{"report_id":"42e9e6c3-80a0-4104-b039-4b7108a34379","version":6,"status":"done","tags":[],"date":"2026-02-22T13:54:55Z","url":{"schema":"http","addr":"dewa.baaauae.com","fqdn":"dewa.baaauae.com","domain":"baaauae.com","tld":"com"},"ip":{"addr":"104.21.46.124","port":0,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"final":{"url":{"schema":"http","addr":"dewa.baaauae.com/dashboard/","fqdn":"dewa.baaauae.com","domain":"baaauae.com","tld":"com"},"title":"Welcome to XAMPP","dom":{"size":12272,"mime_type":"text/html; charset=utf-8","magic":"HTML document, Unicode text, UTF-8 text, with very long lines (4193)","md5":"9af2f47c392b7e8e3f1c3e0f4470c096","sha1":"9510ce28689bb9488e4c9564874b50dd2423fb21","sha256":"52789245ea8ad01e874bd469e7f30613469e185e2222ac68c8dbafade7bc7b79","sha512":"672c35d88c135d5c8476f46c4d5f557b42f604435a66929aeb331cf3e6119f2f328db6ae9597d69ddafb6b9fdd05f7434a35f56754983b824f089ad58ab2eb1f","ssdeep":"192:BZgCgNiS2ADiDfj6w15BQq/qqira/VozWy:BZgvNNDiDfj6w15lSqIaNozWy","tlshash":"0c42e73744e86019612bc18075a07b0df52ac00beac71f9a72ec6a3d8fd3bd66d5768c","dom_hash":"domhashc6da97a4c40959ab1ed1c048173ba1e0","first_seen":"2026-02-22T13:54:57.763429Z","last_seen":"2026-02-22T13:54:57.763429Z","times_seen":1,"resource_available":false,"data":null}},"submit":{"url":{"schema":"http","addr":"dewa.baaauae.com","fqdn":"dewa.baaauae.com","domain":"baaauae.com","tld":"com"},"ip":{"addr":"104.21.46.124","port":0,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"tags":null,"meta":null},"settings":{"access":"public","device_type":"desktop","expires_at":"2027-03-29T13:54:55Z","useragent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0","referer":"","cookies":null,"exit_node":"z0yflva4pidy47h"},"stats":{"alert_count":{"ids":0,"urlquery":0,"analyzer":3}},"detection":{"ids":null,"analyzer":[{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-02-22","alert":"Sinkholed","trigger":"dewa.baaauae.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-02-22","alert":"Phishing Block","trigger":"dewa.baaauae.com","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-02-22","alert":"Sinkholed","trigger":"dewa.baaauae.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null},"summary":[{"fqdn":"cdnjs.cloudflare.com","ip":{"addr":"104.17.24.14","port":80,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"domain_registered":"2009-02-17","domain_rank":1222,"first_seen":"2012-05-23T12:49:49Z","last_seen":"2026-02-15T22:26:45.957139Z","alert_count":0,"request_count":1,"received_data":20370,"sent_data":396,"comment":"","tags":null,"fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}]},{"fqdn":"code.jquery.com","ip":{"addr":"151.101.130.137","port":80,"asn":54113,"as":"FASTLY","country":"United States","country_code":"US"},"domain_registered":"2005-12-10","domain_rank":4915,"first_seen":"2012-05-21T17:28:02Z","last_seen":"2026-02-15T22:47:07.321489Z","alert_count":0,"request_count":1,"received_data":93703,"sent_data":343,"comment":"","tags":null,"fingerprints":[{"name":"Varnish","description":"Varnish is a reverse caching proxy.","website":"https://www.varnish-cache.org","common_platform_enumeration":"cpe:2.3:a:varnish-software:varnish_cache:*:*:*:*:*:*:*:*","icon":"Varnish.svg","categories":["Caching"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}]},{"fqdn":"dewa.baaauae.com","ip":{"addr":"188.114.97.1","port":80,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"domain_registered":"2025-03-12","domain_rank":0,"first_seen":"2026-02-22T13:54:56.203117Z","last_seen":"2026-02-22T13:54:56.203117Z","alert_count":30,"request_count":10,"received_data":683548,"sent_data":3955,"comment":"","tags":null,"fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"PHP:8.2.12","description":"PHP is a general-purpose scripting language used for web development.","website":"https://php.net","common_platform_enumeration":"cpe:2.3:a:php:php:*:*:*:*:*:*:*:*","icon":"PHP.svg","categories":["Programming languages"]},{"name":"jQuery:1.10.2","description":"jQuery is a JavaScript library which is a free, open-source software designed to simplify HTML DOM tree traversal and manipulation, as well as event handling, CSS animation, and Ajax.","website":"https://jquery.com","common_platform_enumeration":"cpe:2.3:a:jquery:jquery:*:*:*:*:*:*:*:*","icon":"jQuery.svg","categories":["JavaScript libraries"]},{"name":"ZURB Foundation","description":"Zurb Foundation is used to prototype in the browser. Allows rapid creation of websites or applications while leveraging mobile and responsive technology. The front end framework is the collection of HTML, CSS, and Javascript containing design patterns.","website":"https://foundation.zurb.com","common_platform_enumeration":"","icon":"ZURB Foundation.png","categories":["UI frameworks"]},{"name":"Modernizr","description":"Modernizr is a JavaScript library that detects the features available in a user's browser.","website":"https://modernizr.com","common_platform_enumeration":"","icon":"Modernizr.svg","categories":["JavaScript libraries"]},{"name":"jQuery CDN","description":"jQuery CDN is a way to include jQuery in your website without actually downloading and keeping it your website's folder.","website":"https://code.jquery.com/","common_platform_enumeration":"","icon":"jQuery.svg","categories":["CDN"]}]},{"fqdn":"connect.facebook.net","ip":{"addr":"31.13.72.12","port":80,"asn":32934,"as":"FACEBOOK","country":"Sweden","country_code":"SE"},"domain_registered":"2004-04-01","domain_rank":1088,"first_seen":"2012-05-22T02:51:28Z","last_seen":"2026-02-20T13:38:08.624395Z","alert_count":0,"request_count":3,"received_data":298304,"sent_data":1250,"comment":"","tags":null,"fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}]}],"files":null,"artifacts":{"windows_shortcuts":null,"files":null,"telegram":null,"pdfs":null,"clipboard":null},"sensors":{"ids":null,"analyzer":null,"urlquery":null},"javascript":{"script":[{"url":{"schema":"http","addr":"code.jquery.com/jquery-1.10.2.min.js","fqdn":"code.jquery.com","domain":"jquery.com","tld":"com"},"ip":{"addr":"151.101.130.137","port":80,"asn":54113,"as":"FASTLY","country":"United States","country_code":"US"},"introduction_type":"scriptElement","is_inline":false,"md5":"628072e7212db1e8cdacb22b21752cda","sha1":"0511abe9863c2ea7084efa7e24d1d86c5b3974f1","sha256":"0ba081f546084bd5097aa8a73c75931d5aa1fc4d6e846e53c21f98e6a1509988","sha512":"3aa68568ff2592ead412a0c7f5c39abc37ac562f00b7c16af07cd5eff881aadce77ec71040b36c0ad9c2d2aa4edd7744fa72b0f44cb8b485d4f283b1b49c2141","ssdeep":"1536:L4mCgi8DyCuXXFiJ+L0kJQsJVPEKLQRZdC/RlfDknv+p0WzH/IoSZ7qABZnu0sFv:LGsKXlI2p0WPSbDrstfam","tlshash":"3f93f8ddb2d1b06257bb21bd006f540ff236195e280d8850f129e8eabc74a4d9277fad","size":93107,"data":"","first_seen":"2023-03-07T01:02:00Z","last_seen":"2026-08-07T10:16:01.287768Z","times_seen":16949,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"http","addr":"dewa.baaauae.com/dashboard/javascripts/modernizr.js","fqdn":"dewa.baaauae.com","domain":"baaauae.com","tld":"com"},"ip":{"addr":"188.114.97.1","port":80,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"scriptElement","is_inline":false,"md5":"4fae2a90728c528aa148c31466b7ed39","sha1":"6bfc3ff0b0c367ea21003e42175486ae0b2b2bfc","sha256":"654222debe8018b12f1993ceddff30dc163a7d5008d79869c399d6d167321f97","sha512":"1b385498219ad468a9eddb3d4d0747a91ca9f867c75f10715bfaa4be369781b6788489a71350d9509af7132aac92a2b411e817e7928c782fa41e77debc0ee277","ssdeep":"1536:FRCJJ/KpVsnpxvXmET56JYFE7qbe/7Y8fjWWy+4GrkfwuXxJ44ipW/VPRLq277ts:FS/FpzarzCT71Pts","tlshash":"4333a4097ce771264a13f0aa67ef7445fa26c42b2315d440f89e436c2f91f2442bdeea","size":51365,"data":"","first_seen":"2023-03-07T12:03:14Z","last_seen":"2026-08-04T05:50:34.061876Z","times_seen":784,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"http","addr":"connect.facebook.net/en_US/all.js#xfbml=1\u0026appId=277385395761685","fqdn":"connect.facebook.net","domain":"facebook.net","tld":"net"},"ip":{"addr":"31.13.72.12","port":80,"asn":32934,"as":"FACEBOOK","country":"Sweden","country_code":"SE"},"introduction_type":"scriptElement","is_inline":false,"md5":"cfe6392310afa0f9f8f7ce1da6a92015","sha1":"658d105c2ae6262898b72f628827bb31b6554df5","sha256":"87f6e8c3b8bf456b595c1d7f86b4199ad35973261a4b226b1591c00d17c17be9","sha512":"be6c18a7f4f53978f7b85a27420fa8318c5817e131cbe3064a39784d5399b7729dbd31bcd640839fe30401d7e420f3d4d69091f56f431cdf9f7b58d9683cb87f","ssdeep":"","tlshash":"1551761c7151352955f42eb426b7d748f1dba383391fe34898bcc9407e2832e40abd69","size":3070,"data":"","first_seen":"2026-02-22T13:54:57.780492Z","last_seen":"2026-02-22T13:54:57.780492Z","times_seen":1,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"connect.facebook.net/en_US/all.js?hash=f720c277383ad6af4f6cf7bc5cc21c3b","fqdn":"connect.facebook.net","domain":"facebook.net","tld":"net"},"ip":{"addr":"31.13.72.12","port":443,"asn":32934,"as":"FACEBOOK","country":"Sweden","country_code":"SE"},"introduction_type":"scriptElement","is_inline":false,"md5":"de318a11ad69b3c1e9c217f88d2e33a2","sha1":"3b54409d70555522e0558b515750fb0df4a507c7","sha256":"4df75ab36f35f039dfbf41882f612e01e3ae666bd7a21aaf65fdcfae7b12e2eb","sha512":"f52f7861e329112779475dce04bc49cd21a140dca6864e59e1c614830d382d40c636c3ff62342485bc4ce8259ca4f78c13e8aafa2997b1882bcfebc15d34bfcb","ssdeep":"6144:nr8THgXm0WAgZIrb+uH/sbVoj/jCMxMb3h6i4jPG:4TAXT+EjCMxMLh3p","tlshash":"365415ec76a5752582f6246250af214bb23e58a5380ec560b5e0c8d46dbce8f5b37f3c","size":286393,"data":"","first_seen":"2026-02-22T13:54:57.782842Z","last_seen":"2026-02-22T13:54:57.782842Z","times_seen":1,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"http","addr":"dewa.baaauae.com/dashboard/","fqdn":"dewa.baaauae.com","domain":"baaauae.com","tld":"com"},"ip":{"addr":"188.114.96.1","port":80,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"scriptElement","is_inline":true,"md5":"a52bf5d7708a54de400961ec5cb1cce2","sha1":"de3ae78d6bf41bd9a8f29ab4dd4ca95461ef0377","sha256":"5dfec6c0db7dae777a7b166c735da40f749675494154f2bcb62a64fc9f014d74","sha512":"2b5d372f6125296b945fca279461dadb9fc962973d20dea7288a903d89af4376174f10b863afff49c6435cc74d2565d9a4b929b21ba1c4040b3d4ab8fcc79cf0","ssdeep":"","tlshash":"1ae0260e24a330282be6243b4b290198308c55561a01c8107c4d90696fa0fa00aa8abc","size":328,"data":"","first_seen":"2023-03-07T12:03:14Z","last_seen":"2026-08-04T05:50:34.063701Z","times_seen":418,"alerts":{"ids":null,"analyzer":null,"urlquery":null}}],"eval":null,"write":null,"console":null},"http":[{"url":{"schema":"http","addr":"dewa.baaauae.com/dashboard/javascripts/all.js","fqdn":"dewa.baaauae.com","domain":"baaauae.com","tld":"com"},"ip":{"addr":"188.114.97.1","port":80,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"script","requested_by":"http://dewa.baaauae.com/dashboard/","date":"2026-02-22T13:54:34.736Z","timestamp":0,"http_version":"","security_state":"insecure","security_info":null,"request":{"raw":"GET /dashboard/javascripts/all.js HTTP/1.1\r\nHost: dewa.baaauae.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: http://dewa.baaauae.com/dashboard/\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Sun, 22 Feb 2026 13:54:34 GMT\r\nContent-Type: text/javascript\r\nTransfer-Encoding: chunked\r\nConnection: keep-alive\r\nServer: cloudflare\r\nLast-Modified: Tue, 22 Nov 2022 15:37:08 GMT\r\nNel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nReport-To: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=z0p7WctOsRHP%2BMAdSPMff847SDcd%2F8mBeRNI4wb6J2IDC%2Fw4tWbF4zsuaRZ45IdwoaE4c0HHNrGZuNi7AbxrSVAPFWv151WOTQbghugG51w%3D\"}]}\r\nCache-Control: max-age=14400\r\ncf-cache-status: MISS\r\nETag: W/\"2dfe1-5ee10f1d97100\"\r\nContent-Encoding: gzip\r\nCF-RAY: 9d1ef9e708215cf6-ARN\r\nalt-svc: h2=\":443\"; ma=60\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":188385,"size_decoded":0,"mime_type":"text/javascript","magic":"JavaScript source, Unicode text, UTF-8 text, with very long lines (9898)","md5":"83006561af55b7a96dd7e17d34ebfe8a","sha1":"049ace360d58b350e42d26b3f58d1e0e85d82be1","sha256":"0e7d03297babd3fd3f47fd63c3045a561db453ba8c3733e4b6d0be7e4453c126","sha512":"e426881b7ad07e95f0ca306abce2e8cb3996ad8209f1a0d971ce81b5b259a4de777e5dabb908e37ae265947434962a07e4df4441712c748c43ca8023a98d75fd","ssdeep":"3072:aL3PqpaK3ymxI8jdIn5uqlBV5gyBS/FpzarzCT71Ptk:aLfqpaK3ymxI8jdIn5uqlBV5/I/FpOrT","tlshash":"3404930d7af7202685a7707a5bdf5204b232801b550aed28bd7c83946f90a7852f6ffd","first_seen":"2023-03-07T12:09:32Z","last_seen":"2026-08-04T05:50:34.049726Z","times_seen":742,"resource_available":false,"data":null}},"time_used":268,"timings":{"blocked":-1,"dns":1,"connect":8,"send":0,"wait":133,"receive":126,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-02-22","alert":"Sinkholed","trigger":"dewa.baaauae.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-02-22","alert":"Phishing Block","trigger":"dewa.baaauae.com","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-02-22","alert":"Sinkholed","trigger":"dewa.baaauae.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"http","addr":"dewa.baaauae.com/dashboard/images/social-icons.png","fqdn":"dewa.baaauae.com","domain":"baaauae.com","tld":"com"},"ip":{"addr":"188.114.97.1","port":80,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"http://dewa.baaauae.com/dashboard/","date":"2026-02-22T13:54:35.249Z","timestamp":0,"http_version":"","security_state":"insecure","security_info":null,"request":{"raw":"GET /dashboard/images/social-icons.png HTTP/1.1\r\nHost: dewa.baaauae.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: http://dewa.baaauae.com/dashboard/stylesheets/all.css\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Sun, 22 Feb 2026 13:54:35 GMT\r\nContent-Type: image/png\r\nContent-Length: 3361\r\nConnection: keep-alive\r\nServer: cloudflare\r\nLast-Modified: Tue, 22 Nov 2022 15:37:06 GMT\r\nETag: \"d21-5ee10f1baec80\"\r\nAccept-Ranges: bytes\r\nNel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nReport-To: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=%2FWSY58UTpFxROfUN8XuuBOSpEylOS2ZPW8PskjqY%2BPXhtBQDswL9Cn3%2F9XjnA1m22OMQCWXT%2F%2FfbE2bk3%2F1LEQ2AKOWHwkcAH03ejKUKy9U%3D\"}]}\r\nCache-Control: max-age=14400\r\ncf-cache-status: MISS\r\nCF-RAY: 9d1ef9ea58355cf6-ARN\r\nalt-svc: h2=\":443\"; ma=60\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":3361,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 75 x 25, 8-bit/color RGBA, non-interlaced","md5":"059948fd70b704766312bac33debdc53","sha1":"003b4edaeb7d73eb235d74b391b1d7599e7d341e","sha256":"5877c306e97839d8d50872cf8b94105362fe1e7fe7432d2536e916950769b486","sha512":"3f256faedd5e49eabe742c999005b06a22aba01455905e13f9caec0608162cd68c99fced4a0def079377e5f7e07770026df02789b70d264159bf19a1c3a2474a","ssdeep":"","tlshash":"fb612a5cdaf55962aa88d8d104ae403f8a264b80dad8d4ff748b48c448529b6945a1fb","first_seen":"2023-05-08T16:45:43Z","last_seen":"2026-08-04T05:50:34.057908Z","times_seen":778,"resource_available":false,"data":null}},"time_used":94,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":94,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-02-22","alert":"Sinkholed","trigger":"dewa.baaauae.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-02-22","alert":"Sinkholed","trigger":"dewa.baaauae.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-02-22","alert":"Phishing Block","trigger":"dewa.baaauae.com","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null}],"urlquery":null}},{"url":{"schema":"http","addr":"connect.facebook.net/en_US/all.js#xfbml=1\u0026appId=277385395761685","fqdn":"connect.facebook.net","domain":"facebook.net","tld":"net"},"ip":{"addr":"31.13.72.12","port":80,"asn":32934,"as":"FACEBOOK","country":"Sweden","country_code":"SE"},"is_navigation_request":false,"resource_type":"script","requested_by":"http://dewa.baaauae.com/dashboard/","date":"2026-02-22T13:54:35.256Z","timestamp":0,"http_version":"","security_state":"insecure","security_info":null,"request":{"raw":"GET /en_US/all.js HTTP/1.1\r\nHost: connect.facebook.net\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: http://dewa.baaauae.com/\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 301 Moved Permanently\r\nLocation: https://connect.facebook.net/en_US/all.js\r\nContent-Type: text/plain\r\nServer: proxygen-bolt\r\nDate: Sun, 22 Feb 2026 13:54:35 GMT\r\nConnection: keep-alive\r\nContent-Length: 0\r\n\r\n","headers":null,"cookies":null,"status_code":"301","status_text":"Moved Permanently","fingerprints":null,"data":{"size":3070,"size_decoded":0,"mime_type":"application/x-javascript; charset=utf-8","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-08-07T13:07:03.550089Z","times_seen":17761838,"resource_available":true,"data":null}},"time_used":22,"timings":{"blocked":6,"dns":0,"connect":7,"send":0,"wait":7,"receive":1,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"http","addr":"dewa.baaauae.com/dashboard/images/fastly-logo.png","fqdn":"dewa.baaauae.com","domain":"baaauae.com","tld":"com"},"ip":{"addr":"188.114.97.1","port":80,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"http://dewa.baaauae.com/dashboard/","date":"2026-02-22T13:54:34.734Z","timestamp":0,"http_version":"","security_state":"insecure","security_info":null,"request":{"raw":"GET /dashboard/images/fastly-logo.png HTTP/1.1\r\nHost: dewa.baaauae.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: http://dewa.baaauae.com/dashboard/\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Sun, 22 Feb 2026 13:54:35 GMT\r\nContent-Type: image/png\r\nContent-Length: 1770\r\nConnection: keep-alive\r\nServer: cloudflare\r\nLast-Modified: Tue, 22 Nov 2022 15:37:06 GMT\r\nETag: \"6ea-5ee10f1baec80\"\r\nAccept-Ranges: bytes\r\nNel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nReport-To: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=B6NUHYjE3b2YKD3QUUcU0WeXoKEomhMPJ9IP1Xog9uIIlZMthPyUlaKsolDyGFToVwuvucOoNHIu2LhgimVYzEt%2FmDEn71ExbNw8Ku2hx7M%3D\"}]}\r\nCache-Control: max-age=14400\r\ncf-cache-status: MISS\r\nCF-RAY: 9d1ef9e94e085cf6-ARN\r\nalt-svc: h2=\":443\"; ma=60\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":1770,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 48 x 19, 8-bit/color RGBA, non-interlaced","md5":"b9b0f486080438e47a0901e597d0ded8","sha1":"08360cb5849187fd585847a75a56e4519e5c7c77","sha256":"ce826facd2ee6f8e94edd9a72fc0b543ca77a41ce1f648729f2438b47ac4500b","sha512":"87df1e8dd89aaf9fe8c7650dfae0b14fcc0f1f5b954e6d1d0ea76a46c396a00d78914e5a0f2160bf58beba78d9bf229bcd6ad4382d977d4c43be1cf0612a78ba","ssdeep":"","tlshash":"1031e95eef512e068bdaa8c131f90232c652cc809ee0fd666085c86905c32f55d5caca","first_seen":"2023-05-08T16:45:43Z","last_seen":"2026-08-04T05:50:34.0516Z","times_seen":779,"resource_available":false,"data":null}},"time_used":446,"timings":{"blocked":349,"dns":0,"connect":0,"send":0,"wait":96,"receive":1,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-02-22","alert":"Phishing Block","trigger":"dewa.baaauae.com","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-02-22","alert":"Sinkholed","trigger":"dewa.baaauae.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-02-22","alert":"Sinkholed","trigger":"dewa.baaauae.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"http","addr":"dewa.baaauae.com/dashboard/images/favicon.png","fqdn":"dewa.baaauae.com","domain":"baaauae.com","tld":"com"},"ip":{"addr":"188.114.97.1","port":80,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"http://dewa.baaauae.com/dashboard/","date":"2026-02-22T13:54:35.440Z","timestamp":0,"http_version":"","security_state":"insecure","security_info":null,"request":{"raw":"GET /dashboard/images/favicon.png HTTP/1.1\r\nHost: dewa.baaauae.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: http://dewa.baaauae.com/dashboard/\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Sun, 22 Feb 2026 13:54:35 GMT\r\nContent-Type: image/png\r\nContent-Length: 2508\r\nConnection: keep-alive\r\nServer: cloudflare\r\nLast-Modified: Tue, 22 Nov 2022 15:37:06 GMT\r\nETag: \"9cc-5ee10f1baec80\"\r\nAccept-Ranges: bytes\r\nNel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nReport-To: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=lD9X7HMcSn1UzcN%2BK0z1rQz7Il1KVbMjOjc72Vuc8MKZftl1WMpj0CQ5Y%2BpJMesMxVKLM58smRLQw0qWExvaQeRpVwyar%2BxhlgekzWdSPjI%3D\"}]}\r\nCache-Control: max-age=14400\r\ncf-cache-status: MISS\r\nCF-RAY: 9d1ef9eb8bb05cf6-ARN\r\nalt-svc: h2=\":443\"; ma=60\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":2508,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 47 x 48, 8-bit/color RGBA, non-interlaced","md5":"56f7c04657931f2d0b79371b2d6e9820","sha1":"18f9bd42f53a68beda79f9350a638503eee64883","sha256":"0ce37ed9046fdaaee0efbc4d6705459427204d7353e961e6c20fbb0d5e081a46","sha512":"eb2e754dc6410381a9a0e42627e9ab76cbac7b7d1563e3bcdcbd9934b80ce524dfecf2023c64c326f0ecc77a19841a6fed5f8b73ef611e155b0abfe6962666f2","ssdeep":"","tlshash":"0051fa96f591d492ef09ebf120e6707a9e0185c44b94e86c699f502920d24f9c07ecf3","first_seen":"2023-05-08T16:45:43Z","last_seen":"2026-08-04T05:50:34.059207Z","times_seen":777,"resource_available":false,"data":null}},"time_used":101,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":100,"receive":1,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-02-22","alert":"Sinkholed","trigger":"dewa.baaauae.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-02-22","alert":"Phishing Block","trigger":"dewa.baaauae.com","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-02-22","alert":"Sinkholed","trigger":"dewa.baaauae.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"dewa.baaauae.com/","fqdn":"dewa.baaauae.com","domain":"baaauae.com","tld":"com"},"ip":{"addr":"188.114.96.1","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":true,"resource_type":"document","requested_by":"","date":"2026-02-22T13:54:34.140Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"baaauae.com","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Mon, 16 Feb 2026 20:58:53 GMT","end":"Sun, 17 May 2026 21:56:37 GMT"},"fingerprint":{"sha1":"CA:75:78:20:7A:AB:27:8F:78:A5:E2:1F:A6:BA:93:5F:39:8B:26:77","sha256":"39:17:A8:E3:76:0E:EB:59:6E:78:8A:84:4E:69:41:28:BF:E3:E9:69:80:DE:7B:B3:51:CC:D3:B6:A4:D8:E2:F4"}}},"request":{"raw":"GET / HTTP/1.1\r\nHost: dewa.baaauae.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nUpgrade-Insecure-Requests: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: document\r\nSec-Fetch-Mode: navigate\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 302 Found\r\ndate: Sun, 22 Feb 2026 13:54:34 GMT\r\ncontent-type: text/html; charset=UTF-8\r\nlocation: http://dewa.baaauae.com/dashboard/\r\nserver: cloudflare\r\nx-powered-by: PHP/8.2.12\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=8%2FLplsPVpiJ%2BqpyzYodbruiiCQa4tE%2BQ5aUOsBRA6Wn%2Bg4L03Bq%2B0RiqvOdAkFjZLT6lYquiGcyBjE61DZ0se3ZJc0ixJ3KCND54g0F3MXA%3D\"}]}\r\ncf-cache-status: DYNAMIC\r\ncf-ray: 9d1ef9e3db46fb58-ARN\r\nalt-svc: h3=\":443\"; ma=86400\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"302","status_text":"Found","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"PHP:8.2.12","description":"PHP is a general-purpose scripting language used for web development.","website":"https://php.net","common_platform_enumeration":"cpe:2.3:a:php:php:*:*:*:*:*:*:*:*","icon":"PHP.svg","categories":["Programming languages"]}],"data":{"size":5187,"size_decoded":0,"mime_type":"text/html","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-08-07T13:07:03.550089Z","times_seen":17761838,"resource_available":true,"data":null}},"time_used":233,"timings":{"blocked":69,"dns":28,"connect":8,"send":0,"wait":95,"receive":0,"ssl":29},"alerts":{"ids":null,"analyzer":[{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-02-22","alert":"Phishing Block","trigger":"dewa.baaauae.com","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-02-22","alert":"Sinkholed","trigger":"dewa.baaauae.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-02-22","alert":"Sinkholed","trigger":"dewa.baaauae.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null}],"urlquery":null}},{"url":{"schema":"http","addr":"dewa.baaauae.com/dashboard/","fqdn":"dewa.baaauae.com","domain":"baaauae.com","tld":"com"},"ip":{"addr":"188.114.96.1","port":80,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":true,"resource_type":"document","requested_by":"","date":"2026-02-22T13:54:34.311Z","timestamp":0,"http_version":"","security_state":"insecure","security_info":null,"request":{"raw":"GET /dashboard/ HTTP/1.1\r\nHost: dewa.baaauae.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate\r\nDNT: 1\r\nConnection: keep-alive\r\nUpgrade-Insecure-Requests: 1\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Sun, 22 Feb 2026 13:54:34 GMT\r\nContent-Type: text/html\r\nTransfer-Encoding: chunked\r\nConnection: keep-alive\r\nServer: cloudflare\r\nLast-Modified: Sun, 19 Nov 2023 11:10:24 GMT\r\nNel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nReport-To: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=j%2FZfmKfHAb7HWn%2F28JJHn309d8k6z8f5mzLM2rFN%2FiwZ%2BE1wbnayLHEYYuwQSBdezEYNhf9gYWjns47XLAEp2BH8RnfE3b3giPAadm7A7wQ%3D\"}]}\r\ncf-cache-status: DYNAMIC\r\nContent-Encoding: gzip\r\nCF-RAY: 9d1ef9e48906ddf7-ARN\r\nalt-svc: h2=\":443\"; ma=60\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"jQuery:1.10.2","description":"jQuery is a JavaScript library which is a free, open-source software designed to simplify HTML DOM tree traversal and manipulation, as well as event handling, CSS animation, and Ajax.","website":"https://jquery.com","common_platform_enumeration":"cpe:2.3:a:jquery:jquery:*:*:*:*:*:*:*:*","icon":"jQuery.svg","categories":["JavaScript libraries"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"ZURB Foundation","description":"Zurb Foundation is used to prototype in the browser. Allows rapid creation of websites or applications while leveraging mobile and responsive technology. The front end framework is the collection of HTML, CSS, and Javascript containing design patterns.","website":"https://foundation.zurb.com","common_platform_enumeration":"","icon":"ZURB Foundation.png","categories":["UI frameworks"]},{"name":"Modernizr","description":"Modernizr is a JavaScript library that detects the features available in a user's browser.","website":"https://modernizr.com","common_platform_enumeration":"","icon":"Modernizr.svg","categories":["JavaScript libraries"]},{"name":"jQuery CDN","description":"jQuery CDN is a way to include jQuery in your website without actually downloading and keeping it your website's folder.","website":"https://code.jquery.com/","common_platform_enumeration":"","icon":"jQuery.svg","categories":["CDN"]}],"data":{"size":5187,"size_decoded":0,"mime_type":"text/html","magic":"HTML document, ASCII text, with very long lines (350)","md5":"d440b266b54bcfeb010d63075c435459","sha1":"5f3286dd6de855bc4b1cfa79dc0066eab154e822","sha256":"fc8ecaa8e87debb596ab63431a3091ff7270e5c928ae344d9ac0d63948ee9bb2","sha512":"f6dbffdfb0c5cf65158e4fdfbc17c542bbe7c404a9324b4d38005494346d2b9b80ffe924e45d22cd315ec5d13ce7bd35cc1995ad19a0bccb2eb8952e1ab7c602","ssdeep":"48:0Ek88L4CAWJmHXVp41wljyQOrjEZaVqNJl+8uzxWQoxWg4CNlHGrflPxW0xWn15j:5H2DwHXVB1UrjZ/LxCjZXsFOVo4H+wWa","tlshash":"2db1933b64e92227125386a17a706b2cfed2d15beb0a694472dc521d9f93e83cd1f0cd","first_seen":"2023-12-08T13:55:31Z","last_seen":"2026-07-30T17:38:54.751964Z","times_seen":439,"resource_available":true,"data":null}},"time_used":83,"timings":{"blocked":8,"dns":1,"connect":8,"send":0,"wait":65,"receive":1,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-02-22","alert":"Sinkholed","trigger":"dewa.baaauae.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-02-22","alert":"Phishing Block","trigger":"dewa.baaauae.com","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-02-22","alert":"Sinkholed","trigger":"dewa.baaauae.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null}],"urlquery":null}},{"url":{"schema":"http","addr":"dewa.baaauae.com/dashboard/stylesheets/all.css","fqdn":"dewa.baaauae.com","domain":"baaauae.com","tld":"com"},"ip":{"addr":"188.114.97.1","port":80,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"http://dewa.baaauae.com/dashboard/","date":"2026-02-22T13:54:34.724Z","timestamp":0,"http_version":"","security_state":"insecure","security_info":null,"request":{"raw":"GET /dashboard/stylesheets/all.css HTTP/1.1\r\nHost: dewa.baaauae.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: http://dewa.baaauae.com/dashboard/\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Sun, 22 Feb 2026 13:54:34 GMT\r\nContent-Type: text/css\r\nTransfer-Encoding: chunked\r\nConnection: keep-alive\r\nServer: cloudflare\r\nLast-Modified: Tue, 22 Nov 2022 15:37:04 GMT\r\nNel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nReport-To: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=4VEqg%2BiaSCW64TSvnNQs%2F5771Yb9IiHkeksmHRehrRO7IuFZPv5uVY0jXpIe24YP3FDKTCkwLUNlA4nWS0DN6meZ6f3bqYqENZmAThGOc3Q%3D\"}]}\r\nCache-Control: max-age=14400\r\ncf-cache-status: MISS\r\nETag: W/\"635d6-5ee10f19c6800\"\r\nContent-Encoding: gzip\r\nCF-RAY: 9d1ef9e70b2386c4-ARN\r\nalt-svc: h2=\":443\"; ma=60\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":406998,"size_decoded":0,"mime_type":"text/css","magic":"ASCII text, with very long lines (1479)","md5":"5328323c816afb42eba591c6d82cab80","sha1":"007f3cef64d8adb581fc1ff8eabb38a49ec5509f","sha256":"8edb8804b01b16ac94127920b6c6e5dd71736d806e97d49b67f61bac65b7a8ea","sha512":"f4f008244d1f544bede0836f575e0668948d768e8c1da08d480c970df66d0e4dd0ecaab129db6eff0a1ec5a012e0014cf420456d11480d91f9c6e0480f19cf0f","ssdeep":"3072:gLPOPWP5kTTX5hLJD1bFvYT5XeH8M74JOPWPpaeOPWPpagZkWU61qU1IDf4V1E2k:gLdRyM+743P9/1IDfoE27fUpP","tlshash":"c18467a6ed50008a65b592b733793e1266d5f12bcad2ccb4fa4e027c9f853204375bdb","first_seen":"2023-04-05T13:45:37Z","last_seen":"2026-08-04T05:50:34.061065Z","times_seen":627,"resource_available":false,"data":null}},"time_used":371,"timings":{"blocked":-1,"dns":1,"connect":8,"send":0,"wait":114,"receive":248,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-02-22","alert":"Phishing Block","trigger":"dewa.baaauae.com","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-02-22","alert":"Sinkholed","trigger":"dewa.baaauae.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-02-22","alert":"Sinkholed","trigger":"dewa.baaauae.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"http","addr":"cdnjs.cloudflare.com/ajax/libs/font-awesome/3.1.0/css/font-awesome.min.css","fqdn":"cdnjs.cloudflare.com","domain":"cloudflare.com","tld":"com"},"ip":{"addr":"104.17.24.14","port":80,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"http://dewa.baaauae.com/dashboard/","date":"2026-02-22T13:54:34.728Z","timestamp":0,"http_version":"","security_state":"insecure","security_info":null,"request":{"raw":"GET /ajax/libs/font-awesome/3.1.0/css/font-awesome.min.css HTTP/1.1\r\nHost: cdnjs.cloudflare.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: http://dewa.baaauae.com/\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Sun, 22 Feb 2026 13:54:34 GMT\r\nContent-Type: text/css; charset=utf-8\r\nContent-Length: 4101\r\nConnection: keep-alive\r\nCF-RAY: 9d1ef9e6f95032fa-OSL\r\nAccess-Control-Allow-Origin: *\r\nCache-Control: public, max-age=30672000\r\nContent-Encoding: gzip\r\nETag: \"5eb03e5f-4bcb\"\r\nLast-Modified: Mon, 04 May 2020 16:10:07 GMT\r\nCross-Origin-Resource-Policy: cross-origin\r\nTiming-Allow-Origin: *\r\nX-Content-Type-Options: nosniff\r\ncf-cdnjs-via: cfworker/kv\r\nVary: Accept-Encoding\r\nCF-Cache-Status: HIT\r\nAge: 257043\r\nExpires: Fri, 12 Feb 2027 13:54:34 GMT\r\nAccept-Ranges: bytes\r\nReport-To: {\"endpoints\":[{\"url\":\"https:\\/\\/a.nel.cloudflare.com\\/report\\/v4?s=4PaXdi40c%2FyxquAMtX7ecTPruz6oSQCrE6KFK34rSfczZsfUZUZVBK9Vew%2Fr4KKIphim4pKY0FqYdeXTPH846QeY9%2BgTtHbCot6J5kLVDil3iSQe%2FiGkWf5jN6gYDXvRQgt4lZuU\"}],\"group\":\"cf-nel\",\"max_age\":604800}\r\nNEL: {\"success_fraction\":0.01,\"report_to\":\"cf-nel\",\"max_age\":604800}\r\nServer: cloudflare\r\nalt-svc: h3=\":443\"; ma=86400\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":19403,"size_decoded":0,"mime_type":"text/css; charset=utf-8","magic":"ASCII text, with very long lines (18376)","md5":"ea6cc550de5339fc787f1e041363e544","sha1":"1f8f1a6fa898b43de1958384ca103150aadc0a0b","sha256":"c86cb6b421d6b66d5c1de9d0b8390cda5ecf1d341d1156b6194511e14e95f1af","sha512":"e74143255ab2ce6765cdb3b0efac739674c2061e104c3287faf851b3a05ae087ea21a4bba8285fd595d30df233e38e9fddfb666954bc8fb59c1b8f833b2827d8","ssdeep":"384:KqbaJtK4bnrKlfGhH+zxxT4/Yy21b03pmS:stYykoMS","tlshash":"0492b9e9e94d11da6332c483fb816248ed84f129cee14d43f29b605c4ff17598799ba8","first_seen":"2023-04-05T13:45:37Z","last_seen":"2026-08-04T05:50:34.054838Z","times_seen":797,"resource_available":false,"data":null}},"time_used":29,"timings":{"blocked":-1,"dns":1,"connect":1,"send":0,"wait":26,"receive":1,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"http","addr":"dewa.baaauae.com/dashboard/javascripts/modernizr.js","fqdn":"dewa.baaauae.com","domain":"baaauae.com","tld":"com"},"ip":{"addr":"188.114.97.1","port":80,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"script","requested_by":"http://dewa.baaauae.com/dashboard/","date":"2026-02-22T13:54:34.731Z","timestamp":0,"http_version":"","security_state":"insecure","security_info":null,"request":{"raw":"GET /dashboard/javascripts/modernizr.js HTTP/1.1\r\nHost: dewa.baaauae.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: http://dewa.baaauae.com/dashboard/\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Sun, 22 Feb 2026 13:54:34 GMT\r\nContent-Type: text/javascript\r\nTransfer-Encoding: chunked\r\nConnection: keep-alive\r\nServer: cloudflare\r\nLast-Modified: Tue, 22 Nov 2022 15:37:08 GMT\r\nNel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nReport-To: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=BcyM23WKPNn6euIKuc2mGd3QHbwvLjTJtJc5RX0MnwoAlovk0iMdm7Re%2FPevoEzFxKVv%2BauBl%2FwTd2QavM6cnfFenHzZz1ALrVmPeFmsx6w%3D\"}]}\r\nCache-Control: max-age=14400\r\ncf-cache-status: MISS\r\nETag: W/\"c8a5-5ee10f1d97100\"\r\nContent-Encoding: gzip\r\nCF-RAY: 9d1ef9e7092fb09c-ARN\r\nalt-svc: h2=\":443\"; ma=60\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":51365,"size_decoded":0,"mime_type":"text/javascript","magic":"JavaScript source, ASCII text","md5":"4fae2a90728c528aa148c31466b7ed39","sha1":"6bfc3ff0b0c367ea21003e42175486ae0b2b2bfc","sha256":"654222debe8018b12f1993ceddff30dc163a7d5008d79869c399d6d167321f97","sha512":"1b385498219ad468a9eddb3d4d0747a91ca9f867c75f10715bfaa4be369781b6788489a71350d9509af7132aac92a2b411e817e7928c782fa41e77debc0ee277","ssdeep":"1536:FRCJJ/KpVsnpxvXmET56JYFE7qbe/7Y8fjWWy+4GrkfwuXxJ44ipW/VPRLq277ts:FS/FpzarzCT71Pts","tlshash":"4333a4097ce771264a13f0aa67ef7445fa26c42b2315d440f89e436c2f91f2442bdeea","first_seen":"2023-03-07T12:03:14Z","last_seen":"2026-08-04T05:50:34.061876Z","times_seen":784,"resource_available":true,"data":null}},"time_used":190,"timings":{"blocked":-1,"dns":1,"connect":8,"send":0,"wait":111,"receive":70,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-02-22","alert":"Phishing Block","trigger":"dewa.baaauae.com","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-02-22","alert":"Sinkholed","trigger":"dewa.baaauae.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-02-22","alert":"Sinkholed","trigger":"dewa.baaauae.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null}],"urlquery":null}},{"url":{"schema":"http","addr":"code.jquery.com/jquery-1.10.2.min.js","fqdn":"code.jquery.com","domain":"jquery.com","tld":"com"},"ip":{"addr":"151.101.130.137","port":80,"asn":54113,"as":"FASTLY","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"script","requested_by":"http://dewa.baaauae.com/dashboard/","date":"2026-02-22T13:54:34.735Z","timestamp":0,"http_version":"","security_state":"insecure","security_info":null,"request":{"raw":"GET /jquery-1.10.2.min.js HTTP/1.1\r\nHost: code.jquery.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: http://dewa.baaauae.com/\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nConnection: keep-alive\r\nContent-Length: 32788\r\nServer: nginx\r\nContent-Type: application/javascript; charset=utf-8\r\nLast-Modified: Fri, 18 Oct 1991 12:00:00 GMT\r\nETag: W/\"28feccc0-16bb3\"\r\nCache-Control: public, max-age=31536000, stale-while-revalidate=604800\r\nAccess-Control-Allow-Origin: *\r\nContent-Encoding: gzip\r\nVia: 1.1 varnish, 1.1 varnish\r\nAccept-Ranges: bytes\r\nDate: Sun, 22 Feb 2026 13:54:34 GMT\r\nAge: 2989778\r\nX-Served-By: cache-lga13622-LGA, cache-hel1410023-HEL\r\nX-Cache: HIT, HIT\r\nX-Cache-Hits: 1, 14504\r\nX-Timer: S1771768475.737380,VS0,VE0\r\nVary: Accept-Encoding\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Varnish","description":"Varnish is a reverse caching proxy.","website":"https://www.varnish-cache.org","common_platform_enumeration":"cpe:2.3:a:varnish-software:varnish_cache:*:*:*:*:*:*:*:*","icon":"Varnish.svg","categories":["Caching"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":93107,"size_decoded":0,"mime_type":"application/javascript; charset=utf-8","magic":"JavaScript source, ASCII text, with very long lines (32072)","md5":"628072e7212db1e8cdacb22b21752cda","sha1":"0511abe9863c2ea7084efa7e24d1d86c5b3974f1","sha256":"0ba081f546084bd5097aa8a73c75931d5aa1fc4d6e846e53c21f98e6a1509988","sha512":"3aa68568ff2592ead412a0c7f5c39abc37ac562f00b7c16af07cd5eff881aadce77ec71040b36c0ad9c2d2aa4edd7744fa72b0f44cb8b485d4f283b1b49c2141","ssdeep":"1536:L4mCgi8DyCuXXFiJ+L0kJQsJVPEKLQRZdC/RlfDknv+p0WzH/IoSZ7qABZnu0sFv:LGsKXlI2p0WPSbDrstfam","tlshash":"3f93f8ddb2d1b06257bb21bd006f540ff236195e280d8850f129e8eabc74a4d9277fad","first_seen":"2023-03-07T01:02:00Z","last_seen":"2026-08-07T10:16:01.287768Z","times_seen":16949,"resource_available":true,"data":null}},"time_used":33,"timings":{"blocked":-1,"dns":0,"connect":13,"send":0,"wait":14,"receive":6,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"http","addr":"dewa.baaauae.com/dashboard/stylesheets/normalize.css","fqdn":"dewa.baaauae.com","domain":"baaauae.com","tld":"com"},"ip":{"addr":"188.114.96.1","port":80,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"http://dewa.baaauae.com/dashboard/","date":"2026-02-22T13:54:34.720Z","timestamp":0,"http_version":"","security_state":"insecure","security_info":null,"request":{"raw":"GET /dashboard/stylesheets/normalize.css HTTP/1.1\r\nHost: dewa.baaauae.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: http://dewa.baaauae.com/dashboard/\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Sun, 22 Feb 2026 13:54:34 GMT\r\nContent-Type: text/css\r\nTransfer-Encoding: chunked\r\nConnection: keep-alive\r\nServer: cloudflare\r\nLast-Modified: Tue, 22 Nov 2022 15:37:06 GMT\r\nNel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nReport-To: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=XS35kQ9gNjimJqtJZLhqC47JlSja%2Fhh1FY%2FfVG41MMVCTTJekOW6e5L6A2d4JHP8Peu5zBcm8KNkZnyQaNFZmWa5IYY1%2FXVeWrrCC%2F1wX0c%3D\"}]}\r\nCache-Control: max-age=14400\r\ncf-cache-status: MISS\r\nETag: W/\"1adc-5ee10f1baec80\"\r\nContent-Encoding: gzip\r\nCF-RAY: 9d1ef9e6fe85ddf7-ARN\r\nalt-svc: h2=\":443\"; ma=60\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":6876,"size_decoded":0,"mime_type":"text/css","magic":"ASCII text","md5":"ed3146b9b1ec5eecb132a21916d0afe5","sha1":"ef7858efe109963a03f52f2fa0b592a707a8a90a","sha256":"ca7c3f9c26df461561ea2e4ac7101b122f99211810ca1fb6f9acd17d48421223","sha512":"ce20569081e341c80fdae3e451f0b0579c93392a11ba310d5fe02ec2450bdf3163bffc389a6f2aa8579b8b88257f148ce420a720ad81e1fc2c63d591bc1f81e0","ssdeep":"96:rbPT/txAbGLRvRuDTIO8hjpEMyg4bdR+XCo+1P2o35WL0Sl:rDTlib+FYvBUFEXgTCoE2o35nQ","tlshash":"0fe1721a1760be42927a4a713bef82a53309016f535c78feb49a434c8f45799c2f6fd8","first_seen":"2023-04-05T13:45:37Z","last_seen":"2026-08-04T05:50:34.060177Z","times_seen":771,"resource_available":false,"data":null}},"time_used":91,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":91,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-02-22","alert":"Phishing Block","trigger":"dewa.baaauae.com","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-02-22","alert":"Sinkholed","trigger":"dewa.baaauae.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-02-22","alert":"Sinkholed","trigger":"dewa.baaauae.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"http","addr":"dewa.baaauae.com/dashboard/images/xampp-logo.svg","fqdn":"dewa.baaauae.com","domain":"baaauae.com","tld":"com"},"ip":{"addr":"188.114.97.1","port":80,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"http://dewa.baaauae.com/dashboard/","date":"2026-02-22T13:54:34.733Z","timestamp":0,"http_version":"","security_state":"insecure","security_info":null,"request":{"raw":"GET /dashboard/images/xampp-logo.svg HTTP/1.1\r\nHost: dewa.baaauae.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: http://dewa.baaauae.com/dashboard/\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Sun, 22 Feb 2026 13:54:35 GMT\r\nContent-Type: image/svg+xml\r\nTransfer-Encoding: chunked\r\nConnection: keep-alive\r\nServer: cloudflare\r\nLast-Modified: Tue, 22 Nov 2022 15:37:06 GMT\r\nNel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nReport-To: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=ecs%2FUp1Daqi4Wy3GVMllj3csz%2FXjv6k8Wba8r8HEwXgrUjsVDFora668QDqAbeefv9L5Obype05Cr7YQSfszEcu4oKZ8nzFZHakIK37QEfI%3D\"}]}\r\nCache-Control: max-age=14400\r\ncf-cache-status: MISS\r\nETag: W/\"1533-5ee10f1baec80\"\r\nContent-Encoding: gzip\r\nCF-RAY: 9d1ef9e94d7eb09c-ARN\r\nalt-svc: h2=\":443\"; ma=60\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":5427,"size_decoded":0,"mime_type":"image/svg+xml","magic":"SVG Scalable Vector Graphics image","md5":"70ad98330d991043dcf250eae192e431","sha1":"ac950edf487153a55afe14b4fe34b8b52620dabd","sha256":"96e5b8b61d5bdc5e67d7746bcc72141eaca78302aec6ac86dfaaab8be9bd4053","sha512":"31bc4fd2a7f4891bb5c6058ece7b6d3ba878df8211e0e0aa14c5db3461eb552aeb575d7d8243d1e9e6c34328f9368af830d124ae115cd425966d1cb7ba492611","ssdeep":"96:7xXQSf3x5qxtxlil2BUqcuqGFIz7UVNFKLpMMjbaxSLL1DnWqd+/XMFrk:9QA3xM9AbES78N7MrpWq+/cFrk","tlshash":"8ab174da433ad5f871952b6c99353ec23bf064ae80a1d1dcc3ba6c109453ed1666ce28","first_seen":"2023-05-08T16:45:43Z","last_seen":"2026-08-04T05:50:34.056231Z","times_seen":762,"resource_available":false,"data":null}},"time_used":479,"timings":{"blocked":351,"dns":0,"connect":0,"send":0,"wait":113,"receive":15,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-02-22","alert":"Phishing Block","trigger":"dewa.baaauae.com","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-02-22","alert":"Sinkholed","trigger":"dewa.baaauae.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-02-22","alert":"Sinkholed","trigger":"dewa.baaauae.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"connect.facebook.net/en_US/all.js#xfbml=1\u0026appId=277385395761685","fqdn":"connect.facebook.net","domain":"facebook.net","tld":"net"},"ip":{"addr":"31.13.72.12","port":443,"asn":32934,"as":"FACEBOOK","country":"Sweden","country_code":"SE"},"is_navigation_request":false,"resource_type":"script","requested_by":"http://dewa.baaauae.com/dashboard/","date":"2026-02-22T13:54:35.301Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.facebook.com","organization":"Meta Platforms, Inc."},"issuer":{"commonName":"DigiCert Global G2 TLS RSA SHA256 2020 CA1","organization":"DigiCert Inc"},"validity":{"start":"Mon, 01 Dec 2025 00:00:00 GMT","end":"Sun, 01 Mar 2026 23:59:59 GMT"},"fingerprint":{"sha1":"53:05:E7:D6:C0:D7:04:CC:52:8F:BA:2E:A0:17:B5:CF:62:D2:0B:96","sha256":"7F:46:38:49:8D:30:8C:10:04:26:F0:B3:CD:4E:37:78:7B:17:91:2A:BC:FB:C4:64:53:6C:5F:2F:23:3C:DE:4C"}}},"request":{"raw":"GET /en_US/all.js HTTP/1.1\r\nHost: connect.facebook.net\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: http://dewa.baaauae.com/\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nvary: Accept-Encoding\r\ncontent-encoding: gzip\r\naccess-control-expose-headers: X-FB-Content-MD5\r\nx-fb-content-md5: cfe6392310afa0f9f8f7ce1da6a92015\r\netag: \"3f2bf349af66625e40a905a4b17bf4bd\"\r\ncontent-type: application/x-javascript; charset=utf-8\r\ntiming-allow-origin: *\r\naccess-control-allow-origin: *\r\nexpires: Sun, 22 Feb 2026 14:13:34 GMT\r\ncache-control: public,max-age=1200,stale-while-revalidate=3600\r\nreporting-endpoints: coop_report=\"https://www.facebook.com/browser_reporting/coop/?minimize=0\", coep_report=\"https://www.facebook.com/browser_reporting/coep/?minimize=0\", permissions_policy=\"https://www.facebook.com/ajax/browser_error_reports/\"\r\nx-frame-options: DENY\r\ndocument-policy: force-load-at-top, include-js-call-stacks-in-crash-reports\r\npermissions-policy: accelerometer=(), attribution-reporting=(), autoplay=(), bluetooth=(), camera=(), ch-device-memory=(), ch-downlink=(), ch-dpr=(), ch-ect=(), ch-rtt=(), ch-save-data=(), ch-ua-arch=(), ch-ua-bitness=(), ch-viewport-height=(), ch-viewport-width=(), ch-width=(), clipboard-read=(), clipboard-write=(), compute-pressure=(), display-capture=(), encrypted-media=(), fullscreen=(self), gamepad=(), geolocation=(), gyroscope=(), hid=(), idle-detection=(), interest-cohort=(), keyboard-map=(), local-fonts=(), magnetometer=(), microphone=(), midi=(), otp-credentials=(), payment=(), picture-in-picture=(), private-state-token-issuance=(), publickey-credentials-get=(), screen-wake-lock=(), serial=(), shared-storage=(), shared-storage-select-url=(), private-state-token-redemption=(), usb=(), unload=(self), window-management=(), xr-spatial-tracking=();report-to=\"permissions_policy\"\r\ncross-origin-resource-policy: cross-origin\r\ncross-origin-embedder-policy-report-only: require-corp;report-to=\"coep_report\"\r\ncross-origin-opener-policy: same-origin-allow-popups\r\nx-content-type-options: nosniff\r\nreport-to: {\"max_age\":2592000,\"endpoints\":[{\"url\":\"https:\\/\\/www.facebook.com\\/browser_reporting\\/coop\\/?minimize=0\"}],\"group\":\"coop_report\",\"include_subdomains\":true}, {\"max_age\":86400,\"endpoints\":[{\"url\":\"https:\\/\\/www.facebook.com\\/browser_reporting\\/coep\\/?minimize=0\"}],\"group\":\"coep_report\"}, {\"max_age\":21600,\"endpoints\":[{\"url\":\"https:\\/\\/www.facebook.com\\/ajax\\/browser_error_reports\\/\"}],\"group\":\"permissions_policy\"}\r\norigin-agent-cluster: ?1\r\nstrict-transport-security: max-age=31536000; preload; includeSubDomains\r\ncontent-md5: b/FABldrUy0L3OddEUsJ0g==\r\nx-fb-debug: TZZPpqPZ8fVG8+DYO22abZTgDOlOpf/H6tsXWT+rQjoPlVW8Tb8NhUf0FDvvCdLOesv0/5PQsw/sL2X+CcjgOw==\r\ncontent-length: 1667\r\ndate: Sun, 22 Feb 2026 13:54:35 GMT\r\nx-fb-connection-quality: EXCELLENT; q=0.9, rtt=7, rtx=0, c=13, mss=1380, tbw=3408, tp=-1, tpl=-1, uplat=2, ullat=-1\r\nalt-svc: h3=\":443\"; ma=86400\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":3070,"size_decoded":0,"mime_type":"application/x-javascript; charset=utf-8","magic":"JavaScript source, ASCII text, with very long lines (1934)","md5":"cfe6392310afa0f9f8f7ce1da6a92015","sha1":"658d105c2ae6262898b72f628827bb31b6554df5","sha256":"87f6e8c3b8bf456b595c1d7f86b4199ad35973261a4b226b1591c00d17c17be9","sha512":"be6c18a7f4f53978f7b85a27420fa8318c5817e131cbe3064a39784d5399b7729dbd31bcd640839fe30401d7e420f3d4d69091f56f431cdf9f7b58d9683cb87f","ssdeep":"","tlshash":"1551761c7151352955f42eb426b7d748f1dba383391fe34898bcc9407e2832e40abd69","first_seen":"2026-02-22T13:54:57.780492Z","last_seen":"2026-02-22T13:54:57.780492Z","times_seen":1,"resource_available":true,"data":null}},"time_used":129,"timings":{"blocked":56,"dns":3,"connect":7,"send":0,"wait":11,"receive":1,"ssl":45},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"connect.facebook.net/en_US/all.js?hash=f720c277383ad6af4f6cf7bc5cc21c3b","fqdn":"connect.facebook.net","domain":"facebook.net","tld":"net"},"ip":{"addr":"31.13.72.12","port":443,"asn":32934,"as":"FACEBOOK","country":"Sweden","country_code":"SE"},"is_navigation_request":false,"resource_type":"script","requested_by":"http://dewa.baaauae.com/dashboard/","date":"2026-02-22T13:54:35.451Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.facebook.com","organization":"Meta Platforms, Inc."},"issuer":{"commonName":"DigiCert Global G2 TLS RSA SHA256 2020 CA1","organization":"DigiCert Inc"},"validity":{"start":"Mon, 01 Dec 2025 00:00:00 GMT","end":"Sun, 01 Mar 2026 23:59:59 GMT"},"fingerprint":{"sha1":"53:05:E7:D6:C0:D7:04:CC:52:8F:BA:2E:A0:17:B5:CF:62:D2:0B:96","sha256":"7F:46:38:49:8D:30:8C:10:04:26:F0:B3:CD:4E:37:78:7B:17:91:2A:BC:FB:C4:64:53:6C:5F:2F:23:3C:DE:4C"}}},"request":{"raw":"GET /en_US/all.js?hash=f720c277383ad6af4f6cf7bc5cc21c3b HTTP/1.1\r\nHost: connect.facebook.net\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nOrigin: http://dewa.baaauae.com\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: http://dewa.baaauae.com/\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nvary: Accept-Encoding\r\ncontent-encoding: gzip\r\naccess-control-expose-headers: X-FB-Content-MD5\r\nx-fb-content-md5: de318a11ad69b3c1e9c217f88d2e33a2\r\netag: \"6205409cb1fdebb081f892052de65f60\"\r\ncontent-type: application/x-javascript; charset=utf-8\r\ntiming-allow-origin: *\r\naccess-control-allow-origin: *\r\nexpires: Mon, 22 Feb 2027 12:18:02 GMT\r\ncache-control: public,max-age=31536000,stale-while-revalidate=3600,immutable\r\nreporting-endpoints: coop_report=\"https://www.facebook.com/browser_reporting/coop/?minimize=0\", coep_report=\"https://www.facebook.com/browser_reporting/coep/?minimize=0\", permissions_policy=\"https://www.facebook.com/ajax/browser_error_reports/\"\r\nx-frame-options: DENY\r\ndocument-policy: force-load-at-top, include-js-call-stacks-in-crash-reports\r\npermissions-policy: accelerometer=(), attribution-reporting=(), autoplay=(), bluetooth=(), camera=(), ch-device-memory=(), ch-downlink=(), ch-dpr=(), ch-ect=(), ch-rtt=(), ch-save-data=(), ch-ua-arch=(), ch-ua-bitness=(), ch-viewport-height=(), ch-viewport-width=(), ch-width=(), clipboard-read=(), clipboard-write=(), compute-pressure=(), display-capture=(), encrypted-media=(), fullscreen=(self), gamepad=(), geolocation=(), gyroscope=(), hid=(), idle-detection=(), interest-cohort=(), keyboard-map=(), local-fonts=(), magnetometer=(), microphone=(), midi=(), otp-credentials=(), payment=(), picture-in-picture=(), private-state-token-issuance=(), publickey-credentials-get=(), screen-wake-lock=(), serial=(), shared-storage=(), shared-storage-select-url=(), private-state-token-redemption=(), usb=(), unload=(self), window-management=(), xr-spatial-tracking=();report-to=\"permissions_policy\"\r\ncross-origin-resource-policy: cross-origin\r\ncross-origin-embedder-policy-report-only: require-corp;report-to=\"coep_report\"\r\ncross-origin-opener-policy: same-origin-allow-popups\r\nx-content-type-options: nosniff\r\nreport-to: {\"max_age\":2592000,\"endpoints\":[{\"url\":\"https:\\/\\/www.facebook.com\\/browser_reporting\\/coop\\/?minimize=0\"}],\"group\":\"coop_report\",\"include_subdomains\":true}, {\"max_age\":86400,\"endpoints\":[{\"url\":\"https:\\/\\/www.facebook.com\\/browser_reporting\\/coep\\/?minimize=0\"}],\"group\":\"coep_report\"}, {\"max_age\":21600,\"endpoints\":[{\"url\":\"https:\\/\\/www.facebook.com\\/ajax\\/browser_error_reports\\/\"}],\"group\":\"permissions_policy\"}\r\norigin-agent-cluster: ?1\r\nstrict-transport-security: max-age=31536000; preload; includeSubDomains\r\ncontent-md5: NREb2FORtBLcunRJCWWqSA==\r\nx-fb-debug: Qid/mAyjrFqLxopV/DssYjVwMNnqLRztQCNga3dGKuvbQor1SpfZZiF0NzmaqxgQDeCxcTFDgXRi2DrLv0LqFQ==\r\ncontent-length: 84381\r\ndate: Sun, 22 Feb 2026 13:54:35 GMT\r\nx-fb-connection-quality: EXCELLENT; q=0.9, rtt=7, rtx=0, c=13, mss=1380, tbw=4140, tp=-1, tpl=-1, uplat=1, ullat=-1\r\nalt-svc: h3=\":443\"; ma=86400\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":286393,"size_decoded":0,"mime_type":"application/x-javascript; charset=utf-8","magic":"JavaScript source, ASCII text, with very long lines (21904)","md5":"de318a11ad69b3c1e9c217f88d2e33a2","sha1":"3b54409d70555522e0558b515750fb0df4a507c7","sha256":"4df75ab36f35f039dfbf41882f612e01e3ae666bd7a21aaf65fdcfae7b12e2eb","sha512":"f52f7861e329112779475dce04bc49cd21a140dca6864e59e1c614830d382d40c636c3ff62342485bc4ce8259ca4f78c13e8aafa2997b1882bcfebc15d34bfcb","ssdeep":"6144:nr8THgXm0WAgZIrb+uH/sbVoj/jCMxMb3h6i4jPG:4TAXT+EjCMxMLh3p","tlshash":"365415ec76a5752582f6246250af214bb23e58a5380ec560b5e0c8d46dbce8f5b37f3c","first_seen":"2026-02-22T13:54:57.782842Z","last_seen":"2026-02-22T13:54:57.782842Z","times_seen":1,"resource_available":true,"data":null}},"time_used":203,"timings":{"blocked":83,"dns":66,"connect":7,"send":0,"wait":9,"receive":20,"ssl":15},"alerts":{"ids":null,"analyzer":null,"urlquery":null}}]}