{"report_id":"3ac80db7-3ae0-47c8-a08f-b588a8f638ee","version":0,"status":"done","tags":[],"date":"2026-09-25T05:37:19Z","url":{"schema":"http","addr":"bestfond.net/Shaw2022service","fqdn":"bestfond.net","domain":"bestfond.net","tld":"net"},"ip":{"addr":"66.33.215.21","port":0,"asn":22611,"as":"InMotion Hosting, Inc.","country":"The Netherlands","country_code":"NL"},"final":{"url":{"schema":"https","addr":"bestfond.net/Shaw2022service/","fqdn":"bestfond.net","domain":"bestfond.net","tld":"net"},"title":"Sign in . Shaw","dom":{"size":14846,"mime_type":"text/html; charset=utf-8","magic":"HTML document, ASCII text, with very long lines (715)","md5":"a1b77a385c6d3bf3e5db8d23e8280fea","sha1":"f34e02b1cc98db7ecdf1b4977835a37959af5429","sha256":"0ef0bef79627afa2f8c4575054017bf7fdc8a3fe875bf98c2aec77740c20b0f7","sha512":"0e7aa992be7173f611f90ea125e48eebd4516cd6f8d273319e38f0fa380e9007da743dd9ea4c7bb0e17734f51df6f4f2ff54bd7160bba6028a25f86f14e1d816","ssdeep":"384:k9gOzgXSY3J1UBa64oN25SspTtdRyrM+OB5AryYwun:DlVOLQ9pxyJK+","tlshash":"8d628415a8f0a5630153c5cabab6ab1a7de2e207cb462644b2fc07dc0fd3d8add0355e","dom_hash":"domhashf0f644fa29d3a5c7dca45b2cb87e62e1","first_seen":"2026-09-24T01:10:39.462314Z","last_seen":"2026-09-25T05:37:26.491475Z","times_seen":4,"resource_available":false,"data":null}},"submit":{"url":{"schema":"http","addr":"bestfond.net/Shaw2022service","fqdn":"bestfond.net","domain":"bestfond.net","tld":"net"},"ip":{"addr":"66.33.215.21","port":0,"asn":22611,"as":"InMotion Hosting, Inc.","country":"The Netherlands","country_code":"NL"},"tags":null,"meta":null},"settings":{"access":"public","device_type":"desktop","expires_at":"2027-10-30T05:37:19Z","useragent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0","referer":"","cookies":null,"exit_node":"31pu2ilhjrkmwpf"},"stats":{"alert_count":{"ids":0,"urlquery":0,"analyzer":5}},"detection":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-25","alert":"Sinkholed","trigger":"bestfond.net","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-09-25","alert":"Phishing Block","trigger":"bestfond.net","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"cira_dns","sensor_type":"DNS","title":"CIRA Canadian Shield DNS","description":"CIRA Canadian Shield DNS","scan_date":"2026-09-25","alert":"Sinkholed","trigger":"bestfond.net","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cira.ca/en/canadian-shield/","meta":null},{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-09-25","alert":"Sinkholed","trigger":"bestfond.net","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-09-25","alert":"Sinkholed","trigger":"bestfond.net","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null}],"urlquery":null},"summary":[{"fqdn":"bestfond.net","ip":{"addr":"66.33.215.21","port":443,"asn":22611,"as":"INMOTION","country":"United States","country_code":"US"},"domain_registered":"2026-09-18","domain_rank":0,"first_seen":"2026-09-24T01:10:35.591529Z","last_seen":"2026-09-24T01:10:35.591529Z","alert_count":60,"request_count":12,"received_data":387828,"sent_data":6066,"comment":"","tags":null,"fingerprints":[{"name":"Apache HTTP Server","description":"Apache is a free and open-source cross-platform web server software.","website":"https://httpd.apache.org/","common_platform_enumeration":"cpe:2.3:a:apache:http_server:*:*:*:*:*:*:*:*","icon":"Apache.svg","categories":["Web servers"]},{"name":"jQuery","description":"jQuery is a JavaScript library which is a free, open-source software designed to simplify HTML DOM tree traversal and manipulation, as well as event handling, CSS animation, and Ajax.","website":"https://jquery.com","common_platform_enumeration":"cpe:2.3:a:jquery:jquery:*:*:*:*:*:*:*:*","icon":"jQuery.svg","categories":["JavaScript libraries"]}]}],"files":null,"artifacts":{"windows_shortcuts":null,"files":null,"telegram":null,"pdfs":null,"clipboard":null},"sensors":{"ids":null,"analyzer":null,"urlquery":null},"javascript":{"script":[{"url":{"schema":"https","addr":"bestfond.net/Shaw2022service/","fqdn":"bestfond.net","domain":"bestfond.net","tld":"net"},"ip":{"addr":"66.33.215.21","port":443,"asn":22611,"as":"INMOTION","country":"United States","country_code":"US"},"introduction_type":"scriptElement","is_inline":true,"md5":"0613bc1b5cb2068466844790bcf5a962","sha1":"702beddb2283d0f1977d75f30bbdeb957279c4c8","sha256":"073b1d9e270cd6b48df921cd77eee699092aab315ec3b71929a5cf40debe17c5","sha512":"1f27f72b5c7ef10e8ad2eef0e896f130f914a78c6af0fcda3990732b84edad85fb0973843924decd1e750b8e9146fdc93904e9ad40e06eaef8fdcd07a159c9c7","ssdeep":"","tlshash":"8dd022a328974a9013b721eb281ff1e28c33a02c0b46eac006f8f0c03c8f418361b4ca","size":211,"data":"","first_seen":"2026-09-24T01:10:39.475535Z","last_seen":"2026-09-25T05:37:26.499267Z","times_seen":4,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"bestfond.net/Shaw2022service/","fqdn":"bestfond.net","domain":"bestfond.net","tld":"net"},"ip":{"addr":"66.33.215.21","port":443,"asn":22611,"as":"INMOTION","country":"United States","country_code":"US"},"introduction_type":"scriptElement","is_inline":true,"md5":"3c6fa768aa843f858f3d29a769d3e86d","sha1":"bc3bf846c4c7527f4578f88c64ab13fe63f8351c","sha256":"4fd4cc59185c6cc460bfec1eb3b84b8fb7f3eefe3b6fd075dc720c0dd6086f7e","sha512":"f14c6d6d4aacde4554023b2d5c8dd2f5a5cd3864ff35160bb44fb823a9f70988ee9895a27d913316593f4a2798394edd4a8926c61b015abb5d2eb708ac5d2980","ssdeep":"","tlshash":"5cd05e0ab6d811e025732a63127bdb8865354083040699093c7c93a10f089a45403286","size":254,"data":"","first_seen":"2026-09-24T01:10:39.476624Z","last_seen":"2026-09-25T05:37:26.49978Z","times_seen":4,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"bestfond.net/Shaw2022service/","fqdn":"bestfond.net","domain":"bestfond.net","tld":"net"},"ip":{"addr":"66.33.215.21","port":443,"asn":22611,"as":"INMOTION","country":"United States","country_code":"US"},"introduction_type":"eventHandler","is_inline":false,"md5":"0a54097f3b5b21c510115870aa5ddb82","sha1":"93fcb7a176edd5990f9d895266430dbf225cf30b","sha256":"15a9159765fd58d014a6ef4d9774e1d83bd05efaf9ae2bdb354c47fa84a0a621","sha512":"1f6fac885d4ba4bb4bc4f9e9a0c2c7d957a91ca5c05c243066ce85e4214669168ccd38b9e7a977e30b4af04f0a9728506c12a7ed65eeaa9611b4b19f7fa0e567","ssdeep":"","tlshash":"035000000000000c0c00000f0000000c000000000000c00c00c000300c000300003300","size":10,"data":"","first_seen":"2023-04-16T19:20:04Z","last_seen":"2026-09-25T05:37:26.500292Z","times_seen":41,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"bestfond.net/Shaw2022service/js/jquery.min.js","fqdn":"bestfond.net","domain":"bestfond.net","tld":"net"},"ip":{"addr":"66.33.215.21","port":443,"asn":22611,"as":"INMOTION","country":"United States","country_code":"US"},"introduction_type":"scriptElement","is_inline":false,"md5":"b11ced65f32fedbe9bf81ef9db0f3c94","sha1":"fdfd441e66831bfb8809e8cb69c2c3cd26b5d7c2","sha256":"0fb170f24675c84f8228ad6b61d69bf6705030949cc2fec316b3a006eab282f8","sha512":"864e5aa02e74823de70e3914a9ba75413c9559e4508f72ee7d23993acbf6488d69ef13a50e5b465bee3a709b36664f38aefe9ec0b8d9d86f4873f1ac552c64cb","ssdeep":"1536:8YRKUfAjtled3TmtaFyQHGvCXsedOgRc9izzr4yff8teLvHHEjam7W5X3yzSiLnM:VUbCGvCu09s2o2skAieW","tlshash":"9593e7d9b2d67123c7b731b850af510bb17698aa784c8c50f068d8e4be74a48907bf7d","size":94839,"data":"","first_seen":"2023-03-07T12:01:56Z","last_seen":"2026-09-27T21:25:25.041434Z","times_seen":3228,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"bestfond.net/Shaw2022service/js/combine_signon_136.js","fqdn":"bestfond.net","domain":"bestfond.net","tld":"net"},"ip":{"addr":"66.33.215.21","port":443,"asn":22611,"as":"INMOTION","country":"United States","country_code":"US"},"introduction_type":"scriptElement","is_inline":false,"md5":"5ad9a05645773062718c3a131762dfd8","sha1":"9dd2be9f51b8b5679e3c0b5afd7cb16dd95ecba7","sha256":"e0ad5458dbc7bf04431ba5aa06bbc9d2dcb984c22c419c4605a458c3e0c9db8b","sha512":"652e3aa9e52e9fe858aa7b44b4d5a9ca14aca39b5de85052f39498a2dc6d480d1fb889b1ab36677185c0133e8e55a1aec2aa809bdec22b2929b97b1dcf7ed321","ssdeep":"1536:TnNUBXex09xT/26WzwLT30+U9IrADoeakybh/WugIPhk5JM:KBu0jTZE+U9IrADoeKWK","tlshash":"32a3094db291756a83abf074106f230a723a9d69f844c46cf9b4c5f6ae74e48107bf39","size":99059,"data":"","first_seen":"2023-03-09T13:49:27Z","last_seen":"2026-09-25T05:37:26.496402Z","times_seen":28,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"bestfond.net/Shaw2022service/js/jquery.cookie.js","fqdn":"bestfond.net","domain":"bestfond.net","tld":"net"},"ip":{"addr":"66.33.215.21","port":443,"asn":22611,"as":"INMOTION","country":"United States","country_code":"US"},"introduction_type":"scriptElement","is_inline":false,"md5":"a2cb19705e24e742f0feb5a8b0d99bf8","sha1":"30216fe01cbac27e0a5be23656b94f44b9149b25","sha256":"b3ac405c96e1194eb6ab54b6676028c7380716aa5212a26f1572a845808abd5e","sha512":"6a0e1677fa04b4ad6a348a3a7bf310d509400b8b4ab3885a289fc9bac64e125c4963b474ca0711247f2b7fd72d2871cc1e8c561a043603204d7c95d79ac456d6","ssdeep":"","tlshash":"f1411e85319f6a0f0ac723c3767a549afc3cef324008605cb45c66e41970c16c7eba79","size":1911,"data":"","first_seen":"2023-03-07T14:57:02Z","last_seen":"2026-09-27T15:47:36.057843Z","times_seen":112,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"bestfond.net/Shaw2022service/js/jquery.base64.min.js","fqdn":"bestfond.net","domain":"bestfond.net","tld":"net"},"ip":{"addr":"66.33.215.21","port":443,"asn":22611,"as":"INMOTION","country":"United States","country_code":"US"},"introduction_type":"scriptElement","is_inline":false,"md5":"0e0645f8b1c2b9e45470add2df1214b4","sha1":"6fbea5312aee286ab3998612c9b5b4a13553c1e9","sha256":"49416531519583e597dccc3856da2fa093b5e739baf9fda442b7047309e7f51c","sha512":"72174d6369cb2357c5e4d9516599b8d5b8eeb8674ecaa2dcb6daedd48a1f1e4290afb37c05f4487e2e72caab7cff38077210666dd7968d910005326894f0b30f","ssdeep":"","tlshash":"b931bd6731479159a8d8da86280f6787f0fe84b40b2c5cf6f911eebcf024e9d01b5e92","size":1782,"data":"","first_seen":"2023-03-07T12:03:28Z","last_seen":"2026-09-25T05:37:26.4972Z","times_seen":748,"alerts":{"ids":null,"analyzer":null,"urlquery":null}}],"eval":null,"write":null,"console":null},"http":[{"url":{"schema":"https","addr":"bestfond.net/Shaw2022service/js/jquery.cookie.js","fqdn":"bestfond.net","domain":"bestfond.net","tld":"net"},"ip":{"addr":"66.33.215.21","port":443,"asn":22611,"as":"INMOTION","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://bestfond.net/Shaw2022service/","date":"2026-09-25T05:36:50.046Z","timestamp":1790314610046,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"www.bestfond.net","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Fri, 18 Sep 2026 07:37:57 GMT","end":"Thu, 17 Dec 2026 07:37:56 GMT"},"fingerprint":{"sha1":"D9:69:9B:28:E7:60:D0:3E:CF:FA:0E:49:48:21:A5:6D:64:E4:27:CC","sha256":"10:90:74:1A:29:FB:44:76:F7:8B:1F:D6:71:D5:B4:41:8A:FA:5C:C3:73:BE:8D:B6:17:0F:9C:C5:6B:8E:26:37"}}},"request":{"raw":"GET /Shaw2022service/js/jquery.cookie.js HTTP/1.1\r\nHost: bestfond.net\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://bestfond.net/Shaw2022service/\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nlast-modified: Mon, 21 Sep 2026 17:11:37 GMT\r\netag: \"777-65c0157c657b4-gzip\"\r\naccept-ranges: bytes\r\ncache-control: max-age=2592000\r\nexpires: Sun, 25 Oct 2026 05:36:50 GMT\r\nvary: Accept-Encoding,User-Agent\r\ncontent-encoding: gzip\r\ncontent-length: 849\r\ncontent-type: text/javascript\r\ndate: Fri, 25 Sep 2026 05:36:50 GMT\r\nserver: Apache\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Apache HTTP Server","description":"Apache is a free and open-source cross-platform web server software.","website":"https://httpd.apache.org/","common_platform_enumeration":"cpe:2.3:a:apache:http_server:*:*:*:*:*:*:*:*","icon":"Apache.svg","categories":["Web servers"]}],"data":{"size":1911,"size_decoded":1219,"mime_type":"text/javascript","magic":"JavaScript source, ASCII text, with CRLF line terminators","md5":"a2cb19705e24e742f0feb5a8b0d99bf8","sha1":"30216fe01cbac27e0a5be23656b94f44b9149b25","sha256":"b3ac405c96e1194eb6ab54b6676028c7380716aa5212a26f1572a845808abd5e","sha512":"6a0e1677fa04b4ad6a348a3a7bf310d509400b8b4ab3885a289fc9bac64e125c4963b474ca0711247f2b7fd72d2871cc1e8c561a043603204d7c95d79ac456d6","ssdeep":"","tlshash":"f1411e85319f6a0f0ac723c3767a549afc3cef324008605cb45c66e41970c16c7eba79","first_seen":"2023-03-07T14:57:02Z","last_seen":"2026-09-27T15:47:36.057843Z","times_seen":112,"resource_available":true,"data":null}},"time_used":47,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":47,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-25","alert":"Sinkholed","trigger":"bestfond.net","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-09-25","alert":"Phishing Block","trigger":"bestfond.net","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"cira_dns","sensor_type":"DNS","title":"CIRA Canadian Shield DNS","description":"CIRA Canadian Shield DNS","scan_date":"2026-09-25","alert":"Sinkholed","trigger":"bestfond.net","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cira.ca/en/canadian-shield/","meta":null},{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-09-25","alert":"Sinkholed","trigger":"bestfond.net","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-09-25","alert":"Sinkholed","trigger":"bestfond.net","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"bestfond.net/Shaw2022service/images/webmail-desktop.png","fqdn":"bestfond.net","domain":"bestfond.net","tld":"net"},"ip":{"addr":"66.33.215.21","port":443,"asn":22611,"as":"INMOTION","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://bestfond.net/Shaw2022service/","date":"2026-09-25T05:36:50.055Z","timestamp":1790314610055,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"www.bestfond.net","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Fri, 18 Sep 2026 07:37:57 GMT","end":"Thu, 17 Dec 2026 07:37:56 GMT"},"fingerprint":{"sha1":"D9:69:9B:28:E7:60:D0:3E:CF:FA:0E:49:48:21:A5:6D:64:E4:27:CC","sha256":"10:90:74:1A:29:FB:44:76:F7:8B:1F:D6:71:D5:B4:41:8A:FA:5C:C3:73:BE:8D:B6:17:0F:9C:C5:6B:8E:26:37"}}},"request":{"raw":"GET /Shaw2022service/images/webmail-desktop.png HTTP/1.1\r\nHost: bestfond.net\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://bestfond.net/Shaw2022service/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nlast-modified: Mon, 21 Sep 2026 17:11:37 GMT\r\netag: \"1231-65c0157c6369a\"\r\naccept-ranges: bytes\r\ncontent-length: 4657\r\ncache-control: max-age=2592000\r\nexpires: Sun, 25 Oct 2026 05:36:50 GMT\r\nvary: User-Agent,Accept-Encoding\r\ncontent-type: image/png\r\ndate: Fri, 25 Sep 2026 05:36:50 GMT\r\nserver: Apache\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Apache HTTP Server","description":"Apache is a free and open-source cross-platform web server software.","website":"https://httpd.apache.org/","common_platform_enumeration":"cpe:2.3:a:apache:http_server:*:*:*:*:*:*:*:*","icon":"Apache.svg","categories":["Web servers"]}],"data":{"size":4657,"size_decoded":4994,"mime_type":"image/png","magic":"PNG image data, 267 x 44, 8-bit/color RGBA, non-interlaced","md5":"7a1f89b41144a0c9109822b9aba7afce","sha1":"11983fb2a6e11a66bc7a1c0ed0026a33478a70d8","sha256":"27c361265ec07215bcd0373d146e385e13bc62d35cda4f1310faad6dee9eb7b2","sha512":"a595ef8ee8f38dd91bab85e5c6532ed6b179b0e303efe6f3d37c08a4a0a8d0b1af8690787b1e1d9ba874849d8e3633f4a5094449c236bbfcc7a1dde79fa2f5dc","ssdeep":"96:oMjNUxcrGetrO7Mfw/Bk0rJXLEUX5yFes:o1FV490rJbEIKes","tlshash":"b8a15b8abb105842e20cb35710f94077a6185800edf1a07c7e879a421dd63bb17ed6c3","first_seen":"2023-05-06T10:40:53Z","last_seen":"2026-09-25T05:37:26.492861Z","times_seen":104,"resource_available":false,"data":null}},"time_used":42,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":42,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-09-25","alert":"Sinkholed","trigger":"bestfond.net","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"cira_dns","sensor_type":"DNS","title":"CIRA Canadian Shield DNS","description":"CIRA Canadian Shield DNS","scan_date":"2026-09-25","alert":"Sinkholed","trigger":"bestfond.net","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cira.ca/en/canadian-shield/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-25","alert":"Sinkholed","trigger":"bestfond.net","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-09-25","alert":"Sinkholed","trigger":"bestfond.net","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-09-25","alert":"Phishing Block","trigger":"bestfond.net","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"bestfond.net/Shaw2022service/images/icons/helpIcon.png","fqdn":"bestfond.net","domain":"bestfond.net","tld":"net"},"ip":{"addr":"66.33.215.21","port":443,"asn":22611,"as":"INMOTION","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://bestfond.net/Shaw2022service/","date":"2026-09-25T05:36:50.059Z","timestamp":1790314610059,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"www.bestfond.net","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Fri, 18 Sep 2026 07:37:57 GMT","end":"Thu, 17 Dec 2026 07:37:56 GMT"},"fingerprint":{"sha1":"D9:69:9B:28:E7:60:D0:3E:CF:FA:0E:49:48:21:A5:6D:64:E4:27:CC","sha256":"10:90:74:1A:29:FB:44:76:F7:8B:1F:D6:71:D5:B4:41:8A:FA:5C:C3:73:BE:8D:B6:17:0F:9C:C5:6B:8E:26:37"}}},"request":{"raw":"GET /Shaw2022service/images/icons/helpIcon.png HTTP/1.1\r\nHost: bestfond.net\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://bestfond.net/Shaw2022service/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nlast-modified: Mon, 21 Sep 2026 17:11:37 GMT\r\netag: \"593-65c0157c6367c\"\r\naccept-ranges: bytes\r\ncontent-length: 1427\r\ncache-control: max-age=2592000\r\nexpires: Sun, 25 Oct 2026 05:36:50 GMT\r\nvary: User-Agent,Accept-Encoding\r\ncontent-type: image/png\r\ndate: Fri, 25 Sep 2026 05:36:50 GMT\r\nserver: Apache\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Apache HTTP Server","description":"Apache is a free and open-source cross-platform web server software.","website":"https://httpd.apache.org/","common_platform_enumeration":"cpe:2.3:a:apache:http_server:*:*:*:*:*:*:*:*","icon":"Apache.svg","categories":["Web servers"]}],"data":{"size":1427,"size_decoded":1763,"mime_type":"image/png","magic":"PNG image data, 18 x 17, 8-bit/color RGB, non-interlaced","md5":"0767eabfbd1994e41253c46ec60e43ff","sha1":"11e1a92c8b499ef825af88c8990160c103219d4a","sha256":"4a57782e3a025dd4aef0918ddab21ffa7dc69777710836bd1f185ac77a468b37","sha512":"e91b3bbaa0d641b8baa4a2b5f711bebfdfc4d0774cdeedec1919479c7940334a8a4a38b7c8f0c5e21a0ebd1cb0cd32d8f8ccd992b556bccdcf05f3f02d7f14ba","ssdeep":"","tlshash":"3a21830efa009c0268d9ec5234fbe62b45638f90d7825a67b84fc41759601b346aeccb","first_seen":"2023-05-06T10:40:53Z","last_seen":"2026-09-25T05:37:26.49348Z","times_seen":83,"resource_available":false,"data":null}},"time_used":49,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":49,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-09-25","alert":"Sinkholed","trigger":"bestfond.net","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-09-25","alert":"Phishing Block","trigger":"bestfond.net","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"cira_dns","sensor_type":"DNS","title":"CIRA Canadian Shield DNS","description":"CIRA Canadian Shield DNS","scan_date":"2026-09-25","alert":"Sinkholed","trigger":"bestfond.net","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cira.ca/en/canadian-shield/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-25","alert":"Sinkholed","trigger":"bestfond.net","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-09-25","alert":"Sinkholed","trigger":"bestfond.net","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"bestfond.net/Shaw2022service/images/modal-close.png","fqdn":"bestfond.net","domain":"bestfond.net","tld":"net"},"ip":{"addr":"66.33.215.21","port":443,"asn":22611,"as":"INMOTION","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://bestfond.net/Shaw2022service/","date":"2026-09-25T05:36:50.060Z","timestamp":1790314610060,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"www.bestfond.net","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Fri, 18 Sep 2026 07:37:57 GMT","end":"Thu, 17 Dec 2026 07:37:56 GMT"},"fingerprint":{"sha1":"D9:69:9B:28:E7:60:D0:3E:CF:FA:0E:49:48:21:A5:6D:64:E4:27:CC","sha256":"10:90:74:1A:29:FB:44:76:F7:8B:1F:D6:71:D5:B4:41:8A:FA:5C:C3:73:BE:8D:B6:17:0F:9C:C5:6B:8E:26:37"}}},"request":{"raw":"GET /Shaw2022service/images/modal-close.png HTTP/1.1\r\nHost: bestfond.net\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://bestfond.net/Shaw2022service/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nlast-modified: Mon, 21 Sep 2026 17:11:37 GMT\r\netag: \"53c-65c0157c6367c\"\r\naccept-ranges: bytes\r\ncontent-length: 1340\r\ncache-control: max-age=2592000\r\nexpires: Sun, 25 Oct 2026 05:36:50 GMT\r\nvary: User-Agent,Accept-Encoding\r\ncontent-type: image/png\r\ndate: Fri, 25 Sep 2026 05:36:50 GMT\r\nserver: Apache\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Apache HTTP Server","description":"Apache is a free and open-source cross-platform web server software.","website":"https://httpd.apache.org/","common_platform_enumeration":"cpe:2.3:a:apache:http_server:*:*:*:*:*:*:*:*","icon":"Apache.svg","categories":["Web servers"]}],"data":{"size":1340,"size_decoded":1676,"mime_type":"image/png","magic":"PNG image data, 17 x 17, 8-bit/color RGBA, non-interlaced","md5":"0987b9e20007c710eb62859daa0983bf","sha1":"95f2b81718d641146ea416f888f45b423898fc4e","sha256":"30b07af0c79b6241e9cd0ac1b56006cefb70b6204d9a1eb98a61b7b73e3fb7a5","sha512":"0e320a5ab619891e455049cd6bb11a2795a8c7f69f0a3ae39347c183e961c1cdd2eb879d25571136ad5de2b8bfc5be03f258785a9c9739664be4079863296c20","ssdeep":"","tlshash":"e621754fab023422a39cc75638f6c027dd168980eab1f165bccbdd5309719b8018c5da","first_seen":"2023-05-02T01:45:38Z","last_seen":"2026-09-25T05:37:26.494253Z","times_seen":46,"resource_available":false,"data":null}},"time_used":47,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":47,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-25","alert":"Sinkholed","trigger":"bestfond.net","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-09-25","alert":"Phishing Block","trigger":"bestfond.net","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-09-25","alert":"Sinkholed","trigger":"bestfond.net","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"cira_dns","sensor_type":"DNS","title":"CIRA Canadian Shield DNS","description":"CIRA Canadian Shield DNS","scan_date":"2026-09-25","alert":"Sinkholed","trigger":"bestfond.net","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cira.ca/en/canadian-shield/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-09-25","alert":"Sinkholed","trigger":"bestfond.net","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"bestfond.net/Shaw2022service/images/favicon.ico","fqdn":"bestfond.net","domain":"bestfond.net","tld":"net"},"ip":{"addr":"66.33.215.21","port":443,"asn":22611,"as":"INMOTION","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://bestfond.net/Shaw2022service/","date":"2026-09-25T05:36:50.174Z","timestamp":1790314610174,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"www.bestfond.net","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Fri, 18 Sep 2026 07:37:57 GMT","end":"Thu, 17 Dec 2026 07:37:56 GMT"},"fingerprint":{"sha1":"D9:69:9B:28:E7:60:D0:3E:CF:FA:0E:49:48:21:A5:6D:64:E4:27:CC","sha256":"10:90:74:1A:29:FB:44:76:F7:8B:1F:D6:71:D5:B4:41:8A:FA:5C:C3:73:BE:8D:B6:17:0F:9C:C5:6B:8E:26:37"}}},"request":{"raw":"GET /Shaw2022service/images/favicon.ico HTTP/1.1\r\nHost: bestfond.net\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://bestfond.net/Shaw2022service/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=6\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 404 \r\ncontent-length: 315\r\ncontent-type: text/html; charset=iso-8859-1\r\ndate: Fri, 25 Sep 2026 05:36:50 GMT\r\nserver: Apache\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"404","status_text":"Not Found","fingerprints":[{"name":"Apache HTTP Server","description":"Apache is a free and open-source cross-platform web server software.","website":"https://httpd.apache.org/","common_platform_enumeration":"cpe:2.3:a:apache:http_server:*:*:*:*:*:*:*:*","icon":"Apache.svg","categories":["Web servers"]}],"data":{"size":315,"size_decoded":469,"mime_type":"text/html; charset=iso-8859-1","magic":"HTML document, ASCII text","md5":"a34ac19f4afae63adc5d2f7bc970c07f","sha1":"a82190fc530c265aa40a045c21770d967f4767b8","sha256":"d5a89e26beae0bc03ad18a0b0d1d3d75f87c32047879d25da11970cb5c4662a3","sha512":"42e53d96e5961e95b7a984d9c9778a1d3bd8ee0c87b8b3b515fa31f67c2d073c8565afc2f4b962c43668c4efa1e478da9bb0ecffa79479c7e880731bc4c55765","ssdeep":"","tlshash":"b0e0e75f41473347402252907dc110d1d505236b797161fd3d85b4ab501dc3dc99f7dc","first_seen":"2023-03-07T01:02:33Z","last_seen":"2026-09-27T15:29:07.172581Z","times_seen":147120,"resource_available":true,"data":null}},"time_used":20,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":20,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-09-25","alert":"Phishing Block","trigger":"bestfond.net","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-09-25","alert":"Sinkholed","trigger":"bestfond.net","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"cira_dns","sensor_type":"DNS","title":"CIRA Canadian Shield DNS","description":"CIRA Canadian Shield DNS","scan_date":"2026-09-25","alert":"Sinkholed","trigger":"bestfond.net","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cira.ca/en/canadian-shield/","meta":null},{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-09-25","alert":"Sinkholed","trigger":"bestfond.net","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-25","alert":"Sinkholed","trigger":"bestfond.net","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"bestfond.net/Shaw2022service/","fqdn":"bestfond.net","domain":"bestfond.net","tld":"net"},"ip":{"addr":"66.33.215.21","port":443,"asn":22611,"as":"INMOTION","country":"United States","country_code":"US"},"is_navigation_request":true,"resource_type":"document","requested_by":"","date":"2026-09-25T05:36:49.826Z","timestamp":1790314609826,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"www.bestfond.net","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Fri, 18 Sep 2026 07:37:57 GMT","end":"Thu, 17 Dec 2026 07:37:56 GMT"},"fingerprint":{"sha1":"D9:69:9B:28:E7:60:D0:3E:CF:FA:0E:49:48:21:A5:6D:64:E4:27:CC","sha256":"10:90:74:1A:29:FB:44:76:F7:8B:1F:D6:71:D5:B4:41:8A:FA:5C:C3:73:BE:8D:B6:17:0F:9C:C5:6B:8E:26:37"}}},"request":{"raw":"GET /Shaw2022service/ HTTP/1.1\r\nHost: bestfond.net\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nUpgrade-Insecure-Requests: 1\r\nSec-Fetch-Dest: document\r\nSec-Fetch-Mode: navigate\r\nSec-Fetch-Site: none\r\nPriority: u=0, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\ncache-control: max-age=600\r\nexpires: Fri, 25 Sep 2026 05:46:49 GMT\r\nvary: Accept-Encoding,User-Agent\r\ncontent-encoding: gzip\r\ncontent-length: 3894\r\ncontent-type: text/html; charset=UTF-8\r\ndate: Fri, 25 Sep 2026 05:36:49 GMT\r\nserver: Apache\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"jQuery","description":"jQuery is a JavaScript library which is a free, open-source software designed to simplify HTML DOM tree traversal and manipulation, as well as event handling, CSS animation, and Ajax.","website":"https://jquery.com","common_platform_enumeration":"cpe:2.3:a:jquery:jquery:*:*:*:*:*:*:*:*","icon":"jQuery.svg","categories":["JavaScript libraries"]},{"name":"Apache HTTP Server","description":"Apache is a free and open-source cross-platform web server software.","website":"https://httpd.apache.org/","common_platform_enumeration":"cpe:2.3:a:apache:http_server:*:*:*:*:*:*:*:*","icon":"Apache.svg","categories":["Web servers"]}],"data":{"size":14842,"size_decoded":4170,"mime_type":"text/html; charset=UTF-8","magic":"HTML document, ASCII text, with very long lines (563), with CRLF line terminators","md5":"ac07073959fccc58ceb4de81ba63ed08","sha1":"994e49adfcc0ed0cadef43bb2db221367df9e99a","sha256":"f124957f382e88f2d1bb2fab14d140fa3cb69a79ac3911b70af9340022c09a51","sha512":"28b050076194d1b01dd3b3473740276f2129b379d0be74fa4ab7d5fb0ccbf7b2fd8ccca26b68f112ed12fc715967bb4375889772c5df8f7d9d06d92dd33395b3","ssdeep":"384:j9gPodc3GeT462OoNpv7iRSRK+FFZLzc1Pg5:awuV1kpaSB+i","tlshash":"e3622d1568c5a4230173c5caae66ab19ffa2d247cb462a44b2fc23db2ff2d48dd0355d","first_seen":"2023-05-06T10:40:53Z","last_seen":"2026-09-25T05:37:26.495346Z","times_seen":24,"resource_available":true,"data":null}},"time_used":24,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":24,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-09-25","alert":"Sinkholed","trigger":"bestfond.net","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"cira_dns","sensor_type":"DNS","title":"CIRA Canadian Shield DNS","description":"CIRA Canadian Shield DNS","scan_date":"2026-09-25","alert":"Sinkholed","trigger":"bestfond.net","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cira.ca/en/canadian-shield/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-09-25","alert":"Sinkholed","trigger":"bestfond.net","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-25","alert":"Sinkholed","trigger":"bestfond.net","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-09-25","alert":"Phishing Block","trigger":"bestfond.net","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"bestfond.net/Shaw2022service/js/jquery.min.js","fqdn":"bestfond.net","domain":"bestfond.net","tld":"net"},"ip":{"addr":"66.33.215.21","port":443,"asn":22611,"as":"INMOTION","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://bestfond.net/Shaw2022service/","date":"2026-09-25T05:36:50.043Z","timestamp":1790314610043,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"www.bestfond.net","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Fri, 18 Sep 2026 07:37:57 GMT","end":"Thu, 17 Dec 2026 07:37:56 GMT"},"fingerprint":{"sha1":"D9:69:9B:28:E7:60:D0:3E:CF:FA:0E:49:48:21:A5:6D:64:E4:27:CC","sha256":"10:90:74:1A:29:FB:44:76:F7:8B:1F:D6:71:D5:B4:41:8A:FA:5C:C3:73:BE:8D:B6:17:0F:9C:C5:6B:8E:26:37"}}},"request":{"raw":"GET /Shaw2022service/js/jquery.min.js HTTP/1.1\r\nHost: bestfond.net\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://bestfond.net/Shaw2022service/\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nlast-modified: Mon, 21 Sep 2026 17:11:37 GMT\r\netag: \"17277-65c0157c66579-gzip\"\r\naccept-ranges: bytes\r\ncache-control: max-age=2592000\r\nexpires: Sun, 25 Oct 2026 05:36:50 GMT\r\nvary: Accept-Encoding,User-Agent\r\ncontent-encoding: gzip\r\ncontent-type: text/javascript\r\ndate: Fri, 25 Sep 2026 05:36:50 GMT\r\nserver: Apache\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Apache HTTP Server","description":"Apache is a free and open-source cross-platform web server software.","website":"https://httpd.apache.org/","common_platform_enumeration":"cpe:2.3:a:apache:http_server:*:*:*:*:*:*:*:*","icon":"Apache.svg","categories":["Web servers"]}],"data":{"size":94839,"size_decoded":34504,"mime_type":"text/javascript","magic":"JavaScript source, ASCII text, with very long lines (32769)","md5":"b11ced65f32fedbe9bf81ef9db0f3c94","sha1":"fdfd441e66831bfb8809e8cb69c2c3cd26b5d7c2","sha256":"0fb170f24675c84f8228ad6b61d69bf6705030949cc2fec316b3a006eab282f8","sha512":"864e5aa02e74823de70e3914a9ba75413c9559e4508f72ee7d23993acbf6488d69ef13a50e5b465bee3a709b36664f38aefe9ec0b8d9d86f4873f1ac552c64cb","ssdeep":"1536:8YRKUfAjtled3TmtaFyQHGvCXsedOgRc9izzr4yff8teLvHHEjam7W5X3yzSiLnM:VUbCGvCu09s2o2skAieW","tlshash":"9593e7d9b2d67123c7b731b850af510bb17698aa784c8c50f068d8e4be74a48907bf7d","first_seen":"2023-03-07T12:01:56Z","last_seen":"2026-09-27T21:25:25.041434Z","times_seen":3228,"resource_available":true,"data":null}},"time_used":34,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":34,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-09-25","alert":"Sinkholed","trigger":"bestfond.net","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-25","alert":"Sinkholed","trigger":"bestfond.net","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"cira_dns","sensor_type":"DNS","title":"CIRA Canadian Shield DNS","description":"CIRA Canadian Shield DNS","scan_date":"2026-09-25","alert":"Sinkholed","trigger":"bestfond.net","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cira.ca/en/canadian-shield/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-09-25","alert":"Sinkholed","trigger":"bestfond.net","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-09-25","alert":"Phishing Block","trigger":"bestfond.net","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"bestfond.net/Shaw2022service/js/combine_signon_136.js","fqdn":"bestfond.net","domain":"bestfond.net","tld":"net"},"ip":{"addr":"66.33.215.21","port":443,"asn":22611,"as":"INMOTION","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://bestfond.net/Shaw2022service/","date":"2026-09-25T05:36:50.044Z","timestamp":1790314610044,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"www.bestfond.net","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Fri, 18 Sep 2026 07:37:57 GMT","end":"Thu, 17 Dec 2026 07:37:56 GMT"},"fingerprint":{"sha1":"D9:69:9B:28:E7:60:D0:3E:CF:FA:0E:49:48:21:A5:6D:64:E4:27:CC","sha256":"10:90:74:1A:29:FB:44:76:F7:8B:1F:D6:71:D5:B4:41:8A:FA:5C:C3:73:BE:8D:B6:17:0F:9C:C5:6B:8E:26:37"}}},"request":{"raw":"GET /Shaw2022service/js/combine_signon_136.js HTTP/1.1\r\nHost: bestfond.net\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://bestfond.net/Shaw2022service/\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nlast-modified: Mon, 21 Sep 2026 17:11:37 GMT\r\netag: \"182f3-65c0157c657b4-gzip\"\r\naccept-ranges: bytes\r\ncache-control: max-age=2592000\r\nexpires: Sun, 25 Oct 2026 05:36:50 GMT\r\nvary: Accept-Encoding,User-Agent\r\ncontent-encoding: gzip\r\ncontent-type: text/javascript\r\ndate: Fri, 25 Sep 2026 05:36:50 GMT\r\nserver: Apache\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Apache HTTP Server","description":"Apache is a free and open-source cross-platform web server software.","website":"https://httpd.apache.org/","common_platform_enumeration":"cpe:2.3:a:apache:http_server:*:*:*:*:*:*:*:*","icon":"Apache.svg","categories":["Web servers"]}],"data":{"size":99059,"size_decoded":29274,"mime_type":"text/javascript","magic":"JavaScript source, ASCII text, with very long lines (917)","md5":"5ad9a05645773062718c3a131762dfd8","sha1":"9dd2be9f51b8b5679e3c0b5afd7cb16dd95ecba7","sha256":"e0ad5458dbc7bf04431ba5aa06bbc9d2dcb984c22c419c4605a458c3e0c9db8b","sha512":"652e3aa9e52e9fe858aa7b44b4d5a9ca14aca39b5de85052f39498a2dc6d480d1fb889b1ab36677185c0133e8e55a1aec2aa809bdec22b2929b97b1dcf7ed321","ssdeep":"1536:TnNUBXex09xT/26WzwLT30+U9IrADoeakybh/WugIPhk5JM:KBu0jTZE+U9IrADoeKWK","tlshash":"32a3094db291756a83abf074106f230a723a9d69f844c46cf9b4c5f6ae74e48107bf39","first_seen":"2023-03-09T13:49:27Z","last_seen":"2026-09-25T05:37:26.496402Z","times_seen":28,"resource_available":true,"data":null}},"time_used":48,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":48,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"cira_dns","sensor_type":"DNS","title":"CIRA Canadian Shield DNS","description":"CIRA Canadian Shield DNS","scan_date":"2026-09-25","alert":"Sinkholed","trigger":"bestfond.net","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cira.ca/en/canadian-shield/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-09-25","alert":"Sinkholed","trigger":"bestfond.net","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-25","alert":"Sinkholed","trigger":"bestfond.net","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-09-25","alert":"Phishing Block","trigger":"bestfond.net","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-09-25","alert":"Sinkholed","trigger":"bestfond.net","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"bestfond.net/Shaw2022service/js/jquery.base64.min.js","fqdn":"bestfond.net","domain":"bestfond.net","tld":"net"},"ip":{"addr":"66.33.215.21","port":443,"asn":22611,"as":"INMOTION","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://bestfond.net/Shaw2022service/","date":"2026-09-25T05:36:50.047Z","timestamp":1790314610047,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"www.bestfond.net","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Fri, 18 Sep 2026 07:37:57 GMT","end":"Thu, 17 Dec 2026 07:37:56 GMT"},"fingerprint":{"sha1":"D9:69:9B:28:E7:60:D0:3E:CF:FA:0E:49:48:21:A5:6D:64:E4:27:CC","sha256":"10:90:74:1A:29:FB:44:76:F7:8B:1F:D6:71:D5:B4:41:8A:FA:5C:C3:73:BE:8D:B6:17:0F:9C:C5:6B:8E:26:37"}}},"request":{"raw":"GET /Shaw2022service/js/jquery.base64.min.js HTTP/1.1\r\nHost: bestfond.net\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://bestfond.net/Shaw2022service/\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nlast-modified: Mon, 21 Sep 2026 17:11:37 GMT\r\netag: \"6f6-65c0157c657b4-gzip\"\r\naccept-ranges: bytes\r\ncache-control: max-age=2592000\r\nexpires: Sun, 25 Oct 2026 05:36:50 GMT\r\nvary: Accept-Encoding,User-Agent\r\ncontent-encoding: gzip\r\ncontent-length: 704\r\ncontent-type: text/javascript\r\ndate: Fri, 25 Sep 2026 05:36:50 GMT\r\nserver: Apache\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Apache HTTP Server","description":"Apache is a free and open-source cross-platform web server software.","website":"https://httpd.apache.org/","common_platform_enumeration":"cpe:2.3:a:apache:http_server:*:*:*:*:*:*:*:*","icon":"Apache.svg","categories":["Web servers"]}],"data":{"size":1782,"size_decoded":1074,"mime_type":"text/javascript","magic":"JavaScript source, ASCII text, with very long lines (1782), with no line terminators","md5":"0e0645f8b1c2b9e45470add2df1214b4","sha1":"6fbea5312aee286ab3998612c9b5b4a13553c1e9","sha256":"49416531519583e597dccc3856da2fa093b5e739baf9fda442b7047309e7f51c","sha512":"72174d6369cb2357c5e4d9516599b8d5b8eeb8674ecaa2dcb6daedd48a1f1e4290afb37c05f4487e2e72caab7cff38077210666dd7968d910005326894f0b30f","ssdeep":"","tlshash":"b931bd6731479159a8d8da86280f6787f0fe84b40b2c5cf6f911eebcf024e9d01b5e92","first_seen":"2023-03-07T12:03:28Z","last_seen":"2026-09-25T05:37:26.4972Z","times_seen":748,"resource_available":true,"data":null}},"time_used":46,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":46,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-09-25","alert":"Sinkholed","trigger":"bestfond.net","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"cira_dns","sensor_type":"DNS","title":"CIRA Canadian Shield DNS","description":"CIRA Canadian Shield DNS","scan_date":"2026-09-25","alert":"Sinkholed","trigger":"bestfond.net","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cira.ca/en/canadian-shield/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-09-25","alert":"Sinkholed","trigger":"bestfond.net","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-25","alert":"Sinkholed","trigger":"bestfond.net","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-09-25","alert":"Phishing Block","trigger":"bestfond.net","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"bestfond.net/Shaw2022service/images/error_button.png","fqdn":"bestfond.net","domain":"bestfond.net","tld":"net"},"ip":{"addr":"66.33.215.21","port":443,"asn":22611,"as":"INMOTION","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://bestfond.net/Shaw2022service/","date":"2026-09-25T05:36:50.057Z","timestamp":1790314610057,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"www.bestfond.net","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Fri, 18 Sep 2026 07:37:57 GMT","end":"Thu, 17 Dec 2026 07:37:56 GMT"},"fingerprint":{"sha1":"D9:69:9B:28:E7:60:D0:3E:CF:FA:0E:49:48:21:A5:6D:64:E4:27:CC","sha256":"10:90:74:1A:29:FB:44:76:F7:8B:1F:D6:71:D5:B4:41:8A:FA:5C:C3:73:BE:8D:B6:17:0F:9C:C5:6B:8E:26:37"}}},"request":{"raw":"GET /Shaw2022service/images/error_button.png HTTP/1.1\r\nHost: bestfond.net\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://bestfond.net/Shaw2022service/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nlast-modified: Mon, 21 Sep 2026 17:11:37 GMT\r\netag: \"b9-65c0157c626a5\"\r\naccept-ranges: bytes\r\ncontent-length: 185\r\ncache-control: max-age=2592000\r\nexpires: Sun, 25 Oct 2026 05:36:50 GMT\r\nvary: User-Agent,Accept-Encoding\r\ncontent-type: image/png\r\ndate: Fri, 25 Sep 2026 05:36:50 GMT\r\nserver: Apache\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Apache HTTP Server","description":"Apache is a free and open-source cross-platform web server software.","website":"https://httpd.apache.org/","common_platform_enumeration":"cpe:2.3:a:apache:http_server:*:*:*:*:*:*:*:*","icon":"Apache.svg","categories":["Web servers"]}],"data":{"size":185,"size_decoded":519,"mime_type":"image/png","magic":"PNG image data, 12 x 10, 8-bit/color RGBA, non-interlaced","md5":"1c81990a40d588ecf8f3e6711b6c3e06","sha1":"3aae029569bd71c16a84b61136d30cdb09497fd1","sha256":"3de0670375c8a9763362d95d2863c6e1e0360fa3f900c4e9b4b1a10194e3fe89","sha512":"c1020b9605c4026581355aa2f95de00ae861dc3a3d05f90f01c434134e8c3d668aa9e3646a58874847f3eb3209dd28f9eae29fb83702cbdba2e16e37e91e9074","ssdeep":"","tlshash":"48c0c0e203f8fd3c4b42007e12173c719c21d33db477406dc43290142581320b0b876d","first_seen":"2023-05-02T01:45:38Z","last_seen":"2026-09-25T05:37:26.497693Z","times_seen":46,"resource_available":false,"data":null}},"time_used":51,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":51,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-09-25","alert":"Sinkholed","trigger":"bestfond.net","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-09-25","alert":"Phishing Block","trigger":"bestfond.net","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"cira_dns","sensor_type":"DNS","title":"CIRA Canadian Shield DNS","description":"CIRA Canadian Shield DNS","scan_date":"2026-09-25","alert":"Sinkholed","trigger":"bestfond.net","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cira.ca/en/canadian-shield/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-09-25","alert":"Sinkholed","trigger":"bestfond.net","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-25","alert":"Sinkholed","trigger":"bestfond.net","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"bestfond.net/Shaw2022service","fqdn":"bestfond.net","domain":"bestfond.net","tld":"net"},"ip":{"addr":"66.33.215.21","port":443,"asn":22611,"as":"INMOTION","country":"United States","country_code":"US"},"is_navigation_request":true,"resource_type":"document","requested_by":"","date":"2026-09-25T05:36:49.512Z","timestamp":1790314609512,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"www.bestfond.net","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Fri, 18 Sep 2026 07:37:57 GMT","end":"Thu, 17 Dec 2026 07:37:56 GMT"},"fingerprint":{"sha1":"D9:69:9B:28:E7:60:D0:3E:CF:FA:0E:49:48:21:A5:6D:64:E4:27:CC","sha256":"10:90:74:1A:29:FB:44:76:F7:8B:1F:D6:71:D5:B4:41:8A:FA:5C:C3:73:BE:8D:B6:17:0F:9C:C5:6B:8E:26:37"}}},"request":{"raw":"GET /Shaw2022service HTTP/1.1\r\nHost: bestfond.net\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nUpgrade-Insecure-Requests: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: document\r\nSec-Fetch-Mode: navigate\r\nSec-Fetch-Site: none\r\nPriority: u=0, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 301 \r\nlocation: https://bestfond.net/Shaw2022service/\r\ncache-control: max-age=600\r\nexpires: Fri, 25 Sep 2026 05:46:49 GMT\r\ncontent-length: 245\r\ncontent-type: text/html; charset=iso-8859-1\r\ndate: Fri, 25 Sep 2026 05:36:49 GMT\r\nserver: Apache\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"301","status_text":"Moved Permanently","fingerprints":[{"name":"Apache HTTP Server","description":"Apache is a free and open-source cross-platform web server software.","website":"https://httpd.apache.org/","common_platform_enumeration":"cpe:2.3:a:apache:http_server:*:*:*:*:*:*:*:*","icon":"Apache.svg","categories":["Web servers"]}],"data":{"size":0,"size_decoded":0,"mime_type":"text/html; charset=UTF-8","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-09-28T00:46:37.048779Z","times_seen":18697833,"resource_available":true,"data":null}},"time_used":307,"timings":{"blocked":-1,"dns":249,"connect":16,"send":0,"wait":21,"receive":0,"ssl":21},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-09-25","alert":"Sinkholed","trigger":"bestfond.net","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-09-25","alert":"Sinkholed","trigger":"bestfond.net","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"cira_dns","sensor_type":"DNS","title":"CIRA Canadian Shield DNS","description":"CIRA Canadian Shield DNS","scan_date":"2026-09-25","alert":"Sinkholed","trigger":"bestfond.net","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cira.ca/en/canadian-shield/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-25","alert":"Sinkholed","trigger":"bestfond.net","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-09-25","alert":"Phishing Block","trigger":"bestfond.net","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"bestfond.net/Shaw2022service/css/combine_signon_136.css","fqdn":"bestfond.net","domain":"bestfond.net","tld":"net"},"ip":{"addr":"66.33.215.21","port":443,"asn":22611,"as":"INMOTION","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://bestfond.net/Shaw2022service/","date":"2026-09-25T05:36:50.040Z","timestamp":1790314610040,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"www.bestfond.net","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Fri, 18 Sep 2026 07:37:57 GMT","end":"Thu, 17 Dec 2026 07:37:56 GMT"},"fingerprint":{"sha1":"D9:69:9B:28:E7:60:D0:3E:CF:FA:0E:49:48:21:A5:6D:64:E4:27:CC","sha256":"10:90:74:1A:29:FB:44:76:F7:8B:1F:D6:71:D5:B4:41:8A:FA:5C:C3:73:BE:8D:B6:17:0F:9C:C5:6B:8E:26:37"}}},"request":{"raw":"GET /Shaw2022service/css/combine_signon_136.css HTTP/1.1\r\nHost: bestfond.net\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://bestfond.net/Shaw2022service/\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=2\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nlast-modified: Mon, 21 Sep 2026 17:11:37 GMT\r\netag: \"27f39-65c0157c60926-gzip\"\r\naccept-ranges: bytes\r\ncache-control: max-age=2592000\r\nexpires: Sun, 25 Oct 2026 05:36:50 GMT\r\nvary: Accept-Encoding,User-Agent\r\ncontent-encoding: gzip\r\ncontent-type: text/css\r\ndate: Fri, 25 Sep 2026 05:36:50 GMT\r\nserver: Apache\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Apache HTTP Server","description":"Apache is a free and open-source cross-platform web server software.","website":"https://httpd.apache.org/","common_platform_enumeration":"cpe:2.3:a:apache:http_server:*:*:*:*:*:*:*:*","icon":"Apache.svg","categories":["Web servers"]}],"data":{"size":163641,"size_decoded":28535,"mime_type":"text/css","magic":"ASCII text, with very long lines (65371)","md5":"4f65e12b4581007d650577623b78a405","sha1":"60b549fb96b7c0b79dbbaea010e7feaea59df809","sha256":"5ac0d1a87ad5eccf2f71c70cad9a38a11e498cc395f2205d45dd7a4524c6582d","sha512":"986104c65f3f28d316a6d21abac14a6d28be0f97b354176a86db13031b67eecf8043617cfc4aab658b8b8cada82ae9c44e29bec03e9e94ed5b8b794c4f6209cf","ssdeep":"768:hbGxwokBWS1LztzuR7JIN6eCBkdIYKbdbXRD38KwaKNhLL9qNlkRQmNaVEqFoSsJ:6wx3ER7JINGkatRtkLMloosxsxVZKAm","tlshash":"6af3c660a51031ddb323c41ab5d0be863569a052e9635fbff16b29ec4fc52ca0673f1a","first_seen":"2023-04-30T10:19:09Z","last_seen":"2026-09-25T05:37:26.498725Z","times_seen":28,"resource_available":true,"data":null}},"time_used":20,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":20,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-09-25","alert":"Sinkholed","trigger":"bestfond.net","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"cira_dns","sensor_type":"DNS","title":"CIRA Canadian Shield DNS","description":"CIRA Canadian Shield DNS","scan_date":"2026-09-25","alert":"Sinkholed","trigger":"bestfond.net","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cira.ca/en/canadian-shield/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-25","alert":"Sinkholed","trigger":"bestfond.net","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-09-25","alert":"Sinkholed","trigger":"bestfond.net","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-09-25","alert":"Phishing Block","trigger":"bestfond.net","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null}],"urlquery":null}}]}