{"report_id":"39f030bd-5952-42b8-b420-585c686f5528","version":6,"status":"done","tags":[],"date":"2026-04-01T00:12:59Z","url":{"schema":"http","addr":"americanexpress-dez03.ink/de","fqdn":"americanexpress-dez03.ink","domain":"americanexpress-dez03.ink","tld":"ink"},"ip":{"addr":"43.159.168.186","port":0,"asn":132203,"as":"Tencent Building, Kejizhongyi Avenue","country":"United States","country_code":"US"},"final":{"url":{"schema":"https","addr":"americanexpress-dez03.ink/de#/","fqdn":"americanexpress-dez03.ink","domain":"americanexpress-dez03.ink","tld":"ink"},"title":"Kreditkarten, Reisen, Prämien | American Express Deutschland","dom":{"size":102999,"mime_type":"text/html; charset=utf-8","magic":"HTML document, Unicode text, UTF-8 text, with very long lines (64331)","md5":"9cdd8c698947428d8c57f1b2605afbc4","sha1":"40c5db517b80e81af170f728ca975c2754f86a76","sha256":"e56b4a40c4f5838b9a7d2c28ee7e7ab4ab9865ddda02fd761705ff4b2e5440fd","sha512":"db0232266720c96565745d461cbc272f75c79366b17435be9f65837d15076d2b8f6ca9c539b834fba2780483acd2dcbe492a876ec54babf5c9f6fea249c2e49a","ssdeep":"1536:8Pm4IGDbFiXktLhvvWWd6NbfEhSZ7qUQt2:8PIMhSZW9w","tlshash":"e0a372e897b5b12f527971cffa065d5be4c280bf801f2c63bb5c851e2ec3a9696d1408","dom_hash":"domhash6d78cdbc905f9a9dd4c7f47363a95100","first_seen":"2026-04-01T00:13:06.400068Z","last_seen":"2026-04-01T03:03:15.215302Z","times_seen":2,"resource_available":false,"data":null}},"submit":{"url":{"schema":"http","addr":"americanexpress-dez03.ink/de","fqdn":"americanexpress-dez03.ink","domain":"americanexpress-dez03.ink","tld":"ink"},"ip":{"addr":"43.159.168.186","port":0,"asn":132203,"as":"Tencent Building, Kejizhongyi Avenue","country":"United States","country_code":"US"},"tags":null,"meta":null},"settings":{"access":"public","device_type":"desktop","expires_at":"2027-05-06T00:12:59Z","useragent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0","referer":"","cookies":null,"exit_node":"z0yflva4pidy47h"},"stats":{"alert_count":{"ids":0,"urlquery":0,"analyzer":2}},"detection":{"ids":null,"analyzer":[{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-04-01","alert":"Phishing Block","trigger":"americanexpress-dez03.ink","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-04-01","alert":"Sinkholed","trigger":"americanexpress-dez03.ink","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null},"summary":[{"fqdn":"americanexpress-dez03.ink","ip":{"addr":"43.159.168.186","port":443,"asn":132203,"as":"Tencent Building, Kejizhongyi Avenue","country":"United States","country_code":"US"},"domain_registered":"unknown","domain_rank":0,"first_seen":"No data","last_seen":"No data","alert_count":30,"request_count":15,"received_data":2491406,"sent_data":8363,"comment":"","tags":null,"fingerprints":[{"name":"Caddy","description":"","website":"https://caddyserver.com","common_platform_enumeration":"cpe:2.3:a:caddyserver:caddy:*:*:*:*:*:*:*:*","icon":"caddy.svg","categories":["Web servers"]}]},{"fqdn":"ipapi.co","ip":{"addr":"104.26.9.44","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"domain_registered":"2016-04-19","domain_rank":7936,"first_seen":"2017-01-31T09:07:01Z","last_seen":"2026-03-25T15:50:32.944467Z","alert_count":0,"request_count":1,"received_data":2504,"sent_data":451,"comment":"","tags":null,"fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}]},{"fqdn":"cdn.jsdelivr.net","ip":{"addr":"151.101.193.229","port":443,"asn":54113,"as":"FASTLY","country":"United States","country_code":"US"},"domain_registered":"2012-05-16","domain_rank":1678,"first_seen":"2012-09-30T00:15:09Z","last_seen":"2026-03-29T22:35:00.993215Z","alert_count":0,"request_count":1,"received_data":711,"sent_data":477,"comment":"","tags":null,"fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}]},{"fqdn":"fonts-api.wp.com","ip":{"addr":"192.0.77.32","port":443,"asn":2635,"as":"AUTOMATTIC","country":"United States","country_code":"US"},"domain_registered":"1997-03-28","domain_rank":166248,"first_seen":"2022-11-28T22:42:34Z","last_seen":"2026-03-25T22:08:56.613951Z","alert_count":0,"request_count":1,"received_data":4673,"sent_data":502,"comment":"","tags":null,"fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}]},{"fqdn":"maxcdn.bootstrapcdn.com","ip":{"addr":"104.18.10.207","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"domain_registered":"2012-05-25","domain_rank":6807,"first_seen":"2014-06-18T00:37:31Z","last_seen":"2026-03-30T02:31:39.707096Z","alert_count":0,"request_count":1,"received_data":28410,"sent_data":479,"comment":"","tags":null,"fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}]}],"files":null,"artifacts":{"windows_shortcuts":null,"files":null,"telegram":null,"pdfs":null,"clipboard":null},"sensors":{"ids":null,"analyzer":null,"urlquery":null},"javascript":{"script":[{"url":{"schema":"https","addr":"americanexpress-dez03.ink/apps/DE_PT_06/assets/HP-175-Year-Banner-1280x400-CNKEqp5j.js","fqdn":"americanexpress-dez03.ink","domain":"americanexpress-dez03.ink","tld":"ink"},"ip":{"addr":"43.159.168.186","port":443,"asn":132203,"as":"Tencent Building, Kejizhongyi Avenue","country":"United States","country_code":"US"},"introduction_type":"importedModule","is_inline":false,"md5":"19c80aa3ed425e1719f54ecfef114053","sha1":"575cf9b9fd0ae4f39d4220eeb4a2d08230374cc4","sha256":"fc2602654bfe5b3e6cc29d599f76bd6b63c4a6694e107528b349c37e0fe41369","sha512":"5a51f695148ca8c7ad7e0446cc2be0731d3132dcf90606c63bdf7cee13cb9678ebd900d454cb0728cdf9b767f5fb2e6b119ff4c196fa0dd315df9fc43cdbf742","ssdeep":"","tlshash":"a3b01203490f21b8023401be0b057fb0111125ccba5087b8374d4ae9875bf521d0a601","size":100,"data":"","first_seen":"2026-03-19T13:43:02.846995Z","last_seen":"2026-04-18T17:33:18.10208Z","times_seen":75,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"americanexpress-dez03.ink/apps/DE_PT_06/assets/index-DLVKgBEN.js","fqdn":"americanexpress-dez03.ink","domain":"americanexpress-dez03.ink","tld":"ink"},"ip":{"addr":"43.159.168.186","port":443,"asn":132203,"as":"Tencent Building, Kejizhongyi Avenue","country":"United States","country_code":"US"},"introduction_type":"scriptElement","is_inline":false,"md5":"e2144745591156267c0d9a283c4abdf6","sha1":"3132e79737aa25e5fc057d83ad557bd70d5be8a0","sha256":"c67a75f6f2ace1969e5f74b22a21cd99e91df5abce0e2b5ba26382ca323d4b6d","sha512":"ddf27758d143c0377feae15dccb71ce85b10f9b8fc9b785adcfa68846fd04a8e39b9f948842a7a98538216c29ec9318316720f128004fc1f6623196497f10e2f","ssdeep":"192:BElN1Hun8a6Cgyyagug1b5wh64D5ITwXDf/2DfOVD1DfopyY64:BElXHu8/DrJuhvIT+f/kfOVxfGH","tlshash":"b1e1b4086af4e1bca0cb04b5e521e4e0b0babc6ae065c5d17ff50a1d97aeb4ca745538","size":6932,"data":"","first_seen":"2026-03-31T15:15:49.546552Z","last_seen":"2026-04-01T03:03:15.223407Z","times_seen":4,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"americanexpress-dez03.ink/apps/DE_PT_06/assets/de-C4D51E0Z.js","fqdn":"americanexpress-dez03.ink","domain":"americanexpress-dez03.ink","tld":"ink"},"ip":{"addr":"43.159.168.186","port":443,"asn":132203,"as":"Tencent Building, Kejizhongyi Avenue","country":"United States","country_code":"US"},"introduction_type":"scriptElement","is_inline":false,"md5":"0cf70b59adc0d43993c5fcf6bc52c753","sha1":"54cfbad5d584b038ecac40ffdfac4dbfc7ce0d73","sha256":"aa221c2b52b178e319e0961826ed0e01710ae936818ab39d2f88f9a182997052","sha512":"f9210edf86ecbd2ee525887faafafbf9f70ad7a18ebdc0a45a5067b473b68b6f67ff7c4ddbec4a6180ab2fe040cbd0516e309e05b621f7a0077851b91304e90f","ssdeep":"","tlshash":"4ae0c28d68131e4388a085760f2a5e6ad8c276c97fecf59f54b2d85c328009bad5c6fd","size":334,"data":"","first_seen":"2026-03-31T15:15:49.543007Z","last_seen":"2026-04-18T17:33:18.099914Z","times_seen":9,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"americanexpress-dez03.ink/apps/DE_PT_06/assets/index-C2e9xBVp.js","fqdn":"americanexpress-dez03.ink","domain":"americanexpress-dez03.ink","tld":"ink"},"ip":{"addr":"43.159.168.186","port":443,"asn":132203,"as":"Tencent Building, Kejizhongyi Avenue","country":"United States","country_code":"US"},"introduction_type":"scriptElement","is_inline":false,"md5":"aaf39a64fefd94104217d190a19bb495","sha1":"2d110bfe502cfc724446da4b98952320edddbe90","sha256":"ad3e4954789761163e1acfac6cc53509a4e66c0d347386407139570684548176","sha512":"07a846da25a6cc562f44aad21e6437c0819824c41a8c9abc37d2f6e2ef9af5a55334a566f914a55dc47adf8ca5a00cbee8294b0c0c41e74c2a81ce9cf1fd0f1e","ssdeep":"24576:Coq0xsBb+69CzS0jBxKWabVLWzhpQtC89PpsUNHi7cGHL3pdTTEBYlwyPC4k0cAA:Coq0xsBb+69CzS0jBxKWabVLWzhpQQV0","tlshash":"4f559d9d39e0633105e2068ee6c7324bf229dc2aa119d1f1b68c99493fc7849d277e7d","size":1380946,"data":"","first_seen":"2026-03-31T15:15:49.553453Z","last_seen":"2026-04-01T03:03:15.233766Z","times_seen":4,"alerts":{"ids":null,"analyzer":null,"urlquery":null}}],"eval":null,"write":null,"console":null},"http":[{"url":{"schema":"https","addr":"maxcdn.bootstrapcdn.com/font-awesome/4.5.0/css/font-awesome.min.css","fqdn":"maxcdn.bootstrapcdn.com","domain":"bootstrapcdn.com","tld":"com"},"ip":{"addr":"104.18.10.207","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://americanexpress-dez03.ink/de","date":"2026-04-01T00:12:37.330Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"bootstrapcdn.com","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Thu, 05 Mar 2026 05:27:05 GMT","end":"Wed, 03 Jun 2026 06:27:01 GMT"},"fingerprint":{"sha1":"04:A8:A2:DB:A5:D9:6E:A1:96:19:8E:E4:20:63:9D:DD:4B:05:E5:4A","sha256":"86:F0:31:59:6F:27:50:6B:1C:65:39:9A:BF:6D:0C:A8:82:D5:B2:A6:36:4B:9C:0A:EB:05:EE:13:0F:EE:25:EC"}}},"request":{"raw":"GET /font-awesome/4.5.0/css/font-awesome.min.css HTTP/1.1\r\nHost: maxcdn.bootstrapcdn.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://americanexpress-dez03.ink/\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ndate: Wed, 01 Apr 2026 00:12:37 GMT\r\ncontent-type: text/css; charset=utf-8\r\nstrict-transport-security: max-age=31536000; includeSubDomains; preload\r\ncdn-pullzone: 252412\r\ncdn-uid: b1941f61-b576-4f40-80de-5677acb38f74\r\ncdn-requestcountrycode: DE\r\nvary: Accept-Encoding\r\naccess-control-allow-origin: *\r\ncache-control: public, max-age=31919000\r\ncontent-encoding: br\r\netag: \"4fbd15cb6047af93373f4f895639c8bf\"\r\nlast-modified: Mon, 25 Jan 2021 22:04:54 GMT\r\ncdn-cachedat: 12/09/2024 23:20:39\r\ncdn-proxyver: 1.06\r\ncdn-requestpullcode: 200\r\ncdn-requestpullsuccess: True\r\ncdn-edgestorageid: 1075\r\ntiming-allow-origin: *\r\ncross-origin-resource-policy: cross-origin\r\nx-content-type-options: nosniff\r\ncdn-status: 200\r\ncdn-requesttime: 0\r\ncdn-requestid: 4f338739bd75b634e7f3517bf2e1f433\r\ncdn-cache: HIT\r\nserver: cloudflare\r\nage: 3254450\r\ncf-cache-status: HIT\r\ncf-ray: 9e53621d7d974c11-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":27466,"size_decoded":0,"mime_type":"text/css; charset=utf-8","magic":"ASCII text, with very long lines (27303)","md5":"4fbd15cb6047af93373f4f895639c8bf","sha1":"12d6861075de8e293265ff6ff03b1f3adcb44c76","sha256":"ddd92f10ad162c7449eff0acaf40598c05b1111739587edb75e5326b6697c5d5","sha512":"f8be32cba15170319b5c9f663c6f0c4ffdd4083cf047d80f7b214d302b489eca25fbee66ddb9366d758a7598efc9b9a886b02c9f751ae71f207cb9db1356243a","ssdeep":"384:Qi5yWeTUKW+KlkJ5de2UYmydfwYUas8l8yQ/8c:Dlr+Klk3YlKfwYUf8l8yQ/T","tlshash":"3bc230f8e54c01d66731c48bff81b36862b6f73dd5814d99f01f690c29d22a522c5bba","first_seen":"2023-04-05T07:46:17Z","last_seen":"2026-08-17T05:36:12.371866Z","times_seen":42005,"resource_available":false,"data":null}},"time_used":62,"timings":{"blocked":29,"dns":4,"connect":1,"send":0,"wait":3,"receive":0,"ssl":20},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"americanexpress-dez03.ink/apps/DE_PT_06/favicon.ico","fqdn":"americanexpress-dez03.ink","domain":"americanexpress-dez03.ink","tld":"ink"},"ip":{"addr":"43.159.168.186","port":443,"asn":132203,"as":"Tencent Building, Kejizhongyi Avenue","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://americanexpress-dez03.ink/de","date":"2026-04-01T00:12:37.802Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"americanexpress-dez03.ink","organization":""},"issuer":{"commonName":"E7","organization":"Let's Encrypt"},"validity":{"start":"Mon, 30 Mar 2026 10:45:40 GMT","end":"Sun, 28 Jun 2026 10:45:39 GMT"},"fingerprint":{"sha1":"50:DF:64:B7:17:54:0F:1D:28:39:7F:0A:0C:22:62:A4:82:3B:82:51","sha256":"94:43:40:91:19:2F:2E:5F:A1:29:CB:BC:29:9C:19:1F:38:9B:C6:03:3F:08:0C:47:4C:27:1F:F9:97:7D:F8:69"}}},"request":{"raw":"GET /apps/DE_PT_06/favicon.ico HTTP/1.1\r\nHost: americanexpress-dez03.ink\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://americanexpress-dez03.ink/de\r\nDNT: 1\r\nConnection: keep-alive\r\nCookie: PHPSID=99830bbd1873da417623fe89a35b01f2\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nalt-svc: h3=\":443\"; ma=2592000\r\ncache-control: public, max-age=2592000\r\ncontent-encoding: gzip\r\ncontent-type: image/vnd.microsoft.icon\r\netag: \"dh6d23ivwgsg12s-gzip\"\r\nlast-modified: Thu, 19 Mar 2026 01:17:22 GMT\r\nreferrer-policy: strict-origin-when-cross-origin\r\nserver: Caddy\r\nvary: Accept-Encoding\r\nx-content-type-options: nosniff\r\nx-frame-options: SAMEORIGIN\r\ncontent-length: 1421\r\ndate: Wed, 01 Apr 2026 00:12:37 GMT\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Caddy","description":"","website":"https://caddyserver.com","common_platform_enumeration":"cpe:2.3:a:caddyserver:caddy:*:*:*:*:*:*:*:*","icon":"caddy.svg","categories":["Web servers"]}],"data":{"size":1396,"size_decoded":0,"mime_type":"image/vnd.microsoft.icon","magic":"PNG image data, 32 x 32, 8-bit/color RGBA, non-interlaced","md5":"d4814ea76c5393efaf6c27e6632e67ed","sha1":"d3c5921add928ed4d86ef31b36887019645cc15e","sha256":"5cd0f23ccd8cdd237af364707b85c20893fe8abf41e6ca3b5640e01411cc55be","sha512":"02ac1dbb0e8b88bfd06466c092282de7563220e422f4763edbb20bc02aca0674f90d7ea32f637cc6014e9a088cbb21f3706094008b45b01a1bda605c8ffc7cf6","ssdeep":"","tlshash":"da21e9653bc3193e6d1057e36fd2802297c614ae5f590f99600558a3a1fb54068a46e0","first_seen":"2026-03-19T13:43:02.85755Z","last_seen":"2026-04-18T17:33:18.114339Z","times_seen":75,"resource_available":false,"data":null}},"time_used":153,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":153,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-04-01","alert":"Phishing Block","trigger":"americanexpress-dez03.ink","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-04-01","alert":"Sinkholed","trigger":"americanexpress-dez03.ink","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"americanexpress-dez03.ink/apps/DE_PT_06/assets/index-DLVKgBEN.js","fqdn":"americanexpress-dez03.ink","domain":"americanexpress-dez03.ink","tld":"ink"},"ip":{"addr":"43.159.168.186","port":443,"asn":132203,"as":"Tencent Building, Kejizhongyi Avenue","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"fetch","requested_by":"https://americanexpress-dez03.ink/de","date":"2026-04-01T00:12:38.095Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"americanexpress-dez03.ink","organization":""},"issuer":{"commonName":"E7","organization":"Let's Encrypt"},"validity":{"start":"Mon, 30 Mar 2026 10:45:40 GMT","end":"Sun, 28 Jun 2026 10:45:39 GMT"},"fingerprint":{"sha1":"50:DF:64:B7:17:54:0F:1D:28:39:7F:0A:0C:22:62:A4:82:3B:82:51","sha256":"94:43:40:91:19:2F:2E:5F:A1:29:CB:BC:29:9C:19:1F:38:9B:C6:03:3F:08:0C:47:4C:27:1F:F9:97:7D:F8:69"}}},"request":{"raw":"GET /apps/DE_PT_06/assets/index-DLVKgBEN.js HTTP/1.1\r\nHost: americanexpress-dez03.ink\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://americanexpress-dez03.ink/de\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nalt-svc: h3=\":443\"; ma=2592000\r\ncache-control: public, max-age=2592000\r\ncontent-encoding: gzip\r\ncontent-type: text/javascript; charset=utf-8\r\netag: \"dhgitbcvu1345ck-gzip\"\r\nlast-modified: Mon, 30 Mar 2026 23:54:40 GMT\r\nreferrer-policy: strict-origin-when-cross-origin\r\nserver: Caddy\r\nvary: Accept-Encoding\r\nx-content-type-options: nosniff\r\nx-frame-options: SAMEORIGIN\r\ncontent-length: 3063\r\ndate: Wed, 01 Apr 2026 00:12:38 GMT\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Caddy","description":"","website":"https://caddyserver.com","common_platform_enumeration":"cpe:2.3:a:caddyserver:caddy:*:*:*:*:*:*:*:*","icon":"caddy.svg","categories":["Web servers"]}],"data":{"size":6932,"size_decoded":0,"mime_type":"text/javascript; charset=utf-8","magic":"JavaScript source, Unicode text, UTF-8 text, with very long lines (6915)","md5":"e2144745591156267c0d9a283c4abdf6","sha1":"3132e79737aa25e5fc057d83ad557bd70d5be8a0","sha256":"c67a75f6f2ace1969e5f74b22a21cd99e91df5abce0e2b5ba26382ca323d4b6d","sha512":"ddf27758d143c0377feae15dccb71ce85b10f9b8fc9b785adcfa68846fd04a8e39b9f948842a7a98538216c29ec9318316720f128004fc1f6623196497f10e2f","ssdeep":"192:BElN1Hun8a6Cgyyagug1b5wh64D5ITwXDf/2DfOVD1DfopyY64:BElXHu8/DrJuhvIT+f/kfOVxfGH","tlshash":"b1e1b4086af4e1bca0cb04b5e521e4e0b0babc6ae065c5d17ff50a1d97aeb4ca745538","first_seen":"2026-03-31T15:15:49.546552Z","last_seen":"2026-04-01T03:03:15.223407Z","times_seen":4,"resource_available":true,"data":null}},"time_used":153,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":153,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-04-01","alert":"Sinkholed","trigger":"americanexpress-dez03.ink","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-04-01","alert":"Phishing Block","trigger":"americanexpress-dez03.ink","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"americanexpress-dez03.ink/apps/DE_PT_06/assets/HP-175-Year-Banner-1280x400-CNKEqp5j.js","fqdn":"americanexpress-dez03.ink","domain":"americanexpress-dez03.ink","tld":"ink"},"ip":{"addr":"43.159.168.186","port":443,"asn":132203,"as":"Tencent Building, Kejizhongyi Avenue","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://americanexpress-dez03.ink/de","date":"2026-04-01T00:12:38.420Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"americanexpress-dez03.ink","organization":""},"issuer":{"commonName":"E7","organization":"Let's Encrypt"},"validity":{"start":"Mon, 30 Mar 2026 10:45:40 GMT","end":"Sun, 28 Jun 2026 10:45:39 GMT"},"fingerprint":{"sha1":"50:DF:64:B7:17:54:0F:1D:28:39:7F:0A:0C:22:62:A4:82:3B:82:51","sha256":"94:43:40:91:19:2F:2E:5F:A1:29:CB:BC:29:9C:19:1F:38:9B:C6:03:3F:08:0C:47:4C:27:1F:F9:97:7D:F8:69"}}},"request":{"raw":"GET /apps/DE_PT_06/assets/HP-175-Year-Banner-1280x400-CNKEqp5j.js HTTP/1.1\r\nHost: americanexpress-dez03.ink\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://americanexpress-dez03.ink/apps/DE_PT_06/assets/index-DLVKgBEN.js\r\nDNT: 1\r\nConnection: keep-alive\r\nCookie: PHPSID=99830bbd1873da417623fe89a35b01f2; uuid=99830bbd1873da417623fe89a35b01f2\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\naccept-ranges: bytes\r\nalt-svc: h3=\":443\"; ma=2592000\r\ncache-control: public, max-age=2592000\r\ncontent-type: text/javascript; charset=utf-8\r\netag: \"dhgitbcvu1342s\"\r\nlast-modified: Mon, 30 Mar 2026 23:54:40 GMT\r\nreferrer-policy: strict-origin-when-cross-origin\r\nserver: Caddy\r\nvary: Accept-Encoding\r\nx-content-type-options: nosniff\r\nx-frame-options: SAMEORIGIN\r\ncontent-length: 100\r\ndate: Wed, 01 Apr 2026 00:12:38 GMT\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Caddy","description":"","website":"https://caddyserver.com","common_platform_enumeration":"cpe:2.3:a:caddyserver:caddy:*:*:*:*:*:*:*:*","icon":"caddy.svg","categories":["Web servers"]}],"data":{"size":100,"size_decoded":0,"mime_type":"text/javascript; charset=utf-8","magic":"ASCII text","md5":"19c80aa3ed425e1719f54ecfef114053","sha1":"575cf9b9fd0ae4f39d4220eeb4a2d08230374cc4","sha256":"fc2602654bfe5b3e6cc29d599f76bd6b63c4a6694e107528b349c37e0fe41369","sha512":"5a51f695148ca8c7ad7e0446cc2be0731d3132dcf90606c63bdf7cee13cb9678ebd900d454cb0728cdf9b767f5fb2e6b119ff4c196fa0dd315df9fc43cdbf742","ssdeep":"","tlshash":"a3b01203490f21b8023401be0b057fb0111125ccba5087b8374d4ae9875bf521d0a601","first_seen":"2026-03-19T13:43:02.846995Z","last_seen":"2026-04-18T17:33:18.10208Z","times_seen":75,"resource_available":true,"data":null}},"time_used":153,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":153,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-04-01","alert":"Phishing Block","trigger":"americanexpress-dez03.ink","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-04-01","alert":"Sinkholed","trigger":"americanexpress-dez03.ink","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"americanexpress-dez03.ink/apps/DE_PT_06/assets/bg-CjBvNwF8.webp","fqdn":"americanexpress-dez03.ink","domain":"americanexpress-dez03.ink","tld":"ink"},"ip":{"addr":"43.159.168.186","port":443,"asn":132203,"as":"Tencent Building, Kejizhongyi Avenue","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://americanexpress-dez03.ink/de","date":"2026-04-01T00:12:38.587Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"americanexpress-dez03.ink","organization":""},"issuer":{"commonName":"E7","organization":"Let's Encrypt"},"validity":{"start":"Mon, 30 Mar 2026 10:45:40 GMT","end":"Sun, 28 Jun 2026 10:45:39 GMT"},"fingerprint":{"sha1":"50:DF:64:B7:17:54:0F:1D:28:39:7F:0A:0C:22:62:A4:82:3B:82:51","sha256":"94:43:40:91:19:2F:2E:5F:A1:29:CB:BC:29:9C:19:1F:38:9B:C6:03:3F:08:0C:47:4C:27:1F:F9:97:7D:F8:69"}}},"request":{"raw":"GET /apps/DE_PT_06/assets/bg-CjBvNwF8.webp HTTP/1.1\r\nHost: americanexpress-dez03.ink\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://americanexpress-dez03.ink/de\r\nDNT: 1\r\nConnection: keep-alive\r\nCookie: PHPSID=99830bbd1873da417623fe89a35b01f2; uuid=99830bbd1873da417623fe89a35b01f2\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\naccept-ranges: bytes\r\nalt-svc: h3=\":443\"; ma=2592000\r\ncontent-type: image/webp\r\nlast-modified: Mon, 30 Mar 2026 23:54:40 GMT\r\nreferrer-policy: strict-origin-when-cross-origin\r\nserver: workerman\r\nvia: 1.1 Caddy\r\nx-content-type-options: nosniff\r\nx-frame-options: SAMEORIGIN\r\ncontent-length: 435048\r\ndate: Wed, 01 Apr 2026 00:12:38 GMT\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":null,"data":{"size":435048,"size_decoded":0,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image, VP8 encoding, 1920x1080, Scaling: [none]x[none], YUV color, decoders should clamp","md5":"d06c06f717870a9cc7f45531645f6cdd","sha1":"ef29b938d9fceca9294f236166d05593c10bfd00","sha256":"f0e0e5123ad3951d18978d1a50c8a20e703d3fdc1e315fe127bc32353d4df047","sha512":"2ca8eaa02c7bd1b27b1a8d8fe87110cd8d7e3f3928160e232ca9941af45e0f546f4fa83ad05264a6556c27acf438551223539bedc57f0e6eec703017cf75a59d","ssdeep":"12288:sOrOxzKFxLj6wy4H6ZxNErNllPil/P08EvUxAUwACxSL+R:gByxLjc4aZxNEBll8H0Tv7px2+R","tlshash":"379423027b794a96e0444b1032c2f2e6abc5d1c9e787db7dc32857bddac0885c13ee69","first_seen":"2026-03-31T15:15:49.55053Z","last_seen":"2026-04-18T17:33:18.109892Z","times_seen":9,"resource_available":false,"data":null}},"time_used":325,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":153,"receive":172,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-04-01","alert":"Sinkholed","trigger":"americanexpress-dez03.ink","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-04-01","alert":"Phishing Block","trigger":"americanexpress-dez03.ink","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"ipapi.co/json/","fqdn":"ipapi.co","domain":"ipapi.co","tld":"co"},"ip":{"addr":"104.26.9.44","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"fetch","requested_by":"https://americanexpress-dez03.ink/de","date":"2026-04-01T00:12:38.935Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.2","cert":{"subject":{"commonName":"ipapi.co","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Mon, 16 Feb 2026 15:59:25 GMT","end":"Sun, 17 May 2026 16:59:23 GMT"},"fingerprint":{"sha1":"37:8F:7A:B7:BF:60:24:8D:1C:83:4F:C2:59:C3:0A:0C:EE:B3:75:A5","sha256":"8D:E6:B5:3D:41:1D:D8:B2:FA:03:95:07:E2:54:7C:1F:A2:22:E9:05:05:5E:D2:99:7D:DF:46:3F:32:52:53:F9"}}},"request":{"raw":"GET /json/ HTTP/1.1\r\nHost: ipapi.co\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://americanexpress-dez03.ink/\r\nOrigin: https://americanexpress-dez03.ink\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ndate: Wed, 01 Apr 2026 00:12:39 GMT\r\ncontent-type: application/json\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nserver: cloudflare\r\nallow: OPTIONS, HEAD, OPTIONS, POST, GET\r\nx-frame-options: DENY\r\nvary: Host, origin\r\naccess-control-allow-origin: https://americanexpress-dez03.ink\r\nx-content-type-options: nosniff\r\nreferrer-policy: same-origin\r\ncross-origin-opener-policy: same-origin\r\ncontent-security-policy-report-only: default-src 'self'; script-src 'self' 'unsafe-inline' 'unsafe-eval' https://*.stripe.com https://*.paddle.com https://www.google.com https://www.gstatic.com https://maps.gstatic.com https://maps.googleapis.com https://www.google.com/recaptcha/ https://www.gstatic.com/recaptcha/; style-src 'self' 'unsafe-inline' https://*.paddle.com https://fonts.gstatic.com https://fonts.googleapis.com; img-src 'self' data: https://ipapi.co https://maps.gstatic.com https://maps.googleapis.com https://*.stripe.com; font-src 'self' data: https://fonts.gstatic.com https://fonts.googleapis.com; frame-src 'self' https://www.google.com https://*.stripe.com https://*.paddle.com https://www.google.com/recaptcha/ https://recaptcha.google.com/recaptcha/; connect-src 'self' https://ipapi.co/ https://*.paddle.com https://*.stripe.com https://maps.googleapis.com https://www.google.com/recaptcha/; object-src 'none'; frame-ancestors 'none'; base-uri 'self'; form-action 'self';\r\ncf-cache-status: DYNAMIC\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=Kfm8TZXd8uCRAUKJAzTCUsQAHDiqLpKMgfQP3uWxf%2BTVsQZ1hhCJtmsLfqVci8sJdbRSWW5fHFatZ3cesULe5Vvuh3ivzSdBB6ohpVGY5xQnaIB8dkM1wZpY\"}]}\r\ncontent-encoding: br\r\ncf-ray: 9e5362295b7b5696-OSL\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":744,"size_decoded":0,"mime_type":"application/json","magic":"JSON text data","md5":"8215cbff3bb6e3f77b55f4f0f961749d","sha1":"d0c2a5a1be293236326a4c5a59b5172fba74d19b","sha256":"2bc635d44b5ca6c38b73aa6021eaccf71239109e9cb17b2c11d16d1fc1020308","sha512":"1d64ba84e769e0e5105bb0a51b90978a8bc52b3cbd30f03cddf95933de6ede8eec31b677a44c517a801ae7a293b479def7c6a4d933b936b8878eaa27dea76bb0","ssdeep":"","tlshash":"7f01df68e4680e7bacb9135cb42869071274220b5e56758e7bd09b8d0f8e9bf30b534e","first_seen":"2026-03-29T01:09:24.875702Z","last_seen":"2026-04-08T08:47:27.106595Z","times_seen":464,"resource_available":false,"data":null}},"time_used":875,"timings":{"blocked":323,"dns":301,"connect":3,"send":0,"wait":229,"receive":0,"ssl":15},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"cdn.jsdelivr.net/npm/@formkit/themes@1.6.9/dist/genesis/theme.css","fqdn":"cdn.jsdelivr.net","domain":"jsdelivr.net","tld":"net"},"ip":{"addr":"151.101.193.229","port":443,"asn":54113,"as":"FASTLY","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://americanexpress-dez03.ink/de","date":"2026-04-01T00:12:37.619Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"jsdelivr.net","organization":""},"issuer":{"commonName":"GlobalSign Atlas R3 DV TLS CA 2025 Q2","organization":"GlobalSign nv-sa"},"validity":{"start":"Mon, 02 Jun 2025 15:43:52 GMT","end":"Sat, 04 Jul 2026 15:43:51 GMT"},"fingerprint":{"sha1":"21:17:81:78:41:C6:8F:86:D6:CF:8D:98:CC:74:A8:F1:03:F8:C9:D4","sha256":"D0:E6:8D:08:11:05:7E:0C:2A:0D:C7:E0:ED:AE:9E:18:C8:74:32:12:3D:56:43:98:62:CD:A2:08:6F:64:5B:B0"}}},"request":{"raw":"GET /npm/@formkit/themes@1.6.9/dist/genesis/theme.css HTTP/1.1\r\nHost: cdn.jsdelivr.net\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://americanexpress-dez03.ink/\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 404 Not Found\r\naccess-control-allow-origin: *\r\naccess-control-expose-headers: *\r\ntiming-allow-origin: *\r\ncache-control: public, max-age=86400, s-maxage=86400\r\ncross-origin-resource-policy: cross-origin\r\nx-content-type-options: nosniff\r\nstrict-transport-security: max-age=31536000; includeSubDomains; preload\r\ncontent-type: text/plain; charset=utf-8\r\netag: W/\"4c-4MDUp7kfXiNqi5+TqygY6Z58cgc\"\r\ncontent-encoding: br\r\naccept-ranges: bytes\r\nage: 84460\r\ndate: Wed, 01 Apr 2026 00:12:37 GMT\r\nx-served-by: cache-fra-etou8220162-FRA, cache-hel1410027-HEL\r\nx-cache: HIT, HIT\r\nvary: Accept-Encoding\r\nalt-svc: h3=\":443\";ma=86400,h3-29=\":443\";ma=86400,h3-27=\":443\";ma=86400\r\ncontent-length: 72\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"404","status_text":"Not Found","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":0,"size_decoded":0,"mime_type":"text/plain; charset=utf-8","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-08-17T06:42:25.972765Z","times_seen":17931210,"resource_available":true,"data":null}},"time_used":100,"timings":{"blocked":42,"dns":5,"connect":13,"send":0,"wait":14,"receive":2,"ssl":20},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"americanexpress-dez03.ink/getApp?app_id=DE_PT_06","fqdn":"americanexpress-dez03.ink","domain":"americanexpress-dez03.ink","tld":"ink"},"ip":{"addr":"43.159.168.186","port":443,"asn":132203,"as":"Tencent Building, Kejizhongyi Avenue","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"https://americanexpress-dez03.ink/de","date":"2026-04-01T00:12:37.626Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"americanexpress-dez03.ink","organization":""},"issuer":{"commonName":"E7","organization":"Let's Encrypt"},"validity":{"start":"Mon, 30 Mar 2026 10:45:40 GMT","end":"Sun, 28 Jun 2026 10:45:39 GMT"},"fingerprint":{"sha1":"50:DF:64:B7:17:54:0F:1D:28:39:7F:0A:0C:22:62:A4:82:3B:82:51","sha256":"94:43:40:91:19:2F:2E:5F:A1:29:CB:BC:29:9C:19:1F:38:9B:C6:03:3F:08:0C:47:4C:27:1F:F9:97:7D:F8:69"}}},"request":{"raw":"GET /getApp?app_id=DE_PT_06 HTTP/1.1\r\nHost: americanexpress-dez03.ink\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/json, text/plain, */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://americanexpress-dez03.ink/de\r\nDNT: 1\r\nConnection: keep-alive\r\nCookie: PHPSID=99830bbd1873da417623fe89a35b01f2\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\naccess-control-allow-credentials: true\r\naccess-control-allow-headers: *\r\naccess-control-allow-methods: *\r\naccess-control-allow-origin: *\r\nalt-svc: h3=\":443\"; ma=2592000\r\ncontent-encoding: gzip\r\ncontent-type: application/json\r\nreferrer-policy: strict-origin-when-cross-origin\r\nserver: workerman\r\nvary: Accept-Encoding\r\nvia: 1.1 Caddy\r\nx-content-type-options: nosniff\r\nx-frame-options: SAMEORIGIN\r\ndate: Wed, 01 Apr 2026 00:12:37 GMT\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":null,"data":{"size":11740,"size_decoded":0,"mime_type":"application/json","magic":"JSON text data","md5":"d5e2cbe22aef6ee6ffcc85c19e60418a","sha1":"63266b7af7d2aaa5f3a539cfbd60ba30ea5d57fe","sha256":"2a0a95ea4c366e35c2b9b31c25c97b3014a7826efa68878d263149a3b9561e37","sha512":"7c4d601c311219049d6a5cb3635600384bbd1065e562687118df44c23b9d86b16bb3240a1ce07fca0059467e14317256e42e57b082689996b28b561fc72e9e6c","ssdeep":"192:lwrp6IcROvI3puB8U5ED7M9sc1PWaw+dURsNJaekDqia+DJ3MmTup89GLo7x:lwMI0ZXuEv10PvzdNJaecVVMmCu9G2","tlshash":"9e32bf1287e1fc8881ca30eb714a74b638ec93f45490c3aa1ae9d9ad165e51b6d32ce5","first_seen":"2026-04-01T00:13:06.56523Z","last_seen":"2026-04-01T00:13:06.56523Z","times_seen":1,"resource_available":false,"data":null}},"time_used":172,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":172,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-04-01","alert":"Phishing Block","trigger":"americanexpress-dez03.ink","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-04-01","alert":"Sinkholed","trigger":"americanexpress-dez03.ink","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"wss","addr":"americanexpress-dez03.ink/wss?uuid=99830bbd1873da417623fe89a35b01f2","fqdn":"americanexpress-dez03.ink","domain":"americanexpress-dez03.ink","tld":"ink"},"ip":{"addr":"43.159.168.186","port":443,"asn":132203,"as":"Tencent Building, Kejizhongyi Avenue","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"websocket","requested_by":"https://americanexpress-dez03.ink/de","date":"2026-04-01T00:12:38.013Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"americanexpress-dez03.ink","organization":""},"issuer":{"commonName":"E7","organization":"Let's Encrypt"},"validity":{"start":"Mon, 30 Mar 2026 10:45:40 GMT","end":"Sun, 28 Jun 2026 10:45:39 GMT"},"fingerprint":{"sha1":"50:DF:64:B7:17:54:0F:1D:28:39:7F:0A:0C:22:62:A4:82:3B:82:51","sha256":"94:43:40:91:19:2F:2E:5F:A1:29:CB:BC:29:9C:19:1F:38:9B:C6:03:3F:08:0C:47:4C:27:1F:F9:97:7D:F8:69"}}},"request":{"raw":"GET /wss?uuid=99830bbd1873da417623fe89a35b01f2 HTTP/1.1\r\nHost: americanexpress-dez03.ink\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nSec-WebSocket-Version: 13\r\nOrigin: https://americanexpress-dez03.ink\r\nSec-WebSocket-Extensions: permessage-deflate\r\nSec-WebSocket-Key: 4V7O0xQ7pG+AOCeYGuHkHg==\r\nDNT: 1\r\nConnection: keep-alive, Upgrade\r\nCookie: PHPSID=99830bbd1873da417623fe89a35b01f2; uuid=99830bbd1873da417623fe89a35b01f2\r\nSec-Fetch-Dest: websocket\r\nSec-Fetch-Mode: websocket\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\nUpgrade: websocket\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 101 Switching Protocols\r\nAlt-Svc: h3=\":443\"; ma=2592000\r\nConnection: Upgrade\r\nReferrer-Policy: strict-origin-when-cross-origin\r\nSec-WebSocket-Accept: qjT6aWp9FHkxb2aDm5rfV9GDoHQ=\r\nSec-WebSocket-Version: 13\r\nServer: Caddy, workerman\r\nUpgrade: websocket\r\nX-Content-Type-Options: nosniff\r\nX-Frame-Options: SAMEORIGIN\r\nDate: Wed, 01 Apr 2026 00:12:38 GMT\r\n\r\n","headers":null,"cookies":null,"status_code":"101","status_text":"Switching Protocols","fingerprints":null,"data":{"size":0,"size_decoded":0,"mime_type":"text/plain","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-08-17T06:42:25.972765Z","times_seen":17931210,"resource_available":true,"data":null}},"time_used":471,"timings":{"blocked":0,"dns":1,"connect":152,"send":0,"wait":153,"receive":0,"ssl":164},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-04-01","alert":"Sinkholed","trigger":"americanexpress-dez03.ink","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-04-01","alert":"Phishing Block","trigger":"americanexpress-dez03.ink","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"americanexpress-dez03.ink/apps/DE_PT_06/assets/index-B7O3wHJn.css","fqdn":"americanexpress-dez03.ink","domain":"americanexpress-dez03.ink","tld":"ink"},"ip":{"addr":"43.159.168.186","port":443,"asn":132203,"as":"Tencent Building, Kejizhongyi Avenue","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://americanexpress-dez03.ink/de","date":"2026-04-01T00:12:38.092Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"americanexpress-dez03.ink","organization":""},"issuer":{"commonName":"E7","organization":"Let's Encrypt"},"validity":{"start":"Mon, 30 Mar 2026 10:45:40 GMT","end":"Sun, 28 Jun 2026 10:45:39 GMT"},"fingerprint":{"sha1":"50:DF:64:B7:17:54:0F:1D:28:39:7F:0A:0C:22:62:A4:82:3B:82:51","sha256":"94:43:40:91:19:2F:2E:5F:A1:29:CB:BC:29:9C:19:1F:38:9B:C6:03:3F:08:0C:47:4C:27:1F:F9:97:7D:F8:69"}}},"request":{"raw":"GET /apps/DE_PT_06/assets/index-B7O3wHJn.css HTTP/1.1\r\nHost: americanexpress-dez03.ink\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://americanexpress-dez03.ink/de\r\nDNT: 1\r\nConnection: keep-alive\r\nCookie: PHPSID=99830bbd1873da417623fe89a35b01f2; uuid=99830bbd1873da417623fe89a35b01f2\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nalt-svc: h3=\":443\"; ma=2592000\r\ncache-control: public, max-age=2592000\r\ncontent-encoding: gzip\r\ncontent-type: text/css; charset=utf-8\r\netag: \"dhgitbcvu134k4-gzip\"\r\nlast-modified: Mon, 30 Mar 2026 23:54:40 GMT\r\nreferrer-policy: strict-origin-when-cross-origin\r\nserver: Caddy\r\nvary: Accept-Encoding\r\nx-content-type-options: nosniff\r\nx-frame-options: SAMEORIGIN\r\ncontent-length: 378\r\ndate: Wed, 01 Apr 2026 00:12:38 GMT\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Caddy","description":"","website":"https://caddyserver.com","common_platform_enumeration":"cpe:2.3:a:caddyserver:caddy:*:*:*:*:*:*:*:*","icon":"caddy.svg","categories":["Web servers"]}],"data":{"size":724,"size_decoded":0,"mime_type":"text/css; charset=utf-8","magic":"ASCII text, with very long lines (723)","md5":"bf924c0e4fb700bd54e39df992eb692b","sha1":"b51aa1caf383137b710b77374fa66e5395ee2bf4","sha256":"e4909836f23e7d8d6a7101674aa2c0ea57b709c1726c13a809aea35a7b45f98f","sha512":"09b70f023ed6552095a7289c3336aa5f9e696d483eac0c1a94e5fa7bce442c4665f9d4a6315ca5d4c24331480abd697326673b495264145b431676369d702b7e","ssdeep":"","tlshash":"d7019c31f748e000b236d0a8f8c4f1ec32963b7348565466ac965520cd871a7af40f48","first_seen":"2026-03-31T15:15:49.542021Z","last_seen":"2026-04-18T17:33:18.101047Z","times_seen":9,"resource_available":false,"data":null}},"time_used":153,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":153,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-04-01","alert":"Phishing Block","trigger":"americanexpress-dez03.ink","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-04-01","alert":"Sinkholed","trigger":"americanexpress-dez03.ink","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"americanexpress-dez03.ink/apps/DE_PT_06/assets/HP-175-Year-Banner-1280x400-CNKEqp5j.js","fqdn":"americanexpress-dez03.ink","domain":"americanexpress-dez03.ink","tld":"ink"},"ip":{"addr":"43.159.168.186","port":443,"asn":132203,"as":"Tencent Building, Kejizhongyi Avenue","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"fetch","requested_by":"https://americanexpress-dez03.ink/de","date":"2026-04-01T00:12:38.098Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"americanexpress-dez03.ink","organization":""},"issuer":{"commonName":"E7","organization":"Let's Encrypt"},"validity":{"start":"Mon, 30 Mar 2026 10:45:40 GMT","end":"Sun, 28 Jun 2026 10:45:39 GMT"},"fingerprint":{"sha1":"50:DF:64:B7:17:54:0F:1D:28:39:7F:0A:0C:22:62:A4:82:3B:82:51","sha256":"94:43:40:91:19:2F:2E:5F:A1:29:CB:BC:29:9C:19:1F:38:9B:C6:03:3F:08:0C:47:4C:27:1F:F9:97:7D:F8:69"}}},"request":{"raw":"GET /apps/DE_PT_06/assets/HP-175-Year-Banner-1280x400-CNKEqp5j.js HTTP/1.1\r\nHost: americanexpress-dez03.ink\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://americanexpress-dez03.ink/de\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\naccept-ranges: bytes\r\nalt-svc: h3=\":443\"; ma=2592000\r\ncache-control: public, max-age=2592000\r\ncontent-type: text/javascript; charset=utf-8\r\netag: \"dhgitbcvu1342s\"\r\nlast-modified: Mon, 30 Mar 2026 23:54:40 GMT\r\nreferrer-policy: strict-origin-when-cross-origin\r\nserver: Caddy\r\nvary: Accept-Encoding\r\nx-content-type-options: nosniff\r\nx-frame-options: SAMEORIGIN\r\ncontent-length: 100\r\ndate: Wed, 01 Apr 2026 00:12:38 GMT\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Caddy","description":"","website":"https://caddyserver.com","common_platform_enumeration":"cpe:2.3:a:caddyserver:caddy:*:*:*:*:*:*:*:*","icon":"caddy.svg","categories":["Web servers"]}],"data":{"size":100,"size_decoded":0,"mime_type":"text/javascript; charset=utf-8","magic":"ASCII text","md5":"19c80aa3ed425e1719f54ecfef114053","sha1":"575cf9b9fd0ae4f39d4220eeb4a2d08230374cc4","sha256":"fc2602654bfe5b3e6cc29d599f76bd6b63c4a6694e107528b349c37e0fe41369","sha512":"5a51f695148ca8c7ad7e0446cc2be0731d3132dcf90606c63bdf7cee13cb9678ebd900d454cb0728cdf9b767f5fb2e6b119ff4c196fa0dd315df9fc43cdbf742","ssdeep":"","tlshash":"a3b01203490f21b8023401be0b057fb0111125ccba5087b8374d4ae9875bf521d0a601","first_seen":"2026-03-19T13:43:02.846995Z","last_seen":"2026-04-18T17:33:18.10208Z","times_seen":75,"resource_available":true,"data":null}},"time_used":153,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":153,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-04-01","alert":"Phishing Block","trigger":"americanexpress-dez03.ink","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-04-01","alert":"Sinkholed","trigger":"americanexpress-dez03.ink","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"americanexpress-dez03.ink/apps/DE_PT_06/assets/ws-bg-light-grey-LTdop1CE.jpeg","fqdn":"americanexpress-dez03.ink","domain":"americanexpress-dez03.ink","tld":"ink"},"ip":{"addr":"43.159.168.186","port":443,"asn":132203,"as":"Tencent Building, Kejizhongyi Avenue","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://americanexpress-dez03.ink/de","date":"2026-04-01T00:12:38.617Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"americanexpress-dez03.ink","organization":""},"issuer":{"commonName":"E7","organization":"Let's Encrypt"},"validity":{"start":"Mon, 30 Mar 2026 10:45:40 GMT","end":"Sun, 28 Jun 2026 10:45:39 GMT"},"fingerprint":{"sha1":"50:DF:64:B7:17:54:0F:1D:28:39:7F:0A:0C:22:62:A4:82:3B:82:51","sha256":"94:43:40:91:19:2F:2E:5F:A1:29:CB:BC:29:9C:19:1F:38:9B:C6:03:3F:08:0C:47:4C:27:1F:F9:97:7D:F8:69"}}},"request":{"raw":"GET /apps/DE_PT_06/assets/ws-bg-light-grey-LTdop1CE.jpeg HTTP/1.1\r\nHost: americanexpress-dez03.ink\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://americanexpress-dez03.ink/apps/DE_PT_06/assets/index-CxLJg5Tb.css\r\nDNT: 1\r\nConnection: keep-alive\r\nCookie: PHPSID=99830bbd1873da417623fe89a35b01f2; uuid=99830bbd1873da417623fe89a35b01f2\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\naccept-ranges: bytes\r\nalt-svc: h3=\":443\"; ma=2592000\r\ncache-control: public, max-age=2592000\r\ncontent-type: image/jpeg\r\netag: \"dhgitbcvu134daf\"\r\nlast-modified: Mon, 30 Mar 2026 23:54:40 GMT\r\nreferrer-policy: strict-origin-when-cross-origin\r\nserver: Caddy\r\nvary: Accept-Encoding\r\nx-content-type-options: nosniff\r\nx-frame-options: SAMEORIGIN\r\ncontent-length: 17223\r\ndate: Wed, 01 Apr 2026 00:12:38 GMT\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Caddy","description":"","website":"https://caddyserver.com","common_platform_enumeration":"cpe:2.3:a:caddyserver:caddy:*:*:*:*:*:*:*:*","icon":"caddy.svg","categories":["Web servers"]}],"data":{"size":17223,"size_decoded":0,"mime_type":"image/jpeg","magic":"JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 320x305, components 3","md5":"6b79c0f0a9d869ac00812bb798b34b66","sha1":"fcaea21dd095d7ae4837b1e07a84594093bedf1d","sha256":"4a018578b6c0438c92ce376df95a7fefd9bc6eb122968fe511d72da79131bb42","sha512":"baa39686be7ff8c6e73f7425f010dc0ed963190da7b4090794ba34153ed891bede034cafc83e68580b17409b57058ba8563795b274f5d466017c022ba2e28598","ssdeep":"384:IVSMZQzhElxLBLjmlWwBhEv7J63Hu1GYtlfKK4cVX9XcagWIqsGQk:IVGWlhBLqgahE911tli/iX9sagWIrGb","tlshash":"3872c0f00465871cd8d1b53b5db3d310e2121a66956f88da62a3a676c72a7e03f490cf","first_seen":"2026-03-19T13:43:02.875892Z","last_seen":"2026-04-18T17:33:18.11041Z","times_seen":75,"resource_available":false,"data":null}},"time_used":299,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":298,"receive":1,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-04-01","alert":"Sinkholed","trigger":"americanexpress-dez03.ink","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-04-01","alert":"Phishing Block","trigger":"americanexpress-dez03.ink","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"americanexpress-dez03.ink/apps/DE_PT_06/assets/de-C4D51E0Z.js","fqdn":"americanexpress-dez03.ink","domain":"americanexpress-dez03.ink","tld":"ink"},"ip":{"addr":"43.159.168.186","port":443,"asn":132203,"as":"Tencent Building, Kejizhongyi Avenue","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://americanexpress-dez03.ink/de","date":"2026-04-01T00:12:38.620Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"americanexpress-dez03.ink","organization":""},"issuer":{"commonName":"E7","organization":"Let's Encrypt"},"validity":{"start":"Mon, 30 Mar 2026 10:45:40 GMT","end":"Sun, 28 Jun 2026 10:45:39 GMT"},"fingerprint":{"sha1":"50:DF:64:B7:17:54:0F:1D:28:39:7F:0A:0C:22:62:A4:82:3B:82:51","sha256":"94:43:40:91:19:2F:2E:5F:A1:29:CB:BC:29:9C:19:1F:38:9B:C6:03:3F:08:0C:47:4C:27:1F:F9:97:7D:F8:69"}}},"request":{"raw":"GET /apps/DE_PT_06/assets/de-C4D51E0Z.js HTTP/1.1\r\nHost: americanexpress-dez03.ink\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://americanexpress-dez03.ink/apps/DE_PT_06/assets/index-C2e9xBVp.js\r\nDNT: 1\r\nConnection: keep-alive\r\nCookie: PHPSID=99830bbd1873da417623fe89a35b01f2; uuid=99830bbd1873da417623fe89a35b01f2\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\naccept-ranges: bytes\r\nalt-svc: h3=\":443\"; ma=2592000\r\ncache-control: public, max-age=2592000\r\ncontent-type: text/javascript; charset=utf-8\r\netag: \"dhgitbcvu1349a\"\r\nlast-modified: Mon, 30 Mar 2026 23:54:40 GMT\r\nreferrer-policy: strict-origin-when-cross-origin\r\nserver: Caddy\r\nvary: Accept-Encoding\r\nx-content-type-options: nosniff\r\nx-frame-options: SAMEORIGIN\r\ncontent-length: 334\r\ndate: Wed, 01 Apr 2026 00:12:38 GMT\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Caddy","description":"","website":"https://caddyserver.com","common_platform_enumeration":"cpe:2.3:a:caddyserver:caddy:*:*:*:*:*:*:*:*","icon":"caddy.svg","categories":["Web servers"]}],"data":{"size":334,"size_decoded":0,"mime_type":"text/javascript; charset=utf-8","magic":"ASCII text, with very long lines (333)","md5":"0cf70b59adc0d43993c5fcf6bc52c753","sha1":"54cfbad5d584b038ecac40ffdfac4dbfc7ce0d73","sha256":"aa221c2b52b178e319e0961826ed0e01710ae936818ab39d2f88f9a182997052","sha512":"f9210edf86ecbd2ee525887faafafbf9f70ad7a18ebdc0a45a5067b473b68b6f67ff7c4ddbec4a6180ab2fe040cbd0516e309e05b621f7a0077851b91304e90f","ssdeep":"","tlshash":"4ae0c28d68131e4388a085760f2a5e6ad8c276c97fecf59f54b2d85c328009bad5c6fd","first_seen":"2026-03-31T15:15:49.543007Z","last_seen":"2026-04-18T17:33:18.099914Z","times_seen":9,"resource_available":true,"data":null}},"time_used":297,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":297,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-04-01","alert":"Phishing Block","trigger":"americanexpress-dez03.ink","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-04-01","alert":"Sinkholed","trigger":"americanexpress-dez03.ink","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"americanexpress-dez03.ink/de","fqdn":"americanexpress-dez03.ink","domain":"americanexpress-dez03.ink","tld":"ink"},"ip":{"addr":"43.159.168.186","port":443,"asn":132203,"as":"Tencent Building, Kejizhongyi Avenue","country":"United States","country_code":"US"},"is_navigation_request":true,"resource_type":"document","requested_by":"","date":"2026-04-01T00:12:35.521Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"americanexpress-dez03.ink","organization":""},"issuer":{"commonName":"E7","organization":"Let's Encrypt"},"validity":{"start":"Mon, 30 Mar 2026 10:45:40 GMT","end":"Sun, 28 Jun 2026 10:45:39 GMT"},"fingerprint":{"sha1":"50:DF:64:B7:17:54:0F:1D:28:39:7F:0A:0C:22:62:A4:82:3B:82:51","sha256":"94:43:40:91:19:2F:2E:5F:A1:29:CB:BC:29:9C:19:1F:38:9B:C6:03:3F:08:0C:47:4C:27:1F:F9:97:7D:F8:69"}}},"request":{"raw":"GET /de HTTP/1.1\r\nHost: americanexpress-dez03.ink\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nUpgrade-Insecure-Requests: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: document\r\nSec-Fetch-Mode: navigate\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\naccess-control-allow-credentials: true\r\naccess-control-allow-headers: *\r\naccess-control-allow-methods: *\r\naccess-control-allow-origin: *\r\nalt-svc: h3=\":443\"; ma=2592000\r\ncontent-encoding: gzip\r\ncontent-type: text/html;charset=utf-8\r\nreferrer-policy: strict-origin-when-cross-origin\r\nserver: workerman\r\nset-cookie: PHPSID=99830bbd1873da417623fe89a35b01f2; Max-Age=31536000; Path=/; HttpOnly\r\nvary: Accept-Encoding\r\nvia: 1.1 Caddy\r\nx-content-type-options: nosniff\r\nx-frame-options: SAMEORIGIN\r\ncontent-length: 352\r\ndate: Wed, 01 Apr 2026 00:12:36 GMT\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":null,"data":{"size":572,"size_decoded":0,"mime_type":"text/html; charset=utf-8","magic":"HTML document, ASCII text, with CRLF, CR, LF line terminators","md5":"92a8b452affe76d0225254ec281edd67","sha1":"039c74d2900915ff8d9ca400063fc19b3ea29949","sha256":"2c8c700a8a0905eb6d7f416209a3aab74f79e61b5091a04ce8f18f9a173a6d18","sha512":"294853b88fc1cdf4a5dd12380c7ae43d95729dc963f7bf3c1f829b0540d32fadd0d11af046bf4a24c9272edfd481cb795249cbd258fcff563cc52edce524b70a","ssdeep":"","tlshash":"edf0466108990c2d13b0137d3a90a408f497fa8acb0669d036ea606b2fe5e098adf649","first_seen":"2026-03-31T15:15:49.548599Z","last_seen":"2026-04-01T03:03:15.225514Z","times_seen":4,"resource_available":false,"data":null}},"time_used":1330,"timings":{"blocked":584,"dns":263,"connect":153,"send":0,"wait":161,"receive":1,"ssl":165},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-04-01","alert":"Sinkholed","trigger":"americanexpress-dez03.ink","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-04-01","alert":"Phishing Block","trigger":"americanexpress-dez03.ink","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"americanexpress-dez03.ink/apps/DE_PT_06/assets/index-CxLJg5Tb.css","fqdn":"americanexpress-dez03.ink","domain":"americanexpress-dez03.ink","tld":"ink"},"ip":{"addr":"43.159.168.186","port":443,"asn":132203,"as":"Tencent Building, Kejizhongyi Avenue","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://americanexpress-dez03.ink/de","date":"2026-04-01T00:12:36.550Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"americanexpress-dez03.ink","organization":""},"issuer":{"commonName":"E7","organization":"Let's Encrypt"},"validity":{"start":"Mon, 30 Mar 2026 10:45:40 GMT","end":"Sun, 28 Jun 2026 10:45:39 GMT"},"fingerprint":{"sha1":"50:DF:64:B7:17:54:0F:1D:28:39:7F:0A:0C:22:62:A4:82:3B:82:51","sha256":"94:43:40:91:19:2F:2E:5F:A1:29:CB:BC:29:9C:19:1F:38:9B:C6:03:3F:08:0C:47:4C:27:1F:F9:97:7D:F8:69"}}},"request":{"raw":"GET /apps/DE_PT_06/assets/index-CxLJg5Tb.css HTTP/1.1\r\nHost: americanexpress-dez03.ink\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://americanexpress-dez03.ink/de\r\nDNT: 1\r\nConnection: keep-alive\r\nCookie: PHPSID=99830bbd1873da417623fe89a35b01f2\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nalt-svc: h3=\":443\"; ma=2592000\r\ncache-control: public, max-age=2592000\r\ncontent-encoding: gzip\r\ncontent-type: text/css; charset=utf-8\r\netag: \"dhgitbcvu134bcgc-gzip\"\r\nlast-modified: Mon, 30 Mar 2026 23:54:40 GMT\r\nreferrer-policy: strict-origin-when-cross-origin\r\nserver: Caddy\r\nvary: Accept-Encoding\r\nx-content-type-options: nosniff\r\nx-frame-options: SAMEORIGIN\r\ndate: Wed, 01 Apr 2026 00:12:36 GMT\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Caddy","description":"","website":"https://caddyserver.com","common_platform_enumeration":"cpe:2.3:a:caddyserver:caddy:*:*:*:*:*:*:*:*","icon":"caddy.svg","categories":["Web servers"]}],"data":{"size":529356,"size_decoded":0,"mime_type":"text/css; charset=utf-8","magic":"Unicode text, UTF-8 text, with very long lines (65198), with no line terminators","md5":"27ca80d3572fffdc531b9e1c19be1dca","sha1":"ebac972c4f0344c3123ae2023b2fc53c10ea8f44","sha256":"cb09ea15ccea904c65c26bd4e0b7e19f9c7b15192ef8e73ae6b3c0f8fc36bb02","sha512":"4cbaa73d5aed0151bc585dfc5d9ffb3a51c3f93ffafa9a0ac5b36474e8eb33095fccad5ea9e3c9db0d1d03445fe51d1f43edaad27b7c78d5aace35166a40a26d","ssdeep":"3072:3VXcBu03pAs8zdJHR4/ZDrvLUbemsDAw6Fa:3VXcBu03pL3vLUbemsDAwYa","tlshash":"8cb4b7c9b6e0201dc227c60af2913ab8fb2b555de7552df7f11f7b5c9ac228702b2518","first_seen":"2026-03-31T15:15:49.549489Z","last_seen":"2026-04-01T03:03:15.217101Z","times_seen":4,"resource_available":false,"data":null}},"time_used":312,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":312,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-04-01","alert":"Phishing Block","trigger":"americanexpress-dez03.ink","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-04-01","alert":"Sinkholed","trigger":"americanexpress-dez03.ink","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"fonts-api.wp.com/css?family=Inter%3A500%2C%7CPoppins%3A500%2C\u0026display=fallback\u0026ver=4.11.16","fqdn":"fonts-api.wp.com","domain":"wp.com","tld":"com"},"ip":{"addr":"192.0.77.32","port":443,"asn":2635,"as":"AUTOMATTIC","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://americanexpress-dez03.ink/de","date":"2026-04-01T00:12:37.332Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"wp.com","organization":""},"issuer":{"commonName":"E7","organization":"Let's Encrypt"},"validity":{"start":"Mon, 02 Feb 2026 19:44:49 GMT","end":"Sun, 03 May 2026 19:44:48 GMT"},"fingerprint":{"sha1":"74:16:DF:29:E8:C6:D5:FE:A5:36:94:0A:16:BE:D1:6C:47:5D:73:4E","sha256":"6B:F6:59:57:FF:CF:20:B1:02:F4:62:B9:0B:13:CF:BC:2A:97:53:23:B5:D3:82:11:79:85:81:64:BE:85:54:75"}}},"request":{"raw":"GET /css?family=Inter%3A500%2C%7CPoppins%3A500%2C\u0026display=fallback\u0026ver=4.11.16 HTTP/1.1\r\nHost: fonts-api.wp.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://americanexpress-dez03.ink/\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Wed, 01 Apr 2026 00:12:37 GMT\r\ncontent-type: text/css; charset=utf-8\r\naccess-control-allow-origin: *\r\ntiming-allow-origin: *\r\nlink: \u003chttps://fonts.gstatic.com\u003e; rel=preconnect; crossorigin\r\nstrict-transport-security: max-age=31536000\r\ncache-control: private, max-age=86400\r\ncross-origin-resource-policy: cross-origin\r\ncross-origin-opener-policy: same-origin-allow-popups\r\ncontent-security-policy-report-only: require-trusted-types-for 'script';report-uri https://csp.withgoogle.com/csp/bcfae741e379a885f2ab2cf83ebe6d32/mr\r\nx-xss-protection: 0\r\nx-frame-options: SAMEORIGIN\r\nx-content-type-options: nosniff\r\nvary: Accept-Encoding, Sec-Fetch-Dest, Sec-Fetch-Mode, Sec-Fetch-Site,Accept-Encoding\r\nalt-svc: h3=\":443\"; ma=86400\r\nx-nc: BYPASS arn 28\r\nserver-timing: a8c-cdn, dc;desc=arn, cache;desc=BYPASS;dur=12.0\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":3782,"size_decoded":0,"mime_type":"text/css; charset=utf-8","magic":"ASCII text","md5":"20d3052e2ec2d6724ef6c901b7837b53","sha1":"03b668324779b05d0d08380aeb41e499f1443731","sha256":"6e6595f831c9645979d196d7a5672486e1c31607a883b52472bc6c5492a385ae","sha512":"9eb3303d234a784c73214627ae0c01a3471b6edb534179f960394dc7918eecbd545de181c71d91dba700b43ef73d5cb78e80d7c9da2e7c7dd93ad81379e0502a","ssdeep":"","tlshash":"9e710ea1042ba1009b835dc323cf7f36ee8e25482045d6a95bfd0d486cead3a5371b9e","first_seen":"2026-03-19T13:43:02.872759Z","last_seen":"2026-05-07T13:50:41.271814Z","times_seen":80,"resource_available":false,"data":null}},"time_used":95,"timings":{"blocked":36,"dns":1,"connect":10,"send":0,"wait":20,"receive":0,"ssl":24},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"americanexpress-dez03.ink/apps/DE_PT_06/assets/index-DLVKgBEN.js","fqdn":"americanexpress-dez03.ink","domain":"americanexpress-dez03.ink","tld":"ink"},"ip":{"addr":"43.159.168.186","port":443,"asn":132203,"as":"Tencent Building, Kejizhongyi Avenue","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://americanexpress-dez03.ink/de","date":"2026-04-01T00:12:38.260Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"americanexpress-dez03.ink","organization":""},"issuer":{"commonName":"E7","organization":"Let's Encrypt"},"validity":{"start":"Mon, 30 Mar 2026 10:45:40 GMT","end":"Sun, 28 Jun 2026 10:45:39 GMT"},"fingerprint":{"sha1":"50:DF:64:B7:17:54:0F:1D:28:39:7F:0A:0C:22:62:A4:82:3B:82:51","sha256":"94:43:40:91:19:2F:2E:5F:A1:29:CB:BC:29:9C:19:1F:38:9B:C6:03:3F:08:0C:47:4C:27:1F:F9:97:7D:F8:69"}}},"request":{"raw":"GET /apps/DE_PT_06/assets/index-DLVKgBEN.js HTTP/1.1\r\nHost: americanexpress-dez03.ink\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://americanexpress-dez03.ink/apps/DE_PT_06/assets/index-C2e9xBVp.js\r\nDNT: 1\r\nConnection: keep-alive\r\nCookie: PHPSID=99830bbd1873da417623fe89a35b01f2; uuid=99830bbd1873da417623fe89a35b01f2\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nalt-svc: h3=\":443\"; ma=2592000\r\ncache-control: public, max-age=2592000\r\ncontent-encoding: gzip\r\ncontent-type: text/javascript; charset=utf-8\r\netag: \"dhgitbcvu1345ck-gzip\"\r\nlast-modified: Mon, 30 Mar 2026 23:54:40 GMT\r\nreferrer-policy: strict-origin-when-cross-origin\r\nserver: Caddy\r\nvary: Accept-Encoding\r\nx-content-type-options: nosniff\r\nx-frame-options: SAMEORIGIN\r\ncontent-length: 3063\r\ndate: Wed, 01 Apr 2026 00:12:38 GMT\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Caddy","description":"","website":"https://caddyserver.com","common_platform_enumeration":"cpe:2.3:a:caddyserver:caddy:*:*:*:*:*:*:*:*","icon":"caddy.svg","categories":["Web servers"]}],"data":{"size":6932,"size_decoded":0,"mime_type":"text/javascript; charset=utf-8","magic":"JavaScript source, Unicode text, UTF-8 text, with very long lines (6915)","md5":"e2144745591156267c0d9a283c4abdf6","sha1":"3132e79737aa25e5fc057d83ad557bd70d5be8a0","sha256":"c67a75f6f2ace1969e5f74b22a21cd99e91df5abce0e2b5ba26382ca323d4b6d","sha512":"ddf27758d143c0377feae15dccb71ce85b10f9b8fc9b785adcfa68846fd04a8e39b9f948842a7a98538216c29ec9318316720f128004fc1f6623196497f10e2f","ssdeep":"192:BElN1Hun8a6Cgyyagug1b5wh64D5ITwXDf/2DfOVD1DfopyY64:BElXHu8/DrJuhvIT+f/kfOVxfGH","tlshash":"b1e1b4086af4e1bca0cb04b5e521e4e0b0babc6ae065c5d17ff50a1d97aeb4ca745538","first_seen":"2026-03-31T15:15:49.546552Z","last_seen":"2026-04-01T03:03:15.223407Z","times_seen":4,"resource_available":true,"data":null}},"time_used":154,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":154,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-04-01","alert":"Phishing Block","trigger":"americanexpress-dez03.ink","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-04-01","alert":"Sinkholed","trigger":"americanexpress-dez03.ink","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"americanexpress-dez03.ink/apps/DE_PT_06/assets/index-C2e9xBVp.js","fqdn":"americanexpress-dez03.ink","domain":"americanexpress-dez03.ink","tld":"ink"},"ip":{"addr":"43.159.168.186","port":443,"asn":132203,"as":"Tencent Building, Kejizhongyi Avenue","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://americanexpress-dez03.ink/de","date":"2026-04-01T00:12:36.541Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"americanexpress-dez03.ink","organization":""},"issuer":{"commonName":"E7","organization":"Let's Encrypt"},"validity":{"start":"Mon, 30 Mar 2026 10:45:40 GMT","end":"Sun, 28 Jun 2026 10:45:39 GMT"},"fingerprint":{"sha1":"50:DF:64:B7:17:54:0F:1D:28:39:7F:0A:0C:22:62:A4:82:3B:82:51","sha256":"94:43:40:91:19:2F:2E:5F:A1:29:CB:BC:29:9C:19:1F:38:9B:C6:03:3F:08:0C:47:4C:27:1F:F9:97:7D:F8:69"}}},"request":{"raw":"GET /apps/DE_PT_06/assets/index-C2e9xBVp.js HTTP/1.1\r\nHost: americanexpress-dez03.ink\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://americanexpress-dez03.ink/de\r\nDNT: 1\r\nConnection: keep-alive\r\nCookie: PHPSID=99830bbd1873da417623fe89a35b01f2\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nalt-svc: h3=\":443\"; ma=2592000\r\ncache-control: public, max-age=2592000\r\ncontent-encoding: gzip\r\ncontent-type: text/javascript; charset=utf-8\r\netag: \"dhgitbcvu134tljm-gzip\"\r\nlast-modified: Mon, 30 Mar 2026 23:54:40 GMT\r\nreferrer-policy: strict-origin-when-cross-origin\r\nserver: Caddy\r\nvary: Accept-Encoding\r\nx-content-type-options: nosniff\r\nx-frame-options: SAMEORIGIN\r\ndate: Wed, 01 Apr 2026 00:12:36 GMT\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Caddy","description":"","website":"https://caddyserver.com","common_platform_enumeration":"cpe:2.3:a:caddyserver:caddy:*:*:*:*:*:*:*:*","icon":"caddy.svg","categories":["Web servers"]}],"data":{"size":1380946,"size_decoded":0,"mime_type":"text/javascript; charset=utf-8","magic":"JavaScript source, ASCII text, with very long lines (65124)","md5":"d3965e920c03aa7be888e29f87979cf5","sha1":"82b5c23c338bf897d53cea7410714421e2b109ee","sha256":"e4adfd289fd26a147b49b0c9d77392b73c2104cde9579314c7d112773eacedb5","sha512":"dc96ad8d8b7e008165cab4007a4cdec94cde131e523c21b2f052f0496d9d002f3f94d68ae6f435984ed005d7fd105112724d6a2f0d7b142eb26098d6c769525b","ssdeep":"24576:Coq0xsBb+69CzS0jBxKWabVLWzhpQtC89PpsUNHi7cGHL3pdTTEBYlwyg:Coq0xsBb+69CzS0jBxKWabVLWzhpQQV6","tlshash":"ec359eac39d0632005e2468de6c7364fe32ddc2ab109a5f5b68cd84a3fc3895d177e69","first_seen":"2026-04-01T00:13:06.643369Z","last_seen":"2026-04-01T00:13:06.643369Z","times_seen":1,"resource_available":false,"data":null}},"time_used":158,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":158,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-04-01","alert":"Sinkholed","trigger":"americanexpress-dez03.ink","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-04-01","alert":"Phishing Block","trigger":"americanexpress-dez03.ink","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"americanexpress-dez03.ink/apps/DE_PT_06/assets/HP-175-Year-Banner-1280x400-DWqgiJZK.jpg","fqdn":"americanexpress-dez03.ink","domain":"americanexpress-dez03.ink","tld":"ink"},"ip":{"addr":"43.159.168.186","port":443,"asn":132203,"as":"Tencent Building, Kejizhongyi Avenue","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://americanexpress-dez03.ink/de","date":"2026-04-01T00:12:38.597Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"americanexpress-dez03.ink","organization":""},"issuer":{"commonName":"E7","organization":"Let's Encrypt"},"validity":{"start":"Mon, 30 Mar 2026 10:45:40 GMT","end":"Sun, 28 Jun 2026 10:45:39 GMT"},"fingerprint":{"sha1":"50:DF:64:B7:17:54:0F:1D:28:39:7F:0A:0C:22:62:A4:82:3B:82:51","sha256":"94:43:40:91:19:2F:2E:5F:A1:29:CB:BC:29:9C:19:1F:38:9B:C6:03:3F:08:0C:47:4C:27:1F:F9:97:7D:F8:69"}}},"request":{"raw":"GET /apps/DE_PT_06/assets/HP-175-Year-Banner-1280x400-DWqgiJZK.jpg HTTP/1.1\r\nHost: americanexpress-dez03.ink\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://americanexpress-dez03.ink/de\r\nDNT: 1\r\nConnection: keep-alive\r\nCookie: PHPSID=99830bbd1873da417623fe89a35b01f2; uuid=99830bbd1873da417623fe89a35b01f2\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\naccept-ranges: bytes\r\nalt-svc: h3=\":443\"; ma=2592000\r\ncache-control: public, max-age=2592000\r\ncontent-type: image/jpeg\r\netag: \"dhgitbcvu1341zya\"\r\nlast-modified: Mon, 30 Mar 2026 23:54:40 GMT\r\nreferrer-policy: strict-origin-when-cross-origin\r\nserver: Caddy\r\nvary: Accept-Encoding\r\nx-content-type-options: nosniff\r\nx-frame-options: SAMEORIGIN\r\ncontent-length: 93250\r\ndate: Wed, 01 Apr 2026 00:12:38 GMT\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Caddy","description":"","website":"https://caddyserver.com","common_platform_enumeration":"cpe:2.3:a:caddyserver:caddy:*:*:*:*:*:*:*:*","icon":"caddy.svg","categories":["Web servers"]}],"data":{"size":93250,"size_decoded":0,"mime_type":"image/jpeg","magic":"JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 1280x400, components 3","md5":"c8d4768df9076ac1443c6207c86bd056","sha1":"924d8b4b963d209a7f2aa311f87ed2ef25cb5a6b","sha256":"e3ea017d0f19e27e01aaa5ee9a50bc3d0cf08d668101e4c5cfeea36c5312ad59","sha512":"bd65ecef06cf5b46f237c5dbcbde1010800c322809f9ea96e7a0959f6c57f32e9a4f3bd865b10164b43ce00ba100aab8dd2bd7c4ed6ad77b914748089e63f176","ssdeep":"1536:xsg+BPX8CvQsq6xNXD/JUY8wT87rE8RKxjxmK0jEXNStzm1ZXOOwl:e/tsEtQwT8UBxtXHSlu8Z","tlshash":"bb9312eb938345049526df3e33e52700871e890fefe13e7d089e9171ab2c7649a25d6b","first_seen":"2026-03-19T13:43:02.849525Z","last_seen":"2026-04-18T17:33:18.099084Z","times_seen":75,"resource_available":false,"data":null}},"time_used":319,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":316,"receive":3,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-04-01","alert":"Sinkholed","trigger":"americanexpress-dez03.ink","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-04-01","alert":"Phishing Block","trigger":"americanexpress-dez03.ink","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null}],"urlquery":null}}]}