{"report_id":"3efb905d-28dc-4ca0-900a-2757e50445e1","version":6,"status":"done","tags":[],"date":"2025-12-18T11:10:21Z","url":{"schema":"http","addr":"mhgigt.blogspot.co.at/","fqdn":"mhgigt.blogspot.co.at","domain":"mhgigt.blogspot.co.at","tld":"blogspot.co.at"},"ip":{"addr":"216.58.207.225","port":0,"asn":15169,"as":"GOOGLE","country":"United States","country_code":"US"},"final":{"url":{"schema":"about","addr":"about:neterror?e=connectionFailure\u0026u=https%3A//proxette.cc/payouts/%3Fb%3DYTo0OntzOjU6ImxhYmVsIjtzOjA6IiI7czozOiJ1c3IiO2k6ODM5O3M6NDoibm9wZCI7czo5OiJnb3Byb3guY2MiO3M6MToibyI7aToxO30%3D\u0026c=UTF-8\u0026d=Firefox%20can%E2%80%99t%20establish%20a%20connection%20to%20the%20server%20at%20proxette.cc.","fqdn":"","domain":"","tld":""},"title":"Problem loading page","dom":{"size":8057,"mime_type":"text/html; charset=utf-8","magic":"JavaScript source, Unicode text, UTF-8 text, with very long lines (488)","md5":"000a3d8c43bb6600fcc29149153d33d3","sha1":"daf5e9ca669e20ca21372b0b4ffc1971cc68487f","sha256":"2abf2476105529d210a51a280ecb6f24b78eecb5e442b053c4be6fe0ae9415c2","sha512":"5639f6ab56b7665c02605a934958f485a6584d9514ce04ca074f03c4eb5145d0729274c3a7b6bc801fdce80d39b32b1ccf649beb9f926930724031e09a650f4f","ssdeep":"96:rhfVK40tVfrp1LS8k45USz+45RaIkata89+RzydNAIl9+kex8KdRonI7B1g/M:r3Gvjp1LS8LUSZRa2b9wm7I98IT","tlshash":"f2f171a462fa192b818386ed38d77509bd01d257d36c28e5bf6d05e10fc7da19c0f19b","dom_hash":"domhash00ae9e3bca261b1ffff94c1aaedb777d","first_seen":"","last_seen":"","times_seen":0,"resource_available":false,"data":null}},"submit":{"url":{"schema":"http","addr":"mhgigt.blogspot.co.at/","fqdn":"mhgigt.blogspot.co.at","domain":"mhgigt.blogspot.co.at","tld":"blogspot.co.at"},"ip":{"addr":"216.58.207.225","port":0,"asn":15169,"as":"GOOGLE","country":"United States","country_code":"US"},"tags":null,"meta":null},"settings":{"access":"public","device_type":"desktop","expires_at":"2027-01-22T11:10:21Z","useragent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0","referer":"","cookies":null,"exit_node":"z0yflva4pidy47h"},"stats":{"alert_count":{"ids":0,"urlquery":0,"analyzer":20}},"detection":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2025-12-18","alert":"Sinkholed","trigger":"sharkboss.top","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-12-18","alert":"Sinkholed","trigger":"sharkboss.top","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2025-12-18","alert":"Sinkholed","trigger":"sharkboss.top","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2025-12-18","alert":"Sinkholed","trigger":"goprox.cc","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"openphish","sensor_type":"Blocklist","title":"OpenPhish","description":"OpenPhish","scan_date":"2025-12-18","alert":"Phishing - Generic/Spear Phishing","trigger":"goprox.cc","verdict":"phishing","severity":"medium","comment":"Generic/Spear Phishing","link":"https://openphish.com/","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-12-18","alert":"Sinkholed","trigger":"goprox.cc","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2025-12-18","alert":"Sinkholed","trigger":"goprox.cc","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2025-12-18","alert":"Sinkholed","trigger":"proxette.cc","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2025-12-18","alert":"Sinkholed","trigger":"proxette.cc","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2025-12-18","alert":"Sinkholed","trigger":"proxette.cc","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2025-12-18","alert":"Sinkholed","trigger":"proxette.cc","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2025-12-18","alert":"Sinkholed","trigger":"proxette.cc","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"openphish","sensor_type":"Blocklist","title":"OpenPhish","description":"OpenPhish","scan_date":"2025-12-18","alert":"Phishing - Generic/Spear Phishing","trigger":"proxette.cc","verdict":"phishing","severity":"medium","comment":"Generic/Spear Phishing","link":"https://openphish.com/","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-12-18","alert":"Sinkholed","trigger":"proxette.cc","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2025-12-18","alert":"Sinkholed","trigger":"getk100.cc","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2025-12-18","alert":"Sinkholed","trigger":"getk100.cc","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-12-18","alert":"Sinkholed","trigger":"getk100.cc","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2025-12-18","alert":"Sinkholed","trigger":"dirtylk.cc","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2025-12-18","alert":"Sinkholed","trigger":"dirtylk.cc","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-12-18","alert":"Sinkholed","trigger":"dirtylk.cc","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null},"summary":[{"fqdn":"sharkboss.top","ip":{"addr":"172.67.129.154","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"domain_registered":"2023-09-07","domain_rank":3245438,"first_seen":"2023-11-08T09:35:58Z","last_seen":"2025-12-16T23:29:58.494947Z","alert_count":3,"request_count":1,"received_data":849,"sent_data":440,"comment":"","tags":null,"fingerprints":[{"name":"PHP","description":"PHP is a general-purpose scripting language used for web development.","website":"https://php.net","common_platform_enumeration":"cpe:2.3:a:php:php:*:*:*:*:*:*:*:*","icon":"PHP.svg","categories":["Programming languages"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}]},{"fqdn":"goprox.cc","ip":{"addr":"194.87.237.143","port":443,"asn":48347,"as":"JSC Mediasoft ekspert","country":"Russia","country_code":"RU"},"domain_registered":"2025-02-19","domain_rank":3827104,"first_seen":"2025-04-29T02:35:45.965806Z","last_seen":"2025-12-18T08:56:47.691762Z","alert_count":4,"request_count":1,"received_data":839,"sent_data":520,"comment":"","tags":null,"fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"PHP","description":"PHP is a general-purpose scripting language used for web development.","website":"https://php.net","common_platform_enumeration":"cpe:2.3:a:php:php:*:*:*:*:*:*:*:*","icon":"PHP.svg","categories":["Programming languages"]}]},{"fqdn":"proxette.cc","ip":{"addr":"0.0.0.0","port":0,"asn":0,"as":"","country":"","country_code":"zz"},"domain_registered":"2025-10-27","domain_rank":0,"first_seen":"2025-10-28T04:19:49.326234Z","last_seen":"2025-12-17T11:54:04.711659Z","alert_count":7,"request_count":1,"received_data":0,"sent_data":629,"comment":"","tags":null,"fingerprints":null},{"fqdn":"mhgigt.blogspot.co.at","ip":{"addr":"142.251.142.225","port":443,"asn":15169,"as":"GOOGLE","country":"United States","country_code":"US"},"domain_registered":"unknown","domain_rank":0,"first_seen":"2025-12-18T11:10:21.574127Z","last_seen":"2025-12-18T11:10:21.574127Z","alert_count":0,"request_count":1,"received_data":66877,"sent_data":490,"comment":"","tags":null,"fingerprints":[{"name":"OpenGSE","description":"OpenGSE is a test suite used for testing servlet compliance. It is deployed by using WAR files that are deployed on the server engine.","website":"https://code.google.com/p/opengse","common_platform_enumeration":"","icon":"Google.svg","categories":["Web servers"]},{"name":"Java","description":"Java is a class-based, object-oriented programming language that is designed to have as few implementation dependencies as possible.","website":"https://java.com","common_platform_enumeration":"cpe:2.3:a:oracle:jre:*:*:*:*:*:*:*:*","icon":"Java.svg","categories":["Programming languages"]}]},{"fqdn":"getk100.cc","ip":{"addr":"185.208.156.66","port":443,"asn":42624,"as":"Global-Data System IT Corporation","country":"Seychelles","country_code":"SC"},"domain_registered":"2025-06-04","domain_rank":3318541,"first_seen":"2025-06-04T22:00:32.39979Z","last_seen":"2025-12-16T03:11:12.166747Z","alert_count":6,"request_count":2,"received_data":1301,"sent_data":1050,"comment":"","tags":null,"fingerprints":[{"name":"LiteSpeed","description":"LiteSpeed is a high-scalability web server.","website":"https://litespeedtech.com","common_platform_enumeration":"cpe:2.3:a:litespeedtech:litespeed_web_server:*:*:*:*:*:*:*:*","icon":"LiteSpeed.svg","categories":["Web servers"]}]},{"fqdn":"dirtylk.cc","ip":{"addr":"185.208.156.66","port":443,"asn":42624,"as":"Global-Data System IT Corporation","country":"Seychelles","country_code":"SC"},"domain_registered":"2025-10-10","domain_rank":0,"first_seen":"2025-10-10T15:16:48.632367Z","last_seen":"2025-12-16T03:11:09.776964Z","alert_count":9,"request_count":3,"received_data":2920,"sent_data":1471,"comment":"","tags":null,"fingerprints":[{"name":"LiteSpeed","description":"LiteSpeed is a high-scalability web server.","website":"https://litespeedtech.com","common_platform_enumeration":"cpe:2.3:a:litespeedtech:litespeed_web_server:*:*:*:*:*:*:*:*","icon":"LiteSpeed.svg","categories":["Web servers"]}]},{"fqdn":"mhgigt.blogspot.com","ip":{"addr":"142.251.142.225","port":443,"asn":15169,"as":"GOOGLE","country":"United States","country_code":"US"},"domain_registered":"2000-07-31","domain_rank":0,"first_seen":"2025-11-14T15:28:16.854935Z","last_seen":"2025-11-14T15:28:16.854935Z","alert_count":0,"request_count":1,"received_data":66880,"sent_data":488,"comment":"","tags":null,"fingerprints":[{"name":"Python","description":"Python is an interpreted and general-purpose programming language.","website":"https://python.org","common_platform_enumeration":"cpe:2.3:a:python:python:*:*:*:*:*:*:*:*","icon":"Python.png","categories":["Programming languages"]},{"name":"Clipboard.js","description":"","website":"https://clipboardjs.com/","common_platform_enumeration":"","icon":"Clipboard.js.svg","categories":["JavaScript libraries"]},{"name":"OpenGSE","description":"OpenGSE is a test suite used for testing servlet compliance. It is deployed by using WAR files that are deployed on the server engine.","website":"https://code.google.com/p/opengse","common_platform_enumeration":"","icon":"Google.svg","categories":["Web servers"]},{"name":"Java","description":"Java is a class-based, object-oriented programming language that is designed to have as few implementation dependencies as possible.","website":"https://java.com","common_platform_enumeration":"cpe:2.3:a:oracle:jre:*:*:*:*:*:*:*:*","icon":"Java.svg","categories":["Programming languages"]},{"name":"Blogger","description":"Blogger is a blog-publishing service that allows multi-user blogs with time-stamped entries.","website":"https://www.blogger.com","common_platform_enumeration":"","icon":"Blogger.png","categories":["Blogs"]}]}],"files":null,"artifacts":{"windows_shortcuts":null,"files":null,"telegram":null,"pdfs":null,"clipboard":null},"sensors":{"ids":null,"analyzer":null,"urlquery":null},"javascript":{"script":null,"eval":null,"write":null,"console":null},"http":[{"url":{"schema":"https","addr":"sharkboss.top/share/get_redir.php","fqdn":"sharkboss.top","domain":"sharkboss.top","tld":"top"},"ip":{"addr":"172.67.129.154","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"fetch","requested_by":"https://dirtylk.cc/clear.html","date":"2025-12-18T11:10:01.233Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"sharkboss.top","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Sun, 14 Dec 2025 08:07:09 GMT","end":"Sat, 14 Mar 2026 09:05:44 GMT"},"fingerprint":{"sha1":"94:39:AE:2E:8A:5A:61:BD:56:04:CD:55:24:9B:8A:DA:F4:B9:F4:67","sha256":"86:C8:EC:D0:E2:C5:E3:F9:09:55:A1:30:28:C6:63:91:89:CE:2B:2B:53:C2:D1:C6:08:6C:DB:61:76:DA:77:98"}}},"request":{"raw":"GET /share/get_redir.php HTTP/1.1\r\nHost: sharkboss.top\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://dirtylk.cc/\r\nOrigin: https://dirtylk.cc\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ndate: Thu, 18 Dec 2025 11:10:01 GMT\r\ncontent-type: text/html; charset=UTF-8\r\nserver: cloudflare\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nset-cookie: PHPSESSID=a03dopdh26odi661r49fkprucn; expires=Thu, 16 Feb 2045 11:10:01 GMT; Max-Age=604800000; path=/; domain=sharkboss.top\r\nexpires: Thu, 19 Nov 1981 08:52:00 GMT\r\ncache-control: no-store, no-cache, must-revalidate\r\npragma: no-cache\r\naccess-control-allow-origin: *\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=ZtEoFTcJoYmT0TJSJXWiRw1M%2Fu8DGvPniYYbV4u5MrMl7eG4wAKuqkIDMOKNSW014XRgIT%2F7Ea5zCdajEI8d8iEuOZQNTo1vUDWb\"}]}\r\ncf-cache-status: DYNAMIC\r\nvary: accept-encoding\r\ncontent-encoding: br\r\ncf-ray: 9afe3619c9ed0afe-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"PHP","description":"PHP is a general-purpose scripting language used for web development.","website":"https://php.net","common_platform_enumeration":"cpe:2.3:a:php:php:*:*:*:*:*:*:*:*","icon":"PHP.svg","categories":["Programming languages"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":17,"size_decoded":0,"mime_type":"text/html; charset=UTF-8","magic":"ASCII text, with no line terminators","md5":"44918b3b018c62f7a363a2e16c1511cc","sha1":"a2d2037e3ef6bc7679ef082c3e089e7bcc03060e","sha256":"baeb14fdfeb2a2ad6f4b6beb052a893993909e0662b4a4409faf66cb6b3517b0","sha512":"9435e7ea5a7828164549d018deee0281baf62043b53f8c057b4b4fa392058522d1af01d37545a0c890e9a4789b2bc2df371953791b0d582d0731adf3546b6ac6","ssdeep":"","tlshash":"8f6000238000000e220800b0082a202c0082080a0c882c0c8020800000000280000220","first_seen":"2025-07-24T11:19:38.15304Z","last_seen":"2025-12-19T20:55:30.263669Z","times_seen":2844,"resource_available":false,"data":null}},"time_used":104,"timings":{"blocked":14,"dns":1,"connect":1,"send":0,"wait":68,"receive":0,"ssl":17},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2025-12-18","alert":"Sinkholed","trigger":"sharkboss.top","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-12-18","alert":"Sinkholed","trigger":"sharkboss.top","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2025-12-18","alert":"Sinkholed","trigger":"sharkboss.top","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"goprox.cc/go/539433/y2","fqdn":"goprox.cc","domain":"goprox.cc","tld":"cc"},"ip":{"addr":"194.87.237.143","port":443,"asn":48347,"as":"JSC Mediasoft ekspert","country":"Russia","country_code":"RU"},"is_navigation_request":true,"resource_type":"document","requested_by":"","date":"2025-12-18T11:10:01.359Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"goprox.cc","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Sun, 02 Nov 2025 00:51:53 GMT","end":"Sat, 31 Jan 2026 00:51:52 GMT"},"fingerprint":{"sha1":"5A:D1:58:7E:EE:77:72:EF:FE:A1:33:2C:4B:6B:C3:C2:4A:DA:67:39","sha256":"2A:64:AF:10:56:65:21:E5:AB:D9:A9:C5:A6:68:37:D3:87:BC:44:09:C7:F1:E5:FC:4D:7D:22:AA:F4:3B:69:B4"}}},"request":{"raw":"GET /go/539433/y2 HTTP/1.1\r\nHost: goprox.cc\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://dirtylk.cc/\r\nUpgrade-Insecure-Requests: 1\r\nSec-Fetch-Dest: document\r\nSec-Fetch-Mode: navigate\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 302 Found\r\nServer: nginx\r\nDate: Thu, 18 Dec 2025 11:10:01 GMT\r\nContent-Type: text/html; charset=UTF-8\r\nTransfer-Encoding: chunked\r\nConnection: keep-alive\r\nExpires: Sun, 01 Jan 2014 00:00:00 GMT\r\nCache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0\r\nPragma: no-cache\r\nSet-Cookie: PHPSESSID=ff983a1995cd6a6ef35aeb5318949ac5; expires=Thu, 16-Feb-2045 11:10:01 GMT; Max-Age=604800000; path=/; domain=goprox.cc\nofr_1=a%3A4%3A%7Bs%3A5%3A%22label%22%3Bs%3A0%3A%22%22%3Bs%3A3%3A%22usr%22%3Bi%3A839%3Bs%3A4%3A%22nopd%22%3Bs%3A9%3A%22goprox.cc%22%3Bs%3A1%3A%22o%22%3Bi%3A1%3B%7D; expires=Sun, 18-Jan-2026 11:10:01 GMT; Max-Age=2678400; path=/; domain=goprox.cc\r\nLocation: https://proxette.cc/payouts/?b=YTo0OntzOjU6ImxhYmVsIjtzOjA6IiI7czozOiJ1c3IiO2k6ODM5O3M6NDoibm9wZCI7czo5OiJnb3Byb3guY2MiO3M6MToibyI7aToxO30=\r\n\r\n","headers":null,"cookies":null,"status_code":"302","status_text":"Found","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"PHP","description":"PHP is a general-purpose scripting language used for web development.","website":"https://php.net","common_platform_enumeration":"cpe:2.3:a:php:php:*:*:*:*:*:*:*:*","icon":"PHP.svg","categories":["Programming languages"]}],"data":{"size":0,"size_decoded":0,"mime_type":"","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-08-01T03:32:41.833207Z","times_seen":17645779,"resource_available":true,"data":null}},"time_used":971,"timings":{"blocked":435,"dns":283,"connect":31,"send":0,"wait":100,"receive":0,"ssl":118},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2025-12-18","alert":"Sinkholed","trigger":"goprox.cc","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"openphish","sensor_type":"Blocklist","title":"OpenPhish","description":"OpenPhish","scan_date":"2025-12-18","alert":"Phishing - Generic/Spear Phishing","trigger":"goprox.cc","verdict":"phishing","severity":"medium","comment":"Generic/Spear Phishing","link":"https://openphish.com/","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-12-18","alert":"Sinkholed","trigger":"goprox.cc","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2025-12-18","alert":"Sinkholed","trigger":"goprox.cc","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"proxette.cc/payouts/?b=YTo0OntzOjU6ImxhYmVsIjtzOjA6IiI7czozOiJ1c3IiO2k6ODM5O3M6NDoibm9wZCI7czo5OiJnb3Byb3guY2MiO3M6MToibyI7aToxO30=","fqdn":"proxette.cc","domain":"proxette.cc","tld":"cc"},"ip":{"addr":"0.0.0.0","port":0,"asn":0,"as":"","country":"","country_code":"zz"},"is_navigation_request":true,"resource_type":"document","requested_by":"","date":"2025-12-18T11:10:01.899Z","timestamp":0,"http_version":"","security_state":"insecure","security_info":null,"request":{"raw":"GET /payouts/?b=YTo0OntzOjU6ImxhYmVsIjtzOjA6IiI7czozOiJ1c3IiO2k6ODM5O3M6NDoibm9wZCI7czo5OiJnb3Byb3guY2MiO3M6MToibyI7aToxO30= HTTP/1.1\r\nHost: proxette.cc\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://dirtylk.cc/\r\nDNT: 1\r\nConnection: keep-alive\r\nUpgrade-Insecure-Requests: 1\r\nSec-Fetch-Dest: document\r\nSec-Fetch-Mode: navigate\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"","headers":null,"cookies":null,"status_code":"","status_text":"","fingerprints":null,"data":{"size":0,"size_decoded":0,"mime_type":"","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-08-01T03:32:41.833207Z","times_seen":17645779,"resource_available":true,"data":null}},"time_used":647,"timings":{"blocked":647,"dns":0,"connect":0,"send":0,"wait":0,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2025-12-18","alert":"Sinkholed","trigger":"proxette.cc","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2025-12-18","alert":"Sinkholed","trigger":"proxette.cc","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2025-12-18","alert":"Sinkholed","trigger":"proxette.cc","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2025-12-18","alert":"Sinkholed","trigger":"proxette.cc","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2025-12-18","alert":"Sinkholed","trigger":"proxette.cc","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"openphish","sensor_type":"Blocklist","title":"OpenPhish","description":"OpenPhish","scan_date":"2025-12-18","alert":"Phishing - Generic/Spear Phishing","trigger":"proxette.cc","verdict":"phishing","severity":"medium","comment":"Generic/Spear Phishing","link":"https://openphish.com/","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-12-18","alert":"Sinkholed","trigger":"proxette.cc","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"mhgigt.blogspot.co.at/","fqdn":"mhgigt.blogspot.co.at","domain":"mhgigt.blogspot.co.at","tld":"blogspot.co.at"},"ip":{"addr":"142.251.142.225","port":443,"asn":15169,"as":"GOOGLE","country":"United States","country_code":"US"},"is_navigation_request":true,"resource_type":"document","requested_by":"","date":"2025-12-18T11:09:59.125Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"misc-sni.blogspot.com","organization":""},"issuer":{"commonName":"WR2","organization":"Google Trust Services"},"validity":{"start":"Mon, 24 Nov 2025 08:39:53 GMT","end":"Mon, 16 Feb 2026 08:39:52 GMT"},"fingerprint":{"sha1":"3F:82:DC:44:84:68:F4:B2:2F:EF:70:07:8C:C9:76:06:40:BA:9F:E5","sha256":"6F:4A:B5:8F:2B:3C:09:FB:1C:76:9D:D2:E2:5F:70:C5:23:9E:5B:68:5A:2B:92:52:73:7C:2D:8C:22:6F:93:B7"}}},"request":{"raw":"GET / HTTP/1.1\r\nHost: mhgigt.blogspot.co.at\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nUpgrade-Insecure-Requests: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: document\r\nSec-Fetch-Mode: navigate\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 302 Found\r\nlocation: https://mhgigt.blogspot.com/\r\ncontent-type: text/html; charset=UTF-8\r\ncontent-encoding: gzip\r\ndate: Thu, 18 Dec 2025 11:09:59 GMT\r\nexpires: Thu, 18 Dec 2025 11:09:59 GMT\r\ncache-control: private, max-age=0\r\nx-content-type-options: nosniff\r\nx-frame-options: SAMEORIGIN\r\ncontent-security-policy: frame-ancestors 'self'\r\nx-xss-protection: 1; mode=block\r\ncontent-length: 195\r\nserver: GSE\r\nalt-svc: h3=\":443\"; ma=2592000,h3-29=\":443\"; ma=2592000\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"302","status_text":"Found","fingerprints":[{"name":"OpenGSE","description":"OpenGSE is a test suite used for testing servlet compliance. It is deployed by using WAR files that are deployed on the server engine.","website":"https://code.google.com/p/opengse","common_platform_enumeration":"","icon":"Google.svg","categories":["Web servers"]},{"name":"Java","description":"Java is a class-based, object-oriented programming language that is designed to have as few implementation dependencies as possible.","website":"https://java.com","common_platform_enumeration":"cpe:2.3:a:oracle:jre:*:*:*:*:*:*:*:*","icon":"Java.svg","categories":["Programming languages"]}],"data":{"size":66386,"size_decoded":0,"mime_type":"text/html; charset=UTF-8","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-08-01T03:32:41.833207Z","times_seen":17645779,"resource_available":true,"data":null}},"time_used":395,"timings":{"blocked":132,"dns":45,"connect":21,"send":0,"wait":131,"receive":0,"ssl":63},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"getk100.cc/tt/811","fqdn":"getk100.cc","domain":"getk100.cc","tld":"cc"},"ip":{"addr":"185.208.156.66","port":443,"asn":42624,"as":"Global-Data System IT Corporation","country":"Seychelles","country_code":"SC"},"is_navigation_request":true,"resource_type":"document","requested_by":"","date":"2025-12-18T11:10:00.541Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"getk100.cc","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Tue, 16 Dec 2025 12:58:16 GMT","end":"Mon, 16 Mar 2026 12:58:15 GMT"},"fingerprint":{"sha1":"BF:50:95:73:77:2E:B4:90:15:5E:70:E0:94:84:CE:67:65:18:8F:99","sha256":"E2:B4:9F:17:13:41:92:CA:53:81:74:87:5F:DE:77:C0:36:8A:B2:D9:8E:B8:5D:DC:88:49:1F:F7:13:CC:A2:28"}}},"request":{"raw":"GET /tt/811 HTTP/1.1\r\nHost: getk100.cc\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://mhgigt.blogspot.com/\r\nUpgrade-Insecure-Requests: 1\r\nSec-Fetch-Dest: document\r\nSec-Fetch-Mode: navigate\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 301 Moved Permanently\r\ncontent-type: text/html\r\ncontent-length: 795\r\ndate: Thu, 18 Dec 2025 11:10:00 GMT\r\nserver: LiteSpeed\r\nlocation: https://getk100.cc/qwe.html\r\nalt-svc: h3=\":443\"; ma=2592000, h3-29=\":443\"; ma=2592000, h3-Q050=\":443\"; ma=2592000, h3-Q046=\":443\"; ma=2592000, h3-Q043=\":443\"; ma=2592000, quic=\":443\"; ma=2592000; v=\"43,46\"\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"301","status_text":"Moved Permanently","fingerprints":[{"name":"LiteSpeed","description":"LiteSpeed is a high-scalability web server.","website":"https://litespeedtech.com","common_platform_enumeration":"cpe:2.3:a:litespeedtech:litespeed_web_server:*:*:*:*:*:*:*:*","icon":"LiteSpeed.svg","categories":["Web servers"]}],"data":{"size":349,"size_decoded":0,"mime_type":"text/html","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-08-01T03:32:41.833207Z","times_seen":17645779,"resource_available":true,"data":null}},"time_used":337,"timings":{"blocked":149,"dns":69,"connect":37,"send":0,"wait":36,"receive":0,"ssl":42},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2025-12-18","alert":"Sinkholed","trigger":"getk100.cc","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2025-12-18","alert":"Sinkholed","trigger":"getk100.cc","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-12-18","alert":"Sinkholed","trigger":"getk100.cc","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"getk100.cc/qwe.html","fqdn":"getk100.cc","domain":"getk100.cc","tld":"cc"},"ip":{"addr":"185.208.156.66","port":443,"asn":42624,"as":"Global-Data System IT Corporation","country":"Seychelles","country_code":"SC"},"is_navigation_request":true,"resource_type":"document","requested_by":"","date":"2025-12-18T11:10:00.781Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"getk100.cc","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Tue, 16 Dec 2025 12:58:16 GMT","end":"Mon, 16 Mar 2026 12:58:15 GMT"},"fingerprint":{"sha1":"BF:50:95:73:77:2E:B4:90:15:5E:70:E0:94:84:CE:67:65:18:8F:99","sha256":"E2:B4:9F:17:13:41:92:CA:53:81:74:87:5F:DE:77:C0:36:8A:B2:D9:8E:B8:5D:DC:88:49:1F:F7:13:CC:A2:28"}}},"request":{"raw":"GET /qwe.html HTTP/1.1\r\nHost: getk100.cc\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://mhgigt.blogspot.com/\r\nDNT: 1\r\nConnection: keep-alive\r\nUpgrade-Insecure-Requests: 1\r\nSec-Fetch-Dest: document\r\nSec-Fetch-Mode: navigate\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\ncontent-type: text/html\r\nlast-modified: Thu, 16 Oct 2025 15:22:30 GMT\r\naccept-ranges: bytes\r\ncontent-encoding: br\r\nvary: Accept-Encoding\r\ncontent-length: 189\r\ndate: Thu, 18 Dec 2025 11:09:31 GMT\r\nserver: LiteSpeed\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"LiteSpeed","description":"LiteSpeed is a high-scalability web server.","website":"https://litespeedtech.com","common_platform_enumeration":"cpe:2.3:a:litespeedtech:litespeed_web_server:*:*:*:*:*:*:*:*","icon":"LiteSpeed.svg","categories":["Web servers"]}],"data":{"size":349,"size_decoded":0,"mime_type":"text/html","magic":"HTML document, ASCII text, with CRLF line terminators","md5":"9e2ab1004eea81f7395b59f81abfc2e7","sha1":"5c2a02ad88bd5ff3e0df54bd9380f0e7a40f1443","sha256":"2a65daeb1e22481a08900cb7c9f98a3e90f4f38c567a8703dda3f40d47b5248f","sha512":"5931f9b0f804247ce1146917f72574bfc6fef223a3f0a4d80ffbedd8661f93d02c4adfde86a4e17bee76c3e4afcb511119ae8409d69cdb730801f00a892c7d26","ssdeep":"","tlshash":"44e0d8a735806c0415f092666b95b16cbc93905a0689ae5bb1c426271da535589930c3","first_seen":"2025-10-16T21:07:06.243683Z","last_seen":"2026-01-05T14:33:45.324133Z","times_seen":896,"resource_available":false,"data":null}},"time_used":0,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":0,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2025-12-18","alert":"Sinkholed","trigger":"getk100.cc","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2025-12-18","alert":"Sinkholed","trigger":"getk100.cc","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-12-18","alert":"Sinkholed","trigger":"getk100.cc","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"dirtylk.cc/ops/55","fqdn":"dirtylk.cc","domain":"dirtylk.cc","tld":"cc"},"ip":{"addr":"185.208.156.66","port":443,"asn":42624,"as":"Global-Data System IT Corporation","country":"Seychelles","country_code":"SC"},"is_navigation_request":true,"resource_type":"document","requested_by":"","date":"2025-12-18T11:10:00.933Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.dirtylk.cc","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Tue, 16 Dec 2025 16:00:16 GMT","end":"Mon, 16 Mar 2026 16:00:15 GMT"},"fingerprint":{"sha1":"DF:9D:83:FC:17:35:A1:35:B8:8E:FA:F6:20:2C:0A:4A:D4:49:D1:2F","sha256":"14:A2:6B:6A:D6:0C:20:EB:78:33:C6:86:7F:C6:3D:94:9B:76:98:45:9B:55:6F:72:B5:1A:64:E7:2E:60:45:6E"}}},"request":{"raw":"GET /ops/55 HTTP/1.1\r\nHost: dirtylk.cc\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://getk100.cc/\r\nUpgrade-Insecure-Requests: 1\r\nSec-Fetch-Dest: document\r\nSec-Fetch-Mode: navigate\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 302 Found\r\ncontent-type: text/html\r\ncontent-length: 771\r\ndate: Thu, 18 Dec 2025 11:10:01 GMT\r\nserver: LiteSpeed\r\ncache-control: no-cache, no-store, must-revalidate, max-age=0\r\nlocation: https://dirtylk.cc/clear.html\r\nalt-svc: h3=\":443\"; ma=2592000, h3-29=\":443\"; ma=2592000, h3-Q050=\":443\"; ma=2592000, h3-Q046=\":443\"; ma=2592000, h3-Q043=\":443\"; ma=2592000, quic=\":443\"; ma=2592000; v=\"43,46\"\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"302","status_text":"Found","fingerprints":[{"name":"LiteSpeed","description":"LiteSpeed is a high-scalability web server.","website":"https://litespeedtech.com","common_platform_enumeration":"cpe:2.3:a:litespeedtech:litespeed_web_server:*:*:*:*:*:*:*:*","icon":"LiteSpeed.svg","categories":["Web servers"]}],"data":{"size":1122,"size_decoded":0,"mime_type":"text/html","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-08-01T03:32:41.833207Z","times_seen":17645779,"resource_available":true,"data":null}},"time_used":204,"timings":{"blocked":82,"dns":1,"connect":37,"send":0,"wait":38,"receive":0,"ssl":43},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2025-12-18","alert":"Sinkholed","trigger":"dirtylk.cc","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2025-12-18","alert":"Sinkholed","trigger":"dirtylk.cc","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-12-18","alert":"Sinkholed","trigger":"dirtylk.cc","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"dirtylk.cc/clear.html","fqdn":"dirtylk.cc","domain":"dirtylk.cc","tld":"cc"},"ip":{"addr":"185.208.156.66","port":443,"asn":42624,"as":"Global-Data System IT Corporation","country":"Seychelles","country_code":"SC"},"is_navigation_request":true,"resource_type":"document","requested_by":"","date":"2025-12-18T11:10:01.058Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.dirtylk.cc","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Tue, 16 Dec 2025 16:00:16 GMT","end":"Mon, 16 Mar 2026 16:00:15 GMT"},"fingerprint":{"sha1":"DF:9D:83:FC:17:35:A1:35:B8:8E:FA:F6:20:2C:0A:4A:D4:49:D1:2F","sha256":"14:A2:6B:6A:D6:0C:20:EB:78:33:C6:86:7F:C6:3D:94:9B:76:98:45:9B:55:6F:72:B5:1A:64:E7:2E:60:45:6E"}}},"request":{"raw":"GET /clear.html HTTP/1.1\r\nHost: dirtylk.cc\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://getk100.cc/\r\nDNT: 1\r\nConnection: keep-alive\r\nUpgrade-Insecure-Requests: 1\r\nSec-Fetch-Dest: document\r\nSec-Fetch-Mode: navigate\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ncontent-type: text/html\r\nlast-modified: Tue, 09 Dec 2025 14:29:56 GMT\r\naccept-ranges: bytes\r\ncontent-encoding: br\r\nvary: Accept-Encoding\r\ncontent-length: 526\r\ndate: Thu, 18 Dec 2025 11:10:01 GMT\r\nserver: LiteSpeed\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"LiteSpeed","description":"LiteSpeed is a high-scalability web server.","website":"https://litespeedtech.com","common_platform_enumeration":"cpe:2.3:a:litespeedtech:litespeed_web_server:*:*:*:*:*:*:*:*","icon":"LiteSpeed.svg","categories":["Web servers"]}],"data":{"size":1122,"size_decoded":0,"mime_type":"text/html","magic":"HTML document, Unicode text, UTF-8 text, with CRLF line terminators","md5":"78aa659b62ac1724d34ba2180abf36cf","sha1":"c24505747f56b0e658f87e9f165c78d5107f6ff4","sha256":"979e108523e208ec475263ad8f0f8ca44bacbf0bc893ed6dfa9e850712fdb750","sha512":"3a72b648297d37cd6728f758a8da9033174d0cc581dce83c99081924e1d2d38fa158d0318611c684d376c5767f75ac40993fd717121d68a4aabe8a5765d7e330","ssdeep":"","tlshash":"5c21ef9e041708148bf1e3786793b108f25751af1a8ed6657edc82237f703a98e92bcd","first_seen":"2025-12-09T18:57:44.654223Z","last_seen":"2026-01-12T02:27:22.542675Z","times_seen":750,"resource_available":false,"data":null}},"time_used":39,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":39,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2025-12-18","alert":"Sinkholed","trigger":"dirtylk.cc","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2025-12-18","alert":"Sinkholed","trigger":"dirtylk.cc","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-12-18","alert":"Sinkholed","trigger":"dirtylk.cc","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"dirtylk.cc/favicon.ico","fqdn":"dirtylk.cc","domain":"dirtylk.cc","tld":"cc"},"ip":{"addr":"0.0.0.0","port":0,"asn":0,"as":"","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://dirtylk.cc/clear.html","date":"2025-12-18T11:10:01.352Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.dirtylk.cc","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Tue, 16 Dec 2025 16:00:16 GMT","end":"Mon, 16 Mar 2026 16:00:15 GMT"},"fingerprint":{"sha1":"DF:9D:83:FC:17:35:A1:35:B8:8E:FA:F6:20:2C:0A:4A:D4:49:D1:2F","sha256":"14:A2:6B:6A:D6:0C:20:EB:78:33:C6:86:7F:C6:3D:94:9B:76:98:45:9B:55:6F:72:B5:1A:64:E7:2E:60:45:6E"}}},"request":{"raw":"GET /favicon.ico HTTP/1.1\r\nHost: dirtylk.cc\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://dirtylk.cc/clear.html\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"","headers":null,"cookies":null,"status_code":"","status_text":"","fingerprints":null,"data":{"size":0,"size_decoded":0,"mime_type":"","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-08-01T03:32:41.833207Z","times_seen":17645779,"resource_available":true,"data":null}},"time_used":0,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":0,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2025-12-18","alert":"Sinkholed","trigger":"dirtylk.cc","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2025-12-18","alert":"Sinkholed","trigger":"dirtylk.cc","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-12-18","alert":"Sinkholed","trigger":"dirtylk.cc","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"mhgigt.blogspot.com/","fqdn":"mhgigt.blogspot.com","domain":"mhgigt.blogspot.com","tld":"blogspot.com"},"ip":{"addr":"142.251.142.225","port":443,"asn":15169,"as":"GOOGLE","country":"United States","country_code":"US"},"is_navigation_request":true,"resource_type":"document","requested_by":"","date":"2025-12-18T11:09:59.395Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"misc-sni.blogspot.com","organization":""},"issuer":{"commonName":"WR2","organization":"Google Trust Services"},"validity":{"start":"Mon, 24 Nov 2025 08:39:53 GMT","end":"Mon, 16 Feb 2026 08:39:52 GMT"},"fingerprint":{"sha1":"3F:82:DC:44:84:68:F4:B2:2F:EF:70:07:8C:C9:76:06:40:BA:9F:E5","sha256":"6F:4A:B5:8F:2B:3C:09:FB:1C:76:9D:D2:E2:5F:70:C5:23:9E:5B:68:5A:2B:92:52:73:7C:2D:8C:22:6F:93:B7"}}},"request":{"raw":"GET / HTTP/1.1\r\nHost: mhgigt.blogspot.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nUpgrade-Insecure-Requests: 1\r\nSec-Fetch-Dest: document\r\nSec-Fetch-Mode: navigate\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ncontent-type: text/html; charset=UTF-8\r\nexpires: Thu, 18 Dec 2025 11:10:00 GMT\r\ndate: Thu, 18 Dec 2025 11:10:00 GMT\r\ncache-control: private, max-age=0\r\nlast-modified: Fri, 18 Jul 2025 01:22:19 GMT\r\netag: W/\"bfc475fd1e9a3c12d75a0810106c69fd562bfd559c58075dbfbafdc99d6cdd4d\"\r\ncontent-encoding: gzip\r\nx-content-type-options: nosniff\r\nx-xss-protection: 1; mode=block\r\ncontent-length: 14726\r\nserver: GSE\r\nalt-svc: h3=\":443\"; ma=2592000,h3-29=\":443\"; ma=2592000\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Python","description":"Python is an interpreted and general-purpose programming language.","website":"https://python.org","common_platform_enumeration":"cpe:2.3:a:python:python:*:*:*:*:*:*:*:*","icon":"Python.png","categories":["Programming languages"]},{"name":"Clipboard.js","description":"","website":"https://clipboardjs.com/","common_platform_enumeration":"","icon":"Clipboard.js.svg","categories":["JavaScript libraries"]},{"name":"OpenGSE","description":"OpenGSE is a test suite used for testing servlet compliance. It is deployed by using WAR files that are deployed on the server engine.","website":"https://code.google.com/p/opengse","common_platform_enumeration":"","icon":"Google.svg","categories":["Web servers"]},{"name":"Java","description":"Java is a class-based, object-oriented programming language that is designed to have as few implementation dependencies as possible.","website":"https://java.com","common_platform_enumeration":"cpe:2.3:a:oracle:jre:*:*:*:*:*:*:*:*","icon":"Java.svg","categories":["Programming languages"]},{"name":"Blogger","description":"Blogger is a blog-publishing service that allows multi-user blogs with time-stamped entries.","website":"https://www.blogger.com","common_platform_enumeration":"","icon":"Blogger.png","categories":["Blogs"]}],"data":{"size":66386,"size_decoded":0,"mime_type":"text/html; charset=UTF-8","magic":"HTML document, ASCII text, with very long lines (5299)","md5":"9cad9ce7b2006d64eddb382882f8866c","sha1":"b243bfa5768bc06cb6123d74775a9c1b2fb5b299","sha256":"ff16e6b6949bf91238de64700c82ecabf3c1c5b60ef421c01a72f6f815211702","sha512":"c01bbf16d896655f2c5d2f9bff1716b4a6900f8809123e1d9d2e7c350f79f365bcf411182eebd61b837e686eaf31e8539550bbacb006e4881a4ad722ec62c774","ssdeep":"768:JylLz8bRNv+f5AfpUxnHeob4f1u0eJwO0H+UJFut0coVE1vpg2X7X:JyK6n969VE1vpzX","tlshash":"ac530a7765623e0d9233480cb8c5b6c87b19c453c40759ede9baa62cc3cbdc69172b6e","first_seen":"2025-12-18T11:10:27.901278Z","last_seen":"2025-12-18T11:10:27.901278Z","times_seen":1,"resource_available":false,"data":null}},"time_used":861,"timings":{"blocked":111,"dns":55,"connect":8,"send":0,"wait":599,"receive":39,"ssl":44},"alerts":{"ids":null,"analyzer":null,"urlquery":null}}]}