigger":"gbwhata.app","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-03-12","alert":"Sinkholed","trigger":"gbwhata.app","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-03-12","alert":"Sinkholed","trigger":"gbwhata.app","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-03-12","alert":"Sinkholed","trigger":"gbwhata.app","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-03-12","alert":"Sinkholed","trigger":"gbwhata.app","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"gbwhata.app/wp-content/themes/generatepress/assets/css/components/widget-areas.min.css?ver=3.6.1","fqdn":"gbwhata.app","domain":"gbwhata.app","tld":"app"},"ip":{"addr":"37.49.227.147","port":443,"asn":3920,"as":"ESTOXY OU","country":"The Netherlands","country_code":"NL"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://gbwhata.app/","date":"2026-03-12T12:59:35.493Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"gbwhata.app","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Thu, 19 Feb 2026 08:00:05 GMT","end":"Wed, 20 May 2026 08:00:04 GMT"},"fingerprint":{"sha1":"F7:68:D7:CD:68:0C:05:00:13:71:A0:93:D1:77:B6:B1:41:5F:EC:8B","sha256":"D5:FF:3C:B4:A1:A4:55:FE:42:A5:38:44:C0:50:11:C9:E8:BC:48:0A:96:FE:1D:AE:92:4C:95:33:87:AD:31:B6"}}},"request":{"raw":"GET /wp-content/themes/generatepress/assets/css/components/widget-areas.min.css?ver=3.6.1 HTTP/1.1\r\nHost: gbwhata.app\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://gbwhata.app/\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Thu, 12 Mar 2026 12:59:35 GMT\r\ncontent-type: text/css\r\nvary: Accept-Encoding\r\nlast-modified: Thu, 29 Jan 2026 06:21:39 GMT\r\nexpires: Sat, 11 Apr 2026 12:59:35 GMT\r\ncache-control: max-age=2592000\r\nx-xss-protection: 1; mode=block\r\nx-content-type-options: nosniff\r\nx-nginx-upstream-cache-status: STALE\r\nx-server-powered-by: Engintron\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Engintron","description":"Engintron is a plugin that integrates Nginx to cPanel/WHM server.","website":"https://github.com/engintron/engintron","common_platform_enumeration":"","icon":"engintron.png","categories":["Web server extensions"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":3356,"size_decoded":0,"mime_type":"text/css","magic":"ASCII text, with very long lines (3356), with no line terminators","md5":"f9b0b1948dca272b16005165ab098f29","sha1":"6e6ae044e8392eb26831476b5340808d076ff76f","sha256":"f67e99114807ecac9bba6fbb9f81eea467c50c9f03b59974fe696bdfab6ba227","sha512":"ef44daa0524b9154a0d83b57e66accc70284c318893df7ccee6de0bcb7e9f537d1fd47ca4e52c88de7d519290f53c76641812f1cdd0ddb4b5e90b6acb5718477","ssdeep":"","tlshash":"1b61ac2078759d2eb937450676f120086450a6ebea5a9cfb7cbeff76c4825c04c364ed","first_seen":"2024-02-10T03:24:26Z","last_seen":"2026-08-11T00:48:23.157336Z","times_seen":6927,"resource_available":false,"data":null}},"time_used":21,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":21,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-03-12","alert":"Sinkholed","trigger":"gbwhata.app","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-03-12","alert":"Sinkholed","trigger":"gbwhata.app","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-03-12","alert":"Phishing Block","trigger":"gbwhata.app","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-03-12","alert":"Sinkholed","trigger":"gbwhata.app","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-03-12","alert":"Sinkholed","trigger":"gbwhata.app","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"wh.balzadicyema.com/tQVTaVQGtTV/133338","fqdn":"wh.balzadicyema.com","domain":"balzadicyema.com","tld":"com"},"ip":{"addr":"23.109.253.230","port":443,"asn":7979,"as":"SERVERS-COM","country":"The Netherlands","country_code":"NL"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://gbwhata.app/","date":"2026-03-12T12:59:35.515Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"wh.balzadicyema.com","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Wed, 04 Feb 2026 13:14:15 GMT","end":"Tue, 05 May 2026 13:14:14 GMT"},"fingerprint":{"sha1":"31:92:76:5D:51:D8:DF:D6:BB:88:FE:B3:CA:16:23:07:BC:E8:1A:A6","sha256":"6C:88:31:6F:6E:06:FA:7C:C1:B1:CC:83:DA:AE:67:A4:59:E7:41:AB:7F:A3:03:8C:3B:E4:AD:93:6F:24:14:FB"}}},"request":{"raw":"GET /tQVTaVQGtTV/133338 HTTP/1.1\r\nHost: wh.balzadicyema.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://gbwhata.app/\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Thu, 12 Mar 2026 12:59:35 GMT\r\ncontent-type: application/javascript; charset=utf-8\r\naccept-ch: sec-ch-ua-platform-version,sec-ch-ua-model,sec-ch-ua-full-version,sec-ch-ua-full-version-list\r\naccess-control-allow-credentials: true\r\naccess-control-allow-origin: https://gbwhata.app\r\naccess-control-allow-headers: content-type, gyfr29qt4j80vdr0zhsj, x-forwarded-for, x-requested-with, cache-control, pragma, expires\r\naccess-control-max-age: 600\r\naccess-control-allow-methods: GET, POST, OPTIONS\r\nx-frame-options: SAMEORIGIN\r\nset-cookie: GL_UI4=eJw9jc1OhDAcB%2FkGddnkl%2FAA%2BwgtUtKrF1%2FBI2npn7UKdFMqq28v8eBtDjOZKIqSpka8FyekX0rgwrnsZSdaybpRqlZr2feCaSEZb8U0CTzYbQhKzxQyVNuifBjCniHXXq2mRr44Q3ONUnt338g3KbJVLYTy1Xqa3PdhqA%2FnkfLn7mC7HhwzJG5r0nOF8s2u5ijPj0g4O5%2BKCE%2B3WYXJ%2BWWwpoiRX70yhPgF1agCXZ3%2FQWlo%2BwzuBrjZDP%2F%2B3zi9c4bC0G5HQu7CO%2FlfoWNCFg%3D%3D; expires=Fri, 13-Mar-2026 12:59:35 GMT; Max-Age=86400; path=/; secure; SameSite=None\nGL_GI10=eJxjYGBgEuEXZMosEOSxNNSzNNAzMdIzNDURZEwXZPLzF2RKzhNk88svKk%2BsFGQsEmQyMBZkKsoT5PYvzslXcM4vzSsBiicLsoD4goyZgnxOOZkVCsH5OaUlmfl5xYJMQMzpnJiUk6rvEuwjyFjAxijIVJIPIotTRBgEGcvYJASZchJ5HHw%2Fv9qcvuAnkJPP46BavzE63G61IFNBsSCLoaGZEQCHQinh; expires=Fri, 13-Mar-2026 12:59:35 GMT; Max-Age=86400; path=/; secure; SameSite=None\r\ncontent-encoding: gzip\r\nvary: Accept-Encoding\r\nstrict-transport-security: max-age=1\r\nx-content-type-options: nosniff\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":5,"size_decoded":0,"mime_type":"application/javascript; charset=utf-8","magic":"ASCII text, with no line terminators","md5":"f7a2939527fd9e68723da600e96d76bd","sha1":"a9e717b6364d2895ee0a716050db32ca0ef1bb42","sha256":"d810f5146f4cd1517512a6e31946e764a73c58fb01427aae88d42cc2ae28718a","sha512":"e6956ec633c76eb3ebc408528f950b81373238cd1d5b9fff5ddd97089ea14a1ff5934f23769bac5d93cc4cdb6a1fbc4ce69baebfb940a55d8a7a89caccaf92b5","ssdeep":"","tlshash":"ec300000003000000000000000000000000c0000000000000000000000000c00000000","first_seen":"2023-03-07T01:14:39Z","last_seen":"2026-08-10T21:54:24.417642Z","times_seen":15866,"resource_available":true,"data":null}},"time_used":268,"timings":{"blocked":107,"dns":96,"connect":17,"send":0,"wait":21,"receive":0,"ssl":23},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"gbwhata.app/wp-content/themes/generatepress/assets/js/back-to-top.min.js?ver=3.6.1","fqdn":"gbwhata.app","domain":"gbwhata.app","tld":"app"},"ip":{"addr":"37.49.227.147","port":443,"asn":3920,"as":"ESTOXY OU","country":"The Netherlands","country_code":"NL"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://gbwhata.app/","date":"2026-03-12T12:59:35.546Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"gbwhata.app","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Thu, 19 Feb 2026 08:00:05 GMT","end":"Wed, 20 May 2026 08:00:04 GMT"},"fingerprint":{"sha1":"F7:68:D7:CD:68:0C:05:00:13:71:A0:93:D1:77:B6:B1:41:5F:EC:8B","sha256":"D5:FF:3C:B4:A1:A4:55:FE:42:A5:38:44:C0:50:11:C9:E8:BC:48:0A:96:FE:1D:AE:92:4C:95:33:87:AD:31:B6"}}},"request":{"raw":"GET /wp-content/themes/generatepress/assets/js/back-to-top.min.js?ver=3.6.1 HTTP/1.1\r\nHost: gbwhata.app\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://gbwhata.app/\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Thu, 12 Mar 2026 12:59:35 GMT\r\ncontent-type: text/javascript\r\nvary: Accept-Encoding\r\nlast-modified: Thu, 29 Jan 2026 06:21:39 GMT\r\nexpires: Sat, 11 Apr 2026 12:59:35 GMT\r\ncache-control: max-age=2592000\r\nx-xss-protection: 1; mode=block\r\nx-content-type-options: nosniff\r\nx-nginx-upstream-cache-status: STALE\r\nx-server-powered-by: Engintron\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Engintron","description":"Engintron is a plugin that integrates Nginx to cPanel/WHM server.","website":"https://github.com/engintron/engintron","common_platform_enumeration":"","icon":"engintron.png","categories":["Web server extensions"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":737,"size_decoded":0,"mime_type":"text/javascript","magic":"JavaScript source, ASCII text, with very long lines (737), with no line terminators","md5":"5fc35421139ef9851bc72d3edb90cfba","sha1":"0091cadf005c865d7c4ef093fac9d35566fd1e48","sha256":"3310986e26439bd35318188bd35b0c326bd3334e6699ca0469fd4f0b7d497098","sha512":"0fda88fda5b8a67c7b750712da3543e4572cb89565284cf1cbffb1ec0927f21626ff78d6fe9fa4ac13ce9f780ddc0c36ca46fedeb1c2e7f754573d7acddc7432","ssdeep":"","tlshash":"0401d0fd1190553514fb8695739fbf41393120a686039411812ccca0f5a8ce7f912bc7","first_seen":"2024-09-02T00:59:07Z","last_seen":"2026-08-10T23:24:35.537804Z","times_seen":5450,"resource_available":true,"data":null}},"time_used":29,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":29,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-03-12","alert":"Sinkholed","trigger":"gbwhata.app","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-03-12","alert":"Sinkholed","trigger":"gbwhata.app","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-03-12","alert":"Sinkholed","trigger":"gbwhata.app","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-03-12","alert":"Phishing Block","trigger":"gbwhata.app","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-03-12","alert":"Sinkholed","trigger":"gbwhata.app","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}}]}