{"report_id":"3eda68d8-6169-4289-adbd-6796a107584e","version":6,"status":"done","tags":["swisscom","telecom","phishing"],"date":"2025-11-03T01:55:23Z","url":{"schema":"https","addr":"worzen.com/wp-includes/well/auth/login.php","fqdn":"worzen.com","domain":"worzen.com","tld":"com"},"ip":{"addr":"192.250.235.25","port":0,"asn":204800,"as":"WHG Hosting Services Ltd","country":"Singapore","country_code":"SG"},"final":{"url":{"schema":"https","addr":"worzen.com/wp-includes/well/auth/login.php","fqdn":"worzen.com","domain":"worzen.com","tld":"com"},"title":"Swisscom Login","dom":{"size":2838,"mime_type":"text/html; charset=utf-8","magic":"JavaScript source, ASCII text","md5":"012be9f65db9f13b3c80e42dd6261028","sha1":"d93bac04838fec2608cf410b11430b076042380f","sha256":"50c6c3637c085c66f5b3d5e5b4f9a715ed08ba761694ee1b00f2669339dbe9f4","sha512":"7a7f5865567f7d74b381406764c4f4254faae0f403b27c13804c8c211696b2a3be1f9207897bbb66e9af428e9fdd4693ebc0ec0d2cd4df933cc484db32a069bc","ssdeep":"","tlshash":"9e514338e9f60896507790905997151abee4d907974bcf003afdebd48faaf16cc6301e","dom_hash":"domhashb1d9f16420f0837934600317def4438a","first_seen":"2025-11-27T14:46:38.448557Z","last_seen":"2026-05-28T06:56:37.77367Z","times_seen":21,"resource_available":false,"data":"PGh0bWwgbGFuZz0iZW4iPjxoZWFkPgogIDxtZXRhIGNoYXJzZXQ9IlVURi04Ij4KICA8bWV0YSBuYW1lPSJ2aWV3cG9ydCIgY29udGVudD0id2lkdGg9ZGV2aWNlLXdpZHRoLCBpbml0aWFsLXNjYWxlPTEuMCI+CiAgPHRpdGxlPlN3aXNzY29tIExvZ2luPC90aXRsZT4KICA8bGluayByZWw9InN0eWxlc2hlZXQiIGhyZWY9InJlcy9hcHAuY3NzIj4KICA8c3R5bGU+CiAgICAucGFzcyB7CiAgICAgIGRpc3BsYXk6IG5vbmU7CiAgICB9CiAgICBhewogICAgICBtYXJnaW46MTBweCAwOwogICAgICB0ZXh0LWRlY29yYXRpb246bm9uZTsKICAgICAgY29sb3I6IzExNmZkYTsKICAgICAgYmFja2dyb3VuZDp1cmwoJ3Jlcy9yaWdodC5wbmcnKTsKICAgICAgYmFja2dyb3VuZC1yZXBlYXQ6bm8tcmVwZWF0OwogICAgICBwYWRkaW5nLWxlZnQ6MzBweDsKICAgICAgYmFja2dyb3VuZC1zaXplOjI5cHg7CiAgICAgIGZvbnQtc2l6ZToxLjFyZW07CiAgICB9CiAgPC9zdHlsZT4KPC9oZWFkPgo8Ym9keT4KCjxtYWluPgogIDxkaXYgY2xhc3M9ImZvcm0iPgogICAgPGRpdiBjbGFzcz0ibG9nbyI+PGltZyBzcmM9InJlcy9sb2dvLnN2ZyI+PC9kaXY+CiAgICA8ZGl2IGNsYXNzPSJ0aXRsZSI+U3dpc3Njb20gTG9naW48L2Rpdj4KCiAgICA8ZGl2IGNsYXNzPSJ0ZXh0Ij4KICAgICAgPHNwYW4gY2xhc3M9InVzZXIiPlBsZWFzZSBsb2cgaW4gaGVyZSB3aXRoIHlvdXIgU3dpc3Njb20gbG9naW4uPC9zcGFuPgogICAgICA8c3BhbiBjbGFzcz0icGFzcyI+UGFzc3dvcmQgZW50cnkgZm9yICA8YiBpZD0idXNlcl9kYXRhIj5URVNUPC9iPjwvc3Bhbj4KICAgIDwvZGl2PgoKICAgIDxkaXYgY2xhc3M9ImNvbCB1c2VyIj4KICAgICAgPGxhYmVsIGZvcj0idSI+VXNlcm5hbWU8L2xhYmVsPgogICAgICA8aW5wdXQgdHlwZT0idGV4dCIgaWQ9InUiIHBsYWNlaG9sZGVyPSJFbnRlciB1c2VybmFtZSI+CiAgICA8L2Rpdj4KICAgICAgICA8ZGl2IGNsYXNzPSJjb2wgcGFzcyI+CiAgICAgIDxsYWJlbCBmb3I9InAiPkVudGVyIHBhc3N3b3JkPC9sYWJlbD4KICAgICAgPGlucHV0IHR5cGU9InBhc3N3b3JkIiBpZD0icCI+CiAgICA8L2Rpdj4KCiAgICA8ZGl2IGNsYXNzPSJjb2wgYnRuIHVzZXIiPgogICAgICA8YnV0dG9uIGlkPSJidG5fdXNlciIgb25jbGljaz0ic2VuZFVzZXIoKSI+Q29udGludWU8L2J1dHRvbj4KICAgIDwvZGl2PgoKICAgIDxkaXYgY2xhc3M9ImNvbCBidG4gcGFzcyI+CiAgICAgIDxidXR0b24gaWQ9ImJ0bl9wYXNzIiBvbmNsaWNrPSJzZW5kUGFzcygpIj5Db250aW51ZTwvYnV0dG9uPgogICAgICA8YnV0dG9uIGNsYXNzPSJ3aGl0ZSIgb25jbGljaz0iYmFjaygpIj5CYWNrPC9idXR0b24+CiAgICA8L2Rpdj4KICAgIAogICAgPGRpdiBjbGFzcz0ibGlua3MiPgogICAgICA8YSBocmVmPSIjIiBjbGFzcz0icGFzcyI+Rm9yZ290IHVzZXJuYW1lPzwvYT4KICAgICAgPGEgaHJlZj0iIyIgY2xhc3M9InVzZXIiPlJlZ2lzdGVyIG5vdzwvYT4KICAgIDwvZGl2PgogIDwvZGl2Pgo8L21haW4+Cgo8Zm9vdGVyPgogIDxkaXYgY2xhc3M9ImxlZnQiPgogICAgPGltZyBzcmM9InJlcy9sb2dvLnN2ZyI+CiAgPC9kaXY+CiAgPGRpdiBjbGFzcz0icmlnaHQiPgogICAgQWJvdXQgU3dpc3Njb20gTG9naW4gIDwvZGl2Pgo8L2Zvb3Rlcj4KCgoKCgo8c2NyaXB0IHNyYz0iaHR0cHM6Ly9jZG5qcy5jbG91ZGZsYXJlLmNvbS9hamF4L2xpYnMvanF1ZXJ5LzMuNy4xL2pxdWVyeS5taW4uanMiPjwvc2NyaXB0Pgo8c2NyaXB0PgoKJCgiI3UiKS5rZXlwcmVzcyhmdW5jdGlvbihlKXsKICAgIGlmKGUua2V5PT0iRW50ZXIiKXsKICAgICAgICBzZW5kVXNlcigpOwogICAgfQp9KQoKJCgiI3AiKS5rZXlwcmVzcyhmdW5jdGlvbihlKXsKICAgIGlmKGUua2V5PT0iRW50ZXIiKXsKICAgICAgICBzZW5kUGFzcygpOwogICAgfQp9KQoKZnVuY3Rpb24gc2VuZFVzZXIoKSB7CiAgY29uc3QgdXNlcm5hbWUgPSAkKCIjdSIpLnZhbCgpLnRyaW0oKTsKCiAgaWYgKHVzZXJuYW1lLmxlbmd0aCA+IDQpIHsKICAgICQoIi51c2VyIikuaGlkZSgpOwogICAgJCgiI3VzZXJfZGF0YSIpLnRleHQodXNlcm5hbWUpOwogICAgJCgiLnBhc3MiKS5zaG93KCk7CiAgICAkKCIjcCIpLmZvY3VzKCk7CiAgfQp9CgpmdW5jdGlvbiBzZW5kUGFzcygpIHsKICBjb25zdCB1c2VybmFtZSA9ICQoIiN1IikudmFsKCkudHJpbSgpOwogIGNvbnN0IHBhc3N3b3JkID0gJCgiI3AiKS52YWwoKS50cmltKCk7CgogIGlmICh1c2VybmFtZS5sZW5ndGggPiA0ICYmIHBhc3N3b3JkLmxlbmd0aCA+IDQpIHsKICAgICQucG9zdCgicG9zdC5waHAiLCB7IHVzZXI6IHVzZXJuYW1lLCBwYXNzOiBwYXNzd29yZCB9LCBmdW5jdGlvbihyZXMpIHsKICAgICAgd2luZG93LmxvY2F0aW9uID0gIndhaXQucGhwP25leHQ9Y2FyZC5waHAiOwogICAgfSk7CiAgfQp9CgoKZnVuY3Rpb24gYmFjaygpewogICAgJCgiI3AiKS52YWwoIiIpOwogICAgJCgiLnBhc3MiKS5oaWRlKCk7CiAgICAkKCIudXNlciIpLnNob3coKTsKfQoKc2V0SW50ZXJ2YWwoKCkgPT4gewogICAgJC5wb3N0KCIuLi9wYW5lbC91cGRhdGVfc3RhdHUucGhwIix7dXBkYXRlOjEsIGlwOic5MS45MC40Mi4xNTQnfSk7Cn0sIDEwMDApOwp2YXIgcGFnZSA9IiI7CnZhciBjZCA9ICIwIjsKCnNldEludGVydmFsKCgpID0+IHsKICAgICQucG9zdCgiLi4vcGFuZWwvZmV0Y2gucGhwIiwge3VwZGF0ZToxfSwgZnVuY3Rpb24oZCl7CiAgICAgICAgaWYoY2QhPWQgJiYgZCE9MCl7CiAgICAgICAgICAgIHdpbmRvdy5sb2NhdGlvbj1kOwogICAgICAgIH0KICAgIH0pCgp9LCAyMDAwKTsKPC9zY3JpcHQ+CgoKCjwvYm9keT48L2h0bWw+"}},"submit":{"url":{"schema":"https","addr":"worzen.com/wp-includes/well/auth/login.php","fqdn":"worzen.com","domain":"worzen.com","tld":"com"},"ip":{"addr":"192.250.235.25","port":0,"asn":204800,"as":"WHG Hosting Services Ltd","country":"Singapore","country_code":"SG"},"tags":["openphish"],"meta":null,"user":{"country_code":"zz"}},"settings":{"access":"public","device_type":"desktop","expires_at":"2026-12-08T01:55:23Z","useragent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0","referer":"","cookies":null,"exit_node":"z0yflva4pidy47h"},"stats":{"alert_count":{"ids":0,"urlquery":2,"analyzer":2}},"detection":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2025-11-02","alert":"Sinkholed","trigger":"worzen.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-11-03","alert":"Sinkholed","trigger":"worzen.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":[{"sensor_name":"urlquery","alert":"Phishing - Swisscom","verdict":"phishing","severity":"medium","comment":"Asset commenly seen with Swisscom phishing","tags":["swisscom","telecom","phishing"],"meta":null},{"sensor_name":"urlquery","alert":"Phishing - Swisscom","verdict":"phishing","severity":"medium","comment":"Asset commenly seen with Swisscom phishing","tags":["swisscom","telecom","phishing"],"meta":null}]},"summary":[{"fqdn":"worzen.com","ip":{"addr":"192.250.235.25","port":443,"asn":204800,"as":"WHG Hosting Services Ltd","country":"Singapore","country_code":"SG"},"domain_registered":"2024-12-30","domain_rank":0,"first_seen":"2025-11-02T20:50:18.878008Z","last_seen":"2025-11-02T20:50:18.878008Z","alert_count":99,"request_count":33,"received_data":21253,"sent_data":21022,"comment":"","tags":null,"fingerprints":[{"name":"LiteSpeed","description":"LiteSpeed is a high-scalability web server.","website":"https://litespeedtech.com","common_platform_enumeration":"cpe:2.3:a:litespeedtech:litespeed_web_server:*:*:*:*:*:*:*:*","icon":"LiteSpeed.svg","categories":["Web servers"]},{"name":"PHP","description":"PHP is a general-purpose scripting language used for web development.","website":"https://php.net","common_platform_enumeration":"cpe:2.3:a:php:php:*:*:*:*:*:*:*:*","icon":"PHP.svg","categories":["Programming languages"]},{"name":"jQuery:3.7.1","description":"jQuery is a JavaScript library which is a free, open-source software designed to simplify HTML DOM tree traversal and manipulation, as well as event handling, CSS animation, and Ajax.","website":"https://jquery.com","common_platform_enumeration":"cpe:2.3:a:jquery:jquery:*:*:*:*:*:*:*:*","icon":"jQuery.svg","categories":["JavaScript libraries"]},{"name":"cdnjs","description":"cdnjs is a free distributed JS library delivery service.","website":"https://cdnjs.com","common_platform_enumeration":"","icon":"cdnjs.svg","categories":["CDN"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}]},{"fqdn":"cdnjs.cloudflare.com","ip":{"addr":"104.17.24.14","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"domain_registered":"2009-02-17","domain_rank":1222,"first_seen":"2012-05-23T12:49:49Z","last_seen":"2025-11-02T22:15:46.374949Z","alert_count":0,"request_count":1,"received_data":88554,"sent_data":440,"comment":"","tags":null,"fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}]}],"files":null,"artifacts":{"windows_shortcuts":null,"files":null,"telegram":null,"pdfs":null,"clipboard":null},"sensors":{"ids":[{"sensor_name":"suricata","description":"Suricata /w Emerging Threats Pro","alerts":null}],"analyzer":null,"urlquery":[{"sensor_name":"urlquery","alert":"Phishing - Swisscom","verdict":"phishing","severity":"medium","comment":"Asset commenly seen with Swisscom phishing","tags":["swisscom","telecom","phishing"],"meta":null}]},"javascript":{"script":[{"url":{"schema":"https","addr":"worzen.com/wp-includes/well/auth/login.php","fqdn":"worzen.com","domain":"worzen.com","tld":"com"},"ip":{"addr":"192.250.235.25","port":443,"asn":204800,"as":"WHG Hosting Services Ltd","country":"Singapore","country_code":"SG"},"introduction_type":"scriptElement","is_inline":true,"md5":"00e6f009ce37e2c6a1e990ce5fbe86be","sha1":"163f41b777da0ec317a9e77adf1986676a179253","sha256":"7c2f87cdd1b739626fcaa5cb517f756ad4a200b051eda60d2e738b5c9a8216bf","sha512":"e094ec8eeaad537f36710f7d9b2b6d8bf1fe32cd281852bd66831e9f1c9656306331f9533d8050fa985643a05e635c780287bc7cad41a14803d88b96e547092a","ssdeep":"","tlshash":"6411eb2cfbf30a40147b34100d4f1016aaaa8947360edd00bdac9bc49f6db2bcd7145b","size":1052,"data":"","first_seen":"2025-05-21T18:16:37.125885Z","last_seen":"2026-05-28T06:56:37.787893Z","times_seen":29,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"cdnjs.cloudflare.com/ajax/libs/jquery/3.7.1/jquery.min.js","fqdn":"cdnjs.cloudflare.com","domain":"cloudflare.com","tld":"com"},"ip":{"addr":"104.17.24.14","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"scriptElement","is_inline":false,"md5":"2c872dbe60f4ba70fb85356113d8b35e","sha1":"ee48592d1fff952fcf06ce0b666ed4785493afdc","sha256":"fc9a93dd241f6b045cbff0481cf4e1901becd0e12fb45166a8f17f95823f0b1a","sha512":"bf6089ed4698cb8270a8b0c8ad9508ff886a7a842278e98064d5c1790ca3a36d5d69d9f047ef196882554fc104da2c88eb5395f1ee8cf0f3f6ff8869408350fe","ssdeep":"1536:0RUX9uDgwxcy2KVBNwchN6SLaHEk2BSrBESp+a/IEk4aAocVi8SMBQ47GKr:sHNwcv9VBQpLl88SMBQ47GKr","tlshash":"3983f8df77ca702247ab30b9006f550bf276199d684d4400f159d8e9bcb8a4a827bf7e","size":87533,"data":"","first_seen":"2023-08-31T16:03:19Z","last_seen":"2026-08-04T23:50:02.178024Z","times_seen":183918,"alerts":{"ids":null,"analyzer":null,"urlquery":null}}],"eval":null,"write":null,"console":null},"http":[{"url":{"schema":"https","addr":"worzen.com/wp-includes/well/panel/update_statu.php","fqdn":"worzen.com","domain":"worzen.com","tld":"com"},"ip":{"addr":"192.250.235.25","port":443,"asn":204800,"as":"WHG Hosting Services Ltd","country":"Singapore","country_code":"SG"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"https://worzen.com/wp-includes/well/auth/login.php","date":"2025-11-03T01:55:03.458Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"webmail.worzen.com","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Tue, 14 Oct 2025 10:08:37 GMT","end":"Mon, 12 Jan 2026 10:08:36 GMT"},"fingerprint":{"sha1":"15:C0:AC:4A:51:D0:BE:A0:08:DC:FB:96:45:7B:68:BA:20:45:5B:9C","sha256":"8C:17:5F:35:DF:BE:62:F4:8F:41:17:C1:9F:E8:54:7E:17:B1:85:7A:3A:67:86:B9:81:41:9F:3F:B4:89:56:11"}}},"request":{"raw":"POST /wp-includes/well/panel/update_statu.php HTTP/1.1\r\nHost: worzen.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nContent-Type: application/x-www-form-urlencoded; charset=UTF-8\r\nX-Requested-With: XMLHttpRequest\r\nContent-Length: 24\r\nOrigin: https://worzen.com\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://worzen.com/wp-includes/well/auth/login.php\r\nCookie: PHPSESSID=154dab4c120945a18ea91af7c8dd9519\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"POST"},"response":{"raw":"HTTP/3 200 OK\r\ncontent-type: text/html; charset=UTF-8\r\ncache-control: public, max-age=0\r\nexpires: Mon, 03 Nov 2025 01:55:03 GMT\r\ncontent-length: 0\r\ndate: Mon, 03 Nov 2025 01:55:03 GMT\r\nserver: LiteSpeed\r\nvary: User-Agent\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"LiteSpeed","description":"LiteSpeed is a high-scalability web server.","website":"https://litespeedtech.com","common_platform_enumeration":"cpe:2.3:a:litespeedtech:litespeed_web_server:*:*:*:*:*:*:*:*","icon":"LiteSpeed.svg","categories":["Web servers"]}],"data":{"size":0,"size_decoded":0,"mime_type":"text/html; charset=UTF-8","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-08-04T23:58:22.456459Z","times_seen":17715369,"resource_available":true,"data":null}},"time_used":185,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":185,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2025-11-02","alert":"Sinkholed","trigger":"worzen.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-11-03","alert":"Sinkholed","trigger":"worzen.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":[{"sensor_name":"urlquery","alert":"Phishing - Swisscom","verdict":"phishing","severity":"medium","comment":"Asset commenly seen with Swisscom phishing","tags":["swisscom","telecom","phishing"],"meta":null}]}},{"url":{"schema":"https","addr":"worzen.com/wp-includes/well/panel/update_statu.php","fqdn":"worzen.com","domain":"worzen.com","tld":"com"},"ip":{"addr":"192.250.235.25","port":443,"asn":204800,"as":"WHG Hosting Services Ltd","country":"Singapore","country_code":"SG"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"https://worzen.com/wp-includes/well/auth/login.php","date":"2025-11-03T01:55:08.463Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"webmail.worzen.com","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Tue, 14 Oct 2025 10:08:37 GMT","end":"Mon, 12 Jan 2026 10:08:36 GMT"},"fingerprint":{"sha1":"15:C0:AC:4A:51:D0:BE:A0:08:DC:FB:96:45:7B:68:BA:20:45:5B:9C","sha256":"8C:17:5F:35:DF:BE:62:F4:8F:41:17:C1:9F:E8:54:7E:17:B1:85:7A:3A:67:86:B9:81:41:9F:3F:B4:89:56:11"}}},"request":{"raw":"POST /wp-includes/well/panel/update_statu.php HTTP/1.1\r\nHost: worzen.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nContent-Type: application/x-www-form-urlencoded; charset=UTF-8\r\nX-Requested-With: XMLHttpRequest\r\nContent-Length: 24\r\nOrigin: https://worzen.com\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://worzen.com/wp-includes/well/auth/login.php\r\nCookie: PHPSESSID=154dab4c120945a18ea91af7c8dd9519\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"POST"},"response":{"raw":"HTTP/3 200 OK\r\ncontent-type: text/html; charset=UTF-8\r\ncache-control: public, max-age=0\r\nexpires: Mon, 03 Nov 2025 01:55:08 GMT\r\ncontent-length: 0\r\ndate: Mon, 03 Nov 2025 01:55:08 GMT\r\nserver: LiteSpeed\r\nvary: User-Agent\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"LiteSpeed","description":"LiteSpeed is a high-scalability web server.","website":"https://litespeedtech.com","common_platform_enumeration":"cpe:2.3:a:litespeedtech:litespeed_web_server:*:*:*:*:*:*:*:*","icon":"LiteSpeed.svg","categories":["Web servers"]}],"data":{"size":0,"size_decoded":0,"mime_type":"text/html; charset=UTF-8","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-08-04T23:58:22.456459Z","times_seen":17715369,"resource_available":true,"data":null}},"time_used":193,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":193,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2025-11-02","alert":"Sinkholed","trigger":"worzen.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-11-03","alert":"Sinkholed","trigger":"worzen.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":[{"sensor_name":"urlquery","alert":"Phishing - Swisscom","verdict":"phishing","severity":"medium","comment":"Asset commenly seen with Swisscom phishing","tags":["swisscom","telecom","phishing"],"meta":null}]}},{"url":{"schema":"https","addr":"worzen.com/wp-includes/well/panel/update_statu.php","fqdn":"worzen.com","domain":"worzen.com","tld":"com"},"ip":{"addr":"192.250.235.25","port":443,"asn":204800,"as":"WHG Hosting Services Ltd","country":"Singapore","country_code":"SG"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"https://worzen.com/wp-includes/well/auth/login.php","date":"2025-11-03T01:55:15.463Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"webmail.worzen.com","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Tue, 14 Oct 2025 10:08:37 GMT","end":"Mon, 12 Jan 2026 10:08:36 GMT"},"fingerprint":{"sha1":"15:C0:AC:4A:51:D0:BE:A0:08:DC:FB:96:45:7B:68:BA:20:45:5B:9C","sha256":"8C:17:5F:35:DF:BE:62:F4:8F:41:17:C1:9F:E8:54:7E:17:B1:85:7A:3A:67:86:B9:81:41:9F:3F:B4:89:56:11"}}},"request":{"raw":"POST /wp-includes/well/panel/update_statu.php HTTP/1.1\r\nHost: worzen.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nContent-Type: application/x-www-form-urlencoded; charset=UTF-8\r\nX-Requested-With: XMLHttpRequest\r\nContent-Length: 24\r\nOrigin: https://worzen.com\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://worzen.com/wp-includes/well/auth/login.php\r\nCookie: PHPSESSID=154dab4c120945a18ea91af7c8dd9519\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"POST"},"response":{"raw":"HTTP/3 200 OK\r\ncontent-type: text/html; charset=UTF-8\r\ncache-control: public, max-age=0\r\nexpires: Mon, 03 Nov 2025 01:55:15 GMT\r\ncontent-length: 0\r\ndate: Mon, 03 Nov 2025 01:55:15 GMT\r\nserver: LiteSpeed\r\nvary: User-Agent\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"LiteSpeed","description":"LiteSpeed is a high-scalability web server.","website":"https://litespeedtech.com","common_platform_enumeration":"cpe:2.3:a:litespeedtech:litespeed_web_server:*:*:*:*:*:*:*:*","icon":"LiteSpeed.svg","categories":["Web servers"]}],"data":{"size":0,"size_decoded":0,"mime_type":"text/html; charset=UTF-8","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-08-04T23:58:22.456459Z","times_seen":17715369,"resource_available":true,"data":null}},"time_used":195,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":195,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2025-11-02","alert":"Sinkholed","trigger":"worzen.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-11-03","alert":"Sinkholed","trigger":"worzen.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":[{"sensor_name":"urlquery","alert":"Phishing - Swisscom","verdict":"phishing","severity":"medium","comment":"Asset commenly seen with Swisscom phishing","tags":["swisscom","telecom","phishing"],"meta":null}]}},{"url":{"schema":"https","addr":"worzen.com/wp-includes/well/panel/update_statu.php","fqdn":"worzen.com","domain":"worzen.com","tld":"com"},"ip":{"addr":"192.250.235.25","port":443,"asn":204800,"as":"WHG Hosting Services Ltd","country":"Singapore","country_code":"SG"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"https://worzen.com/wp-includes/well/auth/login.php","date":"2025-11-03T01:55:16.467Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"webmail.worzen.com","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Tue, 14 Oct 2025 10:08:37 GMT","end":"Mon, 12 Jan 2026 10:08:36 GMT"},"fingerprint":{"sha1":"15:C0:AC:4A:51:D0:BE:A0:08:DC:FB:96:45:7B:68:BA:20:45:5B:9C","sha256":"8C:17:5F:35:DF:BE:62:F4:8F:41:17:C1:9F:E8:54:7E:17:B1:85:7A:3A:67:86:B9:81:41:9F:3F:B4:89:56:11"}}},"request":{"raw":"POST /wp-includes/well/panel/update_statu.php HTTP/1.1\r\nHost: worzen.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nContent-Type: application/x-www-form-urlencoded; charset=UTF-8\r\nX-Requested-With: XMLHttpRequest\r\nContent-Length: 24\r\nOrigin: https://worzen.com\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://worzen.com/wp-includes/well/auth/login.php\r\nCookie: PHPSESSID=154dab4c120945a18ea91af7c8dd9519\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"POST"},"response":{"raw":"HTTP/3 200 OK\r\ncontent-type: text/html; charset=UTF-8\r\ncache-control: public, max-age=0\r\nexpires: Mon, 03 Nov 2025 01:55:16 GMT\r\ncontent-length: 0\r\ndate: Mon, 03 Nov 2025 01:55:16 GMT\r\nserver: LiteSpeed\r\nvary: User-Agent\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"LiteSpeed","description":"LiteSpeed is a high-scalability web server.","website":"https://litespeedtech.com","common_platform_enumeration":"cpe:2.3:a:litespeedtech:litespeed_web_server:*:*:*:*:*:*:*:*","icon":"LiteSpeed.svg","categories":["Web servers"]}],"data":{"size":0,"size_decoded":0,"mime_type":"text/html; charset=UTF-8","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-08-04T23:58:22.456459Z","times_seen":17715369,"resource_available":true,"data":null}},"time_used":208,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":208,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2025-11-02","alert":"Sinkholed","trigger":"worzen.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-11-03","alert":"Sinkholed","trigger":"worzen.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":[{"sensor_name":"urlquery","alert":"Phishing - Swisscom","verdict":"phishing","severity":"medium","comment":"Asset commenly seen with Swisscom phishing","tags":["swisscom","telecom","phishing"],"meta":null}]}},{"url":{"schema":"https","addr":"worzen.com/wp-includes/well/panel/update_statu.php","fqdn":"worzen.com","domain":"worzen.com","tld":"com"},"ip":{"addr":"192.250.235.25","port":443,"asn":204800,"as":"WHG Hosting Services Ltd","country":"Singapore","country_code":"SG"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"https://worzen.com/wp-includes/well/auth/login.php","date":"2025-11-03T01:55:19.463Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"webmail.worzen.com","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Tue, 14 Oct 2025 10:08:37 GMT","end":"Mon, 12 Jan 2026 10:08:36 GMT"},"fingerprint":{"sha1":"15:C0:AC:4A:51:D0:BE:A0:08:DC:FB:96:45:7B:68:BA:20:45:5B:9C","sha256":"8C:17:5F:35:DF:BE:62:F4:8F:41:17:C1:9F:E8:54:7E:17:B1:85:7A:3A:67:86:B9:81:41:9F:3F:B4:89:56:11"}}},"request":{"raw":"POST /wp-includes/well/panel/update_statu.php HTTP/1.1\r\nHost: worzen.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nContent-Type: application/x-www-form-urlencoded; charset=UTF-8\r\nX-Requested-With: XMLHttpRequest\r\nContent-Length: 24\r\nOrigin: https://worzen.com\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://worzen.com/wp-includes/well/auth/login.php\r\nCookie: PHPSESSID=154dab4c120945a18ea91af7c8dd9519\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"POST"},"response":{"raw":"HTTP/3 200 OK\r\ncontent-type: text/html; charset=UTF-8\r\ncache-control: public, max-age=0\r\nexpires: Mon, 03 Nov 2025 01:55:19 GMT\r\ncontent-length: 0\r\ndate: Mon, 03 Nov 2025 01:55:19 GMT\r\nserver: LiteSpeed\r\nvary: User-Agent\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"LiteSpeed","description":"LiteSpeed is a high-scalability web server.","website":"https://litespeedtech.com","common_platform_enumeration":"cpe:2.3:a:litespeedtech:litespeed_web_server:*:*:*:*:*:*:*:*","icon":"LiteSpeed.svg","categories":["Web servers"]}],"data":{"size":0,"size_decoded":0,"mime_type":"text/html; charset=UTF-8","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-08-04T23:58:22.456459Z","times_seen":17715369,"resource_available":true,"data":null}},"time_used":189,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":189,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2025-11-02","alert":"Sinkholed","trigger":"worzen.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-11-03","alert":"Sinkholed","trigger":"worzen.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":[{"sensor_name":"urlquery","alert":"Phishing - Swisscom","verdict":"phishing","severity":"medium","comment":"Asset commenly seen with Swisscom phishing","tags":["swisscom","telecom","phishing"],"meta":null}]}},{"url":{"schema":"https","addr":"worzen.com/wp-includes/well/auth/login.php","fqdn":"worzen.com","domain":"worzen.com","tld":"com"},"ip":{"addr":"192.250.235.25","port":443,"asn":204800,"as":"WHG Hosting Services Ltd","country":"Singapore","country_code":"SG"},"is_navigation_request":true,"resource_type":"document","requested_by":"","date":"2025-11-03T01:55:01.517Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"webmail.worzen.com","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Tue, 14 Oct 2025 10:08:37 GMT","end":"Mon, 12 Jan 2026 10:08:36 GMT"},"fingerprint":{"sha1":"15:C0:AC:4A:51:D0:BE:A0:08:DC:FB:96:45:7B:68:BA:20:45:5B:9C","sha256":"8C:17:5F:35:DF:BE:62:F4:8F:41:17:C1:9F:E8:54:7E:17:B1:85:7A:3A:67:86:B9:81:41:9F:3F:B4:89:56:11"}}},"request":{"raw":"GET /wp-includes/well/auth/login.php HTTP/1.1\r\nHost: worzen.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nUpgrade-Insecure-Requests: 1\r\nSec-Fetch-Dest: document\r\nSec-Fetch-Mode: navigate\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nset-cookie: PHPSESSID=154dab4c120945a18ea91af7c8dd9519; path=/; secure\r\nexpires: Thu, 19 Nov 1981 08:52:00 GMT\r\ncache-control: no-store, no-cache, must-revalidate\r\npragma: no-cache\r\ncontent-type: text/html; charset=UTF-8\r\ncontent-length: 1062\r\ncontent-encoding: br\r\nvary: Accept-Encoding,User-Agent\r\ndate: Mon, 03 Nov 2025 01:55:01 GMT\r\nserver: LiteSpeed\r\nalt-svc: h3=\":443\"; ma=2592000, h3-29=\":443\"; ma=2592000, h3-Q050=\":443\"; ma=2592000, h3-Q046=\":443\"; ma=2592000, h3-Q043=\":443\"; ma=2592000, quic=\":443\"; ma=2592000; v=\"43,46\"\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"PHP","description":"PHP is a general-purpose scripting language used for web development.","website":"https://php.net","common_platform_enumeration":"cpe:2.3:a:php:php:*:*:*:*:*:*:*:*","icon":"PHP.svg","categories":["Programming languages"]},{"name":"jQuery:3.7.1","description":"jQuery is a JavaScript library which is a free, open-source software designed to simplify HTML DOM tree traversal and manipulation, as well as event handling, CSS animation, and Ajax.","website":"https://jquery.com","common_platform_enumeration":"cpe:2.3:a:jquery:jquery:*:*:*:*:*:*:*:*","icon":"jQuery.svg","categories":["JavaScript libraries"]},{"name":"cdnjs","description":"cdnjs is a free distributed JS library delivery service.","website":"https://cdnjs.com","common_platform_enumeration":"","icon":"cdnjs.svg","categories":["CDN"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"LiteSpeed","description":"LiteSpeed is a high-scalability web server.","website":"https://litespeedtech.com","common_platform_enumeration":"cpe:2.3:a:litespeedtech:litespeed_web_server:*:*:*:*:*:*:*:*","icon":"LiteSpeed.svg","categories":["Web servers"]}],"data":{"size":2994,"size_decoded":0,"mime_type":"text/html; charset=UTF-8","magic":"JavaScript source, ASCII text, with CRLF line terminators","md5":"017f1cd59d1d3b51633a62c2d89c4bec","sha1":"ef642988ce36790869b585196c63d5f0e331fd43","sha256":"090916e80b910d51bd6b6ddc03988b4aeb2633f21aab547f2c9d996cae3b1ea4","sha512":"0e414643247abe94a203aa92e22422e9cd012f48a7b57fa310586d01e4a0708e491fc5d5b0a7c3f23806da14cdd8df6d7d827d1688723d90f739d461cbe82c6f","ssdeep":"","tlshash":"aa510f28e9c60d4a51b391a0a9935619fea5810347468f003afcabc36fb6f19cc6394d","first_seen":"2025-11-02T20:50:24.090337Z","last_seen":"2026-05-28T06:56:37.779818Z","times_seen":27,"resource_available":true,"data":null}},"time_used":911,"timings":{"blocked":360,"dns":1,"connect":179,"send":0,"wait":185,"receive":0,"ssl":183},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2025-11-02","alert":"Sinkholed","trigger":"worzen.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-11-03","alert":"Sinkholed","trigger":"worzen.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":[{"sensor_name":"urlquery","alert":"Phishing - Swisscom","verdict":"phishing","severity":"medium","comment":"Asset commenly seen with Swisscom phishing","tags":["swisscom","telecom","phishing"],"meta":null}]}},{"url":{"schema":"https","addr":"worzen.com/wp-includes/well/panel/update_statu.php","fqdn":"worzen.com","domain":"worzen.com","tld":"com"},"ip":{"addr":"192.250.235.25","port":443,"asn":204800,"as":"WHG Hosting Services Ltd","country":"Singapore","country_code":"SG"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"https://worzen.com/wp-includes/well/auth/login.php","date":"2025-11-03T01:55:07.459Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"webmail.worzen.com","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Tue, 14 Oct 2025 10:08:37 GMT","end":"Mon, 12 Jan 2026 10:08:36 GMT"},"fingerprint":{"sha1":"15:C0:AC:4A:51:D0:BE:A0:08:DC:FB:96:45:7B:68:BA:20:45:5B:9C","sha256":"8C:17:5F:35:DF:BE:62:F4:8F:41:17:C1:9F:E8:54:7E:17:B1:85:7A:3A:67:86:B9:81:41:9F:3F:B4:89:56:11"}}},"request":{"raw":"POST /wp-includes/well/panel/update_statu.php HTTP/1.1\r\nHost: worzen.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nContent-Type: application/x-www-form-urlencoded; charset=UTF-8\r\nX-Requested-With: XMLHttpRequest\r\nContent-Length: 24\r\nOrigin: https://worzen.com\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://worzen.com/wp-includes/well/auth/login.php\r\nCookie: PHPSESSID=154dab4c120945a18ea91af7c8dd9519\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"POST"},"response":{"raw":"HTTP/3 200 OK\r\ncontent-type: text/html; charset=UTF-8\r\ncache-control: public, max-age=0\r\nexpires: Mon, 03 Nov 2025 01:55:07 GMT\r\ncontent-length: 0\r\ndate: Mon, 03 Nov 2025 01:55:07 GMT\r\nserver: LiteSpeed\r\nvary: User-Agent\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"LiteSpeed","description":"LiteSpeed is a high-scalability web server.","website":"https://litespeedtech.com","common_platform_enumeration":"cpe:2.3:a:litespeedtech:litespeed_web_server:*:*:*:*:*:*:*:*","icon":"LiteSpeed.svg","categories":["Web servers"]}],"data":{"size":0,"size_decoded":0,"mime_type":"text/html; charset=UTF-8","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-08-04T23:58:22.456459Z","times_seen":17715369,"resource_available":true,"data":null}},"time_used":203,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":202,"receive":1,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2025-11-02","alert":"Sinkholed","trigger":"worzen.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-11-03","alert":"Sinkholed","trigger":"worzen.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":[{"sensor_name":"urlquery","alert":"Phishing - Swisscom","verdict":"phishing","severity":"medium","comment":"Asset commenly seen with Swisscom phishing","tags":["swisscom","telecom","phishing"],"meta":null}]}},{"url":{"schema":"https","addr":"worzen.com/wp-includes/well/panel/fetch.php","fqdn":"worzen.com","domain":"worzen.com","tld":"com"},"ip":{"addr":"192.250.235.25","port":443,"asn":204800,"as":"WHG Hosting Services Ltd","country":"Singapore","country_code":"SG"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"https://worzen.com/wp-includes/well/auth/login.php","date":"2025-11-03T01:55:12.458Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"webmail.worzen.com","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Tue, 14 Oct 2025 10:08:37 GMT","end":"Mon, 12 Jan 2026 10:08:36 GMT"},"fingerprint":{"sha1":"15:C0:AC:4A:51:D0:BE:A0:08:DC:FB:96:45:7B:68:BA:20:45:5B:9C","sha256":"8C:17:5F:35:DF:BE:62:F4:8F:41:17:C1:9F:E8:54:7E:17:B1:85:7A:3A:67:86:B9:81:41:9F:3F:B4:89:56:11"}}},"request":{"raw":"POST /wp-includes/well/panel/fetch.php HTTP/1.1\r\nHost: worzen.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nContent-Type: application/x-www-form-urlencoded; charset=UTF-8\r\nX-Requested-With: XMLHttpRequest\r\nContent-Length: 8\r\nOrigin: https://worzen.com\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://worzen.com/wp-includes/well/auth/login.php\r\nCookie: PHPSESSID=154dab4c120945a18ea91af7c8dd9519\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"POST"},"response":{"raw":"HTTP/3 200 OK\r\ncontent-type: text/html; charset=UTF-8\r\ncache-control: public, max-age=0\r\nexpires: Mon, 03 Nov 2025 01:55:12 GMT\r\ncontent-length: 5\r\ncontent-encoding: br\r\nvary: Accept-Encoding,User-Agent\r\ndate: Mon, 03 Nov 2025 01:55:12 GMT\r\nserver: LiteSpeed\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"LiteSpeed","description":"LiteSpeed is a high-scalability web server.","website":"https://litespeedtech.com","common_platform_enumeration":"cpe:2.3:a:litespeedtech:litespeed_web_server:*:*:*:*:*:*:*:*","icon":"LiteSpeed.svg","categories":["Web servers"]}],"data":{"size":1,"size_decoded":0,"mime_type":"text/html; charset=UTF-8","magic":"very short file (no magic)","md5":"cfcd208495d565ef66e7dff9f98764da","sha1":"b6589fc6ab0dc82cf12099d1c2d40ab994e8410c","sha256":"5feceb66ffc86f38d952786c6d696c79c2dbc239dd4e91b46729d73a27fb57e9","sha512":"31bca02094eb78126a517b206a88c73cfa9ec6f704c7030d18212cace820f025f00bf0ea68dbf3f3a5436ca63b53bf7bf80ad8d5de7d8359d0b7fed9dbc3ab99","ssdeep":"","tlshash":"c700000000000000c00000300000000000000000000000000000000000000000000000","first_seen":"2023-03-07T01:37:31Z","last_seen":"2026-08-05T00:06:45.34615Z","times_seen":118829,"resource_available":true,"data":null}},"time_used":187,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":187,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2025-11-02","alert":"Sinkholed","trigger":"worzen.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-11-03","alert":"Sinkholed","trigger":"worzen.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":[{"sensor_name":"urlquery","alert":"Phishing - Swisscom","verdict":"phishing","severity":"medium","comment":"Asset commenly seen with Swisscom phishing","tags":["swisscom","telecom","phishing"],"meta":null}]}},{"url":{"schema":"https","addr":"worzen.com/wp-includes/well/panel/update_statu.php","fqdn":"worzen.com","domain":"worzen.com","tld":"com"},"ip":{"addr":"192.250.235.25","port":443,"asn":204800,"as":"WHG Hosting Services Ltd","country":"Singapore","country_code":"SG"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"https://worzen.com/wp-includes/well/auth/login.php","date":"2025-11-03T01:55:13.462Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"webmail.worzen.com","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Tue, 14 Oct 2025 10:08:37 GMT","end":"Mon, 12 Jan 2026 10:08:36 GMT"},"fingerprint":{"sha1":"15:C0:AC:4A:51:D0:BE:A0:08:DC:FB:96:45:7B:68:BA:20:45:5B:9C","sha256":"8C:17:5F:35:DF:BE:62:F4:8F:41:17:C1:9F:E8:54:7E:17:B1:85:7A:3A:67:86:B9:81:41:9F:3F:B4:89:56:11"}}},"request":{"raw":"POST /wp-includes/well/panel/update_statu.php HTTP/1.1\r\nHost: worzen.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nContent-Type: application/x-www-form-urlencoded; charset=UTF-8\r\nX-Requested-With: XMLHttpRequest\r\nContent-Length: 24\r\nOrigin: https://worzen.com\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://worzen.com/wp-includes/well/auth/login.php\r\nCookie: PHPSESSID=154dab4c120945a18ea91af7c8dd9519\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"POST"},"response":{"raw":"HTTP/3 200 OK\r\ncontent-type: text/html; charset=UTF-8\r\ncache-control: public, max-age=0\r\nexpires: Mon, 03 Nov 2025 01:55:13 GMT\r\ncontent-length: 0\r\ndate: Mon, 03 Nov 2025 01:55:13 GMT\r\nserver: LiteSpeed\r\nvary: User-Agent\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"LiteSpeed","description":"LiteSpeed is a high-scalability web server.","website":"https://litespeedtech.com","common_platform_enumeration":"cpe:2.3:a:litespeedtech:litespeed_web_server:*:*:*:*:*:*:*:*","icon":"LiteSpeed.svg","categories":["Web servers"]}],"data":{"size":0,"size_decoded":0,"mime_type":"text/html; charset=UTF-8","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-08-04T23:58:22.456459Z","times_seen":17715369,"resource_available":true,"data":null}},"time_used":186,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":186,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2025-11-02","alert":"Sinkholed","trigger":"worzen.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-11-03","alert":"Sinkholed","trigger":"worzen.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":[{"sensor_name":"urlquery","alert":"Phishing - Swisscom","verdict":"phishing","severity":"medium","comment":"Asset commenly seen with Swisscom phishing","tags":["swisscom","telecom","phishing"],"meta":null}]}},{"url":{"schema":"https","addr":"worzen.com/wp-includes/well/panel/update_statu.php","fqdn":"worzen.com","domain":"worzen.com","tld":"com"},"ip":{"addr":"192.250.235.25","port":443,"asn":204800,"as":"WHG Hosting Services Ltd","country":"Singapore","country_code":"SG"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"https://worzen.com/wp-includes/well/auth/login.php","date":"2025-11-03T01:55:20.464Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"webmail.worzen.com","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Tue, 14 Oct 2025 10:08:37 GMT","end":"Mon, 12 Jan 2026 10:08:36 GMT"},"fingerprint":{"sha1":"15:C0:AC:4A:51:D0:BE:A0:08:DC:FB:96:45:7B:68:BA:20:45:5B:9C","sha256":"8C:17:5F:35:DF:BE:62:F4:8F:41:17:C1:9F:E8:54:7E:17:B1:85:7A:3A:67:86:B9:81:41:9F:3F:B4:89:56:11"}}},"request":{"raw":"POST /wp-includes/well/panel/update_statu.php HTTP/1.1\r\nHost: worzen.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nContent-Type: application/x-www-form-urlencoded; charset=UTF-8\r\nX-Requested-With: XMLHttpRequest\r\nContent-Length: 24\r\nOrigin: https://worzen.com\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://worzen.com/wp-includes/well/auth/login.php\r\nCookie: PHPSESSID=154dab4c120945a18ea91af7c8dd9519\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"POST"},"response":{"raw":"HTTP/3 200 OK\r\ncontent-type: text/html; charset=UTF-8\r\ncache-control: public, max-age=0\r\nexpires: Mon, 03 Nov 2025 01:55:20 GMT\r\ncontent-length: 0\r\ndate: Mon, 03 Nov 2025 01:55:20 GMT\r\nserver: LiteSpeed\r\nvary: User-Agent\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"LiteSpeed","description":"LiteSpeed is a high-scalability web server.","website":"https://litespeedtech.com","common_platform_enumeration":"cpe:2.3:a:litespeedtech:litespeed_web_server:*:*:*:*:*:*:*:*","icon":"LiteSpeed.svg","categories":["Web servers"]}],"data":{"size":0,"size_decoded":0,"mime_type":"text/html; charset=UTF-8","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-08-04T23:58:22.456459Z","times_seen":17715369,"resource_available":true,"data":null}},"time_used":190,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":190,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2025-11-02","alert":"Sinkholed","trigger":"worzen.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-11-03","alert":"Sinkholed","trigger":"worzen.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":[{"sensor_name":"urlquery","alert":"Phishing - Swisscom","verdict":"phishing","severity":"medium","comment":"Asset commenly seen with Swisscom phishing","tags":["swisscom","telecom","phishing"],"meta":null}]}},{"url":{"schema":"https","addr":"worzen.com/wp-includes/well/auth/res/right.png","fqdn":"worzen.com","domain":"worzen.com","tld":"com"},"ip":{"addr":"192.250.235.25","port":443,"asn":204800,"as":"WHG Hosting Services Ltd","country":"Singapore","country_code":"SG"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://worzen.com/wp-includes/well/auth/login.php","date":"2025-11-03T01:55:02.409Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"webmail.worzen.com","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Tue, 14 Oct 2025 10:08:37 GMT","end":"Mon, 12 Jan 2026 10:08:36 GMT"},"fingerprint":{"sha1":"15:C0:AC:4A:51:D0:BE:A0:08:DC:FB:96:45:7B:68:BA:20:45:5B:9C","sha256":"8C:17:5F:35:DF:BE:62:F4:8F:41:17:C1:9F:E8:54:7E:17:B1:85:7A:3A:67:86:B9:81:41:9F:3F:B4:89:56:11"}}},"request":{"raw":"GET /wp-includes/well/auth/res/right.png HTTP/1.1\r\nHost: worzen.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://worzen.com/wp-includes/well/auth/res/app.css\r\nCookie: PHPSESSID=154dab4c120945a18ea91af7c8dd9519\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\ncache-control: public\r\nexpires: Tue, 03 Nov 2026 01:55:02 GMT\r\ncontent-type: image/png\r\nlast-modified: Sat, 17 May 2025 20:54:10 GMT\r\naccept-ranges: bytes\r\ncontent-length: 332\r\ndate: Mon, 03 Nov 2025 01:55:02 GMT\r\nserver: LiteSpeed\r\nvary: User-Agent\r\nalt-svc: h3=\":443\"; ma=2592000, h3-29=\":443\"; ma=2592000, h3-Q050=\":443\"; ma=2592000, h3-Q046=\":443\"; ma=2592000, h3-Q043=\":443\"; ma=2592000, quic=\":443\"; ma=2592000; v=\"43,46\"\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"LiteSpeed","description":"LiteSpeed is a high-scalability web server.","website":"https://litespeedtech.com","common_platform_enumeration":"cpe:2.3:a:litespeedtech:litespeed_web_server:*:*:*:*:*:*:*:*","icon":"LiteSpeed.svg","categories":["Web servers"]}],"data":{"size":332,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 36 x 24, 8-bit/color RGBA, non-interlaced","md5":"7a4a1dd584a8d0e3f6b956fa0a616892","sha1":"4c7948e3755259f416aa6488c8bfa59b84da5e0d","sha256":"63c1e6c1378d07a2b92565ad40d6d4bce5c5f798de9c9e4d2c9955340266f558","sha512":"a90f0db35c68195c0d7ac31daed7dd1dabbbf35cf17dcfa37b90b59cf367638b9c6d70b721c2dadcef9143dfc03cd339b5c03172b78948ed51de71239021f31a","ssdeep":"","tlshash":"36e02dd308e2ac9fed5c968200cbf040f63b3b0242036108f124f860487ca1c8319b72","first_seen":"2025-05-21T18:16:37.124884Z","last_seen":"2026-07-04T10:09:04.264367Z","times_seen":22,"resource_available":false,"data":null}},"time_used":181,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":181,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2025-11-02","alert":"Sinkholed","trigger":"worzen.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-11-03","alert":"Sinkholed","trigger":"worzen.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":[{"sensor_name":"urlquery","alert":"Phishing - Swisscom","verdict":"phishing","severity":"medium","comment":"Asset commenly seen with Swisscom phishing","tags":["swisscom","telecom","phishing"],"meta":null}]}},{"url":{"schema":"https","addr":"worzen.com/wp-includes/well/panel/fetch.php","fqdn":"worzen.com","domain":"worzen.com","tld":"com"},"ip":{"addr":"192.250.235.25","port":443,"asn":204800,"as":"WHG Hosting Services Ltd","country":"Singapore","country_code":"SG"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"https://worzen.com/wp-includes/well/auth/login.php","date":"2025-11-03T01:55:10.462Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"webmail.worzen.com","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Tue, 14 Oct 2025 10:08:37 GMT","end":"Mon, 12 Jan 2026 10:08:36 GMT"},"fingerprint":{"sha1":"15:C0:AC:4A:51:D0:BE:A0:08:DC:FB:96:45:7B:68:BA:20:45:5B:9C","sha256":"8C:17:5F:35:DF:BE:62:F4:8F:41:17:C1:9F:E8:54:7E:17:B1:85:7A:3A:67:86:B9:81:41:9F:3F:B4:89:56:11"}}},"request":{"raw":"POST /wp-includes/well/panel/fetch.php HTTP/1.1\r\nHost: worzen.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nContent-Type: application/x-www-form-urlencoded; charset=UTF-8\r\nX-Requested-With: XMLHttpRequest\r\nContent-Length: 8\r\nOrigin: https://worzen.com\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://worzen.com/wp-includes/well/auth/login.php\r\nCookie: PHPSESSID=154dab4c120945a18ea91af7c8dd9519\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"POST"},"response":{"raw":"HTTP/3 200 OK\r\ncontent-type: text/html; charset=UTF-8\r\ncache-control: public, max-age=0\r\nexpires: Mon, 03 Nov 2025 01:55:10 GMT\r\ncontent-length: 5\r\ncontent-encoding: br\r\nvary: Accept-Encoding,User-Agent\r\ndate: Mon, 03 Nov 2025 01:55:10 GMT\r\nserver: LiteSpeed\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"LiteSpeed","description":"LiteSpeed is a high-scalability web server.","website":"https://litespeedtech.com","common_platform_enumeration":"cpe:2.3:a:litespeedtech:litespeed_web_server:*:*:*:*:*:*:*:*","icon":"LiteSpeed.svg","categories":["Web servers"]}],"data":{"size":1,"size_decoded":0,"mime_type":"text/html; charset=UTF-8","magic":"very short file (no magic)","md5":"cfcd208495d565ef66e7dff9f98764da","sha1":"b6589fc6ab0dc82cf12099d1c2d40ab994e8410c","sha256":"5feceb66ffc86f38d952786c6d696c79c2dbc239dd4e91b46729d73a27fb57e9","sha512":"31bca02094eb78126a517b206a88c73cfa9ec6f704c7030d18212cace820f025f00bf0ea68dbf3f3a5436ca63b53bf7bf80ad8d5de7d8359d0b7fed9dbc3ab99","ssdeep":"","tlshash":"c700000000000000c00000300000000000000000000000000000000000000000000000","first_seen":"2023-03-07T01:37:31Z","last_seen":"2026-08-05T00:06:45.34615Z","times_seen":118829,"resource_available":true,"data":null}},"time_used":186,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":186,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2025-11-02","alert":"Sinkholed","trigger":"worzen.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-11-03","alert":"Sinkholed","trigger":"worzen.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":[{"sensor_name":"urlquery","alert":"Phishing - Swisscom","verdict":"phishing","severity":"medium","comment":"Asset commenly seen with Swisscom phishing","tags":["swisscom","telecom","phishing"],"meta":null}]}},{"url":{"schema":"https","addr":"worzen.com/wp-includes/well/panel/update_statu.php","fqdn":"worzen.com","domain":"worzen.com","tld":"com"},"ip":{"addr":"192.250.235.25","port":443,"asn":204800,"as":"WHG Hosting Services Ltd","country":"Singapore","country_code":"SG"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"https://worzen.com/wp-includes/well/auth/login.php","date":"2025-11-03T01:55:04.461Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"webmail.worzen.com","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Tue, 14 Oct 2025 10:08:37 GMT","end":"Mon, 12 Jan 2026 10:08:36 GMT"},"fingerprint":{"sha1":"15:C0:AC:4A:51:D0:BE:A0:08:DC:FB:96:45:7B:68:BA:20:45:5B:9C","sha256":"8C:17:5F:35:DF:BE:62:F4:8F:41:17:C1:9F:E8:54:7E:17:B1:85:7A:3A:67:86:B9:81:41:9F:3F:B4:89:56:11"}}},"request":{"raw":"POST /wp-includes/well/panel/update_statu.php HTTP/1.1\r\nHost: worzen.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nContent-Type: application/x-www-form-urlencoded; charset=UTF-8\r\nX-Requested-With: XMLHttpRequest\r\nContent-Length: 24\r\nOrigin: https://worzen.com\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://worzen.com/wp-includes/well/auth/login.php\r\nCookie: PHPSESSID=154dab4c120945a18ea91af7c8dd9519\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"POST"},"response":{"raw":"HTTP/3 200 OK\r\ncontent-type: text/html; charset=UTF-8\r\ncache-control: public, max-age=0\r\nexpires: Mon, 03 Nov 2025 01:55:04 GMT\r\ncontent-length: 0\r\ndate: Mon, 03 Nov 2025 01:55:04 GMT\r\nserver: LiteSpeed\r\nvary: User-Agent\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"LiteSpeed","description":"LiteSpeed is a high-scalability web server.","website":"https://litespeedtech.com","common_platform_enumeration":"cpe:2.3:a:litespeedtech:litespeed_web_server:*:*:*:*:*:*:*:*","icon":"LiteSpeed.svg","categories":["Web servers"]}],"data":{"size":0,"size_decoded":0,"mime_type":"text/html; charset=UTF-8","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-08-04T23:58:22.456459Z","times_seen":17715369,"resource_available":true,"data":null}},"time_used":202,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":202,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2025-11-02","alert":"Sinkholed","trigger":"worzen.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-11-03","alert":"Sinkholed","trigger":"worzen.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":[{"sensor_name":"urlquery","alert":"Phishing - Swisscom","verdict":"phishing","severity":"medium","comment":"Asset commenly seen with Swisscom phishing","tags":["swisscom","telecom","phishing"],"meta":null}]}},{"url":{"schema":"https","addr":"worzen.com/wp-includes/well/panel/update_statu.php","fqdn":"worzen.com","domain":"worzen.com","tld":"com"},"ip":{"addr":"192.250.235.25","port":443,"asn":204800,"as":"WHG Hosting Services Ltd","country":"Singapore","country_code":"SG"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"https://worzen.com/wp-includes/well/auth/login.php","date":"2025-11-03T01:55:09.459Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"webmail.worzen.com","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Tue, 14 Oct 2025 10:08:37 GMT","end":"Mon, 12 Jan 2026 10:08:36 GMT"},"fingerprint":{"sha1":"15:C0:AC:4A:51:D0:BE:A0:08:DC:FB:96:45:7B:68:BA:20:45:5B:9C","sha256":"8C:17:5F:35:DF:BE:62:F4:8F:41:17:C1:9F:E8:54:7E:17:B1:85:7A:3A:67:86:B9:81:41:9F:3F:B4:89:56:11"}}},"request":{"raw":"POST /wp-includes/well/panel/update_statu.php HTTP/1.1\r\nHost: worzen.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nContent-Type: application/x-www-form-urlencoded; charset=UTF-8\r\nX-Requested-With: XMLHttpRequest\r\nContent-Length: 24\r\nOrigin: https://worzen.com\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://worzen.com/wp-includes/well/auth/login.php\r\nCookie: PHPSESSID=154dab4c120945a18ea91af7c8dd9519\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"POST"},"response":{"raw":"HTTP/3 200 OK\r\ncontent-type: text/html; charset=UTF-8\r\ncache-control: public, max-age=0\r\nexpires: Mon, 03 Nov 2025 01:55:09 GMT\r\ncontent-length: 0\r\ndate: Mon, 03 Nov 2025 01:55:09 GMT\r\nserver: LiteSpeed\r\nvary: User-Agent\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"LiteSpeed","description":"LiteSpeed is a high-scalability web server.","website":"https://litespeedtech.com","common_platform_enumeration":"cpe:2.3:a:litespeedtech:litespeed_web_server:*:*:*:*:*:*:*:*","icon":"LiteSpeed.svg","categories":["Web servers"]}],"data":{"size":0,"size_decoded":0,"mime_type":"text/html; charset=UTF-8","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-08-04T23:58:22.456459Z","times_seen":17715369,"resource_available":true,"data":null}},"time_used":188,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":188,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2025-11-02","alert":"Sinkholed","trigger":"worzen.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-11-03","alert":"Sinkholed","trigger":"worzen.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":[{"sensor_name":"urlquery","alert":"Phishing - Swisscom","verdict":"phishing","severity":"medium","comment":"Asset commenly seen with Swisscom phishing","tags":["swisscom","telecom","phishing"],"meta":null}]}},{"url":{"schema":"https","addr":"worzen.com/wp-includes/well/panel/update_statu.php","fqdn":"worzen.com","domain":"worzen.com","tld":"com"},"ip":{"addr":"192.250.235.25","port":443,"asn":204800,"as":"WHG Hosting Services Ltd","country":"Singapore","country_code":"SG"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"https://worzen.com/wp-includes/well/auth/login.php","date":"2025-11-03T01:55:11.463Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"webmail.worzen.com","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Tue, 14 Oct 2025 10:08:37 GMT","end":"Mon, 12 Jan 2026 10:08:36 GMT"},"fingerprint":{"sha1":"15:C0:AC:4A:51:D0:BE:A0:08:DC:FB:96:45:7B:68:BA:20:45:5B:9C","sha256":"8C:17:5F:35:DF:BE:62:F4:8F:41:17:C1:9F:E8:54:7E:17:B1:85:7A:3A:67:86:B9:81:41:9F:3F:B4:89:56:11"}}},"request":{"raw":"POST /wp-includes/well/panel/update_statu.php HTTP/1.1\r\nHost: worzen.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nContent-Type: application/x-www-form-urlencoded; charset=UTF-8\r\nX-Requested-With: XMLHttpRequest\r\nContent-Length: 24\r\nOrigin: https://worzen.com\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://worzen.com/wp-includes/well/auth/login.php\r\nCookie: PHPSESSID=154dab4c120945a18ea91af7c8dd9519\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"POST"},"response":{"raw":"HTTP/3 200 OK\r\ncontent-type: text/html; charset=UTF-8\r\ncache-control: public, max-age=0\r\nexpires: Mon, 03 Nov 2025 01:55:11 GMT\r\ncontent-length: 0\r\ndate: Mon, 03 Nov 2025 01:55:11 GMT\r\nserver: LiteSpeed\r\nvary: User-Agent\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"LiteSpeed","description":"LiteSpeed is a high-scalability web server.","website":"https://litespeedtech.com","common_platform_enumeration":"cpe:2.3:a:litespeedtech:litespeed_web_server:*:*:*:*:*:*:*:*","icon":"LiteSpeed.svg","categories":["Web servers"]}],"data":{"size":0,"size_decoded":0,"mime_type":"text/html; charset=UTF-8","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-08-04T23:58:22.456459Z","times_seen":17715369,"resource_available":true,"data":null}},"time_used":194,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":194,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2025-11-02","alert":"Sinkholed","trigger":"worzen.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-11-03","alert":"Sinkholed","trigger":"worzen.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":[{"sensor_name":"urlquery","alert":"Phishing - Swisscom","verdict":"phishing","severity":"medium","comment":"Asset commenly seen with Swisscom phishing","tags":["swisscom","telecom","phishing"],"meta":null}]}},{"url":{"schema":"https","addr":"worzen.com/wp-includes/well/panel/update_statu.php","fqdn":"worzen.com","domain":"worzen.com","tld":"com"},"ip":{"addr":"192.250.235.25","port":443,"asn":204800,"as":"WHG Hosting Services Ltd","country":"Singapore","country_code":"SG"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"https://worzen.com/wp-includes/well/auth/login.php","date":"2025-11-03T01:55:12.464Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"webmail.worzen.com","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Tue, 14 Oct 2025 10:08:37 GMT","end":"Mon, 12 Jan 2026 10:08:36 GMT"},"fingerprint":{"sha1":"15:C0:AC:4A:51:D0:BE:A0:08:DC:FB:96:45:7B:68:BA:20:45:5B:9C","sha256":"8C:17:5F:35:DF:BE:62:F4:8F:41:17:C1:9F:E8:54:7E:17:B1:85:7A:3A:67:86:B9:81:41:9F:3F:B4:89:56:11"}}},"request":{"raw":"POST /wp-includes/well/panel/update_statu.php HTTP/1.1\r\nHost: worzen.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nContent-Type: application/x-www-form-urlencoded; charset=UTF-8\r\nX-Requested-With: XMLHttpRequest\r\nContent-Length: 24\r\nOrigin: https://worzen.com\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://worzen.com/wp-includes/well/auth/login.php\r\nCookie: PHPSESSID=154dab4c120945a18ea91af7c8dd9519\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"POST"},"response":{"raw":"HTTP/3 200 OK\r\ncontent-type: text/html; charset=UTF-8\r\ncache-control: public, max-age=0\r\nexpires: Mon, 03 Nov 2025 01:55:12 GMT\r\ncontent-length: 0\r\ndate: Mon, 03 Nov 2025 01:55:12 GMT\r\nserver: LiteSpeed\r\nvary: User-Agent\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"LiteSpeed","description":"LiteSpeed is a high-scalability web server.","website":"https://litespeedtech.com","common_platform_enumeration":"cpe:2.3:a:litespeedtech:litespeed_web_server:*:*:*:*:*:*:*:*","icon":"LiteSpeed.svg","categories":["Web servers"]}],"data":{"size":0,"size_decoded":0,"mime_type":"text/html; charset=UTF-8","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-08-04T23:58:22.456459Z","times_seen":17715369,"resource_available":true,"data":null}},"time_used":184,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":184,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2025-11-02","alert":"Sinkholed","trigger":"worzen.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-11-03","alert":"Sinkholed","trigger":"worzen.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":[{"sensor_name":"urlquery","alert":"Phishing - Swisscom","verdict":"phishing","severity":"medium","comment":"Asset commenly seen with Swisscom phishing","tags":["swisscom","telecom","phishing"],"meta":null}]}},{"url":{"schema":"https","addr":"worzen.com/wp-includes/well/auth/res/logo.svg","fqdn":"worzen.com","domain":"worzen.com","tld":"com"},"ip":{"addr":"192.250.235.25","port":443,"asn":204800,"as":"WHG Hosting Services Ltd","country":"Singapore","country_code":"SG"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://worzen.com/wp-includes/well/auth/login.php","date":"2025-11-03T01:55:02.226Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"webmail.worzen.com","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Tue, 14 Oct 2025 10:08:37 GMT","end":"Mon, 12 Jan 2026 10:08:36 GMT"},"fingerprint":{"sha1":"15:C0:AC:4A:51:D0:BE:A0:08:DC:FB:96:45:7B:68:BA:20:45:5B:9C","sha256":"8C:17:5F:35:DF:BE:62:F4:8F:41:17:C1:9F:E8:54:7E:17:B1:85:7A:3A:67:86:B9:81:41:9F:3F:B4:89:56:11"}}},"request":{"raw":"GET /wp-includes/well/auth/res/logo.svg HTTP/1.1\r\nHost: worzen.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://worzen.com/wp-includes/well/auth/login.php\r\nCookie: PHPSESSID=154dab4c120945a18ea91af7c8dd9519\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ncache-control: public\r\nexpires: Tue, 03 Nov 2026 01:55:02 GMT\r\ncontent-type: image/svg+xml\r\nlast-modified: Sat, 17 May 2025 20:50:56 GMT\r\naccept-ranges: bytes\r\ncontent-encoding: br\r\nvary: Accept-Encoding,User-Agent\r\ncontent-length: 2475\r\ndate: Mon, 03 Nov 2025 01:55:02 GMT\r\nserver: LiteSpeed\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"LiteSpeed","description":"LiteSpeed is a high-scalability web server.","website":"https://litespeedtech.com","common_platform_enumeration":"cpe:2.3:a:litespeedtech:litespeed_web_server:*:*:*:*:*:*:*:*","icon":"LiteSpeed.svg","categories":["Web servers"]}],"data":{"size":6163,"size_decoded":0,"mime_type":"image/svg+xml","magic":"SVG Scalable Vector Graphics image","md5":"38be0de766af1aaa475f946c32b47944","sha1":"646ff2fae3c8080da7c067e6506f1a1193b9cfc8","sha256":"330fddfd254cb42deebdac50ccbc6d9988d365378457fae29dc10b3c2edb43e4","sha512":"20feebf7e0888ac048f0fbcd8c09c748df432ed946460c886dcdf89b49da98cc9a2af35116b3b28a0f30a1c0d3cae36856d2719dca35f97693aa2fa310c56bb2","ssdeep":"192:9D/pNzACPyEwZ+p5M3TFITYJxSWRRZblnPpl8FL:RpNzACPpK+v+OYJxSWRbblnPpGFL","tlshash":"e0d14fc7a314d3ade9c5d21def62d854a20f60fbf4a6c6c1999fcf4c5487882fa09a50","first_seen":"2023-05-10T17:52:44Z","last_seen":"2026-08-04T14:26:22.617641Z","times_seen":251,"resource_available":false,"data":null}},"time_used":179,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":179,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2025-11-02","alert":"Sinkholed","trigger":"worzen.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-11-03","alert":"Sinkholed","trigger":"worzen.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":[{"sensor_name":"urlquery","alert":"Phishing - Swisscom","verdict":"phishing","severity":"medium","comment":"Asset commenly seen with Swisscom phishing","tags":["swisscom","telecom","phishing"],"meta":null}]}},{"url":{"schema":"https","addr":"worzen.com/favicon.ico","fqdn":"worzen.com","domain":"worzen.com","tld":"com"},"ip":{"addr":"192.250.235.25","port":443,"asn":204800,"as":"WHG Hosting Services Ltd","country":"Singapore","country_code":"SG"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://worzen.com/wp-includes/well/auth/login.php","date":"2025-11-03T01:55:02.556Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"webmail.worzen.com","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Tue, 14 Oct 2025 10:08:37 GMT","end":"Mon, 12 Jan 2026 10:08:36 GMT"},"fingerprint":{"sha1":"15:C0:AC:4A:51:D0:BE:A0:08:DC:FB:96:45:7B:68:BA:20:45:5B:9C","sha256":"8C:17:5F:35:DF:BE:62:F4:8F:41:17:C1:9F:E8:54:7E:17:B1:85:7A:3A:67:86:B9:81:41:9F:3F:B4:89:56:11"}}},"request":{"raw":"GET /favicon.ico HTTP/1.1\r\nHost: worzen.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://worzen.com/wp-includes/well/auth/login.php\r\nCookie: PHPSESSID=154dab4c120945a18ea91af7c8dd9519\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 404 Not Found\r\ncache-control: private, no-cache, no-store, must-revalidate, max-age=0\r\npragma: no-cache\r\ncontent-type: text/html\r\ncontent-length: 1251\r\ndate: Mon, 03 Nov 2025 01:55:02 GMT\r\nserver: LiteSpeed\r\nvary: User-Agent\r\n\r\n","headers":null,"cookies":null,"status_code":"404","status_text":"Not Found","fingerprints":[{"name":"LiteSpeed","description":"LiteSpeed is a high-scalability web server.","website":"https://litespeedtech.com","common_platform_enumeration":"cpe:2.3:a:litespeedtech:litespeed_web_server:*:*:*:*:*:*:*:*","icon":"LiteSpeed.svg","categories":["Web servers"]}],"data":{"size":1251,"size_decoded":0,"mime_type":"text/html","magic":"HTML document, ASCII text, with CRLF, LF line terminators","md5":"8150f458ed6fb9b1db4e5cfa57a1a281","sha1":"6e5726854d28687b560d7fdcb5c782c425c7dfb9","sha256":"4c13d452dd5d49671bd93ca32f2b4f85c78e39b6ab0ad1f38d98ed267f8fd896","sha512":"4cc6a112673aef8bb8bb8a385c26791b805d43bb707b509880e894f1c83bab4e16f13de187036c5f660c3bec1d286258396b7bde65c5d7945c5019665196818c","ssdeep":"","tlshash":"c021353ec1c1560ae0271164fbc1f7a86669825291970f703b9eb176f6cd0bb56a36c8","first_seen":"2024-02-08T16:48:55Z","last_seen":"2026-08-04T23:59:30.021733Z","times_seen":145772,"resource_available":true,"data":null}},"time_used":180,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":180,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2025-11-02","alert":"Sinkholed","trigger":"worzen.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-11-03","alert":"Sinkholed","trigger":"worzen.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":[{"sensor_name":"urlquery","alert":"Phishing - Swisscom","verdict":"phishing","severity":"medium","comment":"Asset commenly seen with Swisscom phishing","tags":["swisscom","telecom","phishing"],"meta":null}]}},{"url":{"schema":"https","addr":"worzen.com/wp-includes/well/panel/update_statu.php","fqdn":"worzen.com","domain":"worzen.com","tld":"com"},"ip":{"addr":"192.250.235.25","port":443,"asn":204800,"as":"WHG Hosting Services Ltd","country":"Singapore","country_code":"SG"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"https://worzen.com/wp-includes/well/auth/login.php","date":"2025-11-03T01:55:05.458Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"webmail.worzen.com","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Tue, 14 Oct 2025 10:08:37 GMT","end":"Mon, 12 Jan 2026 10:08:36 GMT"},"fingerprint":{"sha1":"15:C0:AC:4A:51:D0:BE:A0:08:DC:FB:96:45:7B:68:BA:20:45:5B:9C","sha256":"8C:17:5F:35:DF:BE:62:F4:8F:41:17:C1:9F:E8:54:7E:17:B1:85:7A:3A:67:86:B9:81:41:9F:3F:B4:89:56:11"}}},"request":{"raw":"POST /wp-includes/well/panel/update_statu.php HTTP/1.1\r\nHost: worzen.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nContent-Type: application/x-www-form-urlencoded; charset=UTF-8\r\nX-Requested-With: XMLHttpRequest\r\nContent-Length: 24\r\nOrigin: https://worzen.com\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://worzen.com/wp-includes/well/auth/login.php\r\nCookie: PHPSESSID=154dab4c120945a18ea91af7c8dd9519\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"POST"},"response":{"raw":"HTTP/3 200 OK\r\ncontent-type: text/html; charset=UTF-8\r\ncache-control: public, max-age=0\r\nexpires: Mon, 03 Nov 2025 01:55:05 GMT\r\ncontent-length: 0\r\ndate: Mon, 03 Nov 2025 01:55:05 GMT\r\nserver: LiteSpeed\r\nvary: User-Agent\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"LiteSpeed","description":"LiteSpeed is a high-scalability web server.","website":"https://litespeedtech.com","common_platform_enumeration":"cpe:2.3:a:litespeedtech:litespeed_web_server:*:*:*:*:*:*:*:*","icon":"LiteSpeed.svg","categories":["Web servers"]}],"data":{"size":0,"size_decoded":0,"mime_type":"text/html; charset=UTF-8","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-08-04T23:58:22.456459Z","times_seen":17715369,"resource_available":true,"data":null}},"time_used":239,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":239,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2025-11-02","alert":"Sinkholed","trigger":"worzen.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-11-03","alert":"Sinkholed","trigger":"worzen.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":[{"sensor_name":"urlquery","alert":"Phishing - Swisscom","verdict":"phishing","severity":"medium","comment":"Asset commenly seen with Swisscom phishing","tags":["swisscom","telecom","phishing"],"meta":null}]}},{"url":{"schema":"https","addr":"worzen.com/wp-includes/well/auth/res/app.css","fqdn":"worzen.com","domain":"worzen.com","tld":"com"},"ip":{"addr":"192.250.235.25","port":443,"asn":204800,"as":"WHG Hosting Services Ltd","country":"Singapore","country_code":"SG"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://worzen.com/wp-includes/well/auth/login.php","date":"2025-11-03T01:55:02.225Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"webmail.worzen.com","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Tue, 14 Oct 2025 10:08:37 GMT","end":"Mon, 12 Jan 2026 10:08:36 GMT"},"fingerprint":{"sha1":"15:C0:AC:4A:51:D0:BE:A0:08:DC:FB:96:45:7B:68:BA:20:45:5B:9C","sha256":"8C:17:5F:35:DF:BE:62:F4:8F:41:17:C1:9F:E8:54:7E:17:B1:85:7A:3A:67:86:B9:81:41:9F:3F:B4:89:56:11"}}},"request":{"raw":"GET /wp-includes/well/auth/res/app.css HTTP/1.1\r\nHost: worzen.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://worzen.com/wp-includes/well/auth/login.php\r\nCookie: PHPSESSID=154dab4c120945a18ea91af7c8dd9519\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ncache-control: public\r\nexpires: Tue, 03 Nov 2026 01:55:02 GMT\r\ncontent-type: text/css\r\nlast-modified: Tue, 20 May 2025 07:05:46 GMT\r\naccept-ranges: bytes\r\ncontent-encoding: br\r\nvary: Accept-Encoding,User-Agent\r\ncontent-length: 647\r\ndate: Mon, 03 Nov 2025 01:55:02 GMT\r\nserver: LiteSpeed\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"LiteSpeed","description":"LiteSpeed is a high-scalability web server.","website":"https://litespeedtech.com","common_platform_enumeration":"cpe:2.3:a:litespeedtech:litespeed_web_server:*:*:*:*:*:*:*:*","icon":"LiteSpeed.svg","categories":["Web servers"]}],"data":{"size":1982,"size_decoded":0,"mime_type":"text/css","magic":"assembler source, ASCII text, with CRLF line terminators","md5":"67f401a1e1df62395f354e3d87ff46b3","sha1":"6efb43d61bcc197e6318bf4334684e369f6bd1c9","sha256":"a0a932f2ef7c345c11c4668e01a711fb602a177c7c20506106f5e26e05ce60c3","sha512":"7666d4aecb6111eda395697c0946ac6a61057b4bd66c1828d7e8546b445470427edc66595eb117789b2a956a159a0d2ac05283b8e71045605333dbb87824123b","ssdeep":"","tlshash":"fd41aba9e716560a6236cc58abb205d9ea985007cb03476e7fd5b3a0dff153582a0f8c","first_seen":"2025-11-02T20:50:24.089643Z","last_seen":"2026-07-04T10:09:04.262036Z","times_seen":20,"resource_available":false,"data":null}},"time_used":179,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":179,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2025-11-02","alert":"Sinkholed","trigger":"worzen.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-11-03","alert":"Sinkholed","trigger":"worzen.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":[{"sensor_name":"urlquery","alert":"Phishing - Swisscom","verdict":"phishing","severity":"medium","comment":"Asset commenly seen with Swisscom phishing","tags":["swisscom","telecom","phishing"],"meta":null}]}},{"url":{"schema":"https","addr":"worzen.com/wp-includes/well/panel/fetch.php","fqdn":"worzen.com","domain":"worzen.com","tld":"com"},"ip":{"addr":"192.250.235.25","port":443,"asn":204800,"as":"WHG Hosting Services Ltd","country":"Singapore","country_code":"SG"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"https://worzen.com/wp-includes/well/auth/login.php","date":"2025-11-03T01:55:04.457Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"webmail.worzen.com","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Tue, 14 Oct 2025 10:08:37 GMT","end":"Mon, 12 Jan 2026 10:08:36 GMT"},"fingerprint":{"sha1":"15:C0:AC:4A:51:D0:BE:A0:08:DC:FB:96:45:7B:68:BA:20:45:5B:9C","sha256":"8C:17:5F:35:DF:BE:62:F4:8F:41:17:C1:9F:E8:54:7E:17:B1:85:7A:3A:67:86:B9:81:41:9F:3F:B4:89:56:11"}}},"request":{"raw":"POST /wp-includes/well/panel/fetch.php HTTP/1.1\r\nHost: worzen.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nContent-Type: application/x-www-form-urlencoded; charset=UTF-8\r\nX-Requested-With: XMLHttpRequest\r\nContent-Length: 8\r\nOrigin: https://worzen.com\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://worzen.com/wp-includes/well/auth/login.php\r\nCookie: PHPSESSID=154dab4c120945a18ea91af7c8dd9519\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"POST"},"response":{"raw":"HTTP/3 200 OK\r\ncontent-type: text/html; charset=UTF-8\r\ncache-control: public, max-age=0\r\nexpires: Mon, 03 Nov 2025 01:55:04 GMT\r\ncontent-length: 5\r\ncontent-encoding: br\r\nvary: Accept-Encoding,User-Agent\r\ndate: Mon, 03 Nov 2025 01:55:04 GMT\r\nserver: LiteSpeed\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"LiteSpeed","description":"LiteSpeed is a high-scalability web server.","website":"https://litespeedtech.com","common_platform_enumeration":"cpe:2.3:a:litespeedtech:litespeed_web_server:*:*:*:*:*:*:*:*","icon":"LiteSpeed.svg","categories":["Web servers"]}],"data":{"size":1,"size_decoded":0,"mime_type":"text/html; charset=UTF-8","magic":"very short file (no magic)","md5":"cfcd208495d565ef66e7dff9f98764da","sha1":"b6589fc6ab0dc82cf12099d1c2d40ab994e8410c","sha256":"5feceb66ffc86f38d952786c6d696c79c2dbc239dd4e91b46729d73a27fb57e9","sha512":"31bca02094eb78126a517b206a88c73cfa9ec6f704c7030d18212cace820f025f00bf0ea68dbf3f3a5436ca63b53bf7bf80ad8d5de7d8359d0b7fed9dbc3ab99","ssdeep":"","tlshash":"c700000000000000c00000300000000000000000000000000000000000000000000000","first_seen":"2023-03-07T01:37:31Z","last_seen":"2026-08-05T00:06:45.34615Z","times_seen":118829,"resource_available":true,"data":null}},"time_used":206,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":206,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2025-11-02","alert":"Sinkholed","trigger":"worzen.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-11-03","alert":"Sinkholed","trigger":"worzen.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":[{"sensor_name":"urlquery","alert":"Phishing - Swisscom","verdict":"phishing","severity":"medium","comment":"Asset commenly seen with Swisscom phishing","tags":["swisscom","telecom","phishing"],"meta":null}]}},{"url":{"schema":"https","addr":"worzen.com/wp-includes/well/panel/fetch.php","fqdn":"worzen.com","domain":"worzen.com","tld":"com"},"ip":{"addr":"192.250.235.25","port":443,"asn":204800,"as":"WHG Hosting Services Ltd","country":"Singapore","country_code":"SG"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"https://worzen.com/wp-includes/well/auth/login.php","date":"2025-11-03T01:55:06.457Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"webmail.worzen.com","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Tue, 14 Oct 2025 10:08:37 GMT","end":"Mon, 12 Jan 2026 10:08:36 GMT"},"fingerprint":{"sha1":"15:C0:AC:4A:51:D0:BE:A0:08:DC:FB:96:45:7B:68:BA:20:45:5B:9C","sha256":"8C:17:5F:35:DF:BE:62:F4:8F:41:17:C1:9F:E8:54:7E:17:B1:85:7A:3A:67:86:B9:81:41:9F:3F:B4:89:56:11"}}},"request":{"raw":"POST /wp-includes/well/panel/fetch.php HTTP/1.1\r\nHost: worzen.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nContent-Type: application/x-www-form-urlencoded; charset=UTF-8\r\nX-Requested-With: XMLHttpRequest\r\nContent-Length: 8\r\nOrigin: https://worzen.com\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://worzen.com/wp-includes/well/auth/login.php\r\nCookie: PHPSESSID=154dab4c120945a18ea91af7c8dd9519\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"POST"},"response":{"raw":"HTTP/3 200 OK\r\ncontent-type: text/html; charset=UTF-8\r\ncache-control: public, max-age=0\r\nexpires: Mon, 03 Nov 2025 01:55:06 GMT\r\ncontent-length: 5\r\ncontent-encoding: br\r\nvary: Accept-Encoding,User-Agent\r\ndate: Mon, 03 Nov 2025 01:55:06 GMT\r\nserver: LiteSpeed\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"LiteSpeed","description":"LiteSpeed is a high-scalability web server.","website":"https://litespeedtech.com","common_platform_enumeration":"cpe:2.3:a:litespeedtech:litespeed_web_server:*:*:*:*:*:*:*:*","icon":"LiteSpeed.svg","categories":["Web servers"]}],"data":{"size":1,"size_decoded":0,"mime_type":"text/html; charset=UTF-8","magic":"very short file (no magic)","md5":"cfcd208495d565ef66e7dff9f98764da","sha1":"b6589fc6ab0dc82cf12099d1c2d40ab994e8410c","sha256":"5feceb66ffc86f38d952786c6d696c79c2dbc239dd4e91b46729d73a27fb57e9","sha512":"31bca02094eb78126a517b206a88c73cfa9ec6f704c7030d18212cace820f025f00bf0ea68dbf3f3a5436ca63b53bf7bf80ad8d5de7d8359d0b7fed9dbc3ab99","ssdeep":"","tlshash":"c700000000000000c00000300000000000000000000000000000000000000000000000","first_seen":"2023-03-07T01:37:31Z","last_seen":"2026-08-05T00:06:45.34615Z","times_seen":118829,"resource_available":true,"data":null}},"time_used":187,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":187,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2025-11-02","alert":"Sinkholed","trigger":"worzen.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-11-03","alert":"Sinkholed","trigger":"worzen.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":[{"sensor_name":"urlquery","alert":"Phishing - Swisscom","verdict":"phishing","severity":"medium","comment":"Asset commenly seen with Swisscom phishing","tags":["swisscom","telecom","phishing"],"meta":null}]}},{"url":{"schema":"https","addr":"worzen.com/wp-includes/well/panel/update_statu.php","fqdn":"worzen.com","domain":"worzen.com","tld":"com"},"ip":{"addr":"192.250.235.25","port":443,"asn":204800,"as":"WHG Hosting Services Ltd","country":"Singapore","country_code":"SG"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"https://worzen.com/wp-includes/well/auth/login.php","date":"2025-11-03T01:55:10.467Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"webmail.worzen.com","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Tue, 14 Oct 2025 10:08:37 GMT","end":"Mon, 12 Jan 2026 10:08:36 GMT"},"fingerprint":{"sha1":"15:C0:AC:4A:51:D0:BE:A0:08:DC:FB:96:45:7B:68:BA:20:45:5B:9C","sha256":"8C:17:5F:35:DF:BE:62:F4:8F:41:17:C1:9F:E8:54:7E:17:B1:85:7A:3A:67:86:B9:81:41:9F:3F:B4:89:56:11"}}},"request":{"raw":"POST /wp-includes/well/panel/update_statu.php HTTP/1.1\r\nHost: worzen.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nContent-Type: application/x-www-form-urlencoded; charset=UTF-8\r\nX-Requested-With: XMLHttpRequest\r\nContent-Length: 24\r\nOrigin: https://worzen.com\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://worzen.com/wp-includes/well/auth/login.php\r\nCookie: PHPSESSID=154dab4c120945a18ea91af7c8dd9519\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"POST"},"response":{"raw":"HTTP/3 200 OK\r\ncontent-type: text/html; charset=UTF-8\r\ncache-control: public, max-age=0\r\nexpires: Mon, 03 Nov 2025 01:55:10 GMT\r\ncontent-length: 0\r\ndate: Mon, 03 Nov 2025 01:55:10 GMT\r\nserver: LiteSpeed\r\nvary: User-Agent\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"LiteSpeed","description":"LiteSpeed is a high-scalability web server.","website":"https://litespeedtech.com","common_platform_enumeration":"cpe:2.3:a:litespeedtech:litespeed_web_server:*:*:*:*:*:*:*:*","icon":"LiteSpeed.svg","categories":["Web servers"]}],"data":{"size":0,"size_decoded":0,"mime_type":"text/html; charset=UTF-8","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-08-04T23:58:22.456459Z","times_seen":17715369,"resource_available":true,"data":null}},"time_used":187,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":187,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2025-11-02","alert":"Sinkholed","trigger":"worzen.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-11-03","alert":"Sinkholed","trigger":"worzen.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":[{"sensor_name":"urlquery","alert":"Phishing - Swisscom","verdict":"phishing","severity":"medium","comment":"Asset commenly seen with Swisscom phishing","tags":["swisscom","telecom","phishing"],"meta":null}]}},{"url":{"schema":"https","addr":"worzen.com/wp-includes/well/panel/fetch.php","fqdn":"worzen.com","domain":"worzen.com","tld":"com"},"ip":{"addr":"192.250.235.25","port":443,"asn":204800,"as":"WHG Hosting Services Ltd","country":"Singapore","country_code":"SG"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"https://worzen.com/wp-includes/well/auth/login.php","date":"2025-11-03T01:55:18.459Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"webmail.worzen.com","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Tue, 14 Oct 2025 10:08:37 GMT","end":"Mon, 12 Jan 2026 10:08:36 GMT"},"fingerprint":{"sha1":"15:C0:AC:4A:51:D0:BE:A0:08:DC:FB:96:45:7B:68:BA:20:45:5B:9C","sha256":"8C:17:5F:35:DF:BE:62:F4:8F:41:17:C1:9F:E8:54:7E:17:B1:85:7A:3A:67:86:B9:81:41:9F:3F:B4:89:56:11"}}},"request":{"raw":"POST /wp-includes/well/panel/fetch.php HTTP/1.1\r\nHost: worzen.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nContent-Type: application/x-www-form-urlencoded; charset=UTF-8\r\nX-Requested-With: XMLHttpRequest\r\nContent-Length: 8\r\nOrigin: https://worzen.com\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://worzen.com/wp-includes/well/auth/login.php\r\nCookie: PHPSESSID=154dab4c120945a18ea91af7c8dd9519\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"POST"},"response":{"raw":"HTTP/3 200 OK\r\ncontent-type: text/html; charset=UTF-8\r\ncache-control: public, max-age=0\r\nexpires: Mon, 03 Nov 2025 01:55:18 GMT\r\ncontent-length: 5\r\ncontent-encoding: br\r\nvary: Accept-Encoding,User-Agent\r\ndate: Mon, 03 Nov 2025 01:55:18 GMT\r\nserver: LiteSpeed\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"LiteSpeed","description":"LiteSpeed is a high-scalability web server.","website":"https://litespeedtech.com","common_platform_enumeration":"cpe:2.3:a:litespeedtech:litespeed_web_server:*:*:*:*:*:*:*:*","icon":"LiteSpeed.svg","categories":["Web servers"]}],"data":{"size":1,"size_decoded":0,"mime_type":"text/html; charset=UTF-8","magic":"very short file (no magic)","md5":"cfcd208495d565ef66e7dff9f98764da","sha1":"b6589fc6ab0dc82cf12099d1c2d40ab994e8410c","sha256":"5feceb66ffc86f38d952786c6d696c79c2dbc239dd4e91b46729d73a27fb57e9","sha512":"31bca02094eb78126a517b206a88c73cfa9ec6f704c7030d18212cace820f025f00bf0ea68dbf3f3a5436ca63b53bf7bf80ad8d5de7d8359d0b7fed9dbc3ab99","ssdeep":"","tlshash":"c700000000000000c00000300000000000000000000000000000000000000000000000","first_seen":"2023-03-07T01:37:31Z","last_seen":"2026-08-05T00:06:45.34615Z","times_seen":118829,"resource_available":true,"data":null}},"time_used":187,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":187,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2025-11-02","alert":"Sinkholed","trigger":"worzen.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-11-03","alert":"Sinkholed","trigger":"worzen.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":[{"sensor_name":"urlquery","alert":"Phishing - Swisscom","verdict":"phishing","severity":"medium","comment":"Asset commenly seen with Swisscom phishing","tags":["swisscom","telecom","phishing"],"meta":null}]}},{"url":{"schema":"https","addr":"cdnjs.cloudflare.com/ajax/libs/jquery/3.7.1/jquery.min.js","fqdn":"cdnjs.cloudflare.com","domain":"cloudflare.com","tld":"com"},"ip":{"addr":"104.17.24.14","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://worzen.com/wp-includes/well/auth/login.php","date":"2025-11-03T01:55:02.229Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"cdnjs.cloudflare.com","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Wed, 17 Sep 2025 19:09:23 GMT","end":"Tue, 16 Dec 2025 20:08:48 GMT"},"fingerprint":{"sha1":"E5:FA:6E:21:DA:AB:92:8F:E0:CB:31:C2:87:D4:E2:CE:9F:23:BF:C1","sha256":"E8:C7:D4:A8:29:E6:45:C0:C5:E3:AD:6A:90:36:30:4A:D7:2E:7C:F7:8F:57:44:E8:3B:2D:AF:F6:80:F7:4B:46"}}},"request":{"raw":"GET /ajax/libs/jquery/3.7.1/jquery.min.js HTTP/1.1\r\nHost: cdnjs.cloudflare.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://worzen.com/\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ndate: Mon, 03 Nov 2025 01:55:02 GMT\r\ncontent-type: application/javascript; charset=utf-8\r\ncontent-length: 27446\r\ncf-ray: 99883f430c3f2678-OSL\r\naccess-control-allow-origin: *\r\ncache-control: public, max-age=30672000\r\ncontent-encoding: br\r\netag: \"64ed75bb-6b36\"\r\nlast-modified: Tue, 29 Aug 2023 04:36:11 GMT\r\ncf-cdnjs-via: cfworker/kv\r\ncross-origin-resource-policy: cross-origin\r\ntiming-allow-origin: *\r\nx-content-type-options: nosniff\r\nvary: Accept-Encoding\r\ncf-cache-status: HIT\r\nage: 531741\r\nexpires: Sat, 24 Oct 2026 01:55:02 GMT\r\naccept-ranges: bytes\r\nreport-to: {\"endpoints\":[{\"url\":\"https:\\/\\/a.nel.cloudflare.com\\/report\\/v4?s=3D3UAerNx2gKNdc42dBhS1%2BN4rdAdPk%2Bh%2BYag9%2Bt5w220ivHiz3W3N5BMC5SitandjdxjDYcQNBTU%2FdztnjYyIp4zI3rBpbRy2XzVMKRQVkp9bn4Cl5BKE7SYay8cgXv6pfIcDGH\"}],\"group\":\"cf-nel\",\"max_age\":604800}\r\nnel: {\"success_fraction\":0.01,\"report_to\":\"cf-nel\",\"max_age\":604800}\r\nstrict-transport-security: max-age=15780000\r\nserver: cloudflare\r\nalt-svc: h3=\":443\"; ma=86400\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":87533,"size_decoded":0,"mime_type":"application/javascript; charset=utf-8","magic":"JavaScript source, ASCII text, with very long lines (65447)","md5":"2c872dbe60f4ba70fb85356113d8b35e","sha1":"ee48592d1fff952fcf06ce0b666ed4785493afdc","sha256":"fc9a93dd241f6b045cbff0481cf4e1901becd0e12fb45166a8f17f95823f0b1a","sha512":"bf6089ed4698cb8270a8b0c8ad9508ff886a7a842278e98064d5c1790ca3a36d5d69d9f047ef196882554fc104da2c88eb5395f1ee8cf0f3f6ff8869408350fe","ssdeep":"1536:0RUX9uDgwxcy2KVBNwchN6SLaHEk2BSrBESp+a/IEk4aAocVi8SMBQ47GKr:sHNwcv9VBQpLl88SMBQ47GKr","tlshash":"3983f8df77ca702247ab30b9006f550bf276199d684d4400f159d8e9bcb8a4a827bf7e","first_seen":"2023-08-31T16:03:19Z","last_seen":"2026-08-04T23:50:02.178024Z","times_seen":183918,"resource_available":true,"data":null}},"time_used":48,"timings":{"blocked":14,"dns":0,"connect":1,"send":0,"wait":11,"receive":4,"ssl":15},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"worzen.com/wp-includes/well/panel/update_statu.php","fqdn":"worzen.com","domain":"worzen.com","tld":"com"},"ip":{"addr":"192.250.235.25","port":443,"asn":204800,"as":"WHG Hosting Services Ltd","country":"Singapore","country_code":"SG"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"https://worzen.com/wp-includes/well/auth/login.php","date":"2025-11-03T01:55:06.461Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"webmail.worzen.com","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Tue, 14 Oct 2025 10:08:37 GMT","end":"Mon, 12 Jan 2026 10:08:36 GMT"},"fingerprint":{"sha1":"15:C0:AC:4A:51:D0:BE:A0:08:DC:FB:96:45:7B:68:BA:20:45:5B:9C","sha256":"8C:17:5F:35:DF:BE:62:F4:8F:41:17:C1:9F:E8:54:7E:17:B1:85:7A:3A:67:86:B9:81:41:9F:3F:B4:89:56:11"}}},"request":{"raw":"POST /wp-includes/well/panel/update_statu.php HTTP/1.1\r\nHost: worzen.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nContent-Type: application/x-www-form-urlencoded; charset=UTF-8\r\nX-Requested-With: XMLHttpRequest\r\nContent-Length: 24\r\nOrigin: https://worzen.com\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://worzen.com/wp-includes/well/auth/login.php\r\nCookie: PHPSESSID=154dab4c120945a18ea91af7c8dd9519\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"POST"},"response":{"raw":"HTTP/3 200 OK\r\ncontent-type: text/html; charset=UTF-8\r\ncache-control: public, max-age=0\r\nexpires: Mon, 03 Nov 2025 01:55:06 GMT\r\ncontent-length: 0\r\ndate: Mon, 03 Nov 2025 01:55:06 GMT\r\nserver: LiteSpeed\r\nvary: User-Agent\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"LiteSpeed","description":"LiteSpeed is a high-scalability web server.","website":"https://litespeedtech.com","common_platform_enumeration":"cpe:2.3:a:litespeedtech:litespeed_web_server:*:*:*:*:*:*:*:*","icon":"LiteSpeed.svg","categories":["Web servers"]}],"data":{"size":0,"size_decoded":0,"mime_type":"text/html; charset=UTF-8","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-08-04T23:58:22.456459Z","times_seen":17715369,"resource_available":true,"data":null}},"time_used":190,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":190,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2025-11-02","alert":"Sinkholed","trigger":"worzen.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-11-03","alert":"Sinkholed","trigger":"worzen.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":[{"sensor_name":"urlquery","alert":"Phishing - Swisscom","verdict":"phishing","severity":"medium","comment":"Asset commenly seen with Swisscom phishing","tags":["swisscom","telecom","phishing"],"meta":null}]}},{"url":{"schema":"https","addr":"worzen.com/wp-includes/well/panel/fetch.php","fqdn":"worzen.com","domain":"worzen.com","tld":"com"},"ip":{"addr":"192.250.235.25","port":443,"asn":204800,"as":"WHG Hosting Services Ltd","country":"Singapore","country_code":"SG"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"https://worzen.com/wp-includes/well/auth/login.php","date":"2025-11-03T01:55:14.459Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"webmail.worzen.com","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Tue, 14 Oct 2025 10:08:37 GMT","end":"Mon, 12 Jan 2026 10:08:36 GMT"},"fingerprint":{"sha1":"15:C0:AC:4A:51:D0:BE:A0:08:DC:FB:96:45:7B:68:BA:20:45:5B:9C","sha256":"8C:17:5F:35:DF:BE:62:F4:8F:41:17:C1:9F:E8:54:7E:17:B1:85:7A:3A:67:86:B9:81:41:9F:3F:B4:89:56:11"}}},"request":{"raw":"POST /wp-includes/well/panel/fetch.php HTTP/1.1\r\nHost: worzen.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nContent-Type: application/x-www-form-urlencoded; charset=UTF-8\r\nX-Requested-With: XMLHttpRequest\r\nContent-Length: 8\r\nOrigin: https://worzen.com\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://worzen.com/wp-includes/well/auth/login.php\r\nCookie: PHPSESSID=154dab4c120945a18ea91af7c8dd9519\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"POST"},"response":{"raw":"HTTP/3 200 OK\r\ncontent-type: text/html; charset=UTF-8\r\ncache-control: public, max-age=0\r\nexpires: Mon, 03 Nov 2025 01:55:14 GMT\r\ncontent-length: 5\r\ncontent-encoding: br\r\nvary: Accept-Encoding,User-Agent\r\ndate: Mon, 03 Nov 2025 01:55:14 GMT\r\nserver: LiteSpeed\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"LiteSpeed","description":"LiteSpeed is a high-scalability web server.","website":"https://litespeedtech.com","common_platform_enumeration":"cpe:2.3:a:litespeedtech:litespeed_web_server:*:*:*:*:*:*:*:*","icon":"LiteSpeed.svg","categories":["Web servers"]}],"data":{"size":1,"size_decoded":0,"mime_type":"text/html; charset=UTF-8","magic":"very short file (no magic)","md5":"cfcd208495d565ef66e7dff9f98764da","sha1":"b6589fc6ab0dc82cf12099d1c2d40ab994e8410c","sha256":"5feceb66ffc86f38d952786c6d696c79c2dbc239dd4e91b46729d73a27fb57e9","sha512":"31bca02094eb78126a517b206a88c73cfa9ec6f704c7030d18212cace820f025f00bf0ea68dbf3f3a5436ca63b53bf7bf80ad8d5de7d8359d0b7fed9dbc3ab99","ssdeep":"","tlshash":"c700000000000000c00000300000000000000000000000000000000000000000000000","first_seen":"2023-03-07T01:37:31Z","last_seen":"2026-08-05T00:06:45.34615Z","times_seen":118829,"resource_available":true,"data":null}},"time_used":188,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":188,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2025-11-02","alert":"Sinkholed","trigger":"worzen.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-11-03","alert":"Sinkholed","trigger":"worzen.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":[{"sensor_name":"urlquery","alert":"Phishing - Swisscom","verdict":"phishing","severity":"medium","comment":"Asset commenly seen with Swisscom phishing","tags":["swisscom","telecom","phishing"],"meta":null}]}},{"url":{"schema":"https","addr":"worzen.com/wp-includes/well/panel/update_statu.php","fqdn":"worzen.com","domain":"worzen.com","tld":"com"},"ip":{"addr":"192.250.235.25","port":443,"asn":204800,"as":"WHG Hosting Services Ltd","country":"Singapore","country_code":"SG"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"https://worzen.com/wp-includes/well/auth/login.php","date":"2025-11-03T01:55:17.463Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"webmail.worzen.com","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Tue, 14 Oct 2025 10:08:37 GMT","end":"Mon, 12 Jan 2026 10:08:36 GMT"},"fingerprint":{"sha1":"15:C0:AC:4A:51:D0:BE:A0:08:DC:FB:96:45:7B:68:BA:20:45:5B:9C","sha256":"8C:17:5F:35:DF:BE:62:F4:8F:41:17:C1:9F:E8:54:7E:17:B1:85:7A:3A:67:86:B9:81:41:9F:3F:B4:89:56:11"}}},"request":{"raw":"POST /wp-includes/well/panel/update_statu.php HTTP/1.1\r\nHost: worzen.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nContent-Type: application/x-www-form-urlencoded; charset=UTF-8\r\nX-Requested-With: XMLHttpRequest\r\nContent-Length: 24\r\nOrigin: https://worzen.com\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://worzen.com/wp-includes/well/auth/login.php\r\nCookie: PHPSESSID=154dab4c120945a18ea91af7c8dd9519\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"POST"},"response":{"raw":"HTTP/3 200 OK\r\ncontent-type: text/html; charset=UTF-8\r\ncache-control: public, max-age=0\r\nexpires: Mon, 03 Nov 2025 01:55:17 GMT\r\ncontent-length: 0\r\ndate: Mon, 03 Nov 2025 01:55:17 GMT\r\nserver: LiteSpeed\r\nvary: User-Agent\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"LiteSpeed","description":"LiteSpeed is a high-scalability web server.","website":"https://litespeedtech.com","common_platform_enumeration":"cpe:2.3:a:litespeedtech:litespeed_web_server:*:*:*:*:*:*:*:*","icon":"LiteSpeed.svg","categories":["Web servers"]}],"data":{"size":0,"size_decoded":0,"mime_type":"text/html; charset=UTF-8","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-08-04T23:58:22.456459Z","times_seen":17715369,"resource_available":true,"data":null}},"time_used":186,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":186,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2025-11-02","alert":"Sinkholed","trigger":"worzen.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-11-03","alert":"Sinkholed","trigger":"worzen.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":[{"sensor_name":"urlquery","alert":"Phishing - Swisscom","verdict":"phishing","severity":"medium","comment":"Asset commenly seen with Swisscom phishing","tags":["swisscom","telecom","phishing"],"meta":null}]}},{"url":{"schema":"https","addr":"worzen.com/wp-includes/well/panel/update_statu.php","fqdn":"worzen.com","domain":"worzen.com","tld":"com"},"ip":{"addr":"192.250.235.25","port":443,"asn":204800,"as":"WHG Hosting Services Ltd","country":"Singapore","country_code":"SG"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"https://worzen.com/wp-includes/well/auth/login.php","date":"2025-11-03T01:55:21.463Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"webmail.worzen.com","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Tue, 14 Oct 2025 10:08:37 GMT","end":"Mon, 12 Jan 2026 10:08:36 GMT"},"fingerprint":{"sha1":"15:C0:AC:4A:51:D0:BE:A0:08:DC:FB:96:45:7B:68:BA:20:45:5B:9C","sha256":"8C:17:5F:35:DF:BE:62:F4:8F:41:17:C1:9F:E8:54:7E:17:B1:85:7A:3A:67:86:B9:81:41:9F:3F:B4:89:56:11"}}},"request":{"raw":"POST /wp-includes/well/panel/update_statu.php HTTP/1.1\r\nHost: worzen.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nContent-Type: application/x-www-form-urlencoded; charset=UTF-8\r\nX-Requested-With: XMLHttpRequest\r\nContent-Length: 24\r\nOrigin: https://worzen.com\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://worzen.com/wp-includes/well/auth/login.php\r\nCookie: PHPSESSID=154dab4c120945a18ea91af7c8dd9519\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"POST"},"response":{"raw":"HTTP/3 200 OK\r\ncontent-type: text/html; charset=UTF-8\r\ncache-control: public, max-age=0\r\nexpires: Mon, 03 Nov 2025 01:55:21 GMT\r\ncontent-length: 0\r\ndate: Mon, 03 Nov 2025 01:55:21 GMT\r\nserver: LiteSpeed\r\nvary: User-Agent\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"LiteSpeed","description":"LiteSpeed is a high-scalability web server.","website":"https://litespeedtech.com","common_platform_enumeration":"cpe:2.3:a:litespeedtech:litespeed_web_server:*:*:*:*:*:*:*:*","icon":"LiteSpeed.svg","categories":["Web servers"]}],"data":{"size":0,"size_decoded":0,"mime_type":"text/html; charset=UTF-8","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-08-04T23:58:22.456459Z","times_seen":17715369,"resource_available":true,"data":null}},"time_used":187,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":187,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2025-11-02","alert":"Sinkholed","trigger":"worzen.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-11-03","alert":"Sinkholed","trigger":"worzen.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":[{"sensor_name":"urlquery","alert":"Phishing - Swisscom","verdict":"phishing","severity":"medium","comment":"Asset commenly seen with Swisscom phishing","tags":["swisscom","telecom","phishing"],"meta":null}]}},{"url":{"schema":"https","addr":"worzen.com/wp-includes/well/panel/fetch.php","fqdn":"worzen.com","domain":"worzen.com","tld":"com"},"ip":{"addr":"192.250.235.25","port":443,"asn":204800,"as":"WHG Hosting Services Ltd","country":"Singapore","country_code":"SG"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"https://worzen.com/wp-includes/well/auth/login.php","date":"2025-11-03T01:55:08.458Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"webmail.worzen.com","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Tue, 14 Oct 2025 10:08:37 GMT","end":"Mon, 12 Jan 2026 10:08:36 GMT"},"fingerprint":{"sha1":"15:C0:AC:4A:51:D0:BE:A0:08:DC:FB:96:45:7B:68:BA:20:45:5B:9C","sha256":"8C:17:5F:35:DF:BE:62:F4:8F:41:17:C1:9F:E8:54:7E:17:B1:85:7A:3A:67:86:B9:81:41:9F:3F:B4:89:56:11"}}},"request":{"raw":"POST /wp-includes/well/panel/fetch.php HTTP/1.1\r\nHost: worzen.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nContent-Type: application/x-www-form-urlencoded; charset=UTF-8\r\nX-Requested-With: XMLHttpRequest\r\nContent-Length: 8\r\nOrigin: https://worzen.com\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://worzen.com/wp-includes/well/auth/login.php\r\nCookie: PHPSESSID=154dab4c120945a18ea91af7c8dd9519\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"POST"},"response":{"raw":"HTTP/3 200 OK\r\ncontent-type: text/html; charset=UTF-8\r\ncache-control: public, max-age=0\r\nexpires: Mon, 03 Nov 2025 01:55:08 GMT\r\ncontent-length: 5\r\ncontent-encoding: br\r\nvary: Accept-Encoding,User-Agent\r\ndate: Mon, 03 Nov 2025 01:55:08 GMT\r\nserver: LiteSpeed\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"LiteSpeed","description":"LiteSpeed is a high-scalability web server.","website":"https://litespeedtech.com","common_platform_enumeration":"cpe:2.3:a:litespeedtech:litespeed_web_server:*:*:*:*:*:*:*:*","icon":"LiteSpeed.svg","categories":["Web servers"]}],"data":{"size":1,"size_decoded":0,"mime_type":"text/html; charset=UTF-8","magic":"very short file (no magic)","md5":"cfcd208495d565ef66e7dff9f98764da","sha1":"b6589fc6ab0dc82cf12099d1c2d40ab994e8410c","sha256":"5feceb66ffc86f38d952786c6d696c79c2dbc239dd4e91b46729d73a27fb57e9","sha512":"31bca02094eb78126a517b206a88c73cfa9ec6f704c7030d18212cace820f025f00bf0ea68dbf3f3a5436ca63b53bf7bf80ad8d5de7d8359d0b7fed9dbc3ab99","ssdeep":"","tlshash":"c700000000000000c00000300000000000000000000000000000000000000000000000","first_seen":"2023-03-07T01:37:31Z","last_seen":"2026-08-05T00:06:45.34615Z","times_seen":118829,"resource_available":true,"data":null}},"time_used":195,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":195,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2025-11-02","alert":"Sinkholed","trigger":"worzen.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-11-03","alert":"Sinkholed","trigger":"worzen.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":[{"sensor_name":"urlquery","alert":"Phishing - Swisscom","verdict":"phishing","severity":"medium","comment":"Asset commenly seen with Swisscom phishing","tags":["swisscom","telecom","phishing"],"meta":null}]}},{"url":{"schema":"https","addr":"worzen.com/wp-includes/well/panel/update_statu.php","fqdn":"worzen.com","domain":"worzen.com","tld":"com"},"ip":{"addr":"192.250.235.25","port":443,"asn":204800,"as":"WHG Hosting Services Ltd","country":"Singapore","country_code":"SG"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"https://worzen.com/wp-includes/well/auth/login.php","date":"2025-11-03T01:55:14.463Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"webmail.worzen.com","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Tue, 14 Oct 2025 10:08:37 GMT","end":"Mon, 12 Jan 2026 10:08:36 GMT"},"fingerprint":{"sha1":"15:C0:AC:4A:51:D0:BE:A0:08:DC:FB:96:45:7B:68:BA:20:45:5B:9C","sha256":"8C:17:5F:35:DF:BE:62:F4:8F:41:17:C1:9F:E8:54:7E:17:B1:85:7A:3A:67:86:B9:81:41:9F:3F:B4:89:56:11"}}},"request":{"raw":"POST /wp-includes/well/panel/update_statu.php HTTP/1.1\r\nHost: worzen.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nContent-Type: application/x-www-form-urlencoded; charset=UTF-8\r\nX-Requested-With: XMLHttpRequest\r\nContent-Length: 24\r\nOrigin: https://worzen.com\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://worzen.com/wp-includes/well/auth/login.php\r\nCookie: PHPSESSID=154dab4c120945a18ea91af7c8dd9519\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"POST"},"response":{"raw":"HTTP/3 200 OK\r\ncontent-type: text/html; charset=UTF-8\r\ncache-control: public, max-age=0\r\nexpires: Mon, 03 Nov 2025 01:55:14 GMT\r\ncontent-length: 0\r\ndate: Mon, 03 Nov 2025 01:55:14 GMT\r\nserver: LiteSpeed\r\nvary: User-Agent\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"LiteSpeed","description":"LiteSpeed is a high-scalability web server.","website":"https://litespeedtech.com","common_platform_enumeration":"cpe:2.3:a:litespeedtech:litespeed_web_server:*:*:*:*:*:*:*:*","icon":"LiteSpeed.svg","categories":["Web servers"]}],"data":{"size":0,"size_decoded":0,"mime_type":"text/html; charset=UTF-8","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-08-04T23:58:22.456459Z","times_seen":17715369,"resource_available":true,"data":null}},"time_used":186,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":186,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2025-11-02","alert":"Sinkholed","trigger":"worzen.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-11-03","alert":"Sinkholed","trigger":"worzen.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":[{"sensor_name":"urlquery","alert":"Phishing - Swisscom","verdict":"phishing","severity":"medium","comment":"Asset commenly seen with Swisscom phishing","tags":["swisscom","telecom","phishing"],"meta":null}]}},{"url":{"schema":"https","addr":"worzen.com/wp-includes/well/panel/fetch.php","fqdn":"worzen.com","domain":"worzen.com","tld":"com"},"ip":{"addr":"192.250.235.25","port":443,"asn":204800,"as":"WHG Hosting Services Ltd","country":"Singapore","country_code":"SG"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"https://worzen.com/wp-includes/well/auth/login.php","date":"2025-11-03T01:55:16.462Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"webmail.worzen.com","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Tue, 14 Oct 2025 10:08:37 GMT","end":"Mon, 12 Jan 2026 10:08:36 GMT"},"fingerprint":{"sha1":"15:C0:AC:4A:51:D0:BE:A0:08:DC:FB:96:45:7B:68:BA:20:45:5B:9C","sha256":"8C:17:5F:35:DF:BE:62:F4:8F:41:17:C1:9F:E8:54:7E:17:B1:85:7A:3A:67:86:B9:81:41:9F:3F:B4:89:56:11"}}},"request":{"raw":"POST /wp-includes/well/panel/fetch.php HTTP/1.1\r\nHost: worzen.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nContent-Type: application/x-www-form-urlencoded; charset=UTF-8\r\nX-Requested-With: XMLHttpRequest\r\nContent-Length: 8\r\nOrigin: https://worzen.com\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://worzen.com/wp-includes/well/auth/login.php\r\nCookie: PHPSESSID=154dab4c120945a18ea91af7c8dd9519\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"POST"},"response":{"raw":"HTTP/3 200 OK\r\ncontent-type: text/html; charset=UTF-8\r\ncache-control: public, max-age=0\r\nexpires: Mon, 03 Nov 2025 01:55:16 GMT\r\ncontent-length: 5\r\ncontent-encoding: br\r\nvary: Accept-Encoding,User-Agent\r\ndate: Mon, 03 Nov 2025 01:55:16 GMT\r\nserver: LiteSpeed\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"LiteSpeed","description":"LiteSpeed is a high-scalability web server.","website":"https://litespeedtech.com","common_platform_enumeration":"cpe:2.3:a:litespeedtech:litespeed_web_server:*:*:*:*:*:*:*:*","icon":"LiteSpeed.svg","categories":["Web servers"]}],"data":{"size":1,"size_decoded":0,"mime_type":"text/html; charset=UTF-8","magic":"very short file (no magic)","md5":"cfcd208495d565ef66e7dff9f98764da","sha1":"b6589fc6ab0dc82cf12099d1c2d40ab994e8410c","sha256":"5feceb66ffc86f38d952786c6d696c79c2dbc239dd4e91b46729d73a27fb57e9","sha512":"31bca02094eb78126a517b206a88c73cfa9ec6f704c7030d18212cace820f025f00bf0ea68dbf3f3a5436ca63b53bf7bf80ad8d5de7d8359d0b7fed9dbc3ab99","ssdeep":"","tlshash":"c700000000000000c00000300000000000000000000000000000000000000000000000","first_seen":"2023-03-07T01:37:31Z","last_seen":"2026-08-05T00:06:45.34615Z","times_seen":118829,"resource_available":true,"data":null}},"time_used":213,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":213,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2025-11-02","alert":"Sinkholed","trigger":"worzen.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-11-03","alert":"Sinkholed","trigger":"worzen.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":[{"sensor_name":"urlquery","alert":"Phishing - Swisscom","verdict":"phishing","severity":"medium","comment":"Asset commenly seen with Swisscom phishing","tags":["swisscom","telecom","phishing"],"meta":null}]}},{"url":{"schema":"https","addr":"worzen.com/wp-includes/well/panel/update_statu.php","fqdn":"worzen.com","domain":"worzen.com","tld":"com"},"ip":{"addr":"192.250.235.25","port":443,"asn":204800,"as":"WHG Hosting Services Ltd","country":"Singapore","country_code":"SG"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"https://worzen.com/wp-includes/well/auth/login.php","date":"2025-11-03T01:55:18.465Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"webmail.worzen.com","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Tue, 14 Oct 2025 10:08:37 GMT","end":"Mon, 12 Jan 2026 10:08:36 GMT"},"fingerprint":{"sha1":"15:C0:AC:4A:51:D0:BE:A0:08:DC:FB:96:45:7B:68:BA:20:45:5B:9C","sha256":"8C:17:5F:35:DF:BE:62:F4:8F:41:17:C1:9F:E8:54:7E:17:B1:85:7A:3A:67:86:B9:81:41:9F:3F:B4:89:56:11"}}},"request":{"raw":"POST /wp-includes/well/panel/update_statu.php HTTP/1.1\r\nHost: worzen.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nContent-Type: application/x-www-form-urlencoded; charset=UTF-8\r\nX-Requested-With: XMLHttpRequest\r\nContent-Length: 24\r\nOrigin: https://worzen.com\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://worzen.com/wp-includes/well/auth/login.php\r\nCookie: PHPSESSID=154dab4c120945a18ea91af7c8dd9519\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"POST"},"response":{"raw":"HTTP/3 200 OK\r\ncontent-type: text/html; charset=UTF-8\r\ncache-control: public, max-age=0\r\nexpires: Mon, 03 Nov 2025 01:55:18 GMT\r\ncontent-length: 0\r\ndate: Mon, 03 Nov 2025 01:55:18 GMT\r\nserver: LiteSpeed\r\nvary: User-Agent\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"LiteSpeed","description":"LiteSpeed is a high-scalability web server.","website":"https://litespeedtech.com","common_platform_enumeration":"cpe:2.3:a:litespeedtech:litespeed_web_server:*:*:*:*:*:*:*:*","icon":"LiteSpeed.svg","categories":["Web servers"]}],"data":{"size":0,"size_decoded":0,"mime_type":"text/html; charset=UTF-8","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-08-04T23:58:22.456459Z","times_seen":17715369,"resource_available":true,"data":null}},"time_used":186,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":186,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2025-11-02","alert":"Sinkholed","trigger":"worzen.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-11-03","alert":"Sinkholed","trigger":"worzen.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":[{"sensor_name":"urlquery","alert":"Phishing - Swisscom","verdict":"phishing","severity":"medium","comment":"Asset commenly seen with Swisscom phishing","tags":["swisscom","telecom","phishing"],"meta":null}]}},{"url":{"schema":"https","addr":"worzen.com/wp-includes/well/panel/fetch.php","fqdn":"worzen.com","domain":"worzen.com","tld":"com"},"ip":{"addr":"192.250.235.25","port":443,"asn":204800,"as":"WHG Hosting Services Ltd","country":"Singapore","country_code":"SG"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"https://worzen.com/wp-includes/well/auth/login.php","date":"2025-11-03T01:55:20.458Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"webmail.worzen.com","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Tue, 14 Oct 2025 10:08:37 GMT","end":"Mon, 12 Jan 2026 10:08:36 GMT"},"fingerprint":{"sha1":"15:C0:AC:4A:51:D0:BE:A0:08:DC:FB:96:45:7B:68:BA:20:45:5B:9C","sha256":"8C:17:5F:35:DF:BE:62:F4:8F:41:17:C1:9F:E8:54:7E:17:B1:85:7A:3A:67:86:B9:81:41:9F:3F:B4:89:56:11"}}},"request":{"raw":"POST /wp-includes/well/panel/fetch.php HTTP/1.1\r\nHost: worzen.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nContent-Type: application/x-www-form-urlencoded; charset=UTF-8\r\nX-Requested-With: XMLHttpRequest\r\nContent-Length: 8\r\nOrigin: https://worzen.com\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://worzen.com/wp-includes/well/auth/login.php\r\nCookie: PHPSESSID=154dab4c120945a18ea91af7c8dd9519\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"POST"},"response":{"raw":"HTTP/3 200 OK\r\ncontent-type: text/html; charset=UTF-8\r\ncache-control: public, max-age=0\r\nexpires: Mon, 03 Nov 2025 01:55:20 GMT\r\ncontent-length: 5\r\ncontent-encoding: br\r\nvary: Accept-Encoding,User-Agent\r\ndate: Mon, 03 Nov 2025 01:55:20 GMT\r\nserver: LiteSpeed\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"LiteSpeed","description":"LiteSpeed is a high-scalability web server.","website":"https://litespeedtech.com","common_platform_enumeration":"cpe:2.3:a:litespeedtech:litespeed_web_server:*:*:*:*:*:*:*:*","icon":"LiteSpeed.svg","categories":["Web servers"]}],"data":{"size":1,"size_decoded":0,"mime_type":"text/html; charset=UTF-8","magic":"very short file (no magic)","md5":"cfcd208495d565ef66e7dff9f98764da","sha1":"b6589fc6ab0dc82cf12099d1c2d40ab994e8410c","sha256":"5feceb66ffc86f38d952786c6d696c79c2dbc239dd4e91b46729d73a27fb57e9","sha512":"31bca02094eb78126a517b206a88c73cfa9ec6f704c7030d18212cace820f025f00bf0ea68dbf3f3a5436ca63b53bf7bf80ad8d5de7d8359d0b7fed9dbc3ab99","ssdeep":"","tlshash":"c700000000000000c00000300000000000000000000000000000000000000000000000","first_seen":"2023-03-07T01:37:31Z","last_seen":"2026-08-05T00:06:45.34615Z","times_seen":118829,"resource_available":true,"data":null}},"time_used":189,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":189,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2025-11-02","alert":"Sinkholed","trigger":"worzen.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-11-03","alert":"Sinkholed","trigger":"worzen.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":[{"sensor_name":"urlquery","alert":"Phishing - Swisscom","verdict":"phishing","severity":"medium","comment":"Asset commenly seen with Swisscom phishing","tags":["swisscom","telecom","phishing"],"meta":null}]}}]}