{"report_id":"3ee0c670-ed82-49aa-a724-481e6a601cf5","version":6,"status":"done","tags":[],"date":"2026-03-25T15:47:44Z","url":{"schema":"http","addr":"db.safemessaging.org/landing/form/cdeb5365-2a50-4887-a6d4-c7f2943cc4e8","fqdn":"db.safemessaging.org","domain":"safemessaging.org","tld":"org"},"ip":{"addr":"54.208.183.144","port":0,"asn":14618,"as":"AMAZON-AES","country":"United States","country_code":"US"},"final":{"url":{"schema":"https","addr":"db.safemessaging.org/landing/form/cdeb5365-2a50-4887-a6d4-c7f2943cc4e8","fqdn":"db.safemessaging.org","domain":"safemessaging.org","tld":"org"},"title":"Spotify Login","dom":{"size":3051,"mime_type":"text/html; charset=utf-8","magic":"HTML document, ASCII text, with very long lines (1480)","md5":"666c844a9c876478e07e96e6ec9c785c","sha1":"608c1d9a649fdc7479da1f05796310693f635bb1","sha256":"7e20c04981631a9251ca0b02b1f27bcd3b59edd1d2b0bed222159f7f42d26778","sha512":"1260b8eb6b28d95468fcb457851a38b62fc85e64664866f2c396f2553e71037cbde71178f7d100743d9521844b49fea1a180a7b60baba04563da71299f4cf856","ssdeep":"","tlshash":"fb51746657930a11e2a2d7a0f5a3db8b22314a4a8b9142347ead0631f3cf67916762cd","dom_hash":"domhash64c77531f15477d7d4b661a5537cf3cd","first_seen":"2026-03-25T13:01:16.164237Z","last_seen":"2026-03-25T15:47:44.713609Z","times_seen":2,"resource_available":false,"data":null}},"submit":{"url":{"schema":"http","addr":"db.safemessaging.org/landing/form/cdeb5365-2a50-4887-a6d4-c7f2943cc4e8","fqdn":"db.safemessaging.org","domain":"safemessaging.org","tld":"org"},"ip":{"addr":"54.208.183.144","port":0,"asn":14618,"as":"AMAZON-AES","country":"United States","country_code":"US"},"tags":null,"meta":null},"settings":{"access":"public","device_type":"desktop","expires_at":"2027-04-29T15:47:44Z","useragent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0","referer":"","cookies":null,"exit_node":"z0yflva4pidy47h"},"stats":{"alert_count":{"ids":0,"urlquery":0,"analyzer":2}},"detection":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-03-25","alert":"Sinkholed","trigger":"db.safemessaging.org","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-03-25","alert":"Sinkholed","trigger":"db.safemessaging.org","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null},"summary":[{"fqdn":"db.safemessaging.org","ip":{"addr":"3.94.135.95","port":443,"asn":14618,"as":"AMAZON-AES","country":"United States","country_code":"US"},"domain_registered":"2018-01-11","domain_rank":0,"first_seen":"2022-06-02T09:00:10Z","last_seen":"2026-03-25T13:00:14.83983Z","alert_count":6,"request_count":3,"received_data":8079,"sent_data":1720,"comment":"","tags":null,"fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}]},{"fqdn":"s3.us-east-2.amazonaws.com","ip":{"addr":"3.5.89.110","port":443,"asn":0,"as":"","country":"United States","country_code":"US"},"domain_registered":"2005-08-18","domain_rank":2522817,"first_seen":"2017-02-03T06:20:59Z","last_seen":"2026-03-18T20:03:26.562348Z","alert_count":0,"request_count":1,"received_data":29062,"sent_data":465,"comment":"","tags":null,"fingerprints":[{"name":"Amazon S3","description":"Amazon S3 or Amazon Simple Storage Service is a service offered by Amazon Web Services (AWS) that provides object storage through a web service interface.","website":"https://aws.amazon.com/s3/","common_platform_enumeration":"","icon":"Amazon S3.svg","categories":["CDN"]},{"name":"Amazon Web Services","description":"Amazon Web Services (AWS) is a comprehensive cloud services platform offering compute power, database storage, content delivery and other functionality.","website":"https://aws.amazon.com/","common_platform_enumeration":"","icon":"Amazon Web Services.svg","categories":["PaaS"]}]}],"files":null,"artifacts":{"windows_shortcuts":null,"files":null,"telegram":null,"pdfs":null,"clipboard":null},"sensors":{"ids":null,"analyzer":null,"urlquery":null},"javascript":{"script":[{"url":{"schema":"https","addr":"db.safemessaging.org/landing/form/cdeb5365-2a50-4887-a6d4-c7f2943cc4e8","fqdn":"db.safemessaging.org","domain":"safemessaging.org","tld":"org"},"ip":{"addr":"3.94.135.95","port":443,"asn":14618,"as":"AMAZON-AES","country":"United States","country_code":"US"},"introduction_type":"scriptElement","is_inline":true,"md5":"eb5b98b595e700bbb0bd8df93808ca08","sha1":"23ccc2054cfa70903af135671cd707659be23be5","sha256":"61b85d282653798f927dcf3a378bb84ee1991381a0d1c073b42a3570bc364f44","sha512":"08c0c3693f099aa18d7861df9e5fd76aeb01ef9545089b8102eec925a28bdb3ce6adcac3a2ca22e38bddc5b5d85550954ad1e7a3a19eebbbdf97610069f4b1d0","ssdeep":"","tlshash":"c2d02eab21b204b00a8fa27a430b2a8020b210ea200ea020bc1e8f288b35a8a0251748","size":259,"data":"","first_seen":"2026-03-25T13:01:16.179529Z","last_seen":"2026-03-25T15:47:44.717947Z","times_seen":2,"alerts":{"ids":null,"analyzer":null,"urlquery":null}}],"eval":null,"write":null,"console":null},"http":[{"url":{"schema":"https","addr":"db.safemessaging.org/landing/form/cdeb5365-2a50-4887-a6d4-c7f2943cc4e8","fqdn":"db.safemessaging.org","domain":"safemessaging.org","tld":"org"},"ip":{"addr":"3.94.135.95","port":443,"asn":14618,"as":"AMAZON-AES","country":"United States","country_code":"US"},"is_navigation_request":true,"resource_type":"document","requested_by":"","date":"2026-03-25T15:47:21.978Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256","key_group_name":"P256","signature_name":"RSA-PKCS1-SHA256","protocol":"TLSv1.2","cert":{"subject":{"commonName":"safemessaging.org","organization":""},"issuer":{"commonName":"Amazon RSA 2048 M01","organization":"Amazon"},"validity":{"start":"Mon, 29 Sep 2025 00:00:00 GMT","end":"Wed, 28 Oct 2026 23:59:59 GMT"},"fingerprint":{"sha1":"00:29:30:64:30:7E:E9:06:3F:60:9B:50:C4:14:F0:79:DB:23:28:39","sha256":"22:C6:38:FB:1B:12:3B:1A:57:7F:E7:6C:1E:B6:63:CA:8D:55:62:5F:EF:4E:FB:27:77:01:EB:93:ED:35:9F:43"}}},"request":{"raw":"GET /landing/form/cdeb5365-2a50-4887-a6d4-c7f2943cc4e8 HTTP/1.1\r\nHost: db.safemessaging.org\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nUpgrade-Insecure-Requests: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: document\r\nSec-Fetch-Mode: navigate\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ndate: Wed, 25 Mar 2026 15:47:22 GMT\r\ncontent-type: text/html; charset=UTF-8\r\nserver: nginx\r\nx-frame-options: SAMEORIGIN\r\nreferrer-policy: unsafe-url\r\nset-cookie: csrf=%2B9TTtuUa32ps2aOANPif2zFiY2E2MjMxN2E2M2EzOGUxYTE0NGJiOTFiNmE3MTFhYzMzZTU3ZTA%3D; path=/; secure\r\nx-xss-protection: 1; mode=block\r\nx-content-type-options: nosniff\r\nstrict-transport-security: max-age=63072000; includeSubDomains\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":3080,"size_decoded":0,"mime_type":"text/html; charset=UTF-8","magic":"HTML document, ASCII text, with very long lines (1484)","md5":"3804efd595759cfa6139c0b9b7ddf71a","sha1":"300ce7ad8e9c57b52fc8476c8a96a30335974bb0","sha256":"72c8a900da19ea226517ef14ac2ee023b1b6f1701303c8dc8e509a4e64c00108","sha512":"08df112b88c5e096f522146f83dd2ce1effec8a59aa910957550e48ca8c548df6e68ecae5bd8ee9aedccd431b4ac9386e192cb4bd98847cf63a8c269c1972d70","ssdeep":"","tlshash":"0f51846657930b11e2a2d3a0f5a3db8b22314b4a8b9142347dbd0632f3cf67915762cd","first_seen":"2026-03-25T13:01:16.168541Z","last_seen":"2026-03-25T15:47:44.714627Z","times_seen":2,"resource_available":false,"data":null}},"time_used":959,"timings":{"blocked":395,"dns":15,"connect":93,"send":0,"wait":168,"receive":0,"ssl":285},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-03-25","alert":"Sinkholed","trigger":"db.safemessaging.org","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-03-25","alert":"Sinkholed","trigger":"db.safemessaging.org","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"db.safemessaging.org/css/data-entry.css","fqdn":"db.safemessaging.org","domain":"safemessaging.org","tld":"org"},"ip":{"addr":"3.94.135.95","port":443,"asn":14618,"as":"AMAZON-AES","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://db.safemessaging.org/landing/form/cdeb5365-2a50-4887-a6d4-c7f2943cc4e8","date":"2026-03-25T15:47:22.749Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256","key_group_name":"P256","signature_name":"RSA-PKCS1-SHA256","protocol":"TLSv1.2","cert":{"subject":{"commonName":"safemessaging.org","organization":""},"issuer":{"commonName":"Amazon RSA 2048 M01","organization":"Amazon"},"validity":{"start":"Mon, 29 Sep 2025 00:00:00 GMT","end":"Wed, 28 Oct 2026 23:59:59 GMT"},"fingerprint":{"sha1":"00:29:30:64:30:7E:E9:06:3F:60:9B:50:C4:14:F0:79:DB:23:28:39","sha256":"22:C6:38:FB:1B:12:3B:1A:57:7F:E7:6C:1E:B6:63:CA:8D:55:62:5F:EF:4E:FB:27:77:01:EB:93:ED:35:9F:43"}}},"request":{"raw":"GET /css/data-entry.css HTTP/1.1\r\nHost: db.safemessaging.org\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://db.safemessaging.org/landing/form/cdeb5365-2a50-4887-a6d4-c7f2943cc4e8\r\nDNT: 1\r\nConnection: keep-alive\r\nCookie: csrf=%2B9TTtuUa32ps2aOANPif2zFiY2E2MjMxN2E2M2EzOGUxYTE0NGJiOTFiNmE3MTFhYzMzZTU3ZTA%3D\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ndate: Wed, 25 Mar 2026 15:47:22 GMT\r\ncontent-type: text/css\r\ncontent-length: 3767\r\nserver: nginx\r\nlast-modified: Wed, 25 Mar 2026 11:49:34 GMT\r\netag: \"69c3cbce-eb7\"\r\nx-xss-protection: 1; mode=block\r\nx-content-type-options: nosniff\r\nstrict-transport-security: max-age=63072000; includeSubDomains\r\naccept-ranges: bytes\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":3767,"size_decoded":0,"mime_type":"text/css","magic":"ASCII text, with very long lines (3766)","md5":"9cdb6827dc31b40c61976a7b9b261014","sha1":"59c469d802c67be386a65c7b8f39a9945de03ecd","sha256":"e7f32025f80aaba357fb0490459ef3d76983eb9841e7952cd70f836b8702267b","sha512":"032ff5602249f1fa47e5a43e7a0fe17b54e33965bc445d598958dd5d5817eadbf95fead7fa1fd1452379c249d6c4a301d949e6571eea03bfa5f469dd9256abb5","ssdeep":"","tlshash":"0a713d273e28221cb527861edcdd139922347621b7170beffc94e1248bcede23422a02","first_seen":"2026-03-19T23:45:39.017434Z","last_seen":"2026-03-27T13:57:39.240488Z","times_seen":98,"resource_available":false,"data":null}},"time_used":96,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":95,"receive":1,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-03-25","alert":"Sinkholed","trigger":"db.safemessaging.org","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-03-25","alert":"Sinkholed","trigger":"db.safemessaging.org","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"s3.us-east-2.amazonaws.com/cdn29/images/Spotify.jpg","fqdn":"s3.us-east-2.amazonaws.com","domain":"s3.us-east-2.amazonaws.com","tld":""},"ip":{"addr":"3.5.89.110","port":443,"asn":0,"as":"","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://db.safemessaging.org/landing/form/cdeb5365-2a50-4887-a6d4-c7f2943cc4e8","date":"2026-03-25T15:47:22.752Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"P256","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.s3.us-east-2.amazonaws.com","organization":""},"issuer":{"commonName":"Amazon RSA 2048 M01","organization":"Amazon"},"validity":{"start":"Fri, 11 Jul 2025 00:00:00 GMT","end":"Thu, 11 Jun 2026 23:59:59 GMT"},"fingerprint":{"sha1":"AE:85:0E:36:0C:41:4B:FA:50:FE:A2:66:4A:07:91:CD:2E:5E:4B:96","sha256":"A7:48:62:90:A6:73:71:EE:01:E3:11:2D:C2:60:CD:EC:39:3D:B9:2D:A5:F2:64:BA:6B:AF:E2:38:79:9B:0D:2F"}}},"request":{"raw":"GET /cdn29/images/Spotify.jpg HTTP/1.1\r\nHost: s3.us-east-2.amazonaws.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://db.safemessaging.org/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nx-amz-id-2: WNcEqlZwXIOlUrxi7BGoPjbS5fz13Jo/3ug2IbVzxFj42MYk/GjjYBr/OOPG7D9I/YYmRm/fYQb5oimeUL7y1BkShJh+tV9j\r\nx-amz-request-id: N909S4D91DJHBEQF\r\nDate: Wed, 25 Mar 2026 15:47:24 GMT\r\nLast-Modified: Fri, 01 Feb 2019 19:18:14 GMT\r\nETag: \"17ecbcfc572ffbd4fe1b7555d96bb9d9\"\r\nx-amz-meta-s3b-last-modified: 20180615T165820Z\r\nAccept-Ranges: bytes\r\nContent-Type: image/jpeg\r\nContent-Length: 28635\r\nServer: AmazonS3\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Amazon S3","description":"Amazon S3 or Amazon Simple Storage Service is a service offered by Amazon Web Services (AWS) that provides object storage through a web service interface.","website":"https://aws.amazon.com/s3/","common_platform_enumeration":"","icon":"Amazon S3.svg","categories":["CDN"]},{"name":"Amazon Web Services","description":"Amazon Web Services (AWS) is a comprehensive cloud services platform offering compute power, database storage, content delivery and other functionality.","website":"https://aws.amazon.com/","common_platform_enumeration":"","icon":"Amazon Web Services.svg","categories":["PaaS"]}],"data":{"size":28635,"size_decoded":0,"mime_type":"image/jpeg","magic":"JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 1200x800, components 3","md5":"17ecbcfc572ffbd4fe1b7555d96bb9d9","sha1":"d3fbda9bfc500a038d15c1c20f5891956f185268","sha256":"c404e50ac0428699ffa68d7deee1cf8f8432c38f87959511fc320edf30addece","sha512":"dfaca4e0801e64c63a7b333a66b67ae5196eaf4be565268c620248ab1f5920951c82600ee7b795a094426fa696257fd920aff83d60d0cc876de336eb62efa0e1","ssdeep":"768:RdyXizoGOACduyzz9jhyf5Ix0LSVeOGF8d:CXuMJduyzzT45GkSIA","tlshash":"cbd2c077730574cce28eeb765d955630e6c91e129289f34fe945292c4ece8f430267c6","first_seen":"2025-12-04T03:29:34.45789Z","last_seen":"2026-04-05T08:11:39.537099Z","times_seen":22,"resource_available":false,"data":null}},"time_used":730,"timings":{"blocked":244,"dns":14,"connect":106,"send":0,"wait":130,"receive":107,"ssl":125},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"db.safemessaging.org/favicon.ico","fqdn":"db.safemessaging.org","domain":"safemessaging.org","tld":"org"},"ip":{"addr":"3.94.135.95","port":443,"asn":14618,"as":"AMAZON-AES","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://db.safemessaging.org/landing/form/cdeb5365-2a50-4887-a6d4-c7f2943cc4e8","date":"2026-03-25T15:47:22.970Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256","key_group_name":"P256","signature_name":"RSA-PKCS1-SHA256","protocol":"TLSv1.2","cert":{"subject":{"commonName":"safemessaging.org","organization":""},"issuer":{"commonName":"Amazon RSA 2048 M01","organization":"Amazon"},"validity":{"start":"Mon, 29 Sep 2025 00:00:00 GMT","end":"Wed, 28 Oct 2026 23:59:59 GMT"},"fingerprint":{"sha1":"00:29:30:64:30:7E:E9:06:3F:60:9B:50:C4:14:F0:79:DB:23:28:39","sha256":"22:C6:38:FB:1B:12:3B:1A:57:7F:E7:6C:1E:B6:63:CA:8D:55:62:5F:EF:4E:FB:27:77:01:EB:93:ED:35:9F:43"}}},"request":{"raw":"GET /favicon.ico HTTP/1.1\r\nHost: db.safemessaging.org\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://db.safemessaging.org/landing/form/cdeb5365-2a50-4887-a6d4-c7f2943cc4e8\r\nDNT: 1\r\nConnection: keep-alive\r\nCookie: csrf=%2B9TTtuUa32ps2aOANPif2zFiY2E2MjMxN2E2M2EzOGUxYTE0NGJiOTFiNmE3MTFhYzMzZTU3ZTA%3D\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 404 Not Found\r\ndate: Wed, 25 Mar 2026 15:47:23 GMT\r\ncontent-type: text/html\r\nserver: nginx\r\nx-xss-protection: 1; mode=block\r\nx-content-type-options: nosniff\r\nstrict-transport-security: max-age=63072000; includeSubDomains\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"404","status_text":"Not Found","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":146,"size_decoded":0,"mime_type":"text/html","magic":"HTML document, ASCII text, with CRLF line terminators","md5":"8eec510e57f5f732fd2cce73df7b73ef","sha1":"3c0af39ecb3753c5fee3b53d063c7286019eac3b","sha256":"55f7d9e99b8e2d4e0e193b2f0275501e6d9c1ebd29cadbea6a0da48a8587e3e0","sha512":"73bbf698482132b5fd60a0b58926fddec9055f8095a53bc52714e211e9340c3419736ceafd6b279667810114d306bfccdcfcddf51c0b67fe9e3c73c54583e574","ssdeep":"","tlshash":"b7c02b2d35133c4cc563313423c37140c0d6833b687a41110400c00371cf2998ec3397","first_seen":"2023-03-07T12:05:15Z","last_seen":"2026-08-13T20:48:59.499265Z","times_seen":550500,"resource_available":true,"data":null}},"time_used":95,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":95,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-03-25","alert":"Sinkholed","trigger":"db.safemessaging.org","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-03-25","alert":"Sinkholed","trigger":"db.safemessaging.org","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}}]}