{"report_id":"3ee7afd8-8f0d-48be-806f-32a51d78f107","version":0,"status":"done","tags":[],"date":"2026-08-20T06:42:27Z","url":{"schema":"http","addr":"wwwallocation.com/","fqdn":"wwwallocation.com","domain":"wwwallocation.com","tld":"com"},"ip":{"addr":"216.198.79.1","port":0,"asn":16509,"as":"AMAZON-02","country":"United States","country_code":"US"},"final":{"url":{"schema":"https","addr":"www.wwwallocation.com/login","fqdn":"www.wwwallocation.com","domain":"wwwallocation.com","tld":"com"},"title":"Allocations — Private Preview","dom":{"size":4469,"mime_type":"text/html; charset=utf-8","magic":"JavaScript source, Unicode text, UTF-8 text, with very long lines (316)","md5":"4abc7903124da09d7447b926fb38a29a","sha1":"3bf05ff167e7fe3b20db2a8bf5e42f2374db59fe","sha256":"c55308a317fa443e79d823a198e252056fe9c01a1894ec864de2a611b9c39405","sha512":"ed4fcc85d476c615a214f986db2cb621ea897bca25e6ac7f46af12047e0cce8c76776d9f526bb51b7ef927ce345c5d3ab779cffc9743faa3bacc6ff5a485c4ed","ssdeep":"96:nILoYaZYOlQRJm6W5PpGtuh7TMLSnTunzLGi:IoY4YOeRJmb5RFMLSKnzLGi","tlshash":"4b919696b1830872f926963933da576a3305a023c102de347fe97319dfc56a682e67cc","dom_hash":"domhashb512bc098e2bc31b0f0cc8dea15b9e18","first_seen":"2026-08-20T06:37:22.924031Z","last_seen":"2026-08-20T06:42:27.730998Z","times_seen":2,"resource_available":false,"data":null}},"submit":{"url":{"schema":"http","addr":"wwwallocation.com/","fqdn":"wwwallocation.com","domain":"wwwallocation.com","tld":"com"},"ip":{"addr":"216.198.79.1","port":0,"asn":16509,"as":"AMAZON-02","country":"United States","country_code":"US"},"tags":null,"meta":null},"settings":{"access":"public","device_type":"desktop","expires_at":"2027-09-24T06:42:27Z","useragent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0","referer":"","cookies":null,"exit_node":"qguvgzjxzsgb3vs"},"stats":{"alert_count":{"ids":0,"urlquery":0,"analyzer":2}},"detection":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-08-20","alert":"Sinkholed","trigger":"wwwallocation.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-08-20","alert":"Sinkholed","trigger":"www.wwwallocation.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null},"summary":[{"fqdn":"wwwallocation.com","ip":{"addr":"216.198.79.1","port":443,"asn":16509,"as":"AMAZON-02","country":"United States","country_code":"US"},"domain_registered":"unknown","domain_rank":0,"first_seen":"2026-08-20T06:37:18.650727Z","last_seen":"2026-08-20T06:37:18.650727Z","alert_count":1,"request_count":1,"received_data":351,"sent_data":486,"comment":"","tags":null,"fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Vercel","description":"Vercel is a cloud platform for static frontends and serverless functions.","website":"https://vercel.com","common_platform_enumeration":"","icon":"vercel.svg","categories":["PaaS"]}]},{"fqdn":"www.wwwallocation.com","ip":{"addr":"216.198.79.1","port":443,"asn":16509,"as":"AMAZON-02","country":"United States","country_code":"US"},"domain_registered":"unknown","domain_rank":0,"first_seen":"2026-08-20T06:37:18.646791Z","last_seen":"2026-08-20T06:37:18.646791Z","alert_count":2,"request_count":2,"received_data":5504,"sent_data":985,"comment":"","tags":null,"fingerprints":[{"name":"Vercel","description":"Vercel is a cloud platform for static frontends and serverless functions.","website":"https://vercel.com","common_platform_enumeration":"","icon":"vercel.svg","categories":["PaaS"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}]}],"files":null,"artifacts":{"windows_shortcuts":null,"files":null,"telegram":null,"pdfs":null,"clipboard":null},"sensors":{"ids":null,"analyzer":null,"urlquery":null},"javascript":{"script":[{"url":{"schema":"https","addr":"www.wwwallocation.com/login","fqdn":"www.wwwallocation.com","domain":"wwwallocation.com","tld":"com"},"ip":{"addr":"216.198.79.1","port":443,"asn":16509,"as":"AMAZON-02","country":"United States","country_code":"US"},"introduction_type":"scriptElement","is_inline":true,"md5":"e79289e658f6dc3fbae1b9b2491b4aa4","sha1":"feb39f0ca7f6b7f1ca171aa37cdad012e2718453","sha256":"060b06bfb7a1ef42ae10c40758beadb5083f2ef6a9eef3454c59190c46a3d03a","sha512":"56ddd3d11dbc48945ddb2f9e252a622d1ecbf7f3e292eb60565e044d3e59f5546d8590271e55f8b79b6f6d1df5c6bdd76792c5e120a7399e53696ce6daa0a6b6","ssdeep":"","tlshash":"28e02b2f78835aa589ef279b1a1a53d9323841453051f101b8bc96409e94cae061fdc8","size":396,"data":"","first_seen":"2026-08-20T06:37:22.934876Z","last_seen":"2026-08-20T06:42:27.733521Z","times_seen":2,"alerts":{"ids":null,"analyzer":null,"urlquery":null}}],"eval":null,"write":null,"console":null},"http":[{"url":{"schema":"https","addr":"wwwallocation.com/","fqdn":"wwwallocation.com","domain":"wwwallocation.com","tld":"com"},"ip":{"addr":"216.198.79.1","port":443,"asn":16509,"as":"AMAZON-02","country":"United States","country_code":"US"},"is_navigation_request":true,"resource_type":"document","requested_by":"","date":"2026-08-20T06:42:00.201Z","timestamp":1787208120201,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"wwwallocation.com","organization":""},"issuer":{"commonName":"YR1","organization":"Let's Encrypt"},"validity":{"start":"Tue, 18 Aug 2026 12:06:32 GMT","end":"Mon, 16 Nov 2026 12:06:31 GMT"},"fingerprint":{"sha1":"23:C9:56:CE:26:F7:C5:27:57:46:62:3D:47:60:93:8F:D9:12:F0:90","sha256":"E0:73:7E:CA:D4:8A:B3:88:76:94:86:4A:EE:85:EF:A8:D9:65:B2:7E:AE:BD:30:75:74:7C:4E:A6:5A:FC:45:35"}}},"request":{"raw":"GET / HTTP/1.1\r\nHost: wwwallocation.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nUpgrade-Insecure-Requests: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: document\r\nSec-Fetch-Mode: navigate\r\nSec-Fetch-Site: none\r\nPriority: u=0, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 308 \r\ncache-control: public, max-age=0, must-revalidate\r\ncontent-type: text/html\r\ndate: Thu, 20 Aug 2026 06:42:00 GMT\r\nlocation: https://www.wwwallocation.com/\r\nrefresh: 0;url=https://www.wwwallocation.com/\r\nserver: Vercel\r\nstrict-transport-security: max-age=63072000\r\nx-vercel-id: arn1::2z8cn-1787208120281-7acba71a9c04\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"308","status_text":"Permanent Redirect","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Vercel","description":"Vercel is a cloud platform for static frontends and serverless functions.","website":"https://vercel.com","common_platform_enumeration":"","icon":"vercel.svg","categories":["PaaS"]}],"data":{"size":0,"size_decoded":0,"mime_type":"text/html; charset=utf-8","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-08-20T10:30:42.294956Z","times_seen":17988790,"resource_available":true,"data":null}},"time_used":87,"timings":{"blocked":0,"dns":44,"connect":2,"send":0,"wait":12,"receive":0,"ssl":29},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-08-20","alert":"Sinkholed","trigger":"wwwallocation.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"www.wwwallocation.com/","fqdn":"www.wwwallocation.com","domain":"wwwallocation.com","tld":"com"},"ip":{"addr":"216.198.79.1","port":443,"asn":16509,"as":"AMAZON-02","country":"United States","country_code":"US"},"is_navigation_request":true,"resource_type":"document","requested_by":"","date":"2026-08-20T06:42:00.304Z","timestamp":1787208120304,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"www.wwwallocation.com","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Tue, 18 Aug 2026 12:06:25 GMT","end":"Mon, 16 Nov 2026 12:06:24 GMT"},"fingerprint":{"sha1":"AA:C0:9C:FB:68:7E:53:D2:5B:AA:80:3D:7E:87:FA:54:7B:AD:19:88","sha256":"CD:C0:AF:AD:BA:1A:70:11:81:EF:A6:BA:D5:BB:86:A7:E1:5A:70:CA:E0:51:EB:59:61:1B:2D:C5:B6:86:B7:81"}}},"request":{"raw":"GET / HTTP/1.1\r\nHost: www.wwwallocation.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nUpgrade-Insecure-Requests: 1\r\nSec-Fetch-Dest: document\r\nSec-Fetch-Mode: navigate\r\nSec-Fetch-Site: none\r\nPriority: u=0, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 303 \r\ncache-control: public, max-age=0, must-revalidate\r\ncontent-type: text/html\r\ndate: Thu, 20 Aug 2026 06:42:00 GMT\r\nlocation: /login\r\nreferrer-policy: strict-origin-when-cross-origin\r\nserver: Vercel\r\nstrict-transport-security: max-age=63072000\r\nx-content-type-options: nosniff\r\nx-robots-tag: noindex, nofollow\r\nx-vercel-id: arn1::w6kpm-1787208120379-b84b9c164785\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"303","status_text":"See Other","fingerprints":[{"name":"Vercel","description":"Vercel is a cloud platform for static frontends and serverless functions.","website":"https://vercel.com","common_platform_enumeration":"","icon":"vercel.svg","categories":["PaaS"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":0,"size_decoded":0,"mime_type":"text/html; charset=utf-8","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-08-20T10:30:42.294956Z","times_seen":17988790,"resource_available":true,"data":null}},"time_used":84,"timings":{"blocked":0,"dns":36,"connect":2,"send":0,"wait":12,"receive":0,"ssl":33},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-08-20","alert":"Sinkholed","trigger":"www.wwwallocation.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"www.wwwallocation.com/login","fqdn":"www.wwwallocation.com","domain":"wwwallocation.com","tld":"com"},"ip":{"addr":"216.198.79.1","port":443,"asn":16509,"as":"AMAZON-02","country":"United States","country_code":"US"},"is_navigation_request":true,"resource_type":"document","requested_by":"","date":"2026-08-20T06:42:00.454Z","timestamp":1787208120454,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"www.wwwallocation.com","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Tue, 18 Aug 2026 12:06:25 GMT","end":"Mon, 16 Nov 2026 12:06:24 GMT"},"fingerprint":{"sha1":"AA:C0:9C:FB:68:7E:53:D2:5B:AA:80:3D:7E:87:FA:54:7B:AD:19:88","sha256":"CD:C0:AF:AD:BA:1A:70:11:81:EF:A6:BA:D5:BB:86:A7:E1:5A:70:CA:E0:51:EB:59:61:1B:2D:C5:B6:86:B7:81"}}},"request":{"raw":"GET /login HTTP/1.1\r\nHost: www.wwwallocation.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nUpgrade-Insecure-Requests: 1\r\nSec-Fetch-Dest: document\r\nSec-Fetch-Mode: navigate\r\nSec-Fetch-Site: none\r\nPriority: u=0, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\naccess-control-allow-origin: *\r\nage: 110367\r\ncache-control: public, max-age=0, must-revalidate\r\ncontent-disposition: inline; filename=\"login\"\r\ncontent-encoding: br\r\ncontent-type: text/html; charset=utf-8\r\ndate: Thu, 20 Aug 2026 06:42:00 GMT\r\netag: W/\"cc7be555bbcab07a66f973bed9c5ae94\"\r\nlast-modified: Wed, 19 Aug 2026 00:02:33 GMT\r\nreferrer-policy: strict-origin-when-cross-origin\r\nserver: Vercel\r\nstrict-transport-security: max-age=63072000\r\nx-content-type-options: nosniff\r\nx-robots-tag: noindex, nofollow\r\nx-vercel-cache: HIT\r\nx-vercel-id: arn1::95wqq-1787208120459-5d6950bc3fb9\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Vercel","description":"Vercel is a cloud platform for static frontends and serverless functions.","website":"https://vercel.com","common_platform_enumeration":"","icon":"vercel.svg","categories":["PaaS"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":4490,"size_decoded":2723,"mime_type":"text/html; charset=utf-8","magic":"HTML document, Unicode text, UTF-8 text, with very long lines (316)","md5":"cc7be555bbcab07a66f973bed9c5ae94","sha1":"a5ab53afcc4b7446e8cce7a5dc6f2f669e173f30","sha256":"de9dd4c0b9ec13002ebf1afca005b1cba92fe09ddab85432edf0e7a32e61ca5c","sha512":"dd5eb62997afade910688f2d98bdff32781a154595f21838f136dafb45cc0930d20541d817311fdaf19b12ccf21fbfd3c0dec377a1c648c077124757d1628543","ssdeep":"96:OLoYaZYOlQRJm6W5PpGtuh75oM/SnTunzLGK:KoY4YOeRJmb5RFJ/SKnzLGK","tlshash":"b691a696b1830872f926963d33da576a3306a023c102de347fd97318dfc56a682e67cc","first_seen":"2026-08-20T06:37:22.931824Z","last_seen":"2026-08-20T06:42:27.732718Z","times_seen":2,"resource_available":false,"data":null}},"time_used":12,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":12,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-08-20","alert":"Sinkholed","trigger":"www.wwwallocation.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}}]}