{"report_id":"4daf2ab4-99e8-4edc-ba06-0172d2c28115","version":6,"status":"done","tags":[],"date":"2025-12-20T07:01:47Z","url":{"schema":"http","addr":"bluewhaleusen.com","fqdn":"bluewhaleusen.com","domain":"bluewhaleusen.com","tld":"com"},"ip":{"addr":"118.107.9.252","port":0,"asn":152194,"as":"CTG Server Limited","country":"Singapore","country_code":"SG"},"final":{"url":{"schema":"https","addr":"bluewhaleusen.com/#/index","fqdn":"bluewhaleusen.com","domain":"bluewhaleusen.com","tld":"com"},"title":"TikTok","dom":{"size":194651,"mime_type":"text/html; charset=utf-8","magic":"HTML document, Unicode text, UTF-8 text, with very long lines (37805)","md5":"6926b3390497fdd10ce32f134b617ff9","sha1":"78881ef22e01c5d8937d88735535390c4cf4dbbc","sha256":"8000b757388056a4eae56121da81b9a3aa08e8d274fb7d4e98b72ff8c10cd0f2","sha512":"18971c31fac77d1007f7e31803b3e3de928478a550d7c047ebcf868c1b00e9eeac05ba77cf13100aa5b440721f420461f6562a96bc803cd138422669a336b8e7","ssdeep":"3072:1aqIQHvl9R1T6Nnr4MguYluuaEpkPepfPG:1axQPRR6NnzgvQNEpyqG","tlshash":"de149571c66a223b02274de870606b4fbae3c31dde97560167fcb7895febc94ea04485","dom_hash":"domhash8b65a9f058c64d6cc148f4d7a07d0705","first_seen":"2025-12-20T07:02:05.065628Z","last_seen":"2025-12-20T07:02:05.065628Z","times_seen":1,"resource_available":false,"data":null}},"submit":{"url":{"schema":"http","addr":"bluewhaleusen.com","fqdn":"bluewhaleusen.com","domain":"bluewhaleusen.com","tld":"com"},"ip":{"addr":"118.107.9.252","port":0,"asn":152194,"as":"CTG Server Limited","country":"Singapore","country_code":"SG"},"tags":null,"meta":null,"user":{"user_id":"akbkyowd9geqr98"}},"settings":{"access":"public","device_type":"desktop","expires_at":"2027-01-24T07:01:47Z","useragent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0","referer":"","cookies":null,"exit_node":"z0yflva4pidy47h"},"stats":{"alert_count":{"ids":0,"urlquery":0,"analyzer":5}},"detection":{"ids":null,"analyzer":[{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2025-12-20","alert":"Sinkholed","trigger":"bluewhaleusen.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2025-12-20","alert":"Phishing Block","trigger":"bluewhaleusen.com","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2025-12-20","alert":"Sinkholed","trigger":"bluewhaleusen.com","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2025-12-20","alert":"Sinkholed","trigger":"bluewhaleusen.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2025-12-20","alert":"Sinkholed","trigger":"bluewhaleusen.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null},"summary":[{"fqdn":"bluewhaleusen.com","ip":{"addr":"118.107.9.252","port":443,"asn":152194,"as":"CTG Server Limited","country":"Singapore","country_code":"SG"},"domain_registered":"unknown","domain_rank":0,"first_seen":"2025-12-20T07:01:52.093207Z","last_seen":"2025-12-20T07:01:52.093207Z","alert_count":615,"request_count":123,"received_data":7197908,"sent_data":53189,"comment":"","tags":null,"fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}]},{"fqdn":"mall-test.s3.amazonaws.com","ip":{"addr":"3.5.30.74","port":443,"asn":14618,"as":"AMAZON-AES","country":"United States","country_code":"US"},"domain_registered":"2005-08-18","domain_rank":0,"first_seen":"2024-08-11T22:28:16Z","last_seen":"2025-12-19T06:41:55.653247Z","alert_count":0,"request_count":56,"received_data":5370377,"sent_data":25513,"comment":"","tags":null,"fingerprints":[{"name":"Amazon S3","description":"Amazon S3 or Amazon Simple Storage Service is a service offered by Amazon Web Services (AWS) that provides object storage through a web service interface.","website":"https://aws.amazon.com/s3/","common_platform_enumeration":"","icon":"Amazon S3.svg","categories":["CDN"]},{"name":"Amazon Web Services","description":"Amazon Web Services (AWS) is a comprehensive cloud services platform offering compute power, database storage, content delivery and other functionality.","website":"https://aws.amazon.com/","common_platform_enumeration":"","icon":"Amazon Web Services.svg","categories":["PaaS"]}]},{"fqdn":"imgtest1.s3.amazonaws.com","ip":{"addr":"16.15.207.90","port":443,"asn":14618,"as":"AMAZON-AES","country":"United States","country_code":"US"},"domain_registered":"2005-08-18","domain_rank":0,"first_seen":"2019-08-25T08:51:32Z","last_seen":"2025-12-19T06:42:33.588276Z","alert_count":0,"request_count":34,"received_data":4346465,"sent_data":15515,"comment":"","tags":null,"fingerprints":[{"name":"Amazon Web Services","description":"Amazon Web Services (AWS) is a comprehensive cloud services platform offering compute power, database storage, content delivery and other functionality.","website":"https://aws.amazon.com/","common_platform_enumeration":"","icon":"Amazon Web Services.svg","categories":["PaaS"]},{"name":"Amazon S3","description":"Amazon S3 or Amazon Simple Storage Service is a service offered by Amazon Web Services (AWS) that provides object storage through a web service interface.","website":"https://aws.amazon.com/s3/","common_platform_enumeration":"","icon":"Amazon S3.svg","categories":["CDN"]}]},{"fqdn":"shop-shangcheng-shangchuan2.s3.amazonaws.com","ip":{"addr":"3.5.27.242","port":443,"asn":14618,"as":"AMAZON-AES","country":"United States","country_code":"US"},"domain_registered":"2005-08-18","domain_rank":0,"first_seen":"2024-03-15T17:45:08Z","last_seen":"2025-12-18T04:07:55.90805Z","alert_count":0,"request_count":3,"received_data":894,"sent_data":1425,"comment":"","tags":null,"fingerprints":[{"name":"Amazon S3","description":"Amazon S3 or Amazon Simple Storage Service is a service offered by Amazon Web Services (AWS) that provides object storage through a web service interface.","website":"https://aws.amazon.com/s3/","common_platform_enumeration":"","icon":"Amazon S3.svg","categories":["CDN"]},{"name":"Amazon Web Services","description":"Amazon Web Services (AWS) is a comprehensive cloud services platform offering compute power, database storage, content delivery and other functionality.","website":"https://aws.amazon.com/","common_platform_enumeration":"","icon":"Amazon Web Services.svg","categories":["PaaS"]}]}],"files":null,"artifacts":{"windows_shortcuts":null,"files":null,"telegram":null,"pdfs":null,"clipboard":null},"sensors":{"ids":null,"analyzer":null,"urlquery":null},"javascript":{"script":[{"url":{"schema":"https","addr":"bluewhaleusen.com/js/app.cea013d5.js","fqdn":"bluewhaleusen.com","domain":"bluewhaleusen.com","tld":"com"},"ip":{"addr":"118.107.9.252","port":443,"asn":152194,"as":"CTG Server Limited","country":"Singapore","country_code":"SG"},"introduction_type":"scriptElement","is_inline":false,"md5":"0ca28d829c95d7be422f77eb2aebcb51","sha1":"20e24ba11f15d4ecde560d55a6245053987f5d03","sha256":"f43af70af8358ac07bf5008c549692a4a958dbcefa93502b62a62af55632a18f","sha512":"fabb9f769078420d3e84f9085f2b3d7e1fcf3a5c5c3315d967f59fee78e3373fec9a26bc1a1e8841d757fe9bb17a7545033a1f09d8265fc95edab3758c802ddb","ssdeep":"24576:LOEWKd8OVVhuWMU9WcPiCDPitLz29HxNUCOE3Nkxp5R+4t69uE9s1B9Lfbzxg7Bn:LOXKd8OVVhuWMU9fPZatm9Hb59dWf+8q","tlshash":"ef658def67da77fc08545646a04f3974219c1cbafb96f4e008edf61922e9e40c212f69","size":1442906,"data":"","first_seen":"2025-12-19T18:50:44.110812Z","last_seen":"2025-12-20T07:02:05.229325Z","times_seen":2,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"bluewhaleusen.com/js/vendors~app.de839525.js","fqdn":"bluewhaleusen.com","domain":"bluewhaleusen.com","tld":"com"},"ip":{"addr":"118.107.9.252","port":443,"asn":152194,"as":"CTG Server Limited","country":"Singapore","country_code":"SG"},"introduction_type":"scriptElement","is_inline":false,"md5":"3a2e2620e56aeb87314ad31b2d20f151","sha1":"c47ac2723bc746d72bb25e488c59ddb6b56340a4","sha256":"bb0b89499974411e2d86725d8df128255e67ddc5a70de051746863239c9b8812","sha512":"e937000fdb9a906f657b1f8a9bc6d8f852e5d094dbb671fa0147e45ae458f87876cbddb7f52e2d2307c7284614016264ae180f734a7105f8c6550f0462de36d8","ssdeep":"49152:XJypp88Cx3zMCzMffKGbJUV/8rW4AhW0rzHR1P8Id+is3tTZ4ZUy:5izCxDMCQaGFUV4W4grPITZ4Cy","tlshash":"b3f5c35c365af340914ad0e7e43b3c49d26ae189a40b40d07f7187f31eb574ae7aee26","size":3579712,"data":"","first_seen":"2024-07-31T10:49:34Z","last_seen":"2026-08-02T20:19:22.216529Z","times_seen":167,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"bluewhaleusen.com/js/chunk-79bc161e.85987729.js","fqdn":"bluewhaleusen.com","domain":"bluewhaleusen.com","tld":"com"},"ip":{"addr":"118.107.9.252","port":443,"asn":152194,"as":"CTG Server Limited","country":"Singapore","country_code":"SG"},"introduction_type":"scriptElement","is_inline":false,"md5":"8d8c76ef48289d7ba00968bbc3279842","sha1":"e6102d6eca437c5cbd4110e259bfee480a0070ab","sha256":"1d0ab66ab732032c8bfd0dcf86f44395c979c0e92bfbdb3e5d6cab5850eb54f0","sha512":"6d686935ed8ba895b2c0961c1e83bd187fb734194484fd93066daf1392f492adf3cb5b42a13f1572020b630ac2044509f201a2b89dd91265f851944b662f43ad","ssdeep":"192:RzCjfAcMsHRpMu7mWKD12R+YEX+WzU9MuMOO0Kxq/cictjAfNeNF/BPsGC3M:wfNMsHRp3Q19X+WzU9MKXmvPd","tlshash":"e45295e6c470a4bd895a82b26055f1e0fb643a1cd102514efa7cec9b72ed424332e77e","size":13662,"data":"","first_seen":"2024-11-28T05:36:45.222943Z","last_seen":"2026-06-06T14:40:04.392552Z","times_seen":72,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"bluewhaleusen.com/js/chunk-2bdc7c1c.3b2a0fb6.js","fqdn":"bluewhaleusen.com","domain":"bluewhaleusen.com","tld":"com"},"ip":{"addr":"118.107.9.252","port":443,"asn":152194,"as":"CTG Server Limited","country":"Singapore","country_code":"SG"},"introduction_type":"scriptElement","is_inline":false,"md5":"744c54446e61f5d1b905361d15c85998","sha1":"5c3a6c929e695a790797aa763ea7863cbff0d7ab","sha256":"d8910170ab8c5baaca72f9b047faa7e14c49f97d907e4c137fee23629107c1c3","sha512":"df57b73849df42965644f26b84a1ed37d0e75079d7165a14b96928369ca0065aebe547c803c7b384976f4ff62cc63c1a174eee52ed367e42b421729e168c6bb0","ssdeep":"384:/XWsnfX8q8V8bTpAtlfs/0NbuGoalAS22Hn/jvjs4WvzsL5cU+18e:/pMqs7s/gbuGXH/fsMLDe","tlshash":"56e20a4ba4c2687d899a6159241b2658b8323fc5e041c8d6b53cfdf4e2f8e34772b76c","size":33190,"data":"","first_seen":"2025-04-08T11:27:57.64892Z","last_seen":"2026-06-06T14:40:04.34261Z","times_seen":66,"alerts":{"ids":null,"analyzer":null,"urlquery":null}}],"eval":null,"write":null,"console":null},"http":[{"url":{"schema":"https","addr":"bluewhaleusen.com/js/chunk-3fe0aac0.43d82c52.js","fqdn":"bluewhaleusen.com","domain":"bluewhaleusen.com","tld":"com"},"ip":{"addr":"118.107.9.252","port":443,"asn":152194,"as":"CTG Server Limited","country":"Singapore","country_code":"SG"},"is_navigation_request":false,"resource_type":"other","requested_by":"https://bluewhaleusen.com/","date":"2025-12-20T07:01:26.969Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"bluewhaleusen.com","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Fri, 19 Dec 2025 05:22:57 GMT","end":"Thu, 19 Mar 2026 05:22:56 GMT"},"fingerprint":{"sha1":"23:4C:94:04:E1:25:E0:EA:D1:85:17:4C:09:FC:E0:DA:D0:01:E6:62","sha256":"AC:EF:45:40:E0:37:3A:BD:B9:C9:32:F5:6B:B1:B8:92:BE:33:89:43:FA:25:17:17:7C:CA:50:4E:0B:CD:25:EB"}}},"request":{"raw":"GET /js/chunk-3fe0aac0.43d82c52.js HTTP/1.1\r\nHost: bluewhaleusen.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nX-Moz: prefetch\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Sat, 20 Dec 2025 07:01:27 GMT\r\ncontent-type: application/javascript\r\nvary: Accept-Encoding\r\netag: W/\"3421-1766123972305\"\r\nlast-modified: Fri, 19 Dec 2025 05:59:32 GMT\r\nstrict-transport-security: max-age=31536000\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":3421,"size_decoded":0,"mime_type":"application/javascript","magic":"JavaScript source, ASCII text, with very long lines (3421), with no line terminators","md5":"b91061303183079af6d1c176a51454f5","sha1":"873ff083b0a3d3265bdd9344f2726ba96ccc6a55","sha256":"f21c36c73bec53215b9e2811f1eb4079300991a73742a0910a7a957a63d22f4d","sha512":"0d03e4c1381a14a079356c05497fb5deda4426490ce6bab984504220da2cd46fa0f28b87131d081fcd1c7489769584d5aed8159f7670a9f6c6c8d0a3eb2caeb7","ssdeep":"","tlshash":"1d61520d9443787eac6e4016b11979a8a0722fe6c841c4e7fa3ccda993d0d74332e7e9","first_seen":"2025-04-08T10:46:39.897425Z","last_seen":"2026-06-06T14:40:04.447253Z","times_seen":153,"resource_available":false,"data":null}},"time_used":327,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":327,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2025-12-20","alert":"Sinkholed","trigger":"bluewhaleusen.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2025-12-20","alert":"Phishing Block","trigger":"bluewhaleusen.com","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2025-12-20","alert":"Sinkholed","trigger":"bluewhaleusen.com","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2025-12-20","alert":"Sinkholed","trigger":"bluewhaleusen.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2025-12-20","alert":"Sinkholed","trigger":"bluewhaleusen.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"bluewhaleusen.com/js/chunk-6f6da97b.246148bc.js","fqdn":"bluewhaleusen.com","domain":"bluewhaleusen.com","tld":"com"},"ip":{"addr":"118.107.9.252","port":443,"asn":152194,"as":"CTG Server Limited","country":"Singapore","country_code":"SG"},"is_navigation_request":false,"resource_type":"other","requested_by":"https://bluewhaleusen.com/","date":"2025-12-20T07:01:27.346Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"bluewhaleusen.com","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Fri, 19 Dec 2025 05:22:57 GMT","end":"Thu, 19 Mar 2026 05:22:56 GMT"},"fingerprint":{"sha1":"23:4C:94:04:E1:25:E0:EA:D1:85:17:4C:09:FC:E0:DA:D0:01:E6:62","sha256":"AC:EF:45:40:E0:37:3A:BD:B9:C9:32:F5:6B:B1:B8:92:BE:33:89:43:FA:25:17:17:7C:CA:50:4E:0B:CD:25:EB"}}},"request":{"raw":"GET /js/chunk-6f6da97b.246148bc.js HTTP/1.1\r\nHost: bluewhaleusen.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nX-Moz: prefetch\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Sat, 20 Dec 2025 07:01:27 GMT\r\ncontent-type: application/javascript\r\nvary: Accept-Encoding\r\netag: W/\"1968-1766123972305\"\r\nlast-modified: Fri, 19 Dec 2025 05:59:32 GMT\r\nstrict-transport-security: max-age=31536000\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":1968,"size_decoded":0,"mime_type":"application/javascript","magic":"JavaScript source, ASCII text, with very long lines (1968), with no line terminators","md5":"1208ffa48d331f25a83777fb559bfbd4","sha1":"a7bebd2b652b2bbc2b7f0eb0d4176f751d8e4942","sha256":"3306156b8f41a234a93659be2f2f9a57e76f0cab53ac5b1ca608e4303e122a9b","sha512":"1b26158b73d765db368d52e0333de2308b39dc0d3928f6c7103899bb9cc1be703eb6d0921e94b2b95b66af814d56733bdef493806cce797d752a7f0f3f2882e4","ssdeep":"","tlshash":"b24173df50a7fcaddadbb042112a1035b0623ec144468ca57bf4cd6085c4d945f1e68e","first_seen":"2025-04-08T10:46:39.889069Z","last_seen":"2026-06-06T14:40:04.375699Z","times_seen":153,"resource_available":false,"data":null}},"time_used":327,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":327,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2025-12-20","alert":"Sinkholed","trigger":"bluewhaleusen.com","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2025-12-20","alert":"Sinkholed","trigger":"bluewhaleusen.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2025-12-20","alert":"Phishing Block","trigger":"bluewhaleusen.com","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2025-12-20","alert":"Sinkholed","trigger":"bluewhaleusen.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2025-12-20","alert":"Sinkholed","trigger":"bluewhaleusen.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"bluewhaleusen.com/js/chunk-758a1bbc.14298e0b.js","fqdn":"bluewhaleusen.com","domain":"bluewhaleusen.com","tld":"com"},"ip":{"addr":"118.107.9.252","port":443,"asn":152194,"as":"CTG Server Limited","country":"Singapore","country_code":"SG"},"is_navigation_request":false,"resource_type":"other","requested_by":"https://bluewhaleusen.com/","date":"2025-12-20T07:01:27.351Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"bluewhaleusen.com","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Fri, 19 Dec 2025 05:22:57 GMT","end":"Thu, 19 Mar 2026 05:22:56 GMT"},"fingerprint":{"sha1":"23:4C:94:04:E1:25:E0:EA:D1:85:17:4C:09:FC:E0:DA:D0:01:E6:62","sha256":"AC:EF:45:40:E0:37:3A:BD:B9:C9:32:F5:6B:B1:B8:92:BE:33:89:43:FA:25:17:17:7C:CA:50:4E:0B:CD:25:EB"}}},"request":{"raw":"GET /js/chunk-758a1bbc.14298e0b.js HTTP/1.1\r\nHost: bluewhaleusen.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nX-Moz: prefetch\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Sat, 20 Dec 2025 07:01:27 GMT\r\ncontent-type: application/javascript\r\nvary: Accept-Encoding\r\netag: W/\"59863-1766123972297\"\r\nlast-modified: Fri, 19 Dec 2025 05:59:32 GMT\r\nstrict-transport-security: max-age=31536000\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":59863,"size_decoded":0,"mime_type":"application/javascript","magic":"JavaScript source, ASCII text, with very long lines (59863), with no line terminators","md5":"9e262129756fe946248e28a56b709fb1","sha1":"cac54a09590db3c22fe04d4b8e033cf8548902e8","sha256":"deee4ad3d8035b4ac807487efdd848cfee0c7225bdd3d0e74ea5d01b074adbef","sha512":"9b20a4d796aa65ccdcdf08a13070216b786d536f8f315023277ba7c16b8400442060cc80821ad913e6ecf839b8b986a9d06806bdb542e6782f8b7a879a49951a","ssdeep":"1536:EiLFJc8jJyHnJWwOOYvpRytAe3+afqtls6rpDZPUSRQWaM:JdUHnJWSWw+rlJNDZPFyM","tlshash":"5d43e126a0e394969f678091930b7c5c8c124befd1dbc586bb78b951cc98ef9262707c","first_seen":"2025-04-08T11:27:57.684276Z","last_seen":"2026-06-06T14:40:04.327679Z","times_seen":57,"resource_available":false,"data":null}},"time_used":331,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":331,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2025-12-20","alert":"Sinkholed","trigger":"bluewhaleusen.com","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2025-12-20","alert":"Phishing Block","trigger":"bluewhaleusen.com","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2025-12-20","alert":"Sinkholed","trigger":"bluewhaleusen.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2025-12-20","alert":"Sinkholed","trigger":"bluewhaleusen.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2025-12-20","alert":"Sinkholed","trigger":"bluewhaleusen.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"bluewhaleusen.com/js/chunk-79bc161e.85987729.js","fqdn":"bluewhaleusen.com","domain":"bluewhaleusen.com","tld":"com"},"ip":{"addr":"118.107.9.252","port":443,"asn":152194,"as":"CTG Server Limited","country":"Singapore","country_code":"SG"},"is_navigation_request":false,"resource_type":"other","requested_by":"https://bluewhaleusen.com/","date":"2025-12-20T07:01:27.618Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"bluewhaleusen.com","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Fri, 19 Dec 2025 05:22:57 GMT","end":"Thu, 19 Mar 2026 05:22:56 GMT"},"fingerprint":{"sha1":"23:4C:94:04:E1:25:E0:EA:D1:85:17:4C:09:FC:E0:DA:D0:01:E6:62","sha256":"AC:EF:45:40:E0:37:3A:BD:B9:C9:32:F5:6B:B1:B8:92:BE:33:89:43:FA:25:17:17:7C:CA:50:4E:0B:CD:25:EB"}}},"request":{"raw":"GET /js/chunk-79bc161e.85987729.js HTTP/1.1\r\nHost: bluewhaleusen.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nX-Moz: prefetch\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Sat, 20 Dec 2025 07:01:27 GMT\r\ncontent-type: application/javascript\r\nvary: Accept-Encoding\r\netag: W/\"13662-1766123972313\"\r\nlast-modified: Fri, 19 Dec 2025 05:59:32 GMT\r\nstrict-transport-security: max-age=31536000\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":13662,"size_decoded":0,"mime_type":"application/javascript","magic":"JavaScript source, Unicode text, UTF-8 text, with very long lines (13654), with no line terminators","md5":"8d8c76ef48289d7ba00968bbc3279842","sha1":"e6102d6eca437c5cbd4110e259bfee480a0070ab","sha256":"1d0ab66ab732032c8bfd0dcf86f44395c979c0e92bfbdb3e5d6cab5850eb54f0","sha512":"6d686935ed8ba895b2c0961c1e83bd187fb734194484fd93066daf1392f492adf3cb5b42a13f1572020b630ac2044509f201a2b89dd91265f851944b662f43ad","ssdeep":"192:RzCjfAcMsHRpMu7mWKD12R+YEX+WzU9MuMOO0Kxq/cictjAfNeNF/BPsGC3M:wfNMsHRp3Q19X+WzU9MKXmvPd","tlshash":"e45295e6c470a4bd895a82b26055f1e0fb643a1cd102514efa7cec9b72ed424332e77e","first_seen":"2024-11-28T05:36:45.222943Z","last_seen":"2026-06-06T14:40:04.392552Z","times_seen":72,"resource_available":true,"data":null}},"time_used":327,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":327,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2025-12-20","alert":"Sinkholed","trigger":"bluewhaleusen.com","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2025-12-20","alert":"Sinkholed","trigger":"bluewhaleusen.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2025-12-20","alert":"Sinkholed","trigger":"bluewhaleusen.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2025-12-20","alert":"Phishing Block","trigger":"bluewhaleusen.com","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2025-12-20","alert":"Sinkholed","trigger":"bluewhaleusen.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"mall-test.s3.amazonaws.com/pc/gp/B07V3DF1QP/51G8uW4FLLL._AC_SL1010_.jpg","fqdn":"mall-test.s3.amazonaws.com","domain":"mall-test.s3.amazonaws.com","tld":"s3.amazonaws.com"},"ip":{"addr":"3.5.30.74","port":443,"asn":14618,"as":"AMAZON-AES","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://bluewhaleusen.com/","date":"2025-12-20T07:01:23.445Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_CHACHA20_POLY1305_SHA256","key_group_name":"P256","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"s3.amazonaws.com","organization":""},"issuer":{"commonName":"Amazon RSA 2048 M01","organization":"Amazon"},"validity":{"start":"Fri, 19 Sep 2025 00:00:00 GMT","end":"Sun, 23 Aug 2026 23:59:59 GMT"},"fingerprint":{"sha1":"48:FD:CD:50:85:6A:51:E7:71:E4:CB:E0:03:81:E1:EC:4E:AD:9E:C7","sha256":"D7:11:81:F4:91:03:0D:C6:A5:DE:8A:EF:AA:58:14:BA:AD:33:B5:11:8B:D5:F0:33:53:8B:AF:49:82:E9:4B:A4"}}},"request":{"raw":"GET /pc/gp/B07V3DF1QP/51G8uW4FLLL._AC_SL1010_.jpg HTTP/1.1\r\nHost: mall-test.s3.amazonaws.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nx-amz-id-2: lAHcWL5NKqHfY4oOY656XtDL945kBGVzspDGmiRKUjHtXNBgm06F2KfFLmOqqZLSJTaxiA/0NBDKv7jT16I20Az0t4Q5wod3\r\nx-amz-request-id: S19ZS57XCA27ZKVG\r\nDate: Sat, 20 Dec 2025 07:01:24 GMT\r\nLast-Modified: Wed, 22 May 2024 02:20:51 GMT\r\nETag: \"933feffc6f87b5e835ebcefde5c5c67c\"\r\nx-amz-server-side-encryption: AES256\r\nx-amz-meta-sha256: 8680fdf2f0e12092efe3d61a6df35efeeb6658f49e10a7397687c7f378021bd3\r\nx-amz-meta-s3b-last-modified: 20231029T132225Z\r\nAccept-Ranges: bytes\r\nContent-Type: image/jpeg\r\nContent-Length: 45111\r\nServer: AmazonS3\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Amazon S3","description":"Amazon S3 or Amazon Simple Storage Service is a service offered by Amazon Web Services (AWS) that provides object storage through a web service interface.","website":"https://aws.amazon.com/s3/","common_platform_enumeration":"","icon":"Amazon S3.svg","categories":["CDN"]},{"name":"Amazon Web Services","description":"Amazon Web Services (AWS) is a comprehensive cloud services platform offering compute power, database storage, content delivery and other functionality.","website":"https://aws.amazon.com/","common_platform_enumeration":"","icon":"Amazon Web Services.svg","categories":["PaaS"]}],"data":{"size":45111,"size_decoded":0,"mime_type":"image/jpeg","magic":"JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 499x956, components 3","md5":"933feffc6f87b5e835ebcefde5c5c67c","sha1":"b4961dc6b0b61aaf05cc9e4ffc4318eaaedd60a7","sha256":"8680fdf2f0e12092efe3d61a6df35efeeb6658f49e10a7397687c7f378021bd3","sha512":"1fe7f9b5dcfa651626616464fe7b1c25946eb77d2fb4d6739bb2cd9e9c5012feef50e8928dbc6ee5a125570949760b702b647bd4ed73ea7cde3b4cb853a45bf6","ssdeep":"768:ygg6D3BnJNDyRk1XT3cR1EHhRToTNw8sDd+TnRrJq/TEdjBxT1:y383hPSk53cRiraNw8sDy5dFx5","tlshash":"0113f1cb2eac3597f1ae313bf24150414b9aebd1a8b0da71752380441435b7f6de746e","first_seen":"2024-03-15T18:45:45Z","last_seen":"2026-08-11T08:26:52.919255Z","times_seen":2432,"resource_available":false,"data":null}},"time_used":657,"timings":{"blocked":225,"dns":10,"connect":96,"send":0,"wait":115,"receive":95,"ssl":110},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"imgtest1.s3.amazonaws.com/test/2023-03-11/2b1f361d-49af-4f07-99de-f8e65f804abb.jpg","fqdn":"imgtest1.s3.amazonaws.com","domain":"imgtest1.s3.amazonaws.com","tld":"s3.amazonaws.com"},"ip":{"addr":"16.15.207.90","port":443,"asn":14618,"as":"AMAZON-AES","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://bluewhaleusen.com/","date":"2025-12-20T07:01:23.631Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"P256","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.s3.amazonaws.com","organization":""},"issuer":{"commonName":"Amazon RSA 2048 M01","organization":"Amazon"},"validity":{"start":"Fri, 14 Feb 2025 00:00:00 GMT","end":"Sat, 07 Feb 2026 23:59:59 GMT"},"fingerprint":{"sha1":"2E:BA:63:64:95:A8:CE:55:DD:7E:EB:A9:98:83:14:B1:6F:6B:61:69","sha256":"00:D7:0B:CC:1F:82:6B:F6:D9:2E:55:1A:BA:88:38:33:19:09:5B:85:49:41:5E:DA:A1:97:B9:D2:0A:3B:13:52"}}},"request":{"raw":"GET /test/2023-03-11/2b1f361d-49af-4f07-99de-f8e65f804abb.jpg HTTP/1.1\r\nHost: imgtest1.s3.amazonaws.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nx-amz-id-2: w6PCtDiOE5H8JrTgn7+5RE18eIUHg2tX+9JJalg/R3oMCCsh6oMOFOGsNJ71t99EauTCpr6iS3FrJVxwGTbrZaI1UTX7S2v5\r\nx-amz-request-id: CRNSP7ET776CG486\r\nDate: Sat, 20 Dec 2025 07:01:25 GMT\r\nLast-Modified: Thu, 23 May 2024 01:49:09 GMT\r\nETag: \"8e45ef03c4d3d3f8338e907948eb5268\"\r\nx-amz-server-side-encryption: AES256\r\nAccept-Ranges: bytes\r\nContent-Type: image/jpeg\r\nContent-Length: 55668\r\nServer: AmazonS3\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Amazon Web Services","description":"Amazon Web Services (AWS) is a comprehensive cloud services platform offering compute power, database storage, content delivery and other functionality.","website":"https://aws.amazon.com/","common_platform_enumeration":"","icon":"Amazon Web Services.svg","categories":["PaaS"]},{"name":"Amazon S3","description":"Amazon S3 or Amazon Simple Storage Service is a service offered by Amazon Web Services (AWS) that provides object storage through a web service interface.","website":"https://aws.amazon.com/s3/","common_platform_enumeration":"","icon":"Amazon S3.svg","categories":["CDN"]}],"data":{"size":55668,"size_decoded":0,"mime_type":"image/jpeg","magic":"JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 962x1031, components 3","md5":"8e45ef03c4d3d3f8338e907948eb5268","sha1":"6d8847195c0a42f8310bdcf575ea57a0bb889766","sha256":"de9af8571cfab6b7bdcee5e4fc038ff690fa02e497205a7136633e8fd284f600","sha512":"c14e594f7bd92be09f77d59496127622a20d24f54f2dc28cfc34c33e8f579d2a39d9308b82023403476d985722a30b6bdeae0f8ac97cb69fc9c2d0e466064da3","ssdeep":"1536:d0B/FwBZy6t1n07VqLvJ/qkz5HvEwW2Lto8y:qVFSZd11NpjWX","tlshash":"f84302ca57610c98e499afb2377f37079713a5ed493026a33de69aac110cf112876ef4","first_seen":"2024-02-19T23:01:28Z","last_seen":"2026-08-09T04:44:19.253613Z","times_seen":7333,"resource_available":false,"data":null}},"time_used":859,"timings":{"blocked":739,"dns":0,"connect":0,"send":0,"wait":118,"receive":2,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"bluewhaleusen.com/css/chunk-2fdca798.6015aaea.css","fqdn":"bluewhaleusen.com","domain":"bluewhaleusen.com","tld":"com"},"ip":{"addr":"118.107.9.252","port":443,"asn":152194,"as":"CTG Server Limited","country":"Singapore","country_code":"SG"},"is_navigation_request":false,"resource_type":"other","requested_by":"https://bluewhaleusen.com/","date":"2025-12-20T07:01:24.281Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"bluewhaleusen.com","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Fri, 19 Dec 2025 05:22:57 GMT","end":"Thu, 19 Mar 2026 05:22:56 GMT"},"fingerprint":{"sha1":"23:4C:94:04:E1:25:E0:EA:D1:85:17:4C:09:FC:E0:DA:D0:01:E6:62","sha256":"AC:EF:45:40:E0:37:3A:BD:B9:C9:32:F5:6B:B1:B8:92:BE:33:89:43:FA:25:17:17:7C:CA:50:4E:0B:CD:25:EB"}}},"request":{"raw":"GET /css/chunk-2fdca798.6015aaea.css HTTP/1.1\r\nHost: bluewhaleusen.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nX-Moz: prefetch\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Sat, 20 Dec 2025 07:01:24 GMT\r\ncontent-type: text/css\r\nvary: Accept-Encoding\r\netag: W/\"16022-1766123972325\"\r\nlast-modified: Fri, 19 Dec 2025 05:59:32 GMT\r\nstrict-transport-security: max-age=31536000\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":16022,"size_decoded":0,"mime_type":"text/css","magic":"ASCII text, with very long lines (16022), with no line terminators","md5":"6301294b574a2297ea5bb8ebd51502fc","sha1":"2eaf83df4e82197b710dbe963f9e47e550e903ab","sha256":"07e22451bbdfaea2059e79dbc6dd3173d29b0049ab44d72093bc8d3a62e94722","sha512":"eb625eea493993fb48886af3abd22ed0b6ff2cde89c1557394d9705cace10140424ee12a6c3d4480edc0f5d4931d3651650e2b574605cf7d97f55ab8f947627b","ssdeep":"384:Ox2CQRDeBzT8lN9lc1tXCQRDeBzT8lN9lc1JsncjUdG:Ox2Te2lAFTe2lAJsncv","tlshash":"517218e5f234512e685264b661c0ddca7849f919e2f642e6ef86b929c0c76e3273c34c","first_seen":"2024-02-19T23:01:29Z","last_seen":"2026-06-06T14:40:04.357724Z","times_seen":394,"resource_available":false,"data":null}},"time_used":327,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":327,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2025-12-20","alert":"Sinkholed","trigger":"bluewhaleusen.com","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2025-12-20","alert":"Sinkholed","trigger":"bluewhaleusen.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2025-12-20","alert":"Phishing Block","trigger":"bluewhaleusen.com","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2025-12-20","alert":"Sinkholed","trigger":"bluewhaleusen.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2025-12-20","alert":"Sinkholed","trigger":"bluewhaleusen.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"bluewhaleusen.com/img/right5.66fbdf99.jpeg","fqdn":"bluewhaleusen.com","domain":"bluewhaleusen.com","tld":"com"},"ip":{"addr":"118.107.9.252","port":443,"asn":152194,"as":"CTG Server Limited","country":"Singapore","country_code":"SG"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://bluewhaleusen.com/","date":"2025-12-20T07:01:24.290Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"bluewhaleusen.com","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Fri, 19 Dec 2025 05:22:57 GMT","end":"Thu, 19 Mar 2026 05:22:56 GMT"},"fingerprint":{"sha1":"23:4C:94:04:E1:25:E0:EA:D1:85:17:4C:09:FC:E0:DA:D0:01:E6:62","sha256":"AC:EF:45:40:E0:37:3A:BD:B9:C9:32:F5:6B:B1:B8:92:BE:33:89:43:FA:25:17:17:7C:CA:50:4E:0B:CD:25:EB"}}},"request":{"raw":"GET /img/right5.66fbdf99.jpeg HTTP/1.1\r\nHost: bluewhaleusen.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Sat, 20 Dec 2025 07:01:24 GMT\r\ncontent-type: image/jpeg\r\nvary: Accept-Encoding\r\netag: W/\"5524-1766123972332\"\r\nlast-modified: Fri, 19 Dec 2025 05:59:32 GMT\r\nstrict-transport-security: max-age=31536000\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":5524,"size_decoded":0,"mime_type":"image/jpeg","magic":"JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 242x154, components 3","md5":"66fbdf99c05282d390579ee1e8a4c8b0","sha1":"d7bd65c2553bbf938ba2a7d982e1d90c1860baff","sha256":"847d339af1537664b4c0266c7cd4c84db1432f9174295f132e04e6b6b50121f1","sha512":"49bab24b6a8f47f7b099901a65868be194efe11047dfd9ade98b8fcac862b3bb59ebcbc76921ffe6c900aa91e675f11a9b64a42c418e80f02cc8ad1a43b98b45","ssdeep":"96:WhhUFvxHgld/rdM2oX1pfs1BBfcVq3CxmaiVFMbo9qJC1dwH2J34Rm1cum8lwoRY:EAxH+BqBl1kBBfc1xmnQ7U1dwH64AyuA","tlshash":"17b17e19a62ea807cb2aa9fb2d5c259661012a747f1c0bf246a121debd42cb1af15324","first_seen":"2024-02-19T23:01:28Z","last_seen":"2026-08-11T08:26:52.947966Z","times_seen":421,"resource_available":false,"data":null}},"time_used":328,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":328,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2025-12-20","alert":"Phishing Block","trigger":"bluewhaleusen.com","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2025-12-20","alert":"Sinkholed","trigger":"bluewhaleusen.com","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2025-12-20","alert":"Sinkholed","trigger":"bluewhaleusen.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2025-12-20","alert":"Sinkholed","trigger":"bluewhaleusen.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2025-12-20","alert":"Sinkholed","trigger":"bluewhaleusen.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"imgtest1.s3.amazonaws.com/test/2023-03-07/f204d4bc-b984-45d8-b4c0-c64cd323a50b.jpg","fqdn":"imgtest1.s3.amazonaws.com","domain":"imgtest1.s3.amazonaws.com","tld":"s3.amazonaws.com"},"ip":{"addr":"16.15.207.90","port":443,"asn":14618,"as":"AMAZON-AES","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://bluewhaleusen.com/","date":"2025-12-20T07:01:24.692Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"P256","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.s3.amazonaws.com","organization":""},"issuer":{"commonName":"Amazon RSA 2048 M01","organization":"Amazon"},"validity":{"start":"Fri, 14 Feb 2025 00:00:00 GMT","end":"Sat, 07 Feb 2026 23:59:59 GMT"},"fingerprint":{"sha1":"2E:BA:63:64:95:A8:CE:55:DD:7E:EB:A9:98:83:14:B1:6F:6B:61:69","sha256":"00:D7:0B:CC:1F:82:6B:F6:D9:2E:55:1A:BA:88:38:33:19:09:5B:85:49:41:5E:DA:A1:97:B9:D2:0A:3B:13:52"}}},"request":{"raw":"GET /test/2023-03-07/f204d4bc-b984-45d8-b4c0-c64cd323a50b.jpg HTTP/1.1\r\nHost: imgtest1.s3.amazonaws.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nx-amz-id-2: nqD+xrkm5o0PBcGuFODh6ZEqkZhLlktpKYOkjBOJ+vmpNacaPwURQt9D4HYYAk6fU+pOSGDCc5SE8kr1P4QTnnx/MjFai600\r\nx-amz-request-id: CRNZZATQYX2VEV0C\r\nDate: Sat, 20 Dec 2025 07:01:25 GMT\r\nLast-Modified: Thu, 23 May 2024 01:48:42 GMT\r\nETag: \"eb5830f9537ac75127130551276084ef\"\r\nx-amz-server-side-encryption: AES256\r\nAccept-Ranges: bytes\r\nContent-Type: image/jpeg\r\nContent-Length: 96209\r\nServer: AmazonS3\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Amazon S3","description":"Amazon S3 or Amazon Simple Storage Service is a service offered by Amazon Web Services (AWS) that provides object storage through a web service interface.","website":"https://aws.amazon.com/s3/","common_platform_enumeration":"","icon":"Amazon S3.svg","categories":["CDN"]},{"name":"Amazon Web Services","description":"Amazon Web Services (AWS) is a comprehensive cloud services platform offering compute power, database storage, content delivery and other functionality.","website":"https://aws.amazon.com/","common_platform_enumeration":"","icon":"Amazon Web Services.svg","categories":["PaaS"]}],"data":{"size":96209,"size_decoded":0,"mime_type":"image/jpeg","magic":"JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 552x1500, components 3","md5":"eb5830f9537ac75127130551276084ef","sha1":"79cd82c86181ee69f0202b0817623ed0ddcd9753","sha256":"4c513da923d6affb6789d80dc2193fdec698edf2269ee75adcca490a8104b007","sha512":"267cc959d96d988a6ad817851bd3e5407e41bc18c4a8e8a46179bd78795059e6712136967e43df45ed73723bf5aaa0bbd1163bbf848ef613acb19d2705fbd3a1","ssdeep":"1536:vukkjh8CymhA1P3GeueP0JoPu2cJ6fMjnBMauEQohjoK/9kOLSDCkp:vdkdTIP3wvF9UOMau4OOLSBp","tlshash":"f493120be0874b5ef89f06b843592a17a6fb51dc294b0891f3b68dd08652a50dccf2e7","first_seen":"2024-02-19T23:01:29Z","last_seen":"2026-08-09T04:44:19.271091Z","times_seen":7061,"resource_available":false,"data":null}},"time_used":146,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":144,"receive":2,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"bluewhaleusen.com/css/chunk-f0130b90.c782d047.css","fqdn":"bluewhaleusen.com","domain":"bluewhaleusen.com","tld":"com"},"ip":{"addr":"118.107.9.252","port":443,"asn":152194,"as":"CTG Server Limited","country":"Singapore","country_code":"SG"},"is_navigation_request":false,"resource_type":"other","requested_by":"https://bluewhaleusen.com/","date":"2025-12-20T07:01:25.956Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"bluewhaleusen.com","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Fri, 19 Dec 2025 05:22:57 GMT","end":"Thu, 19 Mar 2026 05:22:56 GMT"},"fingerprint":{"sha1":"23:4C:94:04:E1:25:E0:EA:D1:85:17:4C:09:FC:E0:DA:D0:01:E6:62","sha256":"AC:EF:45:40:E0:37:3A:BD:B9:C9:32:F5:6B:B1:B8:92:BE:33:89:43:FA:25:17:17:7C:CA:50:4E:0B:CD:25:EB"}}},"request":{"raw":"GET /css/chunk-f0130b90.c782d047.css HTTP/1.1\r\nHost: bluewhaleusen.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nX-Moz: prefetch\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Sat, 20 Dec 2025 07:01:26 GMT\r\ncontent-type: text/css\r\nvary: Accept-Encoding\r\netag: W/\"3290-1766123972328\"\r\nlast-modified: Fri, 19 Dec 2025 05:59:32 GMT\r\nstrict-transport-security: max-age=31536000\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":3290,"size_decoded":0,"mime_type":"text/css","magic":"ASCII text, with very long lines (3290), with no line terminators","md5":"2f06748ac3f1235c97a4cb396a1e7a1b","sha1":"4823ff6c0a91a3656eedf994b38bc678ca1b1343","sha256":"7e82833d28b3db83afa9c628fa630038a05c4abcc4f9aff9ce93c2d1e6550f26","sha512":"9a67e6934ef4a0b1f1745f24cb28648c8cc3e7afa73e59a0542aa7dda86a65e4bf320e3ed8ec5494eeff62c4d11fa7adac854c5bd451394374ffa48a841c61da","ssdeep":"","tlshash":"1c61337122295a2e65b7f0ae61c015dc760ca336e792cbffdea1810a8dc93f35130b55","first_seen":"2024-02-19T23:01:29Z","last_seen":"2026-06-06T14:40:04.318125Z","times_seen":987,"resource_available":false,"data":null}},"time_used":327,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":327,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2025-12-20","alert":"Phishing Block","trigger":"bluewhaleusen.com","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2025-12-20","alert":"Sinkholed","trigger":"bluewhaleusen.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2025-12-20","alert":"Sinkholed","trigger":"bluewhaleusen.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2025-12-20","alert":"Sinkholed","trigger":"bluewhaleusen.com","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2025-12-20","alert":"Sinkholed","trigger":"bluewhaleusen.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"bluewhaleusen.com/js/chunk-6140a976.0df7a154.js","fqdn":"bluewhaleusen.com","domain":"bluewhaleusen.com","tld":"com"},"ip":{"addr":"118.107.9.252","port":443,"asn":152194,"as":"CTG Server Limited","country":"Singapore","country_code":"SG"},"is_navigation_request":false,"resource_type":"other","requested_by":"https://bluewhaleusen.com/","date":"2025-12-20T07:01:27.261Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"bluewhaleusen.com","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Fri, 19 Dec 2025 05:22:57 GMT","end":"Thu, 19 Mar 2026 05:22:56 GMT"},"fingerprint":{"sha1":"23:4C:94:04:E1:25:E0:EA:D1:85:17:4C:09:FC:E0:DA:D0:01:E6:62","sha256":"AC:EF:45:40:E0:37:3A:BD:B9:C9:32:F5:6B:B1:B8:92:BE:33:89:43:FA:25:17:17:7C:CA:50:4E:0B:CD:25:EB"}}},"request":{"raw":"GET /js/chunk-6140a976.0df7a154.js HTTP/1.1\r\nHost: bluewhaleusen.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nX-Moz: prefetch\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Sat, 20 Dec 2025 07:01:27 GMT\r\ncontent-type: application/javascript\r\nvary: Accept-Encoding\r\netag: W/\"9708-1766123972312\"\r\nlast-modified: Fri, 19 Dec 2025 05:59:32 GMT\r\nstrict-transport-security: max-age=31536000\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":9708,"size_decoded":0,"mime_type":"application/javascript","magic":"JavaScript source, Unicode text, UTF-8 text, with very long lines (9674), with no line terminators","md5":"f43a113153ccd5bfe841fbac87f747cc","sha1":"0abdb9d883fa8ca19bc2a66c5289912e4ca08835","sha256":"68d94d02fd5941d400bba0b721b47689397757812d2eef4f61ebbb2d0b33c355","sha512":"2f41b7be730abda76186993a6bbdc7c119f99b21a8cbc5d4df28c42cf03090ed7b70884f352cf75c15a6c0539916dc9ec1fa755b2b651aeb5c61409ff2fcfe3a","ssdeep":"192:KDREKpbpvwCW5acMPcPL6VHPqRLp5Zt09iI6KKo:Ktjpbpv45RsHy9F6kno","tlshash":"c112d98dbb92f8ae8b6761d4716fb417f19626107c0d12d2e2788cf63a68c1c6253736","first_seen":"2025-04-08T10:46:39.892489Z","last_seen":"2026-06-06T14:40:04.37243Z","times_seen":153,"resource_available":false,"data":null}},"time_used":327,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":327,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2025-12-20","alert":"Sinkholed","trigger":"bluewhaleusen.com","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2025-12-20","alert":"Phishing Block","trigger":"bluewhaleusen.com","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2025-12-20","alert":"Sinkholed","trigger":"bluewhaleusen.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2025-12-20","alert":"Sinkholed","trigger":"bluewhaleusen.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2025-12-20","alert":"Sinkholed","trigger":"bluewhaleusen.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"bluewhaleusen.com/css/chunk-21f21164.054674a3.css","fqdn":"bluewhaleusen.com","domain":"bluewhaleusen.com","tld":"com"},"ip":{"addr":"118.107.9.252","port":443,"asn":152194,"as":"CTG Server Limited","country":"Singapore","country_code":"SG"},"is_navigation_request":false,"resource_type":"other","requested_by":"https://bluewhaleusen.com/","date":"2025-12-20T07:01:23.243Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"bluewhaleusen.com","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Fri, 19 Dec 2025 05:22:57 GMT","end":"Thu, 19 Mar 2026 05:22:56 GMT"},"fingerprint":{"sha1":"23:4C:94:04:E1:25:E0:EA:D1:85:17:4C:09:FC:E0:DA:D0:01:E6:62","sha256":"AC:EF:45:40:E0:37:3A:BD:B9:C9:32:F5:6B:B1:B8:92:BE:33:89:43:FA:25:17:17:7C:CA:50:4E:0B:CD:25:EB"}}},"request":{"raw":"GET /css/chunk-21f21164.054674a3.css HTTP/1.1\r\nHost: bluewhaleusen.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nX-Moz: prefetch\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Sat, 20 Dec 2025 07:01:23 GMT\r\ncontent-type: text/css\r\nvary: Accept-Encoding\r\netag: W/\"4173-1766123972328\"\r\nlast-modified: Fri, 19 Dec 2025 05:59:32 GMT\r\nstrict-transport-security: max-age=31536000\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":4173,"size_decoded":0,"mime_type":"text/css","magic":"ASCII text, with very long lines (4173), with no line terminators","md5":"d26838e6fc6c5713d841649b06a47e9c","sha1":"7681e0887d8b3957920c84e07fe95a1f8a22bca7","sha256":"5d0e36aa6715f146ee4979217b130ba8e86c334c02758895220835a2366d5a01","sha512":"d01fe57c48c7685b7f14f29a50d61418040c66ed4c756276c25108e74dde577d4c79841b9d3690f94799cb30a1ea691dba49e71870b97018d2d57291026f90d3","ssdeep":"48:jMxKHcoeYHjMBgquTy/ra6oYkAryBxzYpUfRmua+IzvtTm5rx2/6iYrxXfZsfZyK:CKHco56gNTwm+yNfZsfZyZZK+8p5","tlshash":"cd81ee91712c94266c73e07b309e455e6e54ef63c012a3589c56bf3e8c932e32e707c9","first_seen":"2024-02-19T23:01:29Z","last_seen":"2026-06-05T08:23:29.931375Z","times_seen":5300,"resource_available":false,"data":null}},"time_used":336,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":336,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2025-12-20","alert":"Sinkholed","trigger":"bluewhaleusen.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2025-12-20","alert":"Sinkholed","trigger":"bluewhaleusen.com","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2025-12-20","alert":"Sinkholed","trigger":"bluewhaleusen.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2025-12-20","alert":"Phishing Block","trigger":"bluewhaleusen.com","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2025-12-20","alert":"Sinkholed","trigger":"bluewhaleusen.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"bluewhaleusen.com/js/chunk-33a80e61.1cf6120e.js","fqdn":"bluewhaleusen.com","domain":"bluewhaleusen.com","tld":"com"},"ip":{"addr":"118.107.9.252","port":443,"asn":152194,"as":"CTG Server Limited","country":"Singapore","country_code":"SG"},"is_navigation_request":false,"resource_type":"other","requested_by":"https://bluewhaleusen.com/","date":"2025-12-20T07:01:26.660Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"bluewhaleusen.com","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Fri, 19 Dec 2025 05:22:57 GMT","end":"Thu, 19 Mar 2026 05:22:56 GMT"},"fingerprint":{"sha1":"23:4C:94:04:E1:25:E0:EA:D1:85:17:4C:09:FC:E0:DA:D0:01:E6:62","sha256":"AC:EF:45:40:E0:37:3A:BD:B9:C9:32:F5:6B:B1:B8:92:BE:33:89:43:FA:25:17:17:7C:CA:50:4E:0B:CD:25:EB"}}},"request":{"raw":"GET /js/chunk-33a80e61.1cf6120e.js HTTP/1.1\r\nHost: bluewhaleusen.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nX-Moz: prefetch\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Sat, 20 Dec 2025 07:01:26 GMT\r\ncontent-type: application/javascript\r\nvary: Accept-Encoding\r\netag: W/\"3902-1766123972320\"\r\nlast-modified: Fri, 19 Dec 2025 05:59:32 GMT\r\nstrict-transport-security: max-age=31536000\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":3902,"size_decoded":0,"mime_type":"application/javascript","magic":"JavaScript source, ASCII text, with very long lines (3902), with no line terminators","md5":"67971703650007ec0553c105e24bb265","sha1":"4c8a1fcd9387e92a35946bd8562d87e640127012","sha256":"a12630d517277c5e8330b39148b76f7ac634f2309f87c7007b88f7f0c939450e","sha512":"28bba3d2a42ee03c9a59a098810a7d0adbc6c0f28b4e2842529a7e83e5df825ccba15fdba8ee6f9337da4c7709331c6054484955fd93d5b97b8cc1619e6c8349","ssdeep":"","tlshash":"8281702da056e4bc8d9ad052710eb231e1722fd6540089aab738deb492d4da5332b37d","first_seen":"2025-04-08T10:46:39.900715Z","last_seen":"2026-06-06T14:40:04.50671Z","times_seen":155,"resource_available":false,"data":null}},"time_used":327,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":327,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2025-12-20","alert":"Sinkholed","trigger":"bluewhaleusen.com","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2025-12-20","alert":"Sinkholed","trigger":"bluewhaleusen.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2025-12-20","alert":"Phishing Block","trigger":"bluewhaleusen.com","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2025-12-20","alert":"Sinkholed","trigger":"bluewhaleusen.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2025-12-20","alert":"Sinkholed","trigger":"bluewhaleusen.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"bluewhaleusen.com/js/chunk-4c0f0b53.41a9073e.js","fqdn":"bluewhaleusen.com","domain":"bluewhaleusen.com","tld":"com"},"ip":{"addr":"118.107.9.252","port":443,"asn":152194,"as":"CTG Server Limited","country":"Singapore","country_code":"SG"},"is_navigation_request":false,"resource_type":"other","requested_by":"https://bluewhaleusen.com/","date":"2025-12-20T07:01:26.995Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"bluewhaleusen.com","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Fri, 19 Dec 2025 05:22:57 GMT","end":"Thu, 19 Mar 2026 05:22:56 GMT"},"fingerprint":{"sha1":"23:4C:94:04:E1:25:E0:EA:D1:85:17:4C:09:FC:E0:DA:D0:01:E6:62","sha256":"AC:EF:45:40:E0:37:3A:BD:B9:C9:32:F5:6B:B1:B8:92:BE:33:89:43:FA:25:17:17:7C:CA:50:4E:0B:CD:25:EB"}}},"request":{"raw":"GET /js/chunk-4c0f0b53.41a9073e.js HTTP/1.1\r\nHost: bluewhaleusen.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nX-Moz: prefetch\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Sat, 20 Dec 2025 07:01:27 GMT\r\ncontent-type: application/javascript\r\nvary: Accept-Encoding\r\netag: W/\"6661-1766123972305\"\r\nlast-modified: Fri, 19 Dec 2025 05:59:32 GMT\r\nstrict-transport-security: max-age=31536000\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":6661,"size_decoded":0,"mime_type":"application/javascript","magic":"JavaScript source, Unicode text, UTF-8 text, with very long lines (6559), with no line terminators","md5":"952138ac9137e001d2edcf8b59bb9691","sha1":"ea91486e3975bc22bd691fcf0e5229e9292e77f1","sha256":"43c4d94be9ee4723e3c6564be110596b81732a19c493c34ac5cbfb6b5eb4923a","sha512":"035e7893c2bf895feeeae2949ac653cd8fb2b1e275b55474ba43471792c294225d34cb3c5982eabf982e6a13997efd5c384840304fbfe739a474ed083f0cddb6","ssdeep":"96:roVtr/FXl3c1tV+9eXygLnWpZqkIGm6ZriCvWRZr/JGbmQy:kBl3gU9otW25KOHGy","tlshash":"94d1c8196247f95d49678aa0300a3120b0693e98640d949dbbb4def976e4c18337ef7e","first_seen":"2025-04-08T10:46:39.879833Z","last_seen":"2026-06-06T14:40:04.51143Z","times_seen":154,"resource_available":false,"data":null}},"time_used":327,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":327,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2025-12-20","alert":"Sinkholed","trigger":"bluewhaleusen.com","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2025-12-20","alert":"Sinkholed","trigger":"bluewhaleusen.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2025-12-20","alert":"Phishing Block","trigger":"bluewhaleusen.com","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2025-12-20","alert":"Sinkholed","trigger":"bluewhaleusen.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2025-12-20","alert":"Sinkholed","trigger":"bluewhaleusen.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"bluewhaleusen.com/js/chunk-8501b9c2.80e1b8b6.js","fqdn":"bluewhaleusen.com","domain":"bluewhaleusen.com","tld":"com"},"ip":{"addr":"118.107.9.252","port":443,"asn":152194,"as":"CTG Server Limited","country":"Singapore","country_code":"SG"},"is_navigation_request":false,"resource_type":"other","requested_by":"https://bluewhaleusen.com/","date":"2025-12-20T07:01:27.699Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"bluewhaleusen.com","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Fri, 19 Dec 2025 05:22:57 GMT","end":"Thu, 19 Mar 2026 05:22:56 GMT"},"fingerprint":{"sha1":"23:4C:94:04:E1:25:E0:EA:D1:85:17:4C:09:FC:E0:DA:D0:01:E6:62","sha256":"AC:EF:45:40:E0:37:3A:BD:B9:C9:32:F5:6B:B1:B8:92:BE:33:89:43:FA:25:17:17:7C:CA:50:4E:0B:CD:25:EB"}}},"request":{"raw":"GET /js/chunk-8501b9c2.80e1b8b6.js HTTP/1.1\r\nHost: bluewhaleusen.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nX-Moz: prefetch\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Sat, 20 Dec 2025 07:01:27 GMT\r\ncontent-type: application/javascript\r\nvary: Accept-Encoding\r\netag: W/\"15251-1766123972305\"\r\nlast-modified: Fri, 19 Dec 2025 05:59:32 GMT\r\nstrict-transport-security: max-age=31536000\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":15251,"size_decoded":0,"mime_type":"application/javascript","magic":"JavaScript source, Unicode text, UTF-8 text, with very long lines (15221), with no line terminators","md5":"3d3e33359a0540c22920151283652387","sha1":"bcf1aec756f19058c5e7f43c3ce0fd5b02d19bed","sha256":"464515a21f765f3625961918def839ec6414ef0908a9501840fb57115a36bdeb","sha512":"bef956a89267c989825ed3cb9630e3166fe662163733334f6381d82579b90750fd0fb4371a7f377d12876c64450dcb2367c2e7e03d5941015f25265cf1b1eeac","ssdeep":"384:XX12CR7gwJ3INfAKA5kzqXbFk56MoswPW:XX12CRFIOk5iW","tlshash":"596218122185b44e9b7641b2316621a1716639c6d00df0abb778edfe32d9c18372fb2f","first_seen":"2025-04-08T11:27:57.649733Z","last_seen":"2026-06-06T14:40:04.501974Z","times_seen":61,"resource_available":false,"data":null}},"time_used":327,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":327,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2025-12-20","alert":"Sinkholed","trigger":"bluewhaleusen.com","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2025-12-20","alert":"Sinkholed","trigger":"bluewhaleusen.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2025-12-20","alert":"Phishing Block","trigger":"bluewhaleusen.com","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2025-12-20","alert":"Sinkholed","trigger":"bluewhaleusen.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2025-12-20","alert":"Sinkholed","trigger":"bluewhaleusen.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"bluewhaleusen.com/js/chunk-eca3e97c.8f13e302.js","fqdn":"bluewhaleusen.com","domain":"bluewhaleusen.com","tld":"com"},"ip":{"addr":"118.107.9.252","port":443,"asn":152194,"as":"CTG Server Limited","country":"Singapore","country_code":"SG"},"is_navigation_request":false,"resource_type":"other","requested_by":"https://bluewhaleusen.com/","date":"2025-12-20T07:01:28.345Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"bluewhaleusen.com","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Fri, 19 Dec 2025 05:22:57 GMT","end":"Thu, 19 Mar 2026 05:22:56 GMT"},"fingerprint":{"sha1":"23:4C:94:04:E1:25:E0:EA:D1:85:17:4C:09:FC:E0:DA:D0:01:E6:62","sha256":"AC:EF:45:40:E0:37:3A:BD:B9:C9:32:F5:6B:B1:B8:92:BE:33:89:43:FA:25:17:17:7C:CA:50:4E:0B:CD:25:EB"}}},"request":{"raw":"GET /js/chunk-eca3e97c.8f13e302.js HTTP/1.1\r\nHost: bluewhaleusen.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nX-Moz: prefetch\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Sat, 20 Dec 2025 07:01:28 GMT\r\ncontent-type: application/javascript\r\nvary: Accept-Encoding\r\netag: W/\"8120-1766123972322\"\r\nlast-modified: Fri, 19 Dec 2025 05:59:32 GMT\r\nstrict-transport-security: max-age=31536000\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":8120,"size_decoded":0,"mime_type":"application/javascript","magic":"JavaScript source, ASCII text, with very long lines (8120), with no line terminators","md5":"a37362755242bbd0d55a1ca6417b8da1","sha1":"72e24826e637d5e30426c051027c073b5b7305bb","sha256":"44b0ff72ee052976d3f4d0db34643ebab174e1da3f61038a27cc8df9997336e3","sha512":"f8ffadfcad522d96e622d5400fe1a684010815c59dac6235a690d40984a9229b4f58e4f5abba20f700d553dec01458295e09e90c972291207c9b27e33396c8d6","ssdeep":"192:riJzgOfNatB7ukUxcZ198zdvyvlcC0POa3Rx:CgOfNaD7uh8kf","tlshash":"adf197423019a55cca9ad023312599f4e3ae2bb0941158cfe33ecdb972dcc61774e779","first_seen":"2025-04-08T10:46:39.903132Z","last_seen":"2026-06-06T14:40:04.411845Z","times_seen":137,"resource_available":false,"data":null}},"time_used":327,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":327,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2025-12-20","alert":"Sinkholed","trigger":"bluewhaleusen.com","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2025-12-20","alert":"Sinkholed","trigger":"bluewhaleusen.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2025-12-20","alert":"Phishing Block","trigger":"bluewhaleusen.com","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2025-12-20","alert":"Sinkholed","trigger":"bluewhaleusen.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2025-12-20","alert":"Sinkholed","trigger":"bluewhaleusen.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"bluewhaleusen.com/fonts/element-icons.535877f5.woff","fqdn":"bluewhaleusen.com","domain":"bluewhaleusen.com","tld":"com"},"ip":{"addr":"118.107.9.252","port":443,"asn":152194,"as":"CTG Server Limited","country":"Singapore","country_code":"SG"},"is_navigation_request":false,"resource_type":"font","requested_by":"https://bluewhaleusen.com/","date":"2025-12-20T07:01:22.858Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"bluewhaleusen.com","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Fri, 19 Dec 2025 05:22:57 GMT","end":"Thu, 19 Mar 2026 05:22:56 GMT"},"fingerprint":{"sha1":"23:4C:94:04:E1:25:E0:EA:D1:85:17:4C:09:FC:E0:DA:D0:01:E6:62","sha256":"AC:EF:45:40:E0:37:3A:BD:B9:C9:32:F5:6B:B1:B8:92:BE:33:89:43:FA:25:17:17:7C:CA:50:4E:0B:CD:25:EB"}}},"request":{"raw":"GET /fonts/element-icons.535877f5.woff HTTP/1.1\r\nHost: bluewhaleusen.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: identity\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://bluewhaleusen.com/css/app.c8421c31.css\r\nSec-Fetch-Dest: font\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Sat, 20 Dec 2025 07:01:23 GMT\r\ncontent-type: font/woff\r\ncontent-length: 28200\r\netag: W/\"28200-1766123972329\"\r\nlast-modified: Fri, 19 Dec 2025 05:59:32 GMT\r\nstrict-transport-security: max-age=31536000\r\naccept-ranges: bytes\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":28200,"size_decoded":0,"mime_type":"font/woff","magic":"Web Open Font Format, TrueType, length 28200, version 1.0","md5":"535877f50039c0cb49a6196a5b7517cd","sha1":"0000c4e27d38f9f8bbe4e58b5ce2477e589507a7","sha256":"ab40a58972be2ceab32e7e35dab3131b959aae63835d7bda1a79ae51f9a73c17","sha512":"da269b20f13fb5b0bb4628b75ec29e69bb2d36999e94b61a846cb58db679287a13d0aa38cdf64b2893558d183c4cc5df8da770e5a5b2a3288622cd4bd0e1c87b","ssdeep":"768:gOvv6ExpCVxUtrT6w8ClFd80EjPVerMKBaGXjAlEm:Hvv6xVWewtlFdGjPlkFjAlEm","tlshash":"b9c2e13197213ae9d9824ef876e498fef1651402290f390e8696adb3a98d5c73e16831","first_seen":"2023-04-05T15:22:49Z","last_seen":"2026-08-11T09:29:03.78897Z","times_seen":29405,"resource_available":false,"data":null}},"time_used":332,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":329,"receive":3,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2025-12-20","alert":"Phishing Block","trigger":"bluewhaleusen.com","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2025-12-20","alert":"Sinkholed","trigger":"bluewhaleusen.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2025-12-20","alert":"Sinkholed","trigger":"bluewhaleusen.com","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2025-12-20","alert":"Sinkholed","trigger":"bluewhaleusen.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2025-12-20","alert":"Sinkholed","trigger":"bluewhaleusen.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"bluewhaleusen.com/wap/api/syspara!getSyspara.action?code=customer_service_url\u0026lang=en","fqdn":"bluewhaleusen.com","domain":"bluewhaleusen.com","tld":"com"},"ip":{"addr":"118.107.9.252","port":443,"asn":152194,"as":"CTG Server Limited","country":"Singapore","country_code":"SG"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"https://bluewhaleusen.com/","date":"2025-12-20T07:01:22.987Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"bluewhaleusen.com","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Fri, 19 Dec 2025 05:22:57 GMT","end":"Thu, 19 Mar 2026 05:22:56 GMT"},"fingerprint":{"sha1":"23:4C:94:04:E1:25:E0:EA:D1:85:17:4C:09:FC:E0:DA:D0:01:E6:62","sha256":"AC:EF:45:40:E0:37:3A:BD:B9:C9:32:F5:6B:B1:B8:92:BE:33:89:43:FA:25:17:17:7C:CA:50:4E:0B:CD:25:EB"}}},"request":{"raw":"GET /wap/api/syspara!getSyspara.action?code=customer_service_url\u0026lang=en HTTP/1.1\r\nHost: bluewhaleusen.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/json, text/plain, */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Sat, 20 Dec 2025 07:01:23 GMT\r\ncontent-type: application/json;charset=UTF-8\r\nvary: Accept-Encoding, Origin, Access-Control-Request-Method, Access-Control-Request-Headers\r\nstrict-transport-security: max-age=31536000\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":58,"size_decoded":0,"mime_type":"application/json; charset=UTF-8","magic":"JSON text data","md5":"87f201052e0dc6c3b8a4a53b83bf44b5","sha1":"f6b152fa79c655449e9e938e4417a5676a2e06da","sha256":"fb522b0841e80aac3e1cb4fe0f613ae4bfd87fcbe1c03d0137e5c10fbdb86cf4","sha512":"8f854611a22d0fe5ab058bb7ae25c79e995dcc20396f0e64e68aea6662f71cd4144e3378ca1d648d4e3785d96bdb9522864359c14da34c69bbcbceb0bd412777","ssdeep":"","tlshash":"8aa00200146d582b0ca364896c6d39548a5e615348d09f246f99a66440de56d1004429","first_seen":"2023-12-01T19:12:11Z","last_seen":"2026-08-11T08:26:52.926761Z","times_seen":6221,"resource_available":false,"data":null}},"time_used":421,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":421,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2025-12-20","alert":"Sinkholed","trigger":"bluewhaleusen.com","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2025-12-20","alert":"Sinkholed","trigger":"bluewhaleusen.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2025-12-20","alert":"Sinkholed","trigger":"bluewhaleusen.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2025-12-20","alert":"Phishing Block","trigger":"bluewhaleusen.com","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2025-12-20","alert":"Sinkholed","trigger":"bluewhaleusen.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"bluewhaleusen.com/css/chunk-5f9dbc55.cd704402.css","fqdn":"bluewhaleusen.com","domain":"bluewhaleusen.com","tld":"com"},"ip":{"addr":"118.107.9.252","port":443,"asn":152194,"as":"CTG Server Limited","country":"Singapore","country_code":"SG"},"is_navigation_request":false,"resource_type":"other","requested_by":"https://bluewhaleusen.com/","date":"2025-12-20T07:01:24.627Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"bluewhaleusen.com","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Fri, 19 Dec 2025 05:22:57 GMT","end":"Thu, 19 Mar 2026 05:22:56 GMT"},"fingerprint":{"sha1":"23:4C:94:04:E1:25:E0:EA:D1:85:17:4C:09:FC:E0:DA:D0:01:E6:62","sha256":"AC:EF:45:40:E0:37:3A:BD:B9:C9:32:F5:6B:B1:B8:92:BE:33:89:43:FA:25:17:17:7C:CA:50:4E:0B:CD:25:EB"}}},"request":{"raw":"GET /css/chunk-5f9dbc55.cd704402.css HTTP/1.1\r\nHost: bluewhaleusen.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nX-Moz: prefetch\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Sat, 20 Dec 2025 07:01:24 GMT\r\ncontent-type: text/css\r\nvary: Accept-Encoding\r\netag: W/\"1252-1766123972324\"\r\nlast-modified: Fri, 19 Dec 2025 05:59:32 GMT\r\nstrict-transport-security: max-age=31536000\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":1252,"size_decoded":0,"mime_type":"text/css","magic":"ASCII text, with very long lines (1252), with no line terminators","md5":"b50aad23d365ccde72e78b8313b4e7c2","sha1":"82e1ed3080ed69d8b4384e17044cdcf837769a03","sha256":"e36128c4817614792876d24a43ab454dd8cdd52f66965bb00f14406da9011f3c","sha512":"3929980e42defe71e881ffa97bf69c5d70251a4adf0eaabc203dc87188f3d9da61887ecf8f793b9c6a2861a6b24484417bd3adc1cd46a41cf2a0f14082f92dd7","ssdeep":"","tlshash":"3f21ee67b51163ada3bb689413b29c8c7414c840f5ebebfae906411dc7c72973691388","first_seen":"2024-02-11T04:26:49Z","last_seen":"2026-06-06T14:40:04.522312Z","times_seen":7301,"resource_available":false,"data":null}},"time_used":326,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":326,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2025-12-20","alert":"Sinkholed","trigger":"bluewhaleusen.com","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2025-12-20","alert":"Phishing Block","trigger":"bluewhaleusen.com","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2025-12-20","alert":"Sinkholed","trigger":"bluewhaleusen.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2025-12-20","alert":"Sinkholed","trigger":"bluewhaleusen.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2025-12-20","alert":"Sinkholed","trigger":"bluewhaleusen.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"bluewhaleusen.com/css/chunk-7537f99d.002d2e5c.css","fqdn":"bluewhaleusen.com","domain":"bluewhaleusen.com","tld":"com"},"ip":{"addr":"118.107.9.252","port":443,"asn":152194,"as":"CTG Server Limited","country":"Singapore","country_code":"SG"},"is_navigation_request":false,"resource_type":"other","requested_by":"https://bluewhaleusen.com/","date":"2025-12-20T07:01:24.987Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"bluewhaleusen.com","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Fri, 19 Dec 2025 05:22:57 GMT","end":"Thu, 19 Mar 2026 05:22:56 GMT"},"fingerprint":{"sha1":"23:4C:94:04:E1:25:E0:EA:D1:85:17:4C:09:FC:E0:DA:D0:01:E6:62","sha256":"AC:EF:45:40:E0:37:3A:BD:B9:C9:32:F5:6B:B1:B8:92:BE:33:89:43:FA:25:17:17:7C:CA:50:4E:0B:CD:25:EB"}}},"request":{"raw":"GET /css/chunk-7537f99d.002d2e5c.css HTTP/1.1\r\nHost: bluewhaleusen.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nX-Moz: prefetch\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Sat, 20 Dec 2025 07:01:25 GMT\r\ncontent-type: text/css\r\nvary: Accept-Encoding\r\netag: W/\"6996-1766123972324\"\r\nlast-modified: Fri, 19 Dec 2025 05:59:32 GMT\r\nstrict-transport-security: max-age=31536000\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":6996,"size_decoded":0,"mime_type":"text/css","magic":"ASCII text, with very long lines (6996), with no line terminators","md5":"e47703f5ce5dd5a2d872fbf35e5278f7","sha1":"f7f09df63c98e908e2e973e0fbbf1349e3ea00fc","sha256":"d27113c9c0119132a51da268c25bd538d520f967ebf3953c2857ac815c07d5c1","sha512":"475b0b00e5ae76bfe8e85995145e09758369034e0682e64d5c1d08a3ae34e1c32c9d12b9c8a31349b1d04cd1933a75c82ef5893b31197de9b52a44f9cf8e691d","ssdeep":"192:cXzCQIXiDe53zb/UboRyRD5liqF6+llu1JfkXH:cDCQRDeBzT8lN9lc1JkH","tlshash":"bfe14cf6d1768025af36e1a670e0a8e53824c922ecd742e973547518ccc35e3172bb4d","first_seen":"2024-02-19T23:01:29Z","last_seen":"2026-06-06T14:40:04.297658Z","times_seen":225,"resource_available":false,"data":null}},"time_used":327,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":327,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2025-12-20","alert":"Sinkholed","trigger":"bluewhaleusen.com","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2025-12-20","alert":"Sinkholed","trigger":"bluewhaleusen.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2025-12-20","alert":"Sinkholed","trigger":"bluewhaleusen.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2025-12-20","alert":"Sinkholed","trigger":"bluewhaleusen.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2025-12-20","alert":"Phishing Block","trigger":"bluewhaleusen.com","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"bluewhaleusen.com/js/chunk-2d0daea6.7dc15874.js","fqdn":"bluewhaleusen.com","domain":"bluewhaleusen.com","tld":"com"},"ip":{"addr":"118.107.9.252","port":443,"asn":152194,"as":"CTG Server Limited","country":"Singapore","country_code":"SG"},"is_navigation_request":false,"resource_type":"other","requested_by":"https://bluewhaleusen.com/","date":"2025-12-20T07:01:26.326Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"bluewhaleusen.com","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Fri, 19 Dec 2025 05:22:57 GMT","end":"Thu, 19 Mar 2026 05:22:56 GMT"},"fingerprint":{"sha1":"23:4C:94:04:E1:25:E0:EA:D1:85:17:4C:09:FC:E0:DA:D0:01:E6:62","sha256":"AC:EF:45:40:E0:37:3A:BD:B9:C9:32:F5:6B:B1:B8:92:BE:33:89:43:FA:25:17:17:7C:CA:50:4E:0B:CD:25:EB"}}},"request":{"raw":"GET /js/chunk-2d0daea6.7dc15874.js HTTP/1.1\r\nHost: bluewhaleusen.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nX-Moz: prefetch\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Sat, 20 Dec 2025 07:01:26 GMT\r\ncontent-type: application/javascript\r\nvary: Accept-Encoding\r\netag: W/\"89104-1766123972323\"\r\nlast-modified: Fri, 19 Dec 2025 05:59:32 GMT\r\nstrict-transport-security: max-age=31536000\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":89104,"size_decoded":0,"mime_type":"application/javascript","magic":"JavaScript source, Unicode text, UTF-8 text, with very long lines (54758)","md5":"64fd3bd032d776ea4973fc22409c4943","sha1":"f0390cc463b3bc5e9616933f1c46a0731fc67798","sha256":"53e06698cba5db96fa5574765ab68e2f1d31d6752e19ada8e905269b1d23f70a","sha512":"1da51fd74c1855a318d9bb770cebdf6cabcd67a7c3092b26eecdacc05a3b02251dc6dc5626c4e40b6e791dad72d2f88614eb10cc34906e8af837d8bd14ac39e3","ssdeep":"1536:KVpb5uz9we4EPsStPHXannPzQY2Y2eN8ce9PNoZAlE2f:KJ3qHrY2g+ce9PNo2lx","tlshash":"18931a88f2d5b17603a355e0442f140bf176a929a84988a8f734d4e1bdf4ecea47bf74","first_seen":"2024-04-14T17:36:32Z","last_seen":"2026-06-06T14:40:04.332698Z","times_seen":639,"resource_available":false,"data":null}},"time_used":331,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":331,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2025-12-20","alert":"Sinkholed","trigger":"bluewhaleusen.com","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2025-12-20","alert":"Sinkholed","trigger":"bluewhaleusen.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2025-12-20","alert":"Phishing Block","trigger":"bluewhaleusen.com","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2025-12-20","alert":"Sinkholed","trigger":"bluewhaleusen.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2025-12-20","alert":"Sinkholed","trigger":"bluewhaleusen.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"bluewhaleusen.com/js/chunk-2d216994.084ec234.js","fqdn":"bluewhaleusen.com","domain":"bluewhaleusen.com","tld":"com"},"ip":{"addr":"118.107.9.252","port":443,"asn":152194,"as":"CTG Server Limited","country":"Singapore","country_code":"SG"},"is_navigation_request":false,"resource_type":"other","requested_by":"https://bluewhaleusen.com/","date":"2025-12-20T07:01:26.620Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"bluewhaleusen.com","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Fri, 19 Dec 2025 05:22:57 GMT","end":"Thu, 19 Mar 2026 05:22:56 GMT"},"fingerprint":{"sha1":"23:4C:94:04:E1:25:E0:EA:D1:85:17:4C:09:FC:E0:DA:D0:01:E6:62","sha256":"AC:EF:45:40:E0:37:3A:BD:B9:C9:32:F5:6B:B1:B8:92:BE:33:89:43:FA:25:17:17:7C:CA:50:4E:0B:CD:25:EB"}}},"request":{"raw":"GET /js/chunk-2d216994.084ec234.js HTTP/1.1\r\nHost: bluewhaleusen.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nX-Moz: prefetch\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Sat, 20 Dec 2025 07:01:26 GMT\r\ncontent-type: application/javascript\r\ncontent-length: 255\r\netag: W/\"255-1766123972312\"\r\nlast-modified: Fri, 19 Dec 2025 05:59:32 GMT\r\nstrict-transport-security: max-age=31536000\r\naccept-ranges: bytes\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":255,"size_decoded":0,"mime_type":"application/javascript","magic":"JavaScript source, ASCII text, with no line terminators","md5":"7a8a7fb5ffd400e722f95a769e34ef63","sha1":"ac59bc32ff6a0809103fa7a19434ed2e46633ba9","sha256":"b2ce88d59c3e4f4ef0f3c9f065e3a1cb0d23011c15cc116334f5162b365e1c06","sha512":"e311bd396f91df957dc0124e2184bb00a186f65130de68b5a4995c9ed53b18ee302b2326f5a14e00d3b26be4352dc42c5ad7af854eb57188ab79ee4e998a1efc","ssdeep":"","tlshash":"19d02ba6b0527ca5c55b2485026be363382e249a0e8c106417f145d83275b1f8111999","first_seen":"2024-09-28T07:44:49.475934Z","last_seen":"2026-06-06T14:40:04.379464Z","times_seen":156,"resource_available":false,"data":null}},"time_used":327,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":327,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2025-12-20","alert":"Sinkholed","trigger":"bluewhaleusen.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2025-12-20","alert":"Sinkholed","trigger":"bluewhaleusen.com","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2025-12-20","alert":"Sinkholed","trigger":"bluewhaleusen.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2025-12-20","alert":"Sinkholed","trigger":"bluewhaleusen.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2025-12-20","alert":"Phishing Block","trigger":"bluewhaleusen.com","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"bluewhaleusen.com/js/chunk-2fdca798.478de4ad.js","fqdn":"bluewhaleusen.com","domain":"bluewhaleusen.com","tld":"com"},"ip":{"addr":"118.107.9.252","port":443,"asn":152194,"as":"CTG Server Limited","country":"Singapore","country_code":"SG"},"is_navigation_request":false,"resource_type":"other","requested_by":"https://bluewhaleusen.com/","date":"2025-12-20T07:01:26.655Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"bluewhaleusen.com","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Fri, 19 Dec 2025 05:22:57 GMT","end":"Thu, 19 Mar 2026 05:22:56 GMT"},"fingerprint":{"sha1":"23:4C:94:04:E1:25:E0:EA:D1:85:17:4C:09:FC:E0:DA:D0:01:E6:62","sha256":"AC:EF:45:40:E0:37:3A:BD:B9:C9:32:F5:6B:B1:B8:92:BE:33:89:43:FA:25:17:17:7C:CA:50:4E:0B:CD:25:EB"}}},"request":{"raw":"GET /js/chunk-2fdca798.478de4ad.js HTTP/1.1\r\nHost: bluewhaleusen.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nX-Moz: prefetch\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Sat, 20 Dec 2025 07:01:26 GMT\r\ncontent-type: application/javascript\r\nvary: Accept-Encoding\r\netag: W/\"21077-1766123972321\"\r\nlast-modified: Fri, 19 Dec 2025 05:59:32 GMT\r\nstrict-transport-security: max-age=31536000\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":21077,"size_decoded":0,"mime_type":"application/javascript","magic":"JavaScript source, Unicode text, UTF-8 text, with very long lines (21019), with no line terminators","md5":"76315f74b2a11e1af0063f11aab7c390","sha1":"923be2c6e2aabfcb7ed63298734adec78a94cad2","sha256":"282bbaa56cfce2ccd7058065b99b5e924ef634471d65d3a482e6eddb19bb7eff","sha512":"c9e8d81b61d5efb132de18a14f8b68a394456be658e0d2d27aa6789e7c376f7cd51d007905cb93d1e01bb65d8f7118fe9a8040d2f9e1d516621ebbe286581a84","ssdeep":"384:Fy6sASXL78r+DXbyuetIAwXs3iX775b/2MnnVbk7wK6ENN:S77m+D3eOrdb/2MnVbk7wK3","tlshash":"4392c88ae072a8fc855b6261351ab3b4b6712b94a040d459fa3cdcbc25d9d64333fb7c","first_seen":"2025-04-08T11:27:57.667737Z","last_seen":"2026-06-06T14:40:04.382777Z","times_seen":64,"resource_available":false,"data":null}},"time_used":328,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":328,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2025-12-20","alert":"Sinkholed","trigger":"bluewhaleusen.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2025-12-20","alert":"Sinkholed","trigger":"bluewhaleusen.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2025-12-20","alert":"Phishing Block","trigger":"bluewhaleusen.com","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2025-12-20","alert":"Sinkholed","trigger":"bluewhaleusen.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2025-12-20","alert":"Sinkholed","trigger":"bluewhaleusen.com","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"bluewhaleusen.com/js/chunk-708e8450.ad5b7a49.js","fqdn":"bluewhaleusen.com","domain":"bluewhaleusen.com","tld":"com"},"ip":{"addr":"118.107.9.252","port":443,"asn":152194,"as":"CTG Server Limited","country":"Singapore","country_code":"SG"},"is_navigation_request":false,"resource_type":"other","requested_by":"https://bluewhaleusen.com/","date":"2025-12-20T07:01:27.349Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"bluewhaleusen.com","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Fri, 19 Dec 2025 05:22:57 GMT","end":"Thu, 19 Mar 2026 05:22:56 GMT"},"fingerprint":{"sha1":"23:4C:94:04:E1:25:E0:EA:D1:85:17:4C:09:FC:E0:DA:D0:01:E6:62","sha256":"AC:EF:45:40:E0:37:3A:BD:B9:C9:32:F5:6B:B1:B8:92:BE:33:89:43:FA:25:17:17:7C:CA:50:4E:0B:CD:25:EB"}}},"request":{"raw":"GET /js/chunk-708e8450.ad5b7a49.js HTTP/1.1\r\nHost: bluewhaleusen.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nX-Moz: prefetch\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Sat, 20 Dec 2025 07:01:27 GMT\r\ncontent-type: application/javascript\r\nvary: Accept-Encoding\r\netag: W/\"50645-1766123972309\"\r\nlast-modified: Fri, 19 Dec 2025 05:59:32 GMT\r\nstrict-transport-security: max-age=31536000\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":50645,"size_decoded":0,"mime_type":"application/javascript","magic":"JavaScript source, Unicode text, UTF-8 text, with very long lines (50569), with no line terminators","md5":"15abe2bd430b059a8a3b9287fa92dc63","sha1":"511daf13f8267d4b01407c4fc4c2c60abaf56577","sha256":"a8bca1c92fb03b51226e72a4f7be3a81c86937145522bfc3abcdf9d739087890","sha512":"93b09d3e5073018c58920f66378d2a8c60a62319cfcb183c0f52b36d1dced3a02d5fcd83282d857989df3b803640a780196722a0180cca3b498599aa170076d8","ssdeep":"768:MXy9m3v1Y6eUpbH/7wkDOLpdqBPjHCoQWn6Ia1KABkRq7h1:OSMJ7T4obMW6IeBH7X","tlshash":"31331a436129b45e5f6752a2301b20a1a2a426e56409989ff27ccdf973dcc243b1ff7e","first_seen":"2025-04-08T11:27:57.654833Z","last_seen":"2026-06-06T14:40:04.391732Z","times_seen":62,"resource_available":false,"data":null}},"time_used":329,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":329,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2025-12-20","alert":"Sinkholed","trigger":"bluewhaleusen.com","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2025-12-20","alert":"Sinkholed","trigger":"bluewhaleusen.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2025-12-20","alert":"Sinkholed","trigger":"bluewhaleusen.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2025-12-20","alert":"Phishing Block","trigger":"bluewhaleusen.com","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2025-12-20","alert":"Sinkholed","trigger":"bluewhaleusen.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"mall-test.s3.amazonaws.com/test/2023-03-28/cb96f794-0a2c-496e-aa26-ab6b279d2f68.jpg","fqdn":"mall-test.s3.amazonaws.com","domain":"mall-test.s3.amazonaws.com","tld":"s3.amazonaws.com"},"ip":{"addr":"3.5.30.74","port":443,"asn":14618,"as":"AMAZON-AES","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://bluewhaleusen.com/","date":"2025-12-20T07:01:23.471Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"P256","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"s3.amazonaws.com","organization":""},"issuer":{"commonName":"Amazon RSA 2048 M01","organization":"Amazon"},"validity":{"start":"Fri, 19 Sep 2025 00:00:00 GMT","end":"Sun, 23 Aug 2026 23:59:59 GMT"},"fingerprint":{"sha1":"48:FD:CD:50:85:6A:51:E7:71:E4:CB:E0:03:81:E1:EC:4E:AD:9E:C7","sha256":"D7:11:81:F4:91:03:0D:C6:A5:DE:8A:EF:AA:58:14:BA:AD:33:B5:11:8B:D5:F0:33:53:8B:AF:49:82:E9:4B:A4"}}},"request":{"raw":"GET /test/2023-03-28/cb96f794-0a2c-496e-aa26-ab6b279d2f68.jpg HTTP/1.1\r\nHost: mall-test.s3.amazonaws.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nx-amz-id-2: gCwRW09SAsHj2UyTGAhtv7SqgBqN+DvPpQ15+FXrvzd91Y2W06jG5a83eVKk1cYAtUB65SrvD2ECqgqkoeMZQzx1xcPojLL+\r\nx-amz-request-id: CRNZJJA0Q96G68C0\r\nDate: Sat, 20 Dec 2025 07:01:25 GMT\r\nLast-Modified: Wed, 22 May 2024 20:53:50 GMT\r\nETag: \"caad5ce9aae1754f7c5bddfe540beb9a\"\r\nx-amz-server-side-encryption: AES256\r\nAccept-Ranges: bytes\r\nContent-Type: image/jpeg\r\nContent-Length: 56451\r\nServer: AmazonS3\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Amazon S3","description":"Amazon S3 or Amazon Simple Storage Service is a service offered by Amazon Web Services (AWS) that provides object storage through a web service interface.","website":"https://aws.amazon.com/s3/","common_platform_enumeration":"","icon":"Amazon S3.svg","categories":["CDN"]},{"name":"Amazon Web Services","description":"Amazon Web Services (AWS) is a comprehensive cloud services platform offering compute power, database storage, content delivery and other functionality.","website":"https://aws.amazon.com/","common_platform_enumeration":"","icon":"Amazon Web Services.svg","categories":["PaaS"]}],"data":{"size":56451,"size_decoded":0,"mime_type":"image/jpeg","magic":"JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, baseline, precision 8, 1365x1365, components 3","md5":"caad5ce9aae1754f7c5bddfe540beb9a","sha1":"426aa6930c891900c2d0c7f153ffd99e5c60f92a","sha256":"a60a9f18bd2465a00567a344571f0f0fb16fc4fe351d8f075e617ff68137cbb6","sha512":"131af0909590d760d92254d35c5babae05a08fb8df701421723558815221389083186103f86f1f64c08d95a879361f99a310df2ced8bfce63bd8a414e0e806a3","ssdeep":"768:5SZ56j1M27ehueo9GF5Hl/cnawaL+i/opyDHiu/UB/vH+fhQO5F8h:5SZJhqEF5F/cnJaLZopyDHiuMR2Y","tlshash":"2a43d9078d058bc7a46dc7e8be034eed5f5a6b18e4823eeb50210f8b7e212574c8e56d","first_seen":"2024-02-19T23:01:28Z","last_seen":"2026-08-09T04:44:19.247941Z","times_seen":7232,"resource_available":false,"data":null}},"time_used":921,"timings":{"blocked":801,"dns":0,"connect":0,"send":0,"wait":118,"receive":2,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"mall-test.s3.amazonaws.com/avatar/2023-03-15/e784c612-43a1-4248-92ca-68f8c7771479.jpg","fqdn":"mall-test.s3.amazonaws.com","domain":"mall-test.s3.amazonaws.com","tld":"s3.amazonaws.com"},"ip":{"addr":"3.5.30.74","port":443,"asn":14618,"as":"AMAZON-AES","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://bluewhaleusen.com/","date":"2025-12-20T07:01:24.255Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"P256","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"s3.amazonaws.com","organization":""},"issuer":{"commonName":"Amazon RSA 2048 M01","organization":"Amazon"},"validity":{"start":"Fri, 19 Sep 2025 00:00:00 GMT","end":"Sun, 23 Aug 2026 23:59:59 GMT"},"fingerprint":{"sha1":"48:FD:CD:50:85:6A:51:E7:71:E4:CB:E0:03:81:E1:EC:4E:AD:9E:C7","sha256":"D7:11:81:F4:91:03:0D:C6:A5:DE:8A:EF:AA:58:14:BA:AD:33:B5:11:8B:D5:F0:33:53:8B:AF:49:82:E9:4B:A4"}}},"request":{"raw":"GET /avatar/2023-03-15/e784c612-43a1-4248-92ca-68f8c7771479.jpg HTTP/1.1\r\nHost: mall-test.s3.amazonaws.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nx-amz-id-2: DQ3ZXrApffI72MpHq3U2wEdZ+49qTfgGwKeGyBF+o+IPWYD7rC4nKdkj43+43ueBZYPCYRL7b9GsFqY9PQxeFGFtS9aPen3M\r\nx-amz-request-id: CRNRWNCD07ETG6YN\r\nDate: Sat, 20 Dec 2025 07:01:25 GMT\r\nLast-Modified: Tue, 21 May 2024 17:21:39 GMT\r\nETag: \"4fefd642d0ba649e2638d79aba1f06a9\"\r\nx-amz-server-side-encryption: AES256\r\nx-amz-meta-myval: test\r\nAccept-Ranges: bytes\r\nContent-Type: application/octet-stream\r\nContent-Length: 125293\r\nServer: AmazonS3\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Amazon S3","description":"Amazon S3 or Amazon Simple Storage Service is a service offered by Amazon Web Services (AWS) that provides object storage through a web service interface.","website":"https://aws.amazon.com/s3/","common_platform_enumeration":"","icon":"Amazon S3.svg","categories":["CDN"]},{"name":"Amazon Web Services","description":"Amazon Web Services (AWS) is a comprehensive cloud services platform offering compute power, database storage, content delivery and other functionality.","website":"https://aws.amazon.com/","common_platform_enumeration":"","icon":"Amazon Web Services.svg","categories":["PaaS"]}],"data":{"size":125293,"size_decoded":0,"mime_type":"image/jpeg","magic":"JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 1440x1440, components 3","md5":"4fefd642d0ba649e2638d79aba1f06a9","sha1":"2804f3147c498add7926958e9fb5c6561df5c4af","sha256":"57f57a5716871604f452cfbbd9ccc5dddf928412ebd6c445cb85e3b79ff559e6","sha512":"2823160b04b81bfd3fd1c0984df0f804503ed8f26358a213b577013e17efaacdcd25079fb1671d37bfd55989e912ef69eb7b0268025cdf7be8cbaa2e9edd1aa3","ssdeep":"1536:Zle+qHAVjJGKWgL1u/BDsRc6EKkibdjbhL54OKzQSJaB7jvyvolZKAztq4CWw21u:ZBqgAyBuJwK6aqFwOEQScRqF01M1d1","tlshash":"5ac3120265245f0ee9afddb0b65f9be11ba6e8fc18f180937b39344441184da8f65db3","first_seen":"2024-02-19T23:01:29Z","last_seen":"2026-08-09T04:44:19.236929Z","times_seen":2518,"resource_available":false,"data":null}},"time_used":481,"timings":{"blocked":366,"dns":0,"connect":0,"send":0,"wait":112,"receive":3,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"bluewhaleusen.com/js/chunk-c6d7a01a.9cb65d36.js","fqdn":"bluewhaleusen.com","domain":"bluewhaleusen.com","tld":"com"},"ip":{"addr":"118.107.9.252","port":443,"asn":152194,"as":"CTG Server Limited","country":"Singapore","country_code":"SG"},"is_navigation_request":false,"resource_type":"other","requested_by":"https://bluewhaleusen.com/","date":"2025-12-20T07:01:28.031Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"bluewhaleusen.com","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Fri, 19 Dec 2025 05:22:57 GMT","end":"Thu, 19 Mar 2026 05:22:56 GMT"},"fingerprint":{"sha1":"23:4C:94:04:E1:25:E0:EA:D1:85:17:4C:09:FC:E0:DA:D0:01:E6:62","sha256":"AC:EF:45:40:E0:37:3A:BD:B9:C9:32:F5:6B:B1:B8:92:BE:33:89:43:FA:25:17:17:7C:CA:50:4E:0B:CD:25:EB"}}},"request":{"raw":"GET /js/chunk-c6d7a01a.9cb65d36.js HTTP/1.1\r\nHost: bluewhaleusen.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nX-Moz: prefetch\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Sat, 20 Dec 2025 07:01:28 GMT\r\ncontent-type: application/javascript\r\nvary: Accept-Encoding\r\netag: W/\"22757-1766123972305\"\r\nlast-modified: Fri, 19 Dec 2025 05:59:32 GMT\r\nstrict-transport-security: max-age=31536000\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":22757,"size_decoded":0,"mime_type":"application/javascript","magic":"JavaScript source, Unicode text, UTF-8 text, with very long lines (22687), with no line terminators","md5":"aef727481783f4c37082f15f01cf7332","sha1":"e6c3e2517518698bbd0c3b2ad6903bb9d451410a","sha256":"b0371f0c7314af771c1597e385d5d0e375b32c98aa33f0e44492ca61ed5d6460","sha512":"88f41244ceaed8a3fd5fb04df505bee0d0998173f0d4c27d9dc6844620046218e0a0a3913e2ac4d1a466282ff462f716e78b6e0ac4602ebb57a782bbb2608fd4","ssdeep":"192:cthRrXBrciSUbUxZB73GKJoQQBNgtTkzsuQ4y1wTYDLihd15pa0L9OeuuyWwQmcs:KX5b8D72mlJlUjAH9GPWs69s4lqD5Bg","tlshash":"48a2b40ea146fc9b0f9272e5701b301160528054680a9e67f778cdf9b6ffc196a23b3b","first_seen":"2025-08-14T15:17:49.069269Z","last_seen":"2026-05-27T20:53:28.283061Z","times_seen":13,"resource_available":false,"data":null}},"time_used":328,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":328,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2025-12-20","alert":"Sinkholed","trigger":"bluewhaleusen.com","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2025-12-20","alert":"Sinkholed","trigger":"bluewhaleusen.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2025-12-20","alert":"Phishing Block","trigger":"bluewhaleusen.com","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2025-12-20","alert":"Sinkholed","trigger":"bluewhaleusen.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2025-12-20","alert":"Sinkholed","trigger":"bluewhaleusen.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"bluewhaleusen.com/js/chunk-f12f1418.01127275.js","fqdn":"bluewhaleusen.com","domain":"bluewhaleusen.com","tld":"com"},"ip":{"addr":"118.107.9.252","port":443,"asn":152194,"as":"CTG Server Limited","country":"Singapore","country_code":"SG"},"is_navigation_request":false,"resource_type":"other","requested_by":"https://bluewhaleusen.com/","date":"2025-12-20T07:01:28.368Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"bluewhaleusen.com","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Fri, 19 Dec 2025 05:22:57 GMT","end":"Thu, 19 Mar 2026 05:22:56 GMT"},"fingerprint":{"sha1":"23:4C:94:04:E1:25:E0:EA:D1:85:17:4C:09:FC:E0:DA:D0:01:E6:62","sha256":"AC:EF:45:40:E0:37:3A:BD:B9:C9:32:F5:6B:B1:B8:92:BE:33:89:43:FA:25:17:17:7C:CA:50:4E:0B:CD:25:EB"}}},"request":{"raw":"GET /js/chunk-f12f1418.01127275.js HTTP/1.1\r\nHost: bluewhaleusen.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nX-Moz: prefetch\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Sat, 20 Dec 2025 07:01:28 GMT\r\ncontent-type: application/javascript\r\nvary: Accept-Encoding\r\netag: W/\"6366-1766123972321\"\r\nlast-modified: Fri, 19 Dec 2025 05:59:32 GMT\r\nstrict-transport-security: max-age=31536000\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":6366,"size_decoded":0,"mime_type":"application/javascript","magic":"JavaScript source, ASCII text, with very long lines (6366), with no line terminators","md5":"f5430640ba7f3df6f55555de5740f10e","sha1":"0627bb45fd8dcfa31d103e651042304682bebe05","sha256":"675a8c968aa037dcbed5ac3152a9fd353d55d2d0c7328fec4f2f27ba1472c3e3","sha512":"f4e0b713df61e1016bfe96b36dd2deca2741a9deaea073fcab60b0fa6f1bb2c0935b24c12b96399112e780d4449080d475491772ddf64d6000a0740bb865282c","ssdeep":"96:F6Mt/nsTVUWf6MSXU6REqgIldI9OwnZrvVJKk56InO1YkLv3m64n/UJjCVsc3YC:F/sOG6MSXU6GqgCI9pn5VsS6IrI3y4M","tlshash":"76d1195fe49279bcc00b5265341b332876703bd0d044496afb3ddcb82ac88a823677bd","first_seen":"2025-04-08T11:27:57.674306Z","last_seen":"2026-06-06T14:40:04.417808Z","times_seen":94,"resource_available":false,"data":null}},"time_used":328,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":328,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2025-12-20","alert":"Sinkholed","trigger":"bluewhaleusen.com","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2025-12-20","alert":"Phishing Block","trigger":"bluewhaleusen.com","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2025-12-20","alert":"Sinkholed","trigger":"bluewhaleusen.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2025-12-20","alert":"Sinkholed","trigger":"bluewhaleusen.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2025-12-20","alert":"Sinkholed","trigger":"bluewhaleusen.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"mall-test.s3.amazonaws.com/test/2023-03-28/b8a68172-576a-4457-b9aa-10c98bb46782.jpg","fqdn":"mall-test.s3.amazonaws.com","domain":"mall-test.s3.amazonaws.com","tld":"s3.amazonaws.com"},"ip":{"addr":"3.5.30.74","port":443,"asn":14618,"as":"AMAZON-AES","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://bluewhaleusen.com/","date":"2025-12-20T07:01:23.603Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"P256","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"s3.amazonaws.com","organization":""},"issuer":{"commonName":"Amazon RSA 2048 M01","organization":"Amazon"},"validity":{"start":"Fri, 19 Sep 2025 00:00:00 GMT","end":"Sun, 23 Aug 2026 23:59:59 GMT"},"fingerprint":{"sha1":"48:FD:CD:50:85:6A:51:E7:71:E4:CB:E0:03:81:E1:EC:4E:AD:9E:C7","sha256":"D7:11:81:F4:91:03:0D:C6:A5:DE:8A:EF:AA:58:14:BA:AD:33:B5:11:8B:D5:F0:33:53:8B:AF:49:82:E9:4B:A4"}}},"request":{"raw":"GET /test/2023-03-28/b8a68172-576a-4457-b9aa-10c98bb46782.jpg HTTP/1.1\r\nHost: mall-test.s3.amazonaws.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nx-amz-id-2: UhkpS0DJ4qbd3r7XT1sTFaDWS0FtLa5zVKXXZ3BEwRZkWRcoAlZm6LZctgKFFUViEg2a+apMzV4otUCZg9AtaUmsTAURS2OD\r\nx-amz-request-id: CRNZNE6QZM57J19W\r\nDate: Sat, 20 Dec 2025 07:01:25 GMT\r\nLast-Modified: Wed, 22 May 2024 20:53:09 GMT\r\nETag: \"963cb56e987f75139a4206e2853821e6\"\r\nx-amz-server-side-encryption: AES256\r\nAccept-Ranges: bytes\r\nContent-Type: image/jpeg\r\nContent-Length: 234396\r\nServer: AmazonS3\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Amazon S3","description":"Amazon S3 or Amazon Simple Storage Service is a service offered by Amazon Web Services (AWS) that provides object storage through a web service interface.","website":"https://aws.amazon.com/s3/","common_platform_enumeration":"","icon":"Amazon S3.svg","categories":["CDN"]},{"name":"Amazon Web Services","description":"Amazon Web Services (AWS) is a comprehensive cloud services platform offering compute power, database storage, content delivery and other functionality.","website":"https://aws.amazon.com/","common_platform_enumeration":"","icon":"Amazon Web Services.svg","categories":["PaaS"]}],"data":{"size":234396,"size_decoded":0,"mime_type":"image/jpeg","magic":"JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 1440x1440, components 3","md5":"963cb56e987f75139a4206e2853821e6","sha1":"ce71e1769f7261cd7b9a24961ad20fb7a59020af","sha256":"ca1da66523d750de307c04335a1c1c6a4a5984b6e18740d6a9b5d05328a83eb3","sha512":"32b60068394c931060c1753e698783852cf5287a33a02520531964297d9f7c9b2a075a104400d58371a38b39e90f79349952df52f99ce456d4a43da248fba813","ssdeep":"6144:hEAd94lqhbTQUovlU065PNq7FHQpTmsx/:hpd94lEE/Nc5w7Fwt1","tlshash":"de3423f953a91d48d25c2b303153934d7ebd68f3ebe22b319440240b0efd590f55a5ba","first_seen":"2024-03-15T18:45:45Z","last_seen":"2026-08-11T08:26:52.946154Z","times_seen":2490,"resource_available":false,"data":null}},"time_used":669,"timings":{"blocked":460,"dns":0,"connect":0,"send":0,"wait":113,"receive":96,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"bluewhaleusen.com/css/chunk-2abf8681.4d7f7488.css","fqdn":"bluewhaleusen.com","domain":"bluewhaleusen.com","tld":"com"},"ip":{"addr":"118.107.9.252","port":443,"asn":152194,"as":"CTG Server Limited","country":"Singapore","country_code":"SG"},"is_navigation_request":false,"resource_type":"other","requested_by":"https://bluewhaleusen.com/","date":"2025-12-20T07:01:24.274Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"bluewhaleusen.com","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Fri, 19 Dec 2025 05:22:57 GMT","end":"Thu, 19 Mar 2026 05:22:56 GMT"},"fingerprint":{"sha1":"23:4C:94:04:E1:25:E0:EA:D1:85:17:4C:09:FC:E0:DA:D0:01:E6:62","sha256":"AC:EF:45:40:E0:37:3A:BD:B9:C9:32:F5:6B:B1:B8:92:BE:33:89:43:FA:25:17:17:7C:CA:50:4E:0B:CD:25:EB"}}},"request":{"raw":"GET /css/chunk-2abf8681.4d7f7488.css HTTP/1.1\r\nHost: bluewhaleusen.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nX-Moz: prefetch\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Sat, 20 Dec 2025 07:01:24 GMT\r\ncontent-type: text/css\r\nvary: Accept-Encoding\r\netag: W/\"8132-1766123972327\"\r\nlast-modified: Fri, 19 Dec 2025 05:59:32 GMT\r\nstrict-transport-security: max-age=31536000\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":8132,"size_decoded":0,"mime_type":"text/css","magic":"ASCII text, with very long lines (8132), with no line terminators","md5":"c1287bd007ff0b66b87a7e912ed23c7f","sha1":"2cbe09f6425748a57bf073b88becd518374a03de","sha256":"ce89f29d9a484d3dcb924dbc29a6cc09682a4f1c1ad0515f91fcec32d0137fc9","sha512":"e4a99a8be760296eb3a054893f9c45815d2adfef4d1704ff4ecbb5ee0ad7eb318e871c00173c17079aa8fd6a12af1584034e49dd440df30bb9300bcad9883748","ssdeep":"192:IzCQIXiDe53zb/UboRyRD5liqF6+llu1JfP5iFxWXo:iCQRDeBzT8lN9lc1JsFko","tlshash":"23f10aa7a0b2c4296b27f0a6b5a4d4f43444c622ed9782e5b7d47128ccc32e35366f4c","first_seen":"2024-02-19T23:01:30Z","last_seen":"2026-06-06T14:40:04.519789Z","times_seen":226,"resource_available":false,"data":null}},"time_used":330,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":330,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2025-12-20","alert":"Sinkholed","trigger":"bluewhaleusen.com","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2025-12-20","alert":"Sinkholed","trigger":"bluewhaleusen.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2025-12-20","alert":"Phishing Block","trigger":"bluewhaleusen.com","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2025-12-20","alert":"Sinkholed","trigger":"bluewhaleusen.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2025-12-20","alert":"Sinkholed","trigger":"bluewhaleusen.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"mall-test.s3.amazonaws.com/test/2023-03-28/20a7dcb0-4ecb-43d4-bfe4-e7b16a8d6d70.jpg","fqdn":"mall-test.s3.amazonaws.com","domain":"mall-test.s3.amazonaws.com","tld":"s3.amazonaws.com"},"ip":{"addr":"3.5.30.74","port":443,"asn":14618,"as":"AMAZON-AES","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://bluewhaleusen.com/","date":"2025-12-20T07:01:24.655Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"P256","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"s3.amazonaws.com","organization":""},"issuer":{"commonName":"Amazon RSA 2048 M01","organization":"Amazon"},"validity":{"start":"Fri, 19 Sep 2025 00:00:00 GMT","end":"Sun, 23 Aug 2026 23:59:59 GMT"},"fingerprint":{"sha1":"48:FD:CD:50:85:6A:51:E7:71:E4:CB:E0:03:81:E1:EC:4E:AD:9E:C7","sha256":"D7:11:81:F4:91:03:0D:C6:A5:DE:8A:EF:AA:58:14:BA:AD:33:B5:11:8B:D5:F0:33:53:8B:AF:49:82:E9:4B:A4"}}},"request":{"raw":"GET /test/2023-03-28/20a7dcb0-4ecb-43d4-bfe4-e7b16a8d6d70.jpg HTTP/1.1\r\nHost: mall-test.s3.amazonaws.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nx-amz-id-2: DULNfQdpr35UnSasdVJ+uXtJsxYUZHXiP0N48ODrNwFlvE/Q6srGlsnDaxxxX0MQ4Dhf5JrrHI8FNGFu0xuuIQXhqHzinYHq\r\nx-amz-request-id: CRNYWCD4HZPPS89W\r\nDate: Sat, 20 Dec 2025 07:01:25 GMT\r\nLast-Modified: Wed, 22 May 2024 20:47:36 GMT\r\nETag: \"0cb226a4c24b62a8027c524333a66d1a\"\r\nx-amz-server-side-encryption: AES256\r\nAccept-Ranges: bytes\r\nContent-Type: image/jpeg\r\nContent-Length: 9972\r\nServer: AmazonS3\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Amazon Web Services","description":"Amazon Web Services (AWS) is a comprehensive cloud services platform offering compute power, database storage, content delivery and other functionality.","website":"https://aws.amazon.com/","common_platform_enumeration":"","icon":"Amazon Web Services.svg","categories":["PaaS"]},{"name":"Amazon S3","description":"Amazon S3 or Amazon Simple Storage Service is a service offered by Amazon Web Services (AWS) that provides object storage through a web service interface.","website":"https://aws.amazon.com/s3/","common_platform_enumeration":"","icon":"Amazon S3.svg","categories":["CDN"]}],"data":{"size":9972,"size_decoded":0,"mime_type":"image/jpeg","magic":"JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, baseline, precision 8, 68x1500, components 3","md5":"0cb226a4c24b62a8027c524333a66d1a","sha1":"bcd930afabd37e41dbff70ff18d3164036810ea3","sha256":"cae70bc988ba3c3472e4161ca54422d0e54923f5b26ee7e7e34716c90c97c2aa","sha512":"0182b799ed0ad9230c5713f54e77dec912e6873d55c491d41e30db98575b93ece455e58effcf4b52a2f1e5ec5638fa27ac16d8319119f1aa3ff0f1fce499789f","ssdeep":"192:1I49RvIJWdElnZFHjjtCcYjtGDCRxXEZJHMcf:1IKRvAZFDj0cOt4CR9EZJf","tlshash":"3f221ae391d3585f9838efdb9b5886e7d82ac355df6a3102204b030677e9f50ce3945a","first_seen":"2024-03-15T18:45:46Z","last_seen":"2026-08-11T08:26:52.946652Z","times_seen":2529,"resource_available":false,"data":null}},"time_used":229,"timings":{"blocked":116,"dns":0,"connect":0,"send":0,"wait":113,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"mall-test.s3.amazonaws.com/test/2023-03-28/cc9f0c02-1a92-4528-8753-c155478fe852.jpg","fqdn":"mall-test.s3.amazonaws.com","domain":"mall-test.s3.amazonaws.com","tld":"s3.amazonaws.com"},"ip":{"addr":"3.5.30.74","port":443,"asn":14618,"as":"AMAZON-AES","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://bluewhaleusen.com/","date":"2025-12-20T07:01:24.724Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"P256","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"s3.amazonaws.com","organization":""},"issuer":{"commonName":"Amazon RSA 2048 M01","organization":"Amazon"},"validity":{"start":"Fri, 19 Sep 2025 00:00:00 GMT","end":"Sun, 23 Aug 2026 23:59:59 GMT"},"fingerprint":{"sha1":"48:FD:CD:50:85:6A:51:E7:71:E4:CB:E0:03:81:E1:EC:4E:AD:9E:C7","sha256":"D7:11:81:F4:91:03:0D:C6:A5:DE:8A:EF:AA:58:14:BA:AD:33:B5:11:8B:D5:F0:33:53:8B:AF:49:82:E9:4B:A4"}}},"request":{"raw":"GET /test/2023-03-28/cc9f0c02-1a92-4528-8753-c155478fe852.jpg HTTP/1.1\r\nHost: mall-test.s3.amazonaws.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nx-amz-id-2: bT18VjlZVz7mjzXMjiZA1O5Z/TBz57khtbeLoG0SPzFqe2nxc6bgyL32CHG454oNIA2xWRvKVB0l5evoVQrZiAaNQ/Ti4GEf\r\nx-amz-request-id: 72K1NR02ZDYWCKTP\r\nDate: Sat, 20 Dec 2025 07:01:26 GMT\r\nLast-Modified: Wed, 22 May 2024 20:53:52 GMT\r\nETag: \"d858d55afc3e656ee3bfdf0a377589f5\"\r\nx-amz-server-side-encryption: AES256\r\nAccept-Ranges: bytes\r\nContent-Type: image/jpeg\r\nContent-Length: 237188\r\nServer: AmazonS3\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Amazon S3","description":"Amazon S3 or Amazon Simple Storage Service is a service offered by Amazon Web Services (AWS) that provides object storage through a web service interface.","website":"https://aws.amazon.com/s3/","common_platform_enumeration":"","icon":"Amazon S3.svg","categories":["CDN"]},{"name":"Amazon Web Services","description":"Amazon Web Services (AWS) is a comprehensive cloud services platform offering compute power, database storage, content delivery and other functionality.","website":"https://aws.amazon.com/","common_platform_enumeration":"","icon":"Amazon Web Services.svg","categories":["PaaS"]}],"data":{"size":237188,"size_decoded":0,"mime_type":"image/jpeg","magic":"JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 1500x1500, components 3","md5":"d858d55afc3e656ee3bfdf0a377589f5","sha1":"4aad0028082baab839dcf77b15dbb1c1f8cd9cba","sha256":"d642984a117d89349a1406a829df5859a6bcb1c7e55241b7a647bb238b2be1f3","sha512":"9a866f4977ef98b217035df2cf4ca4383f76dfe6a0dd737d85eaabd162224ec671314e5daee299db0eb69e5878e39c2a968bad7c87afe639cd5ac9d4a88113d2","ssdeep":"6144:uS3CPdNMUSSNyTgJ8tQrxaym12NLF8acZXGlexMJnvglDJdc+:eNMUmsJ8yr0gxF8xl0eRDnc+","tlshash":"533423ce7254507401493ab0439c4feae7d2abc34a4863f9b85a4681edc996de7dcb33","first_seen":"2024-02-19T23:01:29Z","last_seen":"2026-08-09T04:44:19.279161Z","times_seen":6934,"resource_available":false,"data":null}},"time_used":377,"timings":{"blocked":254,"dns":0,"connect":0,"send":0,"wait":117,"receive":6,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"bluewhaleusen.com/css/chunk-6ae12620.b30d78dd.css","fqdn":"bluewhaleusen.com","domain":"bluewhaleusen.com","tld":"com"},"ip":{"addr":"118.107.9.252","port":443,"asn":152194,"as":"CTG Server Limited","country":"Singapore","country_code":"SG"},"is_navigation_request":false,"resource_type":"other","requested_by":"https://bluewhaleusen.com/","date":"2025-12-20T07:01:24.931Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"bluewhaleusen.com","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Fri, 19 Dec 2025 05:22:57 GMT","end":"Thu, 19 Mar 2026 05:22:56 GMT"},"fingerprint":{"sha1":"23:4C:94:04:E1:25:E0:EA:D1:85:17:4C:09:FC:E0:DA:D0:01:E6:62","sha256":"AC:EF:45:40:E0:37:3A:BD:B9:C9:32:F5:6B:B1:B8:92:BE:33:89:43:FA:25:17:17:7C:CA:50:4E:0B:CD:25:EB"}}},"request":{"raw":"GET /css/chunk-6ae12620.b30d78dd.css HTTP/1.1\r\nHost: bluewhaleusen.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nX-Moz: prefetch\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Sat, 20 Dec 2025 07:01:25 GMT\r\ncontent-type: text/css\r\ncontent-length: 340\r\netag: W/\"340-1766123972328\"\r\nlast-modified: Fri, 19 Dec 2025 05:59:32 GMT\r\nstrict-transport-security: max-age=31536000\r\naccept-ranges: bytes\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":340,"size_decoded":0,"mime_type":"text/css","magic":"ASCII text, with very long lines (340), with no line terminators","md5":"7de78efe8bf09e10f280567a395d6b1b","sha1":"a84403256fb9c265c757c632def2bf3681d921e3","sha256":"3c64df4c1120ae8af09b2670ec78de64165c17cfe281e9fd19d9a55277f38b77","sha512":"575e2e01d3b715fc66a4de91cbe6cde658c2d3953445a92f711f396196fe921f1ff198fa691271c8670688cac8b445a52076248bc01382ffdd4b6956c1137eb5","ssdeep":"","tlshash":"f6e020708b561089952be1438b034cda2af9e663d16395855fa3d03dd46704f2e2a785","first_seen":"2024-02-11T04:26:48Z","last_seen":"2026-06-06T14:40:04.395716Z","times_seen":7633,"resource_available":false,"data":null}},"time_used":328,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":327,"receive":1,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2025-12-20","alert":"Sinkholed","trigger":"bluewhaleusen.com","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2025-12-20","alert":"Sinkholed","trigger":"bluewhaleusen.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2025-12-20","alert":"Sinkholed","trigger":"bluewhaleusen.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2025-12-20","alert":"Sinkholed","trigger":"bluewhaleusen.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2025-12-20","alert":"Phishing Block","trigger":"bluewhaleusen.com","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"bluewhaleusen.com/css/chunk-eca3e97c.f09689d1.css","fqdn":"bluewhaleusen.com","domain":"bluewhaleusen.com","tld":"com"},"ip":{"addr":"118.107.9.252","port":443,"asn":152194,"as":"CTG Server Limited","country":"Singapore","country_code":"SG"},"is_navigation_request":false,"resource_type":"other","requested_by":"https://bluewhaleusen.com/","date":"2025-12-20T07:01:25.930Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"bluewhaleusen.com","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Fri, 19 Dec 2025 05:22:57 GMT","end":"Thu, 19 Mar 2026 05:22:56 GMT"},"fingerprint":{"sha1":"23:4C:94:04:E1:25:E0:EA:D1:85:17:4C:09:FC:E0:DA:D0:01:E6:62","sha256":"AC:EF:45:40:E0:37:3A:BD:B9:C9:32:F5:6B:B1:B8:92:BE:33:89:43:FA:25:17:17:7C:CA:50:4E:0B:CD:25:EB"}}},"request":{"raw":"GET /css/chunk-eca3e97c.f09689d1.css HTTP/1.1\r\nHost: bluewhaleusen.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nX-Moz: prefetch\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Sat, 20 Dec 2025 07:01:26 GMT\r\ncontent-type: text/css\r\nvary: Accept-Encoding\r\netag: W/\"3625-1766123972328\"\r\nlast-modified: Fri, 19 Dec 2025 05:59:32 GMT\r\nstrict-transport-security: max-age=31536000\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":3625,"size_decoded":0,"mime_type":"text/css","magic":"ASCII text, with very long lines (3625), with no line terminators","md5":"f1780f9d45f7658d040c38d25eb705a1","sha1":"b819f324b3d0a8530037bb5474799ad57939ea91","sha256":"67041091f6905c2a4d162ea27c32382a85a0519e0b6c9dd7e3fe9e3a2393597c","sha512":"a7f6365c1ed56e22baa5c02f6e0d5336e10db1e34ebf13d65c0b62ef517c8a7b81498c8e2f5a8be34d1df3a8119fa643a2c8b569d04233da739edad49bdea906","ssdeep":"","tlshash":"d4718a117b2922f8e867805e2b56944d3710f10ba26ec8f7eea0d435cee29123b7459a","first_seen":"2024-02-19T23:01:29Z","last_seen":"2026-06-06T14:40:04.365877Z","times_seen":1778,"resource_available":false,"data":null}},"time_used":327,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":327,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2025-12-20","alert":"Phishing Block","trigger":"bluewhaleusen.com","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2025-12-20","alert":"Sinkholed","trigger":"bluewhaleusen.com","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2025-12-20","alert":"Sinkholed","trigger":"bluewhaleusen.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2025-12-20","alert":"Sinkholed","trigger":"bluewhaleusen.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2025-12-20","alert":"Sinkholed","trigger":"bluewhaleusen.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"bluewhaleusen.com/js/chunk-20104f2a.f38af1ee.js","fqdn":"bluewhaleusen.com","domain":"bluewhaleusen.com","tld":"com"},"ip":{"addr":"118.107.9.252","port":443,"asn":152194,"as":"CTG Server Limited","country":"Singapore","country_code":"SG"},"is_navigation_request":false,"resource_type":"other","requested_by":"https://bluewhaleusen.com/","date":"2025-12-20T07:01:26.287Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"bluewhaleusen.com","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Fri, 19 Dec 2025 05:22:57 GMT","end":"Thu, 19 Mar 2026 05:22:56 GMT"},"fingerprint":{"sha1":"23:4C:94:04:E1:25:E0:EA:D1:85:17:4C:09:FC:E0:DA:D0:01:E6:62","sha256":"AC:EF:45:40:E0:37:3A:BD:B9:C9:32:F5:6B:B1:B8:92:BE:33:89:43:FA:25:17:17:7C:CA:50:4E:0B:CD:25:EB"}}},"request":{"raw":"GET /js/chunk-20104f2a.f38af1ee.js HTTP/1.1\r\nHost: bluewhaleusen.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nX-Moz: prefetch\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Sat, 20 Dec 2025 07:01:26 GMT\r\ncontent-type: application/javascript\r\nvary: Accept-Encoding\r\netag: W/\"2985-1766123972321\"\r\nlast-modified: Fri, 19 Dec 2025 05:59:32 GMT\r\nstrict-transport-security: max-age=31536000\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":2985,"size_decoded":0,"mime_type":"application/javascript","magic":"JavaScript source, Unicode text, UTF-8 text, with very long lines (2981), with no line terminators","md5":"d1750d92b10c818d2f0a2022c73bd6af","sha1":"8c391560211fd5e51630c95f7b892fcdb990a6c2","sha256":"130f014905f38854e0750966ad16349ef86dc566b611990df65accc7d23f21ad","sha512":"fdbb420c21aaafefd5ed4fdff3ca055e65fa3a3005892e53e00b228a9b73f20c3e138ebfd0045cb17f63b49bedbdf86b843c424d473c5b14d3747a896608c2ef","ssdeep":"","tlshash":"5d51524c5452f47d898e502a311db330b0713fe24885a4bebb78ce9592d8e61370f7a9","first_seen":"2025-04-08T10:46:39.860043Z","last_seen":"2026-06-06T14:40:04.446416Z","times_seen":156,"resource_available":false,"data":null}},"time_used":327,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":327,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2025-12-20","alert":"Sinkholed","trigger":"bluewhaleusen.com","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2025-12-20","alert":"Sinkholed","trigger":"bluewhaleusen.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2025-12-20","alert":"Sinkholed","trigger":"bluewhaleusen.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2025-12-20","alert":"Phishing Block","trigger":"bluewhaleusen.com","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2025-12-20","alert":"Sinkholed","trigger":"bluewhaleusen.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"bluewhaleusen.com/js/chunk-83285f10.93a061b3.js","fqdn":"bluewhaleusen.com","domain":"bluewhaleusen.com","tld":"com"},"ip":{"addr":"118.107.9.252","port":443,"asn":152194,"as":"CTG Server Limited","country":"Singapore","country_code":"SG"},"is_navigation_request":false,"resource_type":"other","requested_by":"https://bluewhaleusen.com/","date":"2025-12-20T07:01:27.698Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"bluewhaleusen.com","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Fri, 19 Dec 2025 05:22:57 GMT","end":"Thu, 19 Mar 2026 05:22:56 GMT"},"fingerprint":{"sha1":"23:4C:94:04:E1:25:E0:EA:D1:85:17:4C:09:FC:E0:DA:D0:01:E6:62","sha256":"AC:EF:45:40:E0:37:3A:BD:B9:C9:32:F5:6B:B1:B8:92:BE:33:89:43:FA:25:17:17:7C:CA:50:4E:0B:CD:25:EB"}}},"request":{"raw":"GET /js/chunk-83285f10.93a061b3.js HTTP/1.1\r\nHost: bluewhaleusen.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nX-Moz: prefetch\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Sat, 20 Dec 2025 07:01:27 GMT\r\ncontent-type: application/javascript\r\nvary: Accept-Encoding\r\netag: W/\"14597-1766123972321\"\r\nlast-modified: Fri, 19 Dec 2025 05:59:32 GMT\r\nstrict-transport-security: max-age=31536000\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":14597,"size_decoded":0,"mime_type":"application/javascript","magic":"JavaScript source, Unicode text, UTF-8 text, with very long lines (14369), with no line terminators","md5":"4d7f4ece8332548ad9c5a6e63f95a68b","sha1":"02b46a34abbd3082801be1cda19782b4ef95d1be","sha256":"7862659bee6112ad934e003a1374f7a71eebff8c369ffb395a8f14eb36d57677","sha512":"4a020a29b6d4c3d251eeee0dc0e67b7a8f9043a2dbf22e4bbfaeb0c7d102f4463feec62e8dec2f81a2ad396f7357d85bcc1f0eb2678cbe43ee95e166cc618c43","ssdeep":"192:0xqG1RPDWzU/q+1mrLvgKHoBUsnyHZHJV6QXfZH+00Ma7YHNKnZX:DG1gzUxArlHotuqQXf8OpHNKZX","tlshash":"d962b88222b6385e4756219330ab2580a17296a5180e94eff53ddcf6b3ccc247d27b77","first_seen":"2025-04-08T11:27:57.692601Z","last_seen":"2026-06-06T14:40:04.366753Z","times_seen":61,"resource_available":false,"data":null}},"time_used":327,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":327,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2025-12-20","alert":"Sinkholed","trigger":"bluewhaleusen.com","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2025-12-20","alert":"Phishing Block","trigger":"bluewhaleusen.com","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2025-12-20","alert":"Sinkholed","trigger":"bluewhaleusen.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2025-12-20","alert":"Sinkholed","trigger":"bluewhaleusen.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2025-12-20","alert":"Sinkholed","trigger":"bluewhaleusen.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"bluewhaleusen.com/js/chunk-79bc161e.85987729.js","fqdn":"bluewhaleusen.com","domain":"bluewhaleusen.com","tld":"com"},"ip":{"addr":"118.107.9.252","port":443,"asn":152194,"as":"CTG Server Limited","country":"Singapore","country_code":"SG"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://bluewhaleusen.com/","date":"2025-12-20T07:01:22.386Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"bluewhaleusen.com","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Fri, 19 Dec 2025 05:22:57 GMT","end":"Thu, 19 Mar 2026 05:22:56 GMT"},"fingerprint":{"sha1":"23:4C:94:04:E1:25:E0:EA:D1:85:17:4C:09:FC:E0:DA:D0:01:E6:62","sha256":"AC:EF:45:40:E0:37:3A:BD:B9:C9:32:F5:6B:B1:B8:92:BE:33:89:43:FA:25:17:17:7C:CA:50:4E:0B:CD:25:EB"}}},"request":{"raw":"GET /js/chunk-79bc161e.85987729.js HTTP/1.1\r\nHost: bluewhaleusen.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Sat, 20 Dec 2025 07:01:22 GMT\r\ncontent-type: application/javascript\r\nvary: Accept-Encoding\r\netag: W/\"13662-1766123972313\"\r\nlast-modified: Fri, 19 Dec 2025 05:59:32 GMT\r\nstrict-transport-security: max-age=31536000\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":13662,"size_decoded":0,"mime_type":"application/javascript","magic":"JavaScript source, Unicode text, UTF-8 text, with very long lines (13654), with no line terminators","md5":"8d8c76ef48289d7ba00968bbc3279842","sha1":"e6102d6eca437c5cbd4110e259bfee480a0070ab","sha256":"1d0ab66ab732032c8bfd0dcf86f44395c979c0e92bfbdb3e5d6cab5850eb54f0","sha512":"6d686935ed8ba895b2c0961c1e83bd187fb734194484fd93066daf1392f492adf3cb5b42a13f1572020b630ac2044509f201a2b89dd91265f851944b662f43ad","ssdeep":"192:RzCjfAcMsHRpMu7mWKD12R+YEX+WzU9MuMOO0Kxq/cictjAfNeNF/BPsGC3M:wfNMsHRp3Q19X+WzU9MKXmvPd","tlshash":"e45295e6c470a4bd895a82b26055f1e0fb643a1cd102514efa7cec9b72ed424332e77e","first_seen":"2024-11-28T05:36:45.222943Z","last_seen":"2026-06-06T14:40:04.392552Z","times_seen":72,"resource_available":true,"data":null}},"time_used":327,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":327,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2025-12-20","alert":"Sinkholed","trigger":"bluewhaleusen.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2025-12-20","alert":"Sinkholed","trigger":"bluewhaleusen.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2025-12-20","alert":"Sinkholed","trigger":"bluewhaleusen.com","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2025-12-20","alert":"Phishing Block","trigger":"bluewhaleusen.com","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2025-12-20","alert":"Sinkholed","trigger":"bluewhaleusen.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"bluewhaleusen.com/js/chunk-2bdc7c1c.3b2a0fb6.js","fqdn":"bluewhaleusen.com","domain":"bluewhaleusen.com","tld":"com"},"ip":{"addr":"118.107.9.252","port":443,"asn":152194,"as":"CTG Server Limited","country":"Singapore","country_code":"SG"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://bluewhaleusen.com/","date":"2025-12-20T07:01:22.390Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"bluewhaleusen.com","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Fri, 19 Dec 2025 05:22:57 GMT","end":"Thu, 19 Mar 2026 05:22:56 GMT"},"fingerprint":{"sha1":"23:4C:94:04:E1:25:E0:EA:D1:85:17:4C:09:FC:E0:DA:D0:01:E6:62","sha256":"AC:EF:45:40:E0:37:3A:BD:B9:C9:32:F5:6B:B1:B8:92:BE:33:89:43:FA:25:17:17:7C:CA:50:4E:0B:CD:25:EB"}}},"request":{"raw":"GET /js/chunk-2bdc7c1c.3b2a0fb6.js HTTP/1.1\r\nHost: bluewhaleusen.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Sat, 20 Dec 2025 07:01:22 GMT\r\ncontent-type: application/javascript\r\nvary: Accept-Encoding\r\netag: W/\"33190-1766123972304\"\r\nlast-modified: Fri, 19 Dec 2025 05:59:32 GMT\r\nstrict-transport-security: max-age=31536000\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":33190,"size_decoded":0,"mime_type":"application/javascript","magic":"JavaScript source, Unicode text, UTF-8 text, with very long lines (33154), with no line terminators","md5":"744c54446e61f5d1b905361d15c85998","sha1":"5c3a6c929e695a790797aa763ea7863cbff0d7ab","sha256":"d8910170ab8c5baaca72f9b047faa7e14c49f97d907e4c137fee23629107c1c3","sha512":"df57b73849df42965644f26b84a1ed37d0e75079d7165a14b96928369ca0065aebe547c803c7b384976f4ff62cc63c1a174eee52ed367e42b421729e168c6bb0","ssdeep":"384:/XWsnfX8q8V8bTpAtlfs/0NbuGoalAS22Hn/jvjs4WvzsL5cU+18e:/pMqs7s/gbuGXH/fsMLDe","tlshash":"56e20a4ba4c2687d899a6159241b2658b8323fc5e041c8d6b53cfdf4e2f8e34772b76c","first_seen":"2025-04-08T11:27:57.64892Z","last_seen":"2026-06-06T14:40:04.34261Z","times_seen":66,"resource_available":true,"data":null}},"time_used":329,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":329,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2025-12-20","alert":"Sinkholed","trigger":"bluewhaleusen.com","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2025-12-20","alert":"Sinkholed","trigger":"bluewhaleusen.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2025-12-20","alert":"Phishing Block","trigger":"bluewhaleusen.com","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2025-12-20","alert":"Sinkholed","trigger":"bluewhaleusen.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2025-12-20","alert":"Sinkholed","trigger":"bluewhaleusen.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"bluewhaleusen.com/img/TikToklogo.3c6559fd.png","fqdn":"bluewhaleusen.com","domain":"bluewhaleusen.com","tld":"com"},"ip":{"addr":"118.107.9.252","port":443,"asn":152194,"as":"CTG Server Limited","country":"Singapore","country_code":"SG"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://bluewhaleusen.com/","date":"2025-12-20T07:01:22.746Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"bluewhaleusen.com","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Fri, 19 Dec 2025 05:22:57 GMT","end":"Thu, 19 Mar 2026 05:22:56 GMT"},"fingerprint":{"sha1":"23:4C:94:04:E1:25:E0:EA:D1:85:17:4C:09:FC:E0:DA:D0:01:E6:62","sha256":"AC:EF:45:40:E0:37:3A:BD:B9:C9:32:F5:6B:B1:B8:92:BE:33:89:43:FA:25:17:17:7C:CA:50:4E:0B:CD:25:EB"}}},"request":{"raw":"GET /img/TikToklogo.3c6559fd.png HTTP/1.1\r\nHost: bluewhaleusen.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Sat, 20 Dec 2025 07:01:22 GMT\r\ncontent-type: image/png\r\nvary: Accept-Encoding\r\netag: W/\"20874-1766123972349\"\r\nlast-modified: Fri, 19 Dec 2025 05:59:32 GMT\r\nstrict-transport-security: max-age=31536000\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":20874,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 1080 x 1080, 8-bit colormap, non-interlaced","md5":"3c6559fd5e238c9a04fe1220eb7a9add","sha1":"017d3076ba0692c6ccbf97868236de430eded9be","sha256":"5d5a6dfb2253b892b60b600598a6c8a7fbb698b3004b38fa3953a1b65b782a73","sha512":"c40f47d60a45f5e5d4c86c3857a669455cd4af95ce13c864c1c0fd63e80148996c4da405df64e069e1270b3623605fe381c27415c3144359b1c06c167f48a9d6","ssdeep":"384:SQMrV4jN1FOAOAfR/C4+ylFueYTgNNZASx1EfXZ8I9BYQkFVe:STSexyR64+ylc1oREfp/Ie","tlshash":"fc92d1d0e7704b08cddf24bb9988e13f32950c6582a3a45d3f574b617e4759bd876088","first_seen":"2024-10-06T09:20:23.06705Z","last_seen":"2026-07-09T07:07:04.497942Z","times_seen":79,"resource_available":false,"data":null}},"time_used":329,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":329,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2025-12-20","alert":"Sinkholed","trigger":"bluewhaleusen.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2025-12-20","alert":"Phishing Block","trigger":"bluewhaleusen.com","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2025-12-20","alert":"Sinkholed","trigger":"bluewhaleusen.com","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2025-12-20","alert":"Sinkholed","trigger":"bluewhaleusen.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2025-12-20","alert":"Sinkholed","trigger":"bluewhaleusen.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"bluewhaleusen.com/img/banner_02.eb3e4878.png","fqdn":"bluewhaleusen.com","domain":"bluewhaleusen.com","tld":"com"},"ip":{"addr":"118.107.9.252","port":443,"asn":152194,"as":"CTG Server Limited","country":"Singapore","country_code":"SG"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://bluewhaleusen.com/","date":"2025-12-20T07:01:22.852Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"bluewhaleusen.com","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Fri, 19 Dec 2025 05:22:57 GMT","end":"Thu, 19 Mar 2026 05:22:56 GMT"},"fingerprint":{"sha1":"23:4C:94:04:E1:25:E0:EA:D1:85:17:4C:09:FC:E0:DA:D0:01:E6:62","sha256":"AC:EF:45:40:E0:37:3A:BD:B9:C9:32:F5:6B:B1:B8:92:BE:33:89:43:FA:25:17:17:7C:CA:50:4E:0B:CD:25:EB"}}},"request":{"raw":"GET /img/banner_02.eb3e4878.png HTTP/1.1\r\nHost: bluewhaleusen.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Sat, 20 Dec 2025 07:01:23 GMT\r\ncontent-type: image/png\r\nvary: Accept-Encoding\r\netag: W/\"20448-1766123972355\"\r\nlast-modified: Fri, 19 Dec 2025 05:59:32 GMT\r\nstrict-transport-security: max-age=31536000\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":20448,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 1200 x 297, 8-bit colormap, non-interlaced","md5":"eb3e48786358c2c5c1686aea78ec7e6f","sha1":"fa65e2adaaa137d2becf62337ac1cab4339fe28c","sha256":"4860d957ed1ef802a37e402893cd4a8734b498832906b986b4dbdbcc632ef870","sha512":"c2c0f3935f901fbf7b56ddc16ad72b4ca8582bb01c4825569a34a30e299f8c51c00e7b253a5dd5c666e56eb16843363760bb1b4bda37c99f2373ec826549128d","ssdeep":"384:9wLMKWoMjvwmrXJxI/vlPvanoXTurZzmo8NC49PvRd1mncOrhOAr0fx0czVxflQ0:gMbNrzglPinQTurZzm9dPdrO30fx0czl","tlshash":"9692d088c8dfcda8d50188b79536145f8bf38f9cb4b2d90c9a2281e1e6f9344827b5b4","first_seen":"2024-02-19T23:01:27Z","last_seen":"2026-07-09T07:07:04.464275Z","times_seen":231,"resource_available":false,"data":null}},"time_used":329,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":329,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2025-12-20","alert":"Sinkholed","trigger":"bluewhaleusen.com","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2025-12-20","alert":"Sinkholed","trigger":"bluewhaleusen.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2025-12-20","alert":"Phishing Block","trigger":"bluewhaleusen.com","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2025-12-20","alert":"Sinkholed","trigger":"bluewhaleusen.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2025-12-20","alert":"Sinkholed","trigger":"bluewhaleusen.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"bluewhaleusen.com/css/chunk-17508bb2.b2e5197a.css","fqdn":"bluewhaleusen.com","domain":"bluewhaleusen.com","tld":"com"},"ip":{"addr":"118.107.9.252","port":443,"asn":152194,"as":"CTG Server Limited","country":"Singapore","country_code":"SG"},"is_navigation_request":false,"resource_type":"other","requested_by":"https://bluewhaleusen.com/","date":"2025-12-20T07:01:23.241Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"bluewhaleusen.com","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Fri, 19 Dec 2025 05:22:57 GMT","end":"Thu, 19 Mar 2026 05:22:56 GMT"},"fingerprint":{"sha1":"23:4C:94:04:E1:25:E0:EA:D1:85:17:4C:09:FC:E0:DA:D0:01:E6:62","sha256":"AC:EF:45:40:E0:37:3A:BD:B9:C9:32:F5:6B:B1:B8:92:BE:33:89:43:FA:25:17:17:7C:CA:50:4E:0B:CD:25:EB"}}},"request":{"raw":"GET /css/chunk-17508bb2.b2e5197a.css HTTP/1.1\r\nHost: bluewhaleusen.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nX-Moz: prefetch\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Sat, 20 Dec 2025 07:01:23 GMT\r\ncontent-type: text/css\r\ncontent-length: 447\r\netag: W/\"447-1766123972324\"\r\nlast-modified: Fri, 19 Dec 2025 05:59:32 GMT\r\nstrict-transport-security: max-age=31536000\r\naccept-ranges: bytes\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":447,"size_decoded":0,"mime_type":"text/css","magic":"ASCII text, with very long lines (447), with no line terminators","md5":"921bce4f483b1f08e93b4216d27b47de","sha1":"b4a29f334d7440c5b2f40841216224b72c6fcde9","sha256":"66b6628c502e0ea0445dc0ae31e229f358bd8a58aaf06e4eb525757fea64d439","sha512":"44e70871a7b43d640237f9f6f070c10a7bed3b3256e548f42488214ac6cd1421ae2209822abbb46e4940081e816f71e92ba2e6a658d1118cf5e3a9f8e7537240","ssdeep":"","tlshash":"f6f0ec012cbd95a15837c53df1c233b42e20369f0206c7a2ac44ac54c68ba613a14201","first_seen":"2024-02-11T04:26:47Z","last_seen":"2026-06-06T14:40:04.334237Z","times_seen":7244,"resource_available":false,"data":null}},"time_used":335,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":335,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2025-12-20","alert":"Sinkholed","trigger":"bluewhaleusen.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2025-12-20","alert":"Sinkholed","trigger":"bluewhaleusen.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2025-12-20","alert":"Phishing Block","trigger":"bluewhaleusen.com","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2025-12-20","alert":"Sinkholed","trigger":"bluewhaleusen.com","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2025-12-20","alert":"Sinkholed","trigger":"bluewhaleusen.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"imgtest1.s3.amazonaws.com/type/2023-03-29/bfa34439-cd8b-4b7c-b849-8cd85c7b6a33.jpg","fqdn":"imgtest1.s3.amazonaws.com","domain":"imgtest1.s3.amazonaws.com","tld":"s3.amazonaws.com"},"ip":{"addr":"16.15.207.90","port":443,"asn":14618,"as":"AMAZON-AES","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://bluewhaleusen.com/","date":"2025-12-20T07:01:23.368Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"P256","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.s3.amazonaws.com","organization":""},"issuer":{"commonName":"Amazon RSA 2048 M01","organization":"Amazon"},"validity":{"start":"Fri, 14 Feb 2025 00:00:00 GMT","end":"Sat, 07 Feb 2026 23:59:59 GMT"},"fingerprint":{"sha1":"2E:BA:63:64:95:A8:CE:55:DD:7E:EB:A9:98:83:14:B1:6F:6B:61:69","sha256":"00:D7:0B:CC:1F:82:6B:F6:D9:2E:55:1A:BA:88:38:33:19:09:5B:85:49:41:5E:DA:A1:97:B9:D2:0A:3B:13:52"}}},"request":{"raw":"GET /type/2023-03-29/bfa34439-cd8b-4b7c-b849-8cd85c7b6a33.jpg HTTP/1.1\r\nHost: imgtest1.s3.amazonaws.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nx-amz-id-2: /om1fylgH+FrPzvLTZifUtbbjW96zCmgi/+idtAgOUTeAEFZkE2GkGCFwb9iheeF9NHY1b0d5meOB70u0stF2Nr4gCnVpoiM\r\nx-amz-request-id: S19WEF0PN8P2F52Q\r\nDate: Sat, 20 Dec 2025 07:01:24 GMT\r\nLast-Modified: Sun, 01 Sep 2024 17:37:18 GMT\r\nETag: \"46155632d481869cb9c3e853c7832bea\"\r\nx-amz-server-side-encryption: AES256\r\nAccept-Ranges: bytes\r\nContent-Type: image/jpeg\r\nContent-Length: 39527\r\nServer: AmazonS3\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Amazon Web Services","description":"Amazon Web Services (AWS) is a comprehensive cloud services platform offering compute power, database storage, content delivery and other functionality.","website":"https://aws.amazon.com/","common_platform_enumeration":"","icon":"Amazon Web Services.svg","categories":["PaaS"]},{"name":"Amazon S3","description":"Amazon S3 or Amazon Simple Storage Service is a service offered by Amazon Web Services (AWS) that provides object storage through a web service interface.","website":"https://aws.amazon.com/s3/","common_platform_enumeration":"","icon":"Amazon S3.svg","categories":["CDN"]}],"data":{"size":39527,"size_decoded":0,"mime_type":"image/jpeg","magic":"JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, comment: \"CREATOR: gd-jpeg v1.0 (using IJG JPEG v80), quality = 90\", baseline, precision 8, 500x500, components 3","md5":"46155632d481869cb9c3e853c7832bea","sha1":"988a2fdc538ca57eadd8730f028800f736e1ee86","sha256":"1e4dba5d9d5fae2a3aafe91ae59ff2f9f938229ee17b6af825d3d7ae78a93913","sha512":"6a93dfe70a2ee1089d7a1137043494795f98bab7533792b6e736c25439b4c871437a83103e1f02c58b32e7af94aa20e67db51929d945869cff4485b6840c2255","ssdeep":"768:G2faHY+HPhvSyz/eZculI+Pl9UTnIbrimLDGEFK6hbrysiU1JL4:GogPUGkymLDGExSsiE4","tlshash":"af03d0472804ef4b762ce2727e9b1f681f819b4ca8c672cc4a530dafaf657b9491c41c","first_seen":"2023-11-07T02:37:41Z","last_seen":"2026-08-11T08:26:52.966838Z","times_seen":9982,"resource_available":false,"data":null}},"time_used":471,"timings":{"blocked":-1,"dns":1,"connect":98,"send":0,"wait":123,"receive":94,"ssl":150},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"mall-test.s3.amazonaws.com/test/2023-03-28/5a905e1d-1756-453e-bc49-baabb5267acb.jpg","fqdn":"mall-test.s3.amazonaws.com","domain":"mall-test.s3.amazonaws.com","tld":"s3.amazonaws.com"},"ip":{"addr":"3.5.30.74","port":443,"asn":14618,"as":"AMAZON-AES","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://bluewhaleusen.com/","date":"2025-12-20T07:01:23.450Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"P256","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"s3.amazonaws.com","organization":""},"issuer":{"commonName":"Amazon RSA 2048 M01","organization":"Amazon"},"validity":{"start":"Fri, 19 Sep 2025 00:00:00 GMT","end":"Sun, 23 Aug 2026 23:59:59 GMT"},"fingerprint":{"sha1":"48:FD:CD:50:85:6A:51:E7:71:E4:CB:E0:03:81:E1:EC:4E:AD:9E:C7","sha256":"D7:11:81:F4:91:03:0D:C6:A5:DE:8A:EF:AA:58:14:BA:AD:33:B5:11:8B:D5:F0:33:53:8B:AF:49:82:E9:4B:A4"}}},"request":{"raw":"GET /test/2023-03-28/5a905e1d-1756-453e-bc49-baabb5267acb.jpg HTTP/1.1\r\nHost: mall-test.s3.amazonaws.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nx-amz-id-2: TdXxBZ6l7vEEgIAHA7L1aNYkUgX+yajbfqct4S5mW006WTvKKbSEyE3v7CSR9+Z/NOoeifV16W/OFBTZqK0zl+cvE/jduw7P\r\nx-amz-request-id: S19WJZ32VEYFQTR4\r\nDate: Sat, 20 Dec 2025 07:01:24 GMT\r\nLast-Modified: Wed, 22 May 2024 20:49:42 GMT\r\nETag: \"d65489337eec1ccd7aa3b7d4e85cce6f\"\r\nx-amz-server-side-encryption: AES256\r\nAccept-Ranges: bytes\r\nContent-Type: image/jpeg\r\nContent-Length: 47706\r\nServer: AmazonS3\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Amazon S3","description":"Amazon S3 or Amazon Simple Storage Service is a service offered by Amazon Web Services (AWS) that provides object storage through a web service interface.","website":"https://aws.amazon.com/s3/","common_platform_enumeration":"","icon":"Amazon S3.svg","categories":["CDN"]},{"name":"Amazon Web Services","description":"Amazon Web Services (AWS) is a comprehensive cloud services platform offering compute power, database storage, content delivery and other functionality.","website":"https://aws.amazon.com/","common_platform_enumeration":"","icon":"Amazon Web Services.svg","categories":["PaaS"]}],"data":{"size":47706,"size_decoded":0,"mime_type":"image/jpeg","magic":"JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 1500x1500, components 3","md5":"d65489337eec1ccd7aa3b7d4e85cce6f","sha1":"363ebd6574ea0eef5bd9fa6ea4245988329dbe21","sha256":"9e10a358d6e01dd67c6fb8668c84cf319256fd3e31e95a65fcce29f090c43baa","sha512":"b4854060269a85c9f2f15c2f8c31144f09d1b29b3d68849886ad40ea128e8e3f86ef2546b42e19afe271bf97b66ddb135c3c52027f73ad7dfae5f87786160a23","ssdeep":"768:19SyEOYqddNLA4oD7z2lkXynB4d2ABlYO2yENr38m1BwZX5plmQQctt9QUMRyqQ6:uyfRddNLpNlWyud9lPiAm1+ZhmBA2U6","tlshash":"a32301427fa5aa8bd238af3157c3e749b86f8289d2a61d01f175ac128d41712fd6cad0","first_seen":"2024-02-19T23:01:28Z","last_seen":"2026-08-09T04:44:19.301271Z","times_seen":7710,"resource_available":false,"data":null}},"time_used":668,"timings":{"blocked":224,"dns":13,"connect":95,"send":0,"wait":122,"receive":94,"ssl":109},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"imgtest1.s3.amazonaws.com/test/2023-03-07/b36d2777-fff7-4cec-b168-5b68c3d256b6.jpg","fqdn":"imgtest1.s3.amazonaws.com","domain":"imgtest1.s3.amazonaws.com","tld":"s3.amazonaws.com"},"ip":{"addr":"16.15.207.90","port":443,"asn":14618,"as":"AMAZON-AES","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://bluewhaleusen.com/","date":"2025-12-20T07:01:23.452Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"P256","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.s3.amazonaws.com","organization":""},"issuer":{"commonName":"Amazon RSA 2048 M01","organization":"Amazon"},"validity":{"start":"Fri, 14 Feb 2025 00:00:00 GMT","end":"Sat, 07 Feb 2026 23:59:59 GMT"},"fingerprint":{"sha1":"2E:BA:63:64:95:A8:CE:55:DD:7E:EB:A9:98:83:14:B1:6F:6B:61:69","sha256":"00:D7:0B:CC:1F:82:6B:F6:D9:2E:55:1A:BA:88:38:33:19:09:5B:85:49:41:5E:DA:A1:97:B9:D2:0A:3B:13:52"}}},"request":{"raw":"GET /test/2023-03-07/b36d2777-fff7-4cec-b168-5b68c3d256b6.jpg HTTP/1.1\r\nHost: imgtest1.s3.amazonaws.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nx-amz-id-2: VJxFhEfxXoVYRi8td8bZZHCvioFOGcoFcGY33fxRnur/Hf5akK02P1B3nQ/IwpZFa4h+7Bmrnd8CfJ1/3/fafvOa6qxQUtvU\r\nx-amz-request-id: CRNR0ESJNX1Z9V85\r\nDate: Sat, 20 Dec 2025 07:01:25 GMT\r\nLast-Modified: Thu, 23 May 2024 01:47:52 GMT\r\nETag: \"2cc7debe43917ab58c294485e5c478d5\"\r\nx-amz-server-side-encryption: AES256\r\nAccept-Ranges: bytes\r\nContent-Type: image/jpeg\r\nContent-Length: 235022\r\nServer: AmazonS3\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Amazon S3","description":"Amazon S3 or Amazon Simple Storage Service is a service offered by Amazon Web Services (AWS) that provides object storage through a web service interface.","website":"https://aws.amazon.com/s3/","common_platform_enumeration":"","icon":"Amazon S3.svg","categories":["CDN"]},{"name":"Amazon Web Services","description":"Amazon Web Services (AWS) is a comprehensive cloud services platform offering compute power, database storage, content delivery and other functionality.","website":"https://aws.amazon.com/","common_platform_enumeration":"","icon":"Amazon Web Services.svg","categories":["PaaS"]}],"data":{"size":235022,"size_decoded":0,"mime_type":"image/jpeg","magic":"JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 981x1500, components 3","md5":"2cc7debe43917ab58c294485e5c478d5","sha1":"1dcb28255d99596d828673da4d474ff999c98905","sha256":"590d7d4cd7f3fa7833565c83bbae73b56e3fc935cfec091c542e28de866d7d5c","sha512":"71f23f15d8d9054cfce9632c25b2f60aa724b043c2a1d3d4e2032123ba89c99e6c404072d0b2baf3ea13240ff17cbb10942be64ebfd0c5499bdcd82f8eefe381","ssdeep":"6144:kPr1Ds5uJHQbwgOYbprdGn0CUmmqtHFCmH:21DDJHQsgR9pw0CUmFCmH","tlshash":"3134239d3608364dc7685bba017bba565e6cf58048cb7bfa197f3e07199311e61e2430","first_seen":"2024-02-19T23:01:28Z","last_seen":"2026-08-09T04:44:19.264957Z","times_seen":7597,"resource_available":false,"data":null}},"time_used":882,"timings":{"blocked":667,"dns":0,"connect":0,"send":0,"wait":114,"receive":101,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"imgtest1.s3.amazonaws.com/type/2023-03-28/b95dc824-0d77-4013-a5b6-73fab1c9e4c5.jpg","fqdn":"imgtest1.s3.amazonaws.com","domain":"imgtest1.s3.amazonaws.com","tld":"s3.amazonaws.com"},"ip":{"addr":"16.15.207.90","port":443,"asn":14618,"as":"AMAZON-AES","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://bluewhaleusen.com/","date":"2025-12-20T07:01:23.381Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"P256","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.s3.amazonaws.com","organization":""},"issuer":{"commonName":"Amazon RSA 2048 M01","organization":"Amazon"},"validity":{"start":"Fri, 14 Feb 2025 00:00:00 GMT","end":"Sat, 07 Feb 2026 23:59:59 GMT"},"fingerprint":{"sha1":"2E:BA:63:64:95:A8:CE:55:DD:7E:EB:A9:98:83:14:B1:6F:6B:61:69","sha256":"00:D7:0B:CC:1F:82:6B:F6:D9:2E:55:1A:BA:88:38:33:19:09:5B:85:49:41:5E:DA:A1:97:B9:D2:0A:3B:13:52"}}},"request":{"raw":"GET /type/2023-03-28/b95dc824-0d77-4013-a5b6-73fab1c9e4c5.jpg HTTP/1.1\r\nHost: imgtest1.s3.amazonaws.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nx-amz-id-2: g419sduS0a0Ks9OBS/9z7czQs+csLmCXiWbyYs0jO3Xh0PJJOQeLfATem6Ar6Um5OUoOkQ/rkl7ViC8FwdoveGxlQumKnRtR\r\nx-amz-request-id: S19VXQBFGJQ1HAG3\r\nDate: Sat, 20 Dec 2025 07:01:24 GMT\r\nLast-Modified: Sun, 01 Sep 2024 17:37:17 GMT\r\nETag: \"0527d1653d7ad2d9fce0c6e3e6ff3f8d\"\r\nx-amz-server-side-encryption: AES256\r\nAccept-Ranges: bytes\r\nContent-Type: image/jpeg\r\nContent-Length: 17300\r\nServer: AmazonS3\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Amazon Web Services","description":"Amazon Web Services (AWS) is a comprehensive cloud services platform offering compute power, database storage, content delivery and other functionality.","website":"https://aws.amazon.com/","common_platform_enumeration":"","icon":"Amazon Web Services.svg","categories":["PaaS"]},{"name":"Amazon S3","description":"Amazon S3 or Amazon Simple Storage Service is a service offered by Amazon Web Services (AWS) that provides object storage through a web service interface.","website":"https://aws.amazon.com/s3/","common_platform_enumeration":"","icon":"Amazon S3.svg","categories":["CDN"]}],"data":{"size":17300,"size_decoded":0,"mime_type":"image/jpeg","magic":"JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, comment: \"CREATOR: gd-jpeg v1.0 (using IJG JPEG v80), quality = 90\", baseline, precision 8, 500x500, components 3","md5":"0527d1653d7ad2d9fce0c6e3e6ff3f8d","sha1":"96f83c2be0860f8d33bda1e5955d2f69e1947cce","sha256":"91d6492646ed09c0cd914e6d6b5756d5e5ce01c44334b1e4fe035ead232a3f00","sha512":"a52945f8f23f05aedb2288cf6da590d9cacdeb9c07cda2e165f751c8f5eab3a752061e605e778f3c374481c4b1661d99be9d5fd8962d30e5cc3e4f5f007f2a61","ssdeep":"192:Gdel8vIA3KMvActt7vDzEu/L38lmmDOTORDpUcQws5kXMwAjdMubITDpgO67jTf:GdSnq/tt7vTLAnyO5skTAjGJTt67","tlshash":"ce7216179d089dd3616cc3e5bf060eec7f9a5758e8063def90a10fd93b206878d8946a","first_seen":"2023-11-07T02:37:41Z","last_seen":"2026-08-11T08:26:52.956613Z","times_seen":9951,"resource_available":false,"data":null}},"time_used":596,"timings":{"blocked":471,"dns":0,"connect":0,"send":0,"wait":123,"receive":2,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"imgtest1.s3.amazonaws.com/test/2023-03-11/946a7bc7-97f9-47e1-a545-5d6225a7b4cc.jpg","fqdn":"imgtest1.s3.amazonaws.com","domain":"imgtest1.s3.amazonaws.com","tld":"s3.amazonaws.com"},"ip":{"addr":"16.15.207.90","port":443,"asn":14618,"as":"AMAZON-AES","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://bluewhaleusen.com/","date":"2025-12-20T07:01:23.472Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"P256","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.s3.amazonaws.com","organization":""},"issuer":{"commonName":"Amazon RSA 2048 M01","organization":"Amazon"},"validity":{"start":"Fri, 14 Feb 2025 00:00:00 GMT","end":"Sat, 07 Feb 2026 23:59:59 GMT"},"fingerprint":{"sha1":"2E:BA:63:64:95:A8:CE:55:DD:7E:EB:A9:98:83:14:B1:6F:6B:61:69","sha256":"00:D7:0B:CC:1F:82:6B:F6:D9:2E:55:1A:BA:88:38:33:19:09:5B:85:49:41:5E:DA:A1:97:B9:D2:0A:3B:13:52"}}},"request":{"raw":"GET /test/2023-03-11/946a7bc7-97f9-47e1-a545-5d6225a7b4cc.jpg HTTP/1.1\r\nHost: imgtest1.s3.amazonaws.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nx-amz-id-2: qZObFZZiK09RKa3KgnDsdbnwD00nkGde2PYbaCPVxkjvVzTMvHfP+3njM1zbQlJoiDL+daYN5nNsWJzvgXFNyxGNbZGGxRUH\r\nx-amz-request-id: CRNH5TAR7XX0XAJN\r\nDate: Sat, 20 Dec 2025 07:01:25 GMT\r\nLast-Modified: Thu, 23 May 2024 01:49:51 GMT\r\nETag: \"579b662c6df2b3a78037574279a6dbf0\"\r\nx-amz-server-side-encryption: AES256\r\nAccept-Ranges: bytes\r\nContent-Type: image/jpeg\r\nContent-Length: 204661\r\nServer: AmazonS3\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Amazon S3","description":"Amazon S3 or Amazon Simple Storage Service is a service offered by Amazon Web Services (AWS) that provides object storage through a web service interface.","website":"https://aws.amazon.com/s3/","common_platform_enumeration":"","icon":"Amazon S3.svg","categories":["CDN"]},{"name":"Amazon Web Services","description":"Amazon Web Services (AWS) is a comprehensive cloud services platform offering compute power, database storage, content delivery and other functionality.","website":"https://aws.amazon.com/","common_platform_enumeration":"","icon":"Amazon Web Services.svg","categories":["PaaS"]}],"data":{"size":204661,"size_decoded":0,"mime_type":"image/jpeg","magic":"JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 1500x1174, components 3","md5":"579b662c6df2b3a78037574279a6dbf0","sha1":"ed24732a5a0395104ca95e074bfb18cf78622f50","sha256":"d6ff3f43a65f9161644219724424fe7856866883c30db94beba7ebad88e4f246","sha512":"8aa538d0a0e7d97a4eb7d5a1a24079351bb02ae73ecf2b95affd033c31a358b578ac375e24fc29308cbe00d950ff7b4fff992229a5f8cf378693537ba21a7ed7","ssdeep":"6144:jaI9PtYKdwCGqPD8Qd8NdqM+JxTj+F2K5SG:j3vyp09goM+m55","tlshash":"a41423178a0eb970c47d95738ab75cfff270df56af642ccd00c198e5967a22018ac792","first_seen":"2024-02-19T23:01:28Z","last_seen":"2026-08-09T04:44:19.291845Z","times_seen":6998,"resource_available":false,"data":null}},"time_used":1002,"timings":{"blocked":787,"dns":0,"connect":0,"send":0,"wait":117,"receive":98,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"imgtest1.s3.amazonaws.com/selle/2023-12-01/0b121c30-4d55-46df-92cd-e7e79fed7a83.jpg","fqdn":"imgtest1.s3.amazonaws.com","domain":"imgtest1.s3.amazonaws.com","tld":"s3.amazonaws.com"},"ip":{"addr":"16.15.207.90","port":443,"asn":14618,"as":"AMAZON-AES","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://bluewhaleusen.com/","date":"2025-12-20T07:01:24.230Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"P256","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.s3.amazonaws.com","organization":""},"issuer":{"commonName":"Amazon RSA 2048 M01","organization":"Amazon"},"validity":{"start":"Fri, 14 Feb 2025 00:00:00 GMT","end":"Sat, 07 Feb 2026 23:59:59 GMT"},"fingerprint":{"sha1":"2E:BA:63:64:95:A8:CE:55:DD:7E:EB:A9:98:83:14:B1:6F:6B:61:69","sha256":"00:D7:0B:CC:1F:82:6B:F6:D9:2E:55:1A:BA:88:38:33:19:09:5B:85:49:41:5E:DA:A1:97:B9:D2:0A:3B:13:52"}}},"request":{"raw":"GET /selle/2023-12-01/0b121c30-4d55-46df-92cd-e7e79fed7a83.jpg HTTP/1.1\r\nHost: imgtest1.s3.amazonaws.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nx-amz-id-2: Hu+Z8v/c0lNdfitJ8n9kyI2TqVoqXpdRBrhPOX9NY349/JpjRbJN6MuhZYwM/gS6+dWCDDdA6JL87PVMSxss9Ty3q3NbM6Id\r\nx-amz-request-id: CRNVG02C8Z4XZGDZ\r\nDate: Sat, 20 Dec 2025 07:01:25 GMT\r\nLast-Modified: Thu, 23 May 2024 01:44:49 GMT\r\nETag: \"097d83a8f1d7e6cddb5185b4a4ba2535\"\r\nx-amz-server-side-encryption: AES256\r\nAccept-Ranges: bytes\r\nContent-Type: image/jpeg\r\nContent-Length: 268274\r\nServer: AmazonS3\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Amazon Web Services","description":"Amazon Web Services (AWS) is a comprehensive cloud services platform offering compute power, database storage, content delivery and other functionality.","website":"https://aws.amazon.com/","common_platform_enumeration":"","icon":"Amazon Web Services.svg","categories":["PaaS"]},{"name":"Amazon S3","description":"Amazon S3 or Amazon Simple Storage Service is a service offered by Amazon Web Services (AWS) that provides object storage through a web service interface.","website":"https://aws.amazon.com/s3/","common_platform_enumeration":"","icon":"Amazon S3.svg","categories":["CDN"]}],"data":{"size":268274,"size_decoded":0,"mime_type":"image/jpeg","magic":"JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 960x1280, components 3","md5":"097d83a8f1d7e6cddb5185b4a4ba2535","sha1":"ab81671e01e6eba67a4a834fa72186151180e0c5","sha256":"0ebd81023c36c931438eae38509e5b57f99193ae7b3441fc53f4001596980a4a","sha512":"c42e6a86e572eda0c00d6aa31142246d151b0e43748c4854f1cee9b6b492a38d5a982b841afde99c97dd641846fdb8333c355929821e5cd41cb4d62829f5c854","ssdeep":"6144:0AX0jPj12+Y21EFnxnB/NZZ85wy7z2pTEabsv:0AX0jb8r2mnxBVZZawy7zoTEabsv","tlshash":"7f44235a4bc2f0a0ee7eb221cc58d94d32c7f8bca05e985917461c6cfac90dc5a5366b","first_seen":"2024-05-25T22:56:10Z","last_seen":"2026-08-11T08:26:52.900174Z","times_seen":965,"resource_available":false,"data":null}},"time_used":347,"timings":{"blocked":222,"dns":0,"connect":0,"send":0,"wait":117,"receive":8,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"bluewhaleusen.com/css/chunk-39678b28.410c36ca.css","fqdn":"bluewhaleusen.com","domain":"bluewhaleusen.com","tld":"com"},"ip":{"addr":"118.107.9.252","port":443,"asn":152194,"as":"CTG Server Limited","country":"Singapore","country_code":"SG"},"is_navigation_request":false,"resource_type":"other","requested_by":"https://bluewhaleusen.com/","date":"2025-12-20T07:01:24.284Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"bluewhaleusen.com","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Fri, 19 Dec 2025 05:22:57 GMT","end":"Thu, 19 Mar 2026 05:22:56 GMT"},"fingerprint":{"sha1":"23:4C:94:04:E1:25:E0:EA:D1:85:17:4C:09:FC:E0:DA:D0:01:E6:62","sha256":"AC:EF:45:40:E0:37:3A:BD:B9:C9:32:F5:6B:B1:B8:92:BE:33:89:43:FA:25:17:17:7C:CA:50:4E:0B:CD:25:EB"}}},"request":{"raw":"GET /css/chunk-39678b28.410c36ca.css HTTP/1.1\r\nHost: bluewhaleusen.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nX-Moz: prefetch\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Sat, 20 Dec 2025 07:01:24 GMT\r\ncontent-type: text/css\r\nvary: Accept-Encoding\r\netag: W/\"11900-1766123972324\"\r\nlast-modified: Fri, 19 Dec 2025 05:59:32 GMT\r\nstrict-transport-security: max-age=31536000\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":11900,"size_decoded":0,"mime_type":"text/css","magic":"ASCII text, with very long lines (11900), with no line terminators","md5":"1fdfaae17b229f449b5bd9e4f1437459","sha1":"e3ffd116dac11f7adb268079fb755db7fc4f2410","sha256":"cfc882d2f62064f4f7ee6bb7fc56a18469494c61feb485c2d03aa6e5666baf4e","sha512":"e7f6bb0843d4f5b8c9121de80bfed974dfa5ea74cc40c10007fe2db07a726d1ce77b8c3445685d2f99365ce5d11e1b6e2866e579b5436d9e605722e201330a8c","ssdeep":"192:IzCQIXiDe53zb/UboRyRD5liqF6+llu1JfOxoi7k2Xer4p412QRAelWklFbaiWsX:iCQRDeBzT8lN9lc1JWxoi7kGerMscKY4","tlshash":"5732f96290b2933dad23e1a57098ace83544d526dd5343eeb7507438cccb2e32632f5c","first_seen":"2024-02-19T23:01:29Z","last_seen":"2026-06-06T14:40:04.394881Z","times_seen":172,"resource_available":false,"data":null}},"time_used":327,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":327,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2025-12-20","alert":"Sinkholed","trigger":"bluewhaleusen.com","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2025-12-20","alert":"Sinkholed","trigger":"bluewhaleusen.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2025-12-20","alert":"Sinkholed","trigger":"bluewhaleusen.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2025-12-20","alert":"Phishing Block","trigger":"bluewhaleusen.com","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2025-12-20","alert":"Sinkholed","trigger":"bluewhaleusen.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"bluewhaleusen.com/js/chunk-2abf8681.288065ec.js","fqdn":"bluewhaleusen.com","domain":"bluewhaleusen.com","tld":"com"},"ip":{"addr":"118.107.9.252","port":443,"asn":152194,"as":"CTG Server Limited","country":"Singapore","country_code":"SG"},"is_navigation_request":false,"resource_type":"other","requested_by":"https://bluewhaleusen.com/","date":"2025-12-20T07:01:26.323Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"bluewhaleusen.com","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Fri, 19 Dec 2025 05:22:57 GMT","end":"Thu, 19 Mar 2026 05:22:56 GMT"},"fingerprint":{"sha1":"23:4C:94:04:E1:25:E0:EA:D1:85:17:4C:09:FC:E0:DA:D0:01:E6:62","sha256":"AC:EF:45:40:E0:37:3A:BD:B9:C9:32:F5:6B:B1:B8:92:BE:33:89:43:FA:25:17:17:7C:CA:50:4E:0B:CD:25:EB"}}},"request":{"raw":"GET /js/chunk-2abf8681.288065ec.js HTTP/1.1\r\nHost: bluewhaleusen.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nX-Moz: prefetch\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Sat, 20 Dec 2025 07:01:26 GMT\r\ncontent-type: application/javascript\r\nvary: Accept-Encoding\r\netag: W/\"14180-1766123972312\"\r\nlast-modified: Fri, 19 Dec 2025 05:59:32 GMT\r\nstrict-transport-security: max-age=31536000\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":14180,"size_decoded":0,"mime_type":"application/javascript","magic":"JavaScript source, ASCII text, with very long lines (14180), with no line terminators","md5":"593a09d8a5dc30f704fc234b8af634c7","sha1":"18b2d93bd1f2a851cecda560d796b8df179ee77a","sha256":"c1c0ed86810043127030f324081c955fe094b78e164529a1ca5b5035f32bc5df","sha512":"fab96b4b8a96f3f898c9634df8c2daa3e9f7cad3eb673893b5bfb7f3052c49a9a9858a2ae6841a3b4427a9a25ed2bb2609f6674d86943fd54c34f09c37aade82","ssdeep":"192:/gCjSKwrD2R/LIT4Ev/sODCMSXc6GqgCI9pn5VsFyeyVu+4ceV6IrI3Up:Fd5LITnXsAKXj782yD4+4ceVZp","tlshash":"0952e85e70bdedf8859a60227016227871712bd0f5094cd8b7bccdf44589ea8a32f67d","first_seen":"2025-04-08T11:27:57.683474Z","last_seen":"2026-06-06T14:40:04.492855Z","times_seen":64,"resource_available":false,"data":null}},"time_used":327,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":327,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2025-12-20","alert":"Sinkholed","trigger":"bluewhaleusen.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2025-12-20","alert":"Phishing Block","trigger":"bluewhaleusen.com","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2025-12-20","alert":"Sinkholed","trigger":"bluewhaleusen.com","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2025-12-20","alert":"Sinkholed","trigger":"bluewhaleusen.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2025-12-20","alert":"Sinkholed","trigger":"bluewhaleusen.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"bluewhaleusen.com/js/chunk-8574639a.53dc5ddc.js","fqdn":"bluewhaleusen.com","domain":"bluewhaleusen.com","tld":"com"},"ip":{"addr":"118.107.9.252","port":443,"asn":152194,"as":"CTG Server Limited","country":"Singapore","country_code":"SG"},"is_navigation_request":false,"resource_type":"other","requested_by":"https://bluewhaleusen.com/","date":"2025-12-20T07:01:27.927Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"bluewhaleusen.com","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Fri, 19 Dec 2025 05:22:57 GMT","end":"Thu, 19 Mar 2026 05:22:56 GMT"},"fingerprint":{"sha1":"23:4C:94:04:E1:25:E0:EA:D1:85:17:4C:09:FC:E0:DA:D0:01:E6:62","sha256":"AC:EF:45:40:E0:37:3A:BD:B9:C9:32:F5:6B:B1:B8:92:BE:33:89:43:FA:25:17:17:7C:CA:50:4E:0B:CD:25:EB"}}},"request":{"raw":"GET /js/chunk-8574639a.53dc5ddc.js HTTP/1.1\r\nHost: bluewhaleusen.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nX-Moz: prefetch\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Sat, 20 Dec 2025 07:01:28 GMT\r\ncontent-type: application/javascript\r\nvary: Accept-Encoding\r\netag: W/\"6581-1766123972320\"\r\nlast-modified: Fri, 19 Dec 2025 05:59:32 GMT\r\nstrict-transport-security: max-age=31536000\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":6581,"size_decoded":0,"mime_type":"application/javascript","magic":"JavaScript source, Unicode text, UTF-8 text, with very long lines (6553), with no line terminators","md5":"10827f09135aa160ea99abf627d7dddb","sha1":"3a6537da9af92a322abc37cd357a0fadb225724f","sha256":"d10436b7f805ed7626732d7c2779fb8b04ee8cf75ab6978ad5035e535e491992","sha512":"42a9d4914a93ddb8111ed3274574b4bac71aa66cd9a8edf9b089f630d11ac2706023455d81958a3c48af8ea97f431ae86b62197c390c38f06d0179c05314d0e6","ssdeep":"96:hngjkdrHrjYXkLIuGtdcskBIHKKpD7AkMTEWgvbVPLYsoqfZTx3:ZlLj45uGtmUHD7AkMAWspUsJfr3","tlshash":"efd1f94aa218f90d4e0fd151301d2572f5a93ae4b064d9da773dc8fd628cd142b2fbb9","first_seen":"2025-04-08T11:27:57.691772Z","last_seen":"2026-06-06T14:40:04.396597Z","times_seen":94,"resource_available":false,"data":null}},"time_used":328,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":328,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2025-12-20","alert":"Sinkholed","trigger":"bluewhaleusen.com","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2025-12-20","alert":"Sinkholed","trigger":"bluewhaleusen.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2025-12-20","alert":"Sinkholed","trigger":"bluewhaleusen.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2025-12-20","alert":"Sinkholed","trigger":"bluewhaleusen.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2025-12-20","alert":"Phishing Block","trigger":"bluewhaleusen.com","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"bluewhaleusen.com/js/chunk-c1e03a3e.4d2e0816.js","fqdn":"bluewhaleusen.com","domain":"bluewhaleusen.com","tld":"com"},"ip":{"addr":"118.107.9.252","port":443,"asn":152194,"as":"CTG Server Limited","country":"Singapore","country_code":"SG"},"is_navigation_request":false,"resource_type":"other","requested_by":"https://bluewhaleusen.com/","date":"2025-12-20T07:01:28.029Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"bluewhaleusen.com","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Fri, 19 Dec 2025 05:22:57 GMT","end":"Thu, 19 Mar 2026 05:22:56 GMT"},"fingerprint":{"sha1":"23:4C:94:04:E1:25:E0:EA:D1:85:17:4C:09:FC:E0:DA:D0:01:E6:62","sha256":"AC:EF:45:40:E0:37:3A:BD:B9:C9:32:F5:6B:B1:B8:92:BE:33:89:43:FA:25:17:17:7C:CA:50:4E:0B:CD:25:EB"}}},"request":{"raw":"GET /js/chunk-c1e03a3e.4d2e0816.js HTTP/1.1\r\nHost: bluewhaleusen.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nX-Moz: prefetch\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Sat, 20 Dec 2025 07:01:28 GMT\r\ncontent-type: application/javascript\r\nvary: Accept-Encoding\r\netag: W/\"27717-1766123972321\"\r\nlast-modified: Fri, 19 Dec 2025 05:59:32 GMT\r\nstrict-transport-security: max-age=31536000\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":27717,"size_decoded":0,"mime_type":"application/javascript","magic":"JavaScript source, Unicode text, UTF-8 text, with very long lines (27675), with no line terminators","md5":"486b56d33fd91538856032fc3e4df7f2","sha1":"18aa44b9fe9656929026a5937e40f85c948cad41","sha256":"0c8702dbf759f9e627a5c1437f1f74cb91a22161efa6901747a67181084d45d1","sha512":"ed4108a35ff994cc61d0095e1bd7cfb2d8a4c6ab6e4d10f5f4006cd7723f467c05ea5a0e97e74b359882a31bfec1f50d817a404e05768710d8dfd47c30586a4c","ssdeep":"384:rtFJ1G5vSct/x5eaveIA6WwQDPqBtlOg5BNK6lRguvwyaP/94GK:RFJ1G5vSgeieT5p7qTnNK6lRguvzaqV","tlshash":"36c2f81a3286246959631fa853df4b09f33260d464264988f3ada1c76f7cd5e30bbb7c","first_seen":"2025-04-08T10:46:39.864867Z","last_seen":"2026-06-06T14:40:04.451587Z","times_seen":150,"resource_available":false,"data":null}},"time_used":329,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":329,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2025-12-20","alert":"Sinkholed","trigger":"bluewhaleusen.com","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2025-12-20","alert":"Sinkholed","trigger":"bluewhaleusen.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2025-12-20","alert":"Phishing Block","trigger":"bluewhaleusen.com","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2025-12-20","alert":"Sinkholed","trigger":"bluewhaleusen.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2025-12-20","alert":"Sinkholed","trigger":"bluewhaleusen.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"bluewhaleusen.com/wap/api/seller!list.action?isRec=1\u0026lang=en","fqdn":"bluewhaleusen.com","domain":"bluewhaleusen.com","tld":"com"},"ip":{"addr":"118.107.9.252","port":443,"asn":152194,"as":"CTG Server Limited","country":"Singapore","country_code":"SG"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"https://bluewhaleusen.com/","date":"2025-12-20T07:01:22.985Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"bluewhaleusen.com","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Fri, 19 Dec 2025 05:22:57 GMT","end":"Thu, 19 Mar 2026 05:22:56 GMT"},"fingerprint":{"sha1":"23:4C:94:04:E1:25:E0:EA:D1:85:17:4C:09:FC:E0:DA:D0:01:E6:62","sha256":"AC:EF:45:40:E0:37:3A:BD:B9:C9:32:F5:6B:B1:B8:92:BE:33:89:43:FA:25:17:17:7C:CA:50:4E:0B:CD:25:EB"}}},"request":{"raw":"POST /wap/api/seller!list.action?isRec=1\u0026lang=en HTTP/1.1\r\nHost: bluewhaleusen.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/json, text/plain, */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nContent-Type: application/x-www-form-urlencoded\r\nOrigin: https://bluewhaleusen.com\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\nContent-Length: 0\r\n\r\n","headers":null,"cookies":null,"method":"POST"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Sat, 20 Dec 2025 07:01:23 GMT\r\ncontent-type: application/json;charset=UTF-8\r\nvary: Accept-Encoding, Origin, Access-Control-Request-Method, Access-Control-Request-Headers\r\naccess-control-allow-origin: *\r\nstrict-transport-security: max-age=31536000\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":12701,"size_decoded":0,"mime_type":"application/json; charset=UTF-8","magic":"JSON text data","md5":"87168da2c94ae17055feac7c5df3daf3","sha1":"8901f4f6e742bfb978eaeeb693ceef986178cfa0","sha256":"20738e7cc52eb6bfe809b2cefa0406fc294295081322ebdaed9ed21fd0696a6b","sha512":"6ea269a5b843c1ef01c15e8232bfab9a745e02ac93369dad0ec601afe55cc4c524b397a1fdd9fed463b92057bcccaeb428b677003e39689dd8ae9f0675f82feb","ssdeep":"192:5qhiuomNuDIp318fnIrIfEdzKwug+IMQBM5iSqBIhZBdXaopP9WR:5qCmqIhYnIaS+IG5BHhhXYR","tlshash":"3b4273852e9c7eb2575d0f536c077e8a80bc129f1d834eb1da8ccf091af4ab5571e524","first_seen":"2025-12-19T18:50:44.0927Z","last_seen":"2025-12-20T07:02:05.114396Z","times_seen":2,"resource_available":false,"data":null}},"time_used":472,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":472,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2025-12-20","alert":"Phishing Block","trigger":"bluewhaleusen.com","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2025-12-20","alert":"Sinkholed","trigger":"bluewhaleusen.com","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2025-12-20","alert":"Sinkholed","trigger":"bluewhaleusen.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2025-12-20","alert":"Sinkholed","trigger":"bluewhaleusen.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2025-12-20","alert":"Sinkholed","trigger":"bluewhaleusen.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"bluewhaleusen.com/wap/api/syspara!getSyspara.action?code=mall_max_goods_number_in_order\u0026lang=en","fqdn":"bluewhaleusen.com","domain":"bluewhaleusen.com","tld":"com"},"ip":{"addr":"118.107.9.252","port":443,"asn":152194,"as":"CTG Server Limited","country":"Singapore","country_code":"SG"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"https://bluewhaleusen.com/","date":"2025-12-20T07:01:22.989Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"bluewhaleusen.com","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Fri, 19 Dec 2025 05:22:57 GMT","end":"Thu, 19 Mar 2026 05:22:56 GMT"},"fingerprint":{"sha1":"23:4C:94:04:E1:25:E0:EA:D1:85:17:4C:09:FC:E0:DA:D0:01:E6:62","sha256":"AC:EF:45:40:E0:37:3A:BD:B9:C9:32:F5:6B:B1:B8:92:BE:33:89:43:FA:25:17:17:7C:CA:50:4E:0B:CD:25:EB"}}},"request":{"raw":"POST /wap/api/syspara!getSyspara.action?code=mall_max_goods_number_in_order\u0026lang=en HTTP/1.1\r\nHost: bluewhaleusen.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/json, text/plain, */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nContent-Type: application/x-www-form-urlencoded\r\nOrigin: https://bluewhaleusen.com\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\nContent-Length: 0\r\n\r\n","headers":null,"cookies":null,"method":"POST"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Sat, 20 Dec 2025 07:01:23 GMT\r\ncontent-type: application/json;charset=UTF-8\r\nvary: Accept-Encoding, Origin, Access-Control-Request-Method, Access-Control-Request-Headers\r\naccess-control-allow-origin: *\r\nstrict-transport-security: max-age=31536000\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":71,"size_decoded":0,"mime_type":"application/json; charset=UTF-8","magic":"JSON text data","md5":"7c4654fa4ff81d11b3c8d322ec628880","sha1":"080c15bfaa6d03e4ccdd092630344aaf1f003c47","sha256":"1f9573c145cceac2e7ec7273293953edd53fd282aca6e50acd9334f59f34a5fa","sha512":"61d2d5a60435f554ef05dcb0e1b1c47875ac6610289e4d3ea66013244a25a7b1b720d3927649ce420575cc00929d9350f519524350066508593ad659aacb79ed","ssdeep":"","tlshash":"b9a012009c155c150c03c244a84d260641c8210246404e180d041928017d43c21000b0","first_seen":"2024-02-19T23:01:28Z","last_seen":"2026-08-11T08:26:52.908725Z","times_seen":5758,"resource_available":false,"data":null}},"time_used":421,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":421,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2025-12-20","alert":"Sinkholed","trigger":"bluewhaleusen.com","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2025-12-20","alert":"Sinkholed","trigger":"bluewhaleusen.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2025-12-20","alert":"Sinkholed","trigger":"bluewhaleusen.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2025-12-20","alert":"Phishing Block","trigger":"bluewhaleusen.com","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2025-12-20","alert":"Sinkholed","trigger":"bluewhaleusen.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"imgtest1.s3.amazonaws.com/type/2023-04-14/a8ed7145-c86e-4506-8da2-b8b27f610db4.jpg","fqdn":"imgtest1.s3.amazonaws.com","domain":"imgtest1.s3.amazonaws.com","tld":"s3.amazonaws.com"},"ip":{"addr":"16.15.207.90","port":443,"asn":14618,"as":"AMAZON-AES","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://bluewhaleusen.com/","date":"2025-12-20T07:01:23.395Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"P256","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.s3.amazonaws.com","organization":""},"issuer":{"commonName":"Amazon RSA 2048 M01","organization":"Amazon"},"validity":{"start":"Fri, 14 Feb 2025 00:00:00 GMT","end":"Sat, 07 Feb 2026 23:59:59 GMT"},"fingerprint":{"sha1":"2E:BA:63:64:95:A8:CE:55:DD:7E:EB:A9:98:83:14:B1:6F:6B:61:69","sha256":"00:D7:0B:CC:1F:82:6B:F6:D9:2E:55:1A:BA:88:38:33:19:09:5B:85:49:41:5E:DA:A1:97:B9:D2:0A:3B:13:52"}}},"request":{"raw":"GET /type/2023-04-14/a8ed7145-c86e-4506-8da2-b8b27f610db4.jpg HTTP/1.1\r\nHost: imgtest1.s3.amazonaws.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nx-amz-id-2: e0zp/CI5/FYgMYheM9heTyaTlDnE2l7a6irlx99ciq2IIPCmSq/gchQhpS9Q//+CIk2olmXi7oAQIVQNODFzCOrPEZKDFDlc\r\nx-amz-request-id: CRNSTJBCK1D9DXS6\r\nDate: Sat, 20 Dec 2025 07:01:25 GMT\r\nLast-Modified: Thu, 23 May 2024 01:50:34 GMT\r\nETag: \"d88ae54a30fed8843621233e2c13698c\"\r\nx-amz-server-side-encryption: AES256\r\nAccept-Ranges: bytes\r\nContent-Type: image/jpeg\r\nContent-Length: 20191\r\nServer: AmazonS3\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Amazon Web Services","description":"Amazon Web Services (AWS) is a comprehensive cloud services platform offering compute power, database storage, content delivery and other functionality.","website":"https://aws.amazon.com/","common_platform_enumeration":"","icon":"Amazon Web Services.svg","categories":["PaaS"]},{"name":"Amazon S3","description":"Amazon S3 or Amazon Simple Storage Service is a service offered by Amazon Web Services (AWS) that provides object storage through a web service interface.","website":"https://aws.amazon.com/s3/","common_platform_enumeration":"","icon":"Amazon S3.svg","categories":["CDN"]}],"data":{"size":20191,"size_decoded":0,"mime_type":"image/jpeg","magic":"JPEG image data, Exif standard: [TIFF image data, little-endian, direntries=0], baseline, precision 8, 500x500, components 3","md5":"d88ae54a30fed8843621233e2c13698c","sha1":"9fa542e8677ab97712a7fdc7e1250e36536ec3a5","sha256":"dbe475f26aed9df934e9dca6ef2115b5d0968f312174dfecb9da3ddd3c9640bf","sha512":"606629525b62e056825a3dfbd8ca45e0f84740cad1cfa79ee8dc3e7a34658e951b3aa72bc8bdf276c294912a38d839dd6c2f864791c9038dc395b7d12d08385f","ssdeep":"384:EUsqD+1BG8DGQZl9Y4PyXpFmx82oEu1W3454xOKeq0ooJRImy+90lh:5V2G8RZHP9oEt3454heq0dRI1flh","tlshash":"fa92d1e1ad0a233de68685f6b7f6e2b304f412919bd19d3b53730c858d88261de396c4","first_seen":"2024-02-11T04:26:46Z","last_seen":"2026-08-11T08:26:52.896229Z","times_seen":9884,"resource_available":false,"data":null}},"time_used":771,"timings":{"blocked":656,"dns":0,"connect":0,"send":0,"wait":114,"receive":1,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"mall-test.s3.amazonaws.com/test/2023-03-28/74320950-831e-4dbb-887e-09fbc2c1b501.jpg","fqdn":"mall-test.s3.amazonaws.com","domain":"mall-test.s3.amazonaws.com","tld":"s3.amazonaws.com"},"ip":{"addr":"3.5.30.74","port":443,"asn":14618,"as":"AMAZON-AES","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://bluewhaleusen.com/","date":"2025-12-20T07:01:24.657Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"P256","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"s3.amazonaws.com","organization":""},"issuer":{"commonName":"Amazon RSA 2048 M01","organization":"Amazon"},"validity":{"start":"Fri, 19 Sep 2025 00:00:00 GMT","end":"Sun, 23 Aug 2026 23:59:59 GMT"},"fingerprint":{"sha1":"48:FD:CD:50:85:6A:51:E7:71:E4:CB:E0:03:81:E1:EC:4E:AD:9E:C7","sha256":"D7:11:81:F4:91:03:0D:C6:A5:DE:8A:EF:AA:58:14:BA:AD:33:B5:11:8B:D5:F0:33:53:8B:AF:49:82:E9:4B:A4"}}},"request":{"raw":"GET /test/2023-03-28/74320950-831e-4dbb-887e-09fbc2c1b501.jpg HTTP/1.1\r\nHost: mall-test.s3.amazonaws.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nx-amz-id-2: d2H8MqrVz0Y9NWSdJTulbpQNBWCKeCtDBy/VfryooutvVOIh77Y8tYhboOve+BNjN7DJC1FwBffU8mq9ryJUiUhZPR5mzZ//\r\nx-amz-request-id: CRNPY1BC4N73TR2Q\r\nDate: Sat, 20 Dec 2025 07:01:25 GMT\r\nLast-Modified: Wed, 22 May 2024 20:50:38 GMT\r\nETag: \"755beb0acc47fd21e538c3b25359b060\"\r\nx-amz-server-side-encryption: AES256\r\nAccept-Ranges: bytes\r\nContent-Type: image/jpeg\r\nContent-Length: 138697\r\nServer: AmazonS3\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Amazon Web Services","description":"Amazon Web Services (AWS) is a comprehensive cloud services platform offering compute power, database storage, content delivery and other functionality.","website":"https://aws.amazon.com/","common_platform_enumeration":"","icon":"Amazon Web Services.svg","categories":["PaaS"]},{"name":"Amazon S3","description":"Amazon S3 or Amazon Simple Storage Service is a service offered by Amazon Web Services (AWS) that provides object storage through a web service interface.","website":"https://aws.amazon.com/s3/","common_platform_enumeration":"","icon":"Amazon S3.svg","categories":["CDN"]}],"data":{"size":138697,"size_decoded":0,"mime_type":"image/jpeg","magic":"JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 1500x1500, components 3","md5":"755beb0acc47fd21e538c3b25359b060","sha1":"3ea9d8c04dc9f72448f2b72802065cca80a98b53","sha256":"9636ca3c7079d5e57d692b66104fd9c53854c54b9c074dc79c974d52fab6fc82","sha512":"9239457347dd2cc3f21401f59280fa233cf0f74d4d47415112e3666210e07410fabee8fd06346880890d5a0fa1211e3d2754bf6c7b83e7fd23e83d8af70cf2d6","ssdeep":"3072:EYIZstVjQOeoAYzeufLqX99sd9JGjY96eDdlswyo102lnkS:ELuBkoAYaKqX99sd9JDQeDd+wPnB","tlshash":"4ad3120e32b8b5bdeded11f0b19970bbbef5e15a4a830e4e1e8b650a57358457c4320e","first_seen":"2024-03-15T18:45:46Z","last_seen":"2026-08-11T08:26:52.957216Z","times_seen":2345,"resource_available":false,"data":null}},"time_used":297,"timings":{"blocked":178,"dns":0,"connect":0,"send":0,"wait":112,"receive":7,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"bluewhaleusen.com/css/chunk-7829c5cc.c6474aa1.css","fqdn":"bluewhaleusen.com","domain":"bluewhaleusen.com","tld":"com"},"ip":{"addr":"118.107.9.252","port":443,"asn":152194,"as":"CTG Server Limited","country":"Singapore","country_code":"SG"},"is_navigation_request":false,"resource_type":"other","requested_by":"https://bluewhaleusen.com/","date":"2025-12-20T07:01:24.990Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"bluewhaleusen.com","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Fri, 19 Dec 2025 05:22:57 GMT","end":"Thu, 19 Mar 2026 05:22:56 GMT"},"fingerprint":{"sha1":"23:4C:94:04:E1:25:E0:EA:D1:85:17:4C:09:FC:E0:DA:D0:01:E6:62","sha256":"AC:EF:45:40:E0:37:3A:BD:B9:C9:32:F5:6B:B1:B8:92:BE:33:89:43:FA:25:17:17:7C:CA:50:4E:0B:CD:25:EB"}}},"request":{"raw":"GET /css/chunk-7829c5cc.c6474aa1.css HTTP/1.1\r\nHost: bluewhaleusen.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nX-Moz: prefetch\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Sat, 20 Dec 2025 07:01:25 GMT\r\ncontent-type: text/css\r\ncontent-length: 242\r\netag: W/\"242-1766123972328\"\r\nlast-modified: Fri, 19 Dec 2025 05:59:32 GMT\r\nstrict-transport-security: max-age=31536000\r\naccept-ranges: bytes\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":242,"size_decoded":0,"mime_type":"text/css","magic":"ASCII text, with no line terminators","md5":"207b8b759b262464712f92d1ae1e37eb","sha1":"7029c92363ea630f095754daf11add091fcb57dd","sha256":"83e8578a1c454c2177dc7c70879f3a2e5e917cb457b060909784e71ddaec84cb","sha512":"7ec9d45d68a15b191ab0ec850c159b6a09cdedeecaa33c45bec5870115ae5717ee8cbdd1c020cdec12987d0705e88b487287e93e72bb2ced89b80fb446516a1b","ssdeep":"","tlshash":"45d0a731b39c5824b527c0dbe6c568c5b6043bb2984974b6edd31f68c887453716834a","first_seen":"2024-02-19T23:01:30Z","last_seen":"2026-06-06T14:40:04.482686Z","times_seen":1462,"resource_available":false,"data":null}},"time_used":327,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":327,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2025-12-20","alert":"Sinkholed","trigger":"bluewhaleusen.com","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2025-12-20","alert":"Sinkholed","trigger":"bluewhaleusen.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2025-12-20","alert":"Sinkholed","trigger":"bluewhaleusen.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2025-12-20","alert":"Sinkholed","trigger":"bluewhaleusen.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2025-12-20","alert":"Phishing Block","trigger":"bluewhaleusen.com","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"mall-test.s3.amazonaws.com/pc/gp/B082Q6RMD4/51LNp4aSxDL._AC_SL1340_.jpg","fqdn":"mall-test.s3.amazonaws.com","domain":"mall-test.s3.amazonaws.com","tld":"s3.amazonaws.com"},"ip":{"addr":"3.5.30.74","port":443,"asn":14618,"as":"AMAZON-AES","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://bluewhaleusen.com/","date":"2025-12-20T07:01:23.448Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"P256","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"s3.amazonaws.com","organization":""},"issuer":{"commonName":"Amazon RSA 2048 M01","organization":"Amazon"},"validity":{"start":"Fri, 19 Sep 2025 00:00:00 GMT","end":"Sun, 23 Aug 2026 23:59:59 GMT"},"fingerprint":{"sha1":"48:FD:CD:50:85:6A:51:E7:71:E4:CB:E0:03:81:E1:EC:4E:AD:9E:C7","sha256":"D7:11:81:F4:91:03:0D:C6:A5:DE:8A:EF:AA:58:14:BA:AD:33:B5:11:8B:D5:F0:33:53:8B:AF:49:82:E9:4B:A4"}}},"request":{"raw":"GET /pc/gp/B082Q6RMD4/51LNp4aSxDL._AC_SL1340_.jpg HTTP/1.1\r\nHost: mall-test.s3.amazonaws.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nx-amz-id-2: CuM04UUb8wj+Wt4MZFoc5gGBf6H1yab4SfJe91CUypsHwPAt9mTG3vhtzivHc3GpRarijid/B5he9GHPK05msgqJ5w2rMwg+\r\nx-amz-request-id: S19ZP2VAWKXBP5QM\r\nDate: Sat, 20 Dec 2025 07:01:24 GMT\r\nLast-Modified: Wed, 22 May 2024 02:54:04 GMT\r\nETag: \"8827b56e1c75a8cfd6be59a5b6d760eb\"\r\nx-amz-server-side-encryption: AES256\r\nx-amz-meta-sha256: f63ce9701ef5941dd9ce6ac432a09e5636f1e0685ede2c4aebb39f96638eec8c\r\nx-amz-meta-s3b-last-modified: 20231026T124940Z\r\nAccept-Ranges: bytes\r\nContent-Type: image/jpeg\r\nContent-Length: 32549\r\nServer: AmazonS3\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Amazon S3","description":"Amazon S3 or Amazon Simple Storage Service is a service offered by Amazon Web Services (AWS) that provides object storage through a web service interface.","website":"https://aws.amazon.com/s3/","common_platform_enumeration":"","icon":"Amazon S3.svg","categories":["CDN"]},{"name":"Amazon Web Services","description":"Amazon Web Services (AWS) is a comprehensive cloud services platform offering compute power, database storage, content delivery and other functionality.","website":"https://aws.amazon.com/","common_platform_enumeration":"","icon":"Amazon Web Services.svg","categories":["PaaS"]}],"data":{"size":32549,"size_decoded":0,"mime_type":"image/jpeg","magic":"JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 431x1340, components 3","md5":"8827b56e1c75a8cfd6be59a5b6d760eb","sha1":"24f3ff786d1c9fe9e787bd9d1977b90aa1d9c3f1","sha256":"f63ce9701ef5941dd9ce6ac432a09e5636f1e0685ede2c4aebb39f96638eec8c","sha512":"233fbb69169772f8a86abc5ea61ae787e1d9b003148430041b7d3e38adf1257e53f1bbb07f31f7893dbda96679864f8d78d9587298deb69013ec2612f7a02d49","ssdeep":"768:dx2GWbs6oBwPJj88PBuMQmJOcjEiKyquTxPOKIjktU:Oe6zPJQ84vcjEinTxGKIjSU","tlshash":"7fe2f10582cbd7d1ed521c7225fb3336df24eb0ea5fad05d3b202b86951ba652683c51","first_seen":"2024-03-15T18:45:45Z","last_seen":"2026-08-11T08:26:52.955408Z","times_seen":2428,"resource_available":false,"data":null}},"time_used":665,"timings":{"blocked":225,"dns":12,"connect":96,"send":0,"wait":119,"receive":94,"ssl":110},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"mall-test.s3.amazonaws.com/test/2023-03-28/ce21709d-d03a-485c-bd1a-0ca3c11840fd.jpg","fqdn":"mall-test.s3.amazonaws.com","domain":"mall-test.s3.amazonaws.com","tld":"s3.amazonaws.com"},"ip":{"addr":"3.5.30.74","port":443,"asn":14618,"as":"AMAZON-AES","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://bluewhaleusen.com/","date":"2025-12-20T07:01:23.621Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_CHACHA20_POLY1305_SHA256","key_group_name":"P256","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"s3.amazonaws.com","organization":""},"issuer":{"commonName":"Amazon RSA 2048 M01","organization":"Amazon"},"validity":{"start":"Fri, 19 Sep 2025 00:00:00 GMT","end":"Sun, 23 Aug 2026 23:59:59 GMT"},"fingerprint":{"sha1":"48:FD:CD:50:85:6A:51:E7:71:E4:CB:E0:03:81:E1:EC:4E:AD:9E:C7","sha256":"D7:11:81:F4:91:03:0D:C6:A5:DE:8A:EF:AA:58:14:BA:AD:33:B5:11:8B:D5:F0:33:53:8B:AF:49:82:E9:4B:A4"}}},"request":{"raw":"GET /test/2023-03-28/ce21709d-d03a-485c-bd1a-0ca3c11840fd.jpg HTTP/1.1\r\nHost: mall-test.s3.amazonaws.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nx-amz-id-2: Z1/DdJQT9Z1BSFI9jKRbC8FULkR+lwmu2HnDx2F0Y4uO2p3QeSueuzdQYpMW96fOFXf3qW5Lxi0QxQzOB0WGjZy8IjIhd7pG\r\nx-amz-request-id: CRNZE6SKCWMS4V2P\r\nDate: Sat, 20 Dec 2025 07:01:25 GMT\r\nLast-Modified: Wed, 22 May 2024 20:53:55 GMT\r\nETag: \"4d6bad8f76dccb096768ff49cc7cf445\"\r\nx-amz-server-side-encryption: AES256\r\nAccept-Ranges: bytes\r\nContent-Type: image/jpeg\r\nContent-Length: 117061\r\nServer: AmazonS3\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Amazon Web Services","description":"Amazon Web Services (AWS) is a comprehensive cloud services platform offering compute power, database storage, content delivery and other functionality.","website":"https://aws.amazon.com/","common_platform_enumeration":"","icon":"Amazon Web Services.svg","categories":["PaaS"]},{"name":"Amazon S3","description":"Amazon S3 or Amazon Simple Storage Service is a service offered by Amazon Web Services (AWS) that provides object storage through a web service interface.","website":"https://aws.amazon.com/s3/","common_platform_enumeration":"","icon":"Amazon S3.svg","categories":["CDN"]}],"data":{"size":117061,"size_decoded":0,"mime_type":"image/jpeg","magic":"JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 1410x1423, components 3","md5":"4d6bad8f76dccb096768ff49cc7cf445","sha1":"de7037cff667ef30de1bfd8e6b7ceec7c69dfc42","sha256":"0d98b6495a5e33454e197017e474fc8e00ea09e9d3e72d6bdb54ee943ed1fb40","sha512":"8bd3d378f9633511746f337bfc2cca32278fdbb5458cb2f7d23d9f3167a6372a172196821b864488d9f30f326785276baa112893754bad58dfd10b15ad0a2cc1","ssdeep":"3072:iypv8tQzm4aYSV7OHP76tr4EbClnokN48XL:iyp0SApOHPsrfbbX8XL","tlshash":"1fb3121b9b295d27e3c7537156210310963cce652895ee3678457f8e3caf3aee88c98c","first_seen":"2024-03-15T18:45:45Z","last_seen":"2026-08-11T08:26:52.960564Z","times_seen":2437,"resource_available":false,"data":null}},"time_used":806,"timings":{"blocked":694,"dns":0,"connect":0,"send":0,"wait":109,"receive":3,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"mall-test.s3.amazonaws.com/pachong/gaoqing/B08HD6SMMY/61Hmfj-ZbBL._AC_SL1000_.jpg","fqdn":"mall-test.s3.amazonaws.com","domain":"mall-test.s3.amazonaws.com","tld":"s3.amazonaws.com"},"ip":{"addr":"3.5.30.74","port":443,"asn":14618,"as":"AMAZON-AES","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://bluewhaleusen.com/","date":"2025-12-20T07:01:23.637Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_CHACHA20_POLY1305_SHA256","key_group_name":"P256","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"s3.amazonaws.com","organization":""},"issuer":{"commonName":"Amazon RSA 2048 M01","organization":"Amazon"},"validity":{"start":"Fri, 19 Sep 2025 00:00:00 GMT","end":"Sun, 23 Aug 2026 23:59:59 GMT"},"fingerprint":{"sha1":"48:FD:CD:50:85:6A:51:E7:71:E4:CB:E0:03:81:E1:EC:4E:AD:9E:C7","sha256":"D7:11:81:F4:91:03:0D:C6:A5:DE:8A:EF:AA:58:14:BA:AD:33:B5:11:8B:D5:F0:33:53:8B:AF:49:82:E9:4B:A4"}}},"request":{"raw":"GET /pachong/gaoqing/B08HD6SMMY/61Hmfj-ZbBL._AC_SL1000_.jpg HTTP/1.1\r\nHost: mall-test.s3.amazonaws.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nx-amz-id-2: zl5iPDTUWf7YTZ+H3aL5EAw96x0ZgTgB3dUkrVm1Au+ev5JdvsLjoJnpfnWxeyyG6BdsV2oyh1taIEJJdQN2a2IXD2M6l+HG\r\nx-amz-request-id: CRNXF1MKD2M9TMT6\r\nDate: Sat, 20 Dec 2025 07:01:25 GMT\r\nLast-Modified: Tue, 21 May 2024 20:59:39 GMT\r\nETag: \"a1734188bf728af1d2bc1d1208e0f770\"\r\nx-amz-server-side-encryption: AES256\r\nx-amz-meta-sha256: 8474ec05ed643c5a71ab1b8e419f23ac2093beaf3a310b98d9b70713795d4c4d\r\nx-amz-meta-s3b-last-modified: 20230412T102755Z\r\nAccept-Ranges: bytes\r\nContent-Type: image/jpeg\r\nContent-Length: 98499\r\nServer: AmazonS3\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Amazon S3","description":"Amazon S3 or Amazon Simple Storage Service is a service offered by Amazon Web Services (AWS) that provides object storage through a web service interface.","website":"https://aws.amazon.com/s3/","common_platform_enumeration":"","icon":"Amazon S3.svg","categories":["CDN"]},{"name":"Amazon Web Services","description":"Amazon Web Services (AWS) is a comprehensive cloud services platform offering compute power, database storage, content delivery and other functionality.","website":"https://aws.amazon.com/","common_platform_enumeration":"","icon":"Amazon Web Services.svg","categories":["PaaS"]}],"data":{"size":98499,"size_decoded":0,"mime_type":"image/jpeg","magic":"JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 1000x1000, components 3","md5":"a1734188bf728af1d2bc1d1208e0f770","sha1":"029eb0c3d5fc7fb25561834526d3d84e90b79997","sha256":"8474ec05ed643c5a71ab1b8e419f23ac2093beaf3a310b98d9b70713795d4c4d","sha512":"1c39aff75617b9d9084fa5f236d558f2628b634588aa3c0d9e3c3ef441e44fc1f6a4949e7f93499d2239e239f075c03a310487538a4462113c9b569dd7637ced","ssdeep":"1536:YciMX0EafziFkAOm13oJcfUeCjvmaFekNsjfl/q7s+QkAVb4QQCwtp:8EaSkAz2yfUNvckNs7o7shd41CU","tlshash":"e4a30268871a5e8bd0a44178355adc417f20b2e9971f217b01f39ffa89b0693f221e5d","first_seen":"2024-03-15T18:45:45Z","last_seen":"2026-08-09T04:44:19.277641Z","times_seen":7289,"resource_available":false,"data":null}},"time_used":913,"timings":{"blocked":790,"dns":0,"connect":0,"send":0,"wait":120,"receive":3,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"bluewhaleusen.com/js/chunk-dea9f6de.9990e491.js","fqdn":"bluewhaleusen.com","domain":"bluewhaleusen.com","tld":"com"},"ip":{"addr":"118.107.9.252","port":443,"asn":152194,"as":"CTG Server Limited","country":"Singapore","country_code":"SG"},"is_navigation_request":false,"resource_type":"other","requested_by":"https://bluewhaleusen.com/","date":"2025-12-20T07:01:28.260Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"bluewhaleusen.com","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Fri, 19 Dec 2025 05:22:57 GMT","end":"Thu, 19 Mar 2026 05:22:56 GMT"},"fingerprint":{"sha1":"23:4C:94:04:E1:25:E0:EA:D1:85:17:4C:09:FC:E0:DA:D0:01:E6:62","sha256":"AC:EF:45:40:E0:37:3A:BD:B9:C9:32:F5:6B:B1:B8:92:BE:33:89:43:FA:25:17:17:7C:CA:50:4E:0B:CD:25:EB"}}},"request":{"raw":"GET /js/chunk-dea9f6de.9990e491.js HTTP/1.1\r\nHost: bluewhaleusen.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nX-Moz: prefetch\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Sat, 20 Dec 2025 07:01:28 GMT\r\ncontent-type: application/javascript\r\nvary: Accept-Encoding\r\netag: W/\"18244-1766123972313\"\r\nlast-modified: Fri, 19 Dec 2025 05:59:32 GMT\r\nstrict-transport-security: max-age=31536000\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":18244,"size_decoded":0,"mime_type":"application/javascript","magic":"JavaScript source, Unicode text, UTF-8 text, with very long lines (18212), with no line terminators","md5":"ef7266018a6d0aec85723b933fd9b7f8","sha1":"d3dde2bb154905fc446521d74e9af3bd4af39e8e","sha256":"661300c3418542bfd2dae006550e4380ed121b89818df442ccff9b9b09f20ed8","sha512":"d0e2e17e7ce1caca39d14c008765b57b123024789c1e9e4981fd6b172fcb4866500306d89bac8e5e75053c1351ebbf3a1a9e1e8896dc491c6302b9a5aa920082","ssdeep":"192:VxJtwDwYwBvpTG25+MOXmj+Ytc8E3Y7nPfYUzRi/ji+3I5qTRiA6aJHz3Jn5stdZ:NtU3wFpGDtmip8WY0OoIYRiA6aJH1i","tlshash":"f382b69ba651b45f0e6776a1309b2403a15862a43c0c9d56f27dc9f633bcc382b17b7e","first_seen":"2025-04-08T10:46:39.885045Z","last_seen":"2026-06-06T14:40:04.305741Z","times_seen":150,"resource_available":false,"data":null}},"time_used":328,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":328,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2025-12-20","alert":"Sinkholed","trigger":"bluewhaleusen.com","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2025-12-20","alert":"Sinkholed","trigger":"bluewhaleusen.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2025-12-20","alert":"Sinkholed","trigger":"bluewhaleusen.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2025-12-20","alert":"Phishing Block","trigger":"bluewhaleusen.com","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2025-12-20","alert":"Sinkholed","trigger":"bluewhaleusen.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"imgtest1.s3.amazonaws.com/type/2023-03-29/b07acf47-c478-464b-b17a-ba9226a7e00e.jpg","fqdn":"imgtest1.s3.amazonaws.com","domain":"imgtest1.s3.amazonaws.com","tld":"s3.amazonaws.com"},"ip":{"addr":"16.15.207.90","port":443,"asn":14618,"as":"AMAZON-AES","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://bluewhaleusen.com/","date":"2025-12-20T07:01:23.387Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"P256","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.s3.amazonaws.com","organization":""},"issuer":{"commonName":"Amazon RSA 2048 M01","organization":"Amazon"},"validity":{"start":"Fri, 14 Feb 2025 00:00:00 GMT","end":"Sat, 07 Feb 2026 23:59:59 GMT"},"fingerprint":{"sha1":"2E:BA:63:64:95:A8:CE:55:DD:7E:EB:A9:98:83:14:B1:6F:6B:61:69","sha256":"00:D7:0B:CC:1F:82:6B:F6:D9:2E:55:1A:BA:88:38:33:19:09:5B:85:49:41:5E:DA:A1:97:B9:D2:0A:3B:13:52"}}},"request":{"raw":"GET /type/2023-03-29/b07acf47-c478-464b-b17a-ba9226a7e00e.jpg HTTP/1.1\r\nHost: imgtest1.s3.amazonaws.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nx-amz-id-2: ZceDAhaNVKPb/BsFNZNd4gTWRvFeS2pAf3Wclv4Zwh2+diq2kL+m4Q5W4wOc9tZh6LHrCw7MN037q6xoagr8x70OnQ0Y9gdv\r\nx-amz-request-id: S19SMH1SY0ZZANDR\r\nDate: Sat, 20 Dec 2025 07:01:24 GMT\r\nLast-Modified: Sun, 01 Sep 2024 17:37:18 GMT\r\nETag: \"3cadf1789eb8f8d80a12e5ad0e19ea67\"\r\nx-amz-server-side-encryption: AES256\r\nAccept-Ranges: bytes\r\nContent-Type: image/jpeg\r\nContent-Length: 26582\r\nServer: AmazonS3\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Amazon S3","description":"Amazon S3 or Amazon Simple Storage Service is a service offered by Amazon Web Services (AWS) that provides object storage through a web service interface.","website":"https://aws.amazon.com/s3/","common_platform_enumeration":"","icon":"Amazon S3.svg","categories":["CDN"]},{"name":"Amazon Web Services","description":"Amazon Web Services (AWS) is a comprehensive cloud services platform offering compute power, database storage, content delivery and other functionality.","website":"https://aws.amazon.com/","common_platform_enumeration":"","icon":"Amazon Web Services.svg","categories":["PaaS"]}],"data":{"size":26582,"size_decoded":0,"mime_type":"image/jpeg","magic":"JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, comment: \"CREATOR: gd-jpeg v1.0 (using IJG JPEG v80), quality = 90\", baseline, precision 8, 500x500, components 3","md5":"3cadf1789eb8f8d80a12e5ad0e19ea67","sha1":"90a7bb2b2bf9588a95f5895d19564e8e0d7a1b01","sha256":"4a1e05ded030983d325fa2a293dffeb39ce70d4948634927f6752dfc6d2f1dbe","sha512":"9236112d6c6dad19ae6b463f258f73caf2470a6f375251a68b7a2f36df53573861a75fe032c86ce6494978e164f514ffcc85e2b20fd04896b014b9a038397a06","ssdeep":"384:G0IuovjpguMrZYtx3ebUIAN+sXub/t4fgq0i9Iun1k2ij4i71P68:G5uoLubd4Ub0AM24ecIGBiHc8","tlshash":"cfc2bf834a448f837859d3ab7f631c408fce49ad85d5b8df11e74243bba673a008e96d","first_seen":"2023-11-07T02:37:41Z","last_seen":"2026-08-11T08:26:52.915956Z","times_seen":9923,"resource_available":false,"data":null}},"time_used":664,"timings":{"blocked":551,"dns":0,"connect":0,"send":0,"wait":111,"receive":2,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"imgtest1.s3.amazonaws.com/type/2023-03-29/d2355e87-0f42-48d3-9924-966b9fd8d2e0.jpg","fqdn":"imgtest1.s3.amazonaws.com","domain":"imgtest1.s3.amazonaws.com","tld":"s3.amazonaws.com"},"ip":{"addr":"16.15.207.90","port":443,"asn":14618,"as":"AMAZON-AES","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://bluewhaleusen.com/","date":"2025-12-20T07:01:23.388Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"P256","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.s3.amazonaws.com","organization":""},"issuer":{"commonName":"Amazon RSA 2048 M01","organization":"Amazon"},"validity":{"start":"Fri, 14 Feb 2025 00:00:00 GMT","end":"Sat, 07 Feb 2026 23:59:59 GMT"},"fingerprint":{"sha1":"2E:BA:63:64:95:A8:CE:55:DD:7E:EB:A9:98:83:14:B1:6F:6B:61:69","sha256":"00:D7:0B:CC:1F:82:6B:F6:D9:2E:55:1A:BA:88:38:33:19:09:5B:85:49:41:5E:DA:A1:97:B9:D2:0A:3B:13:52"}}},"request":{"raw":"GET /type/2023-03-29/d2355e87-0f42-48d3-9924-966b9fd8d2e0.jpg HTTP/1.1\r\nHost: imgtest1.s3.amazonaws.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nx-amz-id-2: bcJAAeE1PE0rGhmWxzrtW3tnB5T/NqTz64x3yFvrxKfFmo6yt8S31Fiz7s9EeTM2nAEMfkFQtTA/eXY2jM+pefCyQwaCqm1T\r\nx-amz-request-id: S19H3EK14EAW3W6Y\r\nDate: Sat, 20 Dec 2025 07:01:24 GMT\r\nLast-Modified: Sun, 01 Sep 2024 17:37:19 GMT\r\nETag: \"3fb702f913ff64c272d67742c3fade6d\"\r\nx-amz-server-side-encryption: AES256\r\nAccept-Ranges: bytes\r\nContent-Type: image/jpeg\r\nContent-Length: 28164\r\nServer: AmazonS3\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Amazon Web Services","description":"Amazon Web Services (AWS) is a comprehensive cloud services platform offering compute power, database storage, content delivery and other functionality.","website":"https://aws.amazon.com/","common_platform_enumeration":"","icon":"Amazon Web Services.svg","categories":["PaaS"]},{"name":"Amazon S3","description":"Amazon S3 or Amazon Simple Storage Service is a service offered by Amazon Web Services (AWS) that provides object storage through a web service interface.","website":"https://aws.amazon.com/s3/","common_platform_enumeration":"","icon":"Amazon S3.svg","categories":["CDN"]}],"data":{"size":28164,"size_decoded":0,"mime_type":"image/jpeg","magic":"JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, comment: \"CREATOR: gd-jpeg v1.0 (using IJG JPEG v80), quality = 90\", baseline, precision 8, 500x500, components 3","md5":"3fb702f913ff64c272d67742c3fade6d","sha1":"9d59af9b1418caaf57ed3f938074958affbdbf5c","sha256":"effe7b76be1c47da3ab9aaf81e6542743506dc40affd341687094417a4feea49","sha512":"1be15380d11c4c57f3ac922aa8d945afa256b4fda813b5254fe3ec2fd8b01fc242c8f9faf79a25245626438240e63d8c68bc1e3dc6c8ae1569b363e28f99c817","ssdeep":"768:GkLEEqGMducsX2FbPZlrPr0YFveH2fzquxgfI:GZXvducmObPZlrPoYkH27hl","tlshash":"3bc2278b59484ed3a46d93e5be970e9c6f453b4ce88229ff10924fd77f202664c4d02b","first_seen":"2023-11-07T02:37:44Z","last_seen":"2026-08-11T08:26:52.95915Z","times_seen":9930,"resource_available":false,"data":null}},"time_used":662,"timings":{"blocked":550,"dns":0,"connect":0,"send":0,"wait":110,"receive":2,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"imgtest1.s3.amazonaws.com/avatar/2023-05-27/bb83d710-d830-40db-a3ea-ad1c84d707d4.png","fqdn":"imgtest1.s3.amazonaws.com","domain":"imgtest1.s3.amazonaws.com","tld":"s3.amazonaws.com"},"ip":{"addr":"16.15.207.90","port":443,"asn":14618,"as":"AMAZON-AES","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://bluewhaleusen.com/","date":"2025-12-20T07:01:24.234Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"P256","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.s3.amazonaws.com","organization":""},"issuer":{"commonName":"Amazon RSA 2048 M01","organization":"Amazon"},"validity":{"start":"Fri, 14 Feb 2025 00:00:00 GMT","end":"Sat, 07 Feb 2026 23:59:59 GMT"},"fingerprint":{"sha1":"2E:BA:63:64:95:A8:CE:55:DD:7E:EB:A9:98:83:14:B1:6F:6B:61:69","sha256":"00:D7:0B:CC:1F:82:6B:F6:D9:2E:55:1A:BA:88:38:33:19:09:5B:85:49:41:5E:DA:A1:97:B9:D2:0A:3B:13:52"}}},"request":{"raw":"GET /avatar/2023-05-27/bb83d710-d830-40db-a3ea-ad1c84d707d4.png HTTP/1.1\r\nHost: imgtest1.s3.amazonaws.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nx-amz-id-2: /4C3yUynYlBSwbYUJ58KoVidjb6H2OfP7CuaYtTboZVTe70Dop9o7N3bBwgriH5So8BesRlTNpIKTqIG1KQzsTbtau9XTTuL\r\nx-amz-request-id: CRNWB6001R12720B\r\nDate: Sat, 20 Dec 2025 07:01:25 GMT\r\nLast-Modified: Thu, 23 May 2024 01:20:56 GMT\r\nETag: \"72fd36f0d2f325647f3117410aec1dd6\"\r\nx-amz-server-side-encryption: AES256\r\nAccept-Ranges: bytes\r\nContent-Type: image/png\r\nContent-Length: 14021\r\nServer: AmazonS3\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Amazon Web Services","description":"Amazon Web Services (AWS) is a comprehensive cloud services platform offering compute power, database storage, content delivery and other functionality.","website":"https://aws.amazon.com/","common_platform_enumeration":"","icon":"Amazon Web Services.svg","categories":["PaaS"]},{"name":"Amazon S3","description":"Amazon S3 or Amazon Simple Storage Service is a service offered by Amazon Web Services (AWS) that provides object storage through a web service interface.","website":"https://aws.amazon.com/s3/","common_platform_enumeration":"","icon":"Amazon S3.svg","categories":["CDN"]}],"data":{"size":14021,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 1024 x 1024, 8-bit colormap, non-interlaced","md5":"72fd36f0d2f325647f3117410aec1dd6","sha1":"7ee804c2afef0256e666952f16239780acc8de61","sha256":"c3041ec54bc45f4d7ac030cf08264a14272459bc059ad82c7e8bf501ee96e9b4","sha512":"1288bf9bb3ef598d80744253b06416d96a58aa89d2be7102dcec88c21f1a8fa36fd72ab9040f27bcaf2f24d1fea44c56ed857493834f5f1581c21883041ad6cd","ssdeep":"384:7T3q3eRuJHzW+tRWfF/Kc2hNCzP13TDTv2VOu68CAvkfChP3b:7TDSqec4hGNDfv2Vr6Csqb","tlshash":"99529d91c740f5f9db8406f629001bb133b62573ba3b2a75b6bb84541d7a7a87304fca","first_seen":"2024-02-19T23:01:28Z","last_seen":"2026-07-06T17:43:37.918653Z","times_seen":2046,"resource_available":false,"data":null}},"time_used":375,"timings":{"blocked":256,"dns":0,"connect":0,"send":0,"wait":119,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"bluewhaleusen.com/wap/api/sellerGoods!recommend_new.action?type=2\u0026pageSize=24\u0026lang=en","fqdn":"bluewhaleusen.com","domain":"bluewhaleusen.com","tld":"com"},"ip":{"addr":"118.107.9.252","port":443,"asn":152194,"as":"CTG Server Limited","country":"Singapore","country_code":"SG"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"https://bluewhaleusen.com/","date":"2025-12-20T07:01:24.272Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"bluewhaleusen.com","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Fri, 19 Dec 2025 05:22:57 GMT","end":"Thu, 19 Mar 2026 05:22:56 GMT"},"fingerprint":{"sha1":"23:4C:94:04:E1:25:E0:EA:D1:85:17:4C:09:FC:E0:DA:D0:01:E6:62","sha256":"AC:EF:45:40:E0:37:3A:BD:B9:C9:32:F5:6B:B1:B8:92:BE:33:89:43:FA:25:17:17:7C:CA:50:4E:0B:CD:25:EB"}}},"request":{"raw":"POST /wap/api/sellerGoods!recommend_new.action?type=2\u0026pageSize=24\u0026lang=en HTTP/1.1\r\nHost: bluewhaleusen.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/json, text/plain, */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nContent-Type: application/x-www-form-urlencoded\r\nOrigin: https://bluewhaleusen.com\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\nContent-Length: 0\r\n\r\n","headers":null,"cookies":null,"method":"POST"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Sat, 20 Dec 2025 07:01:24 GMT\r\ncontent-type: application/json;charset=UTF-8\r\nvary: Accept-Encoding, Origin, Access-Control-Request-Method, Access-Control-Request-Headers\r\naccess-control-allow-origin: *\r\nstrict-transport-security: max-age=31536000\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":126540,"size_decoded":0,"mime_type":"application/json; charset=UTF-8","magic":"JSON text data","md5":"ab8050c50c327b84363614ca5549407b","sha1":"ce27e32decd15d5a11255081209d27f8171f2714","sha256":"d0a7d932d2c5b6b4e7d33845302b490533032805649612ed2e61919f7d4f5da0","sha512":"f92bf882005fd448a40bbedcfc2c41dcb2e7c679ae8815361d142dcd4396ef979616f92de5cd540a49710606be64230ae239edad944982cae7a9929ad9f1a368","ssdeep":"3072:4MGu8dmgfj1jIU4ZARaZ8jb7yHrgjVwPKseZdub/sN7:nG7l4m7qYHB","tlshash":"6ac3e952d7a8926a1e28015544227eaf94fdc217dfb34f88ed2cde34af98cf6761508c","first_seen":"2025-12-19T18:50:43.975762Z","last_seen":"2025-12-20T07:02:05.122025Z","times_seen":2,"resource_available":false,"data":null}},"time_used":371,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":371,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2025-12-20","alert":"Sinkholed","trigger":"bluewhaleusen.com","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2025-12-20","alert":"Sinkholed","trigger":"bluewhaleusen.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2025-12-20","alert":"Phishing Block","trigger":"bluewhaleusen.com","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2025-12-20","alert":"Sinkholed","trigger":"bluewhaleusen.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2025-12-20","alert":"Sinkholed","trigger":"bluewhaleusen.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"mall-test.s3.amazonaws.com/test/2023-03-28/30b476d2-2a51-4c17-a8b4-b57d7df5f00e.jpg","fqdn":"mall-test.s3.amazonaws.com","domain":"mall-test.s3.amazonaws.com","tld":"s3.amazonaws.com"},"ip":{"addr":"3.5.30.74","port":443,"asn":14618,"as":"AMAZON-AES","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://bluewhaleusen.com/","date":"2025-12-20T07:01:24.726Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"P256","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"s3.amazonaws.com","organization":""},"issuer":{"commonName":"Amazon RSA 2048 M01","organization":"Amazon"},"validity":{"start":"Fri, 19 Sep 2025 00:00:00 GMT","end":"Sun, 23 Aug 2026 23:59:59 GMT"},"fingerprint":{"sha1":"48:FD:CD:50:85:6A:51:E7:71:E4:CB:E0:03:81:E1:EC:4E:AD:9E:C7","sha256":"D7:11:81:F4:91:03:0D:C6:A5:DE:8A:EF:AA:58:14:BA:AD:33:B5:11:8B:D5:F0:33:53:8B:AF:49:82:E9:4B:A4"}}},"request":{"raw":"GET /test/2023-03-28/30b476d2-2a51-4c17-a8b4-b57d7df5f00e.jpg HTTP/1.1\r\nHost: mall-test.s3.amazonaws.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nx-amz-id-2: y4orqAgn7jPhfsm1CNlfvhZpXYb59yJH0/2bHKLz4zWIrQh6sqB9c3aDKOkH1wYy/TLBC6HD/ZIlOMH74XpO1pVFG4F+B7Sf\r\nx-amz-request-id: 72KAXSPQM21CEK26\r\nDate: Sat, 20 Dec 2025 07:01:26 GMT\r\nLast-Modified: Wed, 22 May 2024 20:48:12 GMT\r\nETag: \"fde0c1aa02cceddb35ad54b683fbf143\"\r\nx-amz-server-side-encryption: AES256\r\nAccept-Ranges: bytes\r\nContent-Type: image/jpeg\r\nContent-Length: 66684\r\nServer: AmazonS3\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Amazon S3","description":"Amazon S3 or Amazon Simple Storage Service is a service offered by Amazon Web Services (AWS) that provides object storage through a web service interface.","website":"https://aws.amazon.com/s3/","common_platform_enumeration":"","icon":"Amazon S3.svg","categories":["CDN"]},{"name":"Amazon Web Services","description":"Amazon Web Services (AWS) is a comprehensive cloud services platform offering compute power, database storage, content delivery and other functionality.","website":"https://aws.amazon.com/","common_platform_enumeration":"","icon":"Amazon Web Services.svg","categories":["PaaS"]}],"data":{"size":66684,"size_decoded":0,"mime_type":"image/jpeg","magic":"JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 1488x1483, components 3","md5":"fde0c1aa02cceddb35ad54b683fbf143","sha1":"c3f958df892d41c2f9725f70e833c342b0f67f01","sha256":"d21cf0f51f8a537018d4a53b1962ff0c6fde6f637f9fa448f50c60671809c182","sha512":"928ce0eed52eba6e9d64fc73b85fc8f9955eef1f2c122a6df23046d51ad1600e8dad39faa4c07b541033473ed98f6bce2b34a128af735a0f9250a93bdba52930","ssdeep":"1536:CZA9B3wU98oG3+rPg2E0IpEtJVv+iiUB5BgnRVO:qAz3d9fRrYhpEtJVvQyUK","tlshash":"be5302c54b4da98fc3fe13b4611ad9738f82586ff325a84a11458f64613bc662e80cfe","first_seen":"2024-02-19T23:01:29Z","last_seen":"2026-08-09T04:44:19.24965Z","times_seen":6797,"resource_available":false,"data":null}},"time_used":393,"timings":{"blocked":277,"dns":0,"connect":0,"send":0,"wait":114,"receive":2,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"bluewhaleusen.com/js/chunk-8ac79d50.d1fca218.js","fqdn":"bluewhaleusen.com","domain":"bluewhaleusen.com","tld":"com"},"ip":{"addr":"118.107.9.252","port":443,"asn":152194,"as":"CTG Server Limited","country":"Singapore","country_code":"SG"},"is_navigation_request":false,"resource_type":"other","requested_by":"https://bluewhaleusen.com/","date":"2025-12-20T07:01:27.950Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"bluewhaleusen.com","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Fri, 19 Dec 2025 05:22:57 GMT","end":"Thu, 19 Mar 2026 05:22:56 GMT"},"fingerprint":{"sha1":"23:4C:94:04:E1:25:E0:EA:D1:85:17:4C:09:FC:E0:DA:D0:01:E6:62","sha256":"AC:EF:45:40:E0:37:3A:BD:B9:C9:32:F5:6B:B1:B8:92:BE:33:89:43:FA:25:17:17:7C:CA:50:4E:0B:CD:25:EB"}}},"request":{"raw":"GET /js/chunk-8ac79d50.d1fca218.js HTTP/1.1\r\nHost: bluewhaleusen.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nX-Moz: prefetch\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Sat, 20 Dec 2025 07:01:28 GMT\r\ncontent-type: application/javascript\r\nvary: Accept-Encoding\r\netag: W/\"32703-1766123972321\"\r\nlast-modified: Fri, 19 Dec 2025 05:59:32 GMT\r\nstrict-transport-security: max-age=31536000\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":32703,"size_decoded":0,"mime_type":"application/javascript","magic":"JavaScript source, Unicode text, UTF-8 text, with very long lines (32692), with no line terminators","md5":"41c9f4dfba9b8756567b736a0d06c57a","sha1":"9e1a6cc7decfe9a816da02ff78685e86608dacda","sha256":"e218eb9ae2b05ccf922f42d7ed048a5cb8e0eca9f78d4d8a598a259910cee01a","sha512":"800b9c734a258e5eaa03589c886a7f6698fabff64daa993bfdea06f2d63dedefdea986ef17bbb634d8dc311900341f0ce7dbd4f2754781fd40a8558d37cc446b","ssdeep":"384:pnAXzwWQoAU0RNYpFIeqSirBcEw1kyrVTjT0E6RiuXW//f11:Z7h5rBcBhTrJqs1","tlshash":"f3e22c539125f41a5ebb6253316a1496a26429e858089c47f2fccdf633ecc382b1fb7d","first_seen":"2025-04-08T11:27:57.659542Z","last_seen":"2026-06-06T14:40:04.359621Z","times_seen":94,"resource_available":false,"data":null}},"time_used":329,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":329,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2025-12-20","alert":"Sinkholed","trigger":"bluewhaleusen.com","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2025-12-20","alert":"Sinkholed","trigger":"bluewhaleusen.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2025-12-20","alert":"Phishing Block","trigger":"bluewhaleusen.com","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2025-12-20","alert":"Sinkholed","trigger":"bluewhaleusen.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2025-12-20","alert":"Sinkholed","trigger":"bluewhaleusen.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"bluewhaleusen.com/js/chunk-9d964e9e.736cc109.js","fqdn":"bluewhaleusen.com","domain":"bluewhaleusen.com","tld":"com"},"ip":{"addr":"118.107.9.252","port":443,"asn":152194,"as":"CTG Server Limited","country":"Singapore","country_code":"SG"},"is_navigation_request":false,"resource_type":"other","requested_by":"https://bluewhaleusen.com/","date":"2025-12-20T07:01:28.013Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"bluewhaleusen.com","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Fri, 19 Dec 2025 05:22:57 GMT","end":"Thu, 19 Mar 2026 05:22:56 GMT"},"fingerprint":{"sha1":"23:4C:94:04:E1:25:E0:EA:D1:85:17:4C:09:FC:E0:DA:D0:01:E6:62","sha256":"AC:EF:45:40:E0:37:3A:BD:B9:C9:32:F5:6B:B1:B8:92:BE:33:89:43:FA:25:17:17:7C:CA:50:4E:0B:CD:25:EB"}}},"request":{"raw":"GET /js/chunk-9d964e9e.736cc109.js HTTP/1.1\r\nHost: bluewhaleusen.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nX-Moz: prefetch\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Sat, 20 Dec 2025 07:01:28 GMT\r\ncontent-type: application/javascript\r\nvary: Accept-Encoding\r\netag: W/\"11748-1766123972312\"\r\nlast-modified: Fri, 19 Dec 2025 05:59:32 GMT\r\nstrict-transport-security: max-age=31536000\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":11748,"size_decoded":0,"mime_type":"application/javascript","magic":"JavaScript source, Unicode text, UTF-8 text, with very long lines (11718), with no line terminators","md5":"8f95927178d3bddbc93781c785dac00d","sha1":"1b5efd1bdb3d414a06104cc9afd623f5e9607d6a","sha256":"ebea2196a027832a57d109e3e8cd47018fba0ae0d068b99e8a0f8ae2854b43ab","sha512":"3b88d1acd84f41ddd8f1a2942f91a0eb4e9536b1aabc03081341ad61285a9a69ee4326f448dff96287818d2eccd14fc78bce583dcfdddd0b51fd3371fc0245dd","ssdeep":"192:rVthRrXBrmF0USsE/VnwkFiN3i2gv419Il15QtwyO/3a3O56QY3tO/sC4X/5m5Xt:rzX0aUSs8Vwiidgvg9IVt/156f3tO/sG","tlshash":"6932e78c3591bcd90a17b0f1b0ab7496b0968e92540d0542ebf488fa7ebbc5f571372b","first_seen":"2025-04-08T11:27:57.681667Z","last_seen":"2026-06-06T14:40:04.3732Z","times_seen":94,"resource_available":false,"data":null}},"time_used":328,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":328,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2025-12-20","alert":"Sinkholed","trigger":"bluewhaleusen.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2025-12-20","alert":"Sinkholed","trigger":"bluewhaleusen.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2025-12-20","alert":"Sinkholed","trigger":"bluewhaleusen.com","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2025-12-20","alert":"Sinkholed","trigger":"bluewhaleusen.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2025-12-20","alert":"Phishing Block","trigger":"bluewhaleusen.com","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"imgtest1.s3.amazonaws.com/type/2023-03-29/e1158c3f-a786-4374-aab7-3f4dac76589d.jpg","fqdn":"imgtest1.s3.amazonaws.com","domain":"imgtest1.s3.amazonaws.com","tld":"s3.amazonaws.com"},"ip":{"addr":"16.15.207.90","port":443,"asn":14618,"as":"AMAZON-AES","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://bluewhaleusen.com/","date":"2025-12-20T07:01:23.393Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"P256","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.s3.amazonaws.com","organization":""},"issuer":{"commonName":"Amazon RSA 2048 M01","organization":"Amazon"},"validity":{"start":"Fri, 14 Feb 2025 00:00:00 GMT","end":"Sat, 07 Feb 2026 23:59:59 GMT"},"fingerprint":{"sha1":"2E:BA:63:64:95:A8:CE:55:DD:7E:EB:A9:98:83:14:B1:6F:6B:61:69","sha256":"00:D7:0B:CC:1F:82:6B:F6:D9:2E:55:1A:BA:88:38:33:19:09:5B:85:49:41:5E:DA:A1:97:B9:D2:0A:3B:13:52"}}},"request":{"raw":"GET /type/2023-03-29/e1158c3f-a786-4374-aab7-3f4dac76589d.jpg HTTP/1.1\r\nHost: imgtest1.s3.amazonaws.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nx-amz-id-2: TKvADpoY80wWwT9QR/klB5tFEdLDXMAS5F1arsHjfo7/9sUuyFUxRlfh1mlqsPBfp8BaQAk+Uh7Jo0o9gnV0HHqmTOBWy+KO\r\nx-amz-request-id: CRNKZF79BP56RZ5B\r\nDate: Sat, 20 Dec 2025 07:01:25 GMT\r\nLast-Modified: Sun, 01 Sep 2024 17:37:19 GMT\r\nETag: \"dbb5460537325e381060d6a696bdabba\"\r\nx-amz-server-side-encryption: AES256\r\nAccept-Ranges: bytes\r\nContent-Type: image/jpeg\r\nContent-Length: 66319\r\nServer: AmazonS3\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Amazon Web Services","description":"Amazon Web Services (AWS) is a comprehensive cloud services platform offering compute power, database storage, content delivery and other functionality.","website":"https://aws.amazon.com/","common_platform_enumeration":"","icon":"Amazon Web Services.svg","categories":["PaaS"]},{"name":"Amazon S3","description":"Amazon S3 or Amazon Simple Storage Service is a service offered by Amazon Web Services (AWS) that provides object storage through a web service interface.","website":"https://aws.amazon.com/s3/","common_platform_enumeration":"","icon":"Amazon S3.svg","categories":["CDN"]}],"data":{"size":66319,"size_decoded":0,"mime_type":"image/jpeg","magic":"JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, comment: \"CREATOR: gd-jpeg v1.0 (using IJG JPEG v80), quality = 90\", baseline, precision 8, 500x500, components 3","md5":"dbb5460537325e381060d6a696bdabba","sha1":"852c6ea174a0fcdd7e7351b5bc5c1ddc309d87a1","sha256":"3ff029feb7f2d1b0a7bffa8d5060030474f569524abd014585f373a17fc09695","sha512":"404f949ebbad69f94ae8b173c2c1d8807599df69c51675e3b0e06bc0953f94f95a51914abd77bf684dc3c5ff42249defe6152bf148f4aa8c1515fb8d29879374","ssdeep":"1536:Gi+tPxNX6ucnz4Zw7vPYpNuirA5gmQGo1CISuKbKNiI:F+tHKucnz4Zw7vPYxUpPHIS7KNh","tlshash":"cc53d0a31a450fd35629e3e67f0799284fc65b8d94e039ee11d358e37ba13b3680e11e","first_seen":"2023-11-07T02:37:43Z","last_seen":"2026-08-11T08:26:52.922547Z","times_seen":9937,"resource_available":false,"data":null}},"time_used":726,"timings":{"blocked":613,"dns":0,"connect":0,"send":0,"wait":111,"receive":2,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"bluewhaleusen.com/fonts/iconfont.0080bb9b.woff2","fqdn":"bluewhaleusen.com","domain":"bluewhaleusen.com","tld":"com"},"ip":{"addr":"118.107.9.252","port":443,"asn":152194,"as":"CTG Server Limited","country":"Singapore","country_code":"SG"},"is_navigation_request":false,"resource_type":"font","requested_by":"https://bluewhaleusen.com/","date":"2025-12-20T07:01:22.881Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"bluewhaleusen.com","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Fri, 19 Dec 2025 05:22:57 GMT","end":"Thu, 19 Mar 2026 05:22:56 GMT"},"fingerprint":{"sha1":"23:4C:94:04:E1:25:E0:EA:D1:85:17:4C:09:FC:E0:DA:D0:01:E6:62","sha256":"AC:EF:45:40:E0:37:3A:BD:B9:C9:32:F5:6B:B1:B8:92:BE:33:89:43:FA:25:17:17:7C:CA:50:4E:0B:CD:25:EB"}}},"request":{"raw":"GET /fonts/iconfont.0080bb9b.woff2 HTTP/1.1\r\nHost: bluewhaleusen.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: identity\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://bluewhaleusen.com/css/app.c8421c31.css\r\nSec-Fetch-Dest: font\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Sat, 20 Dec 2025 07:01:23 GMT\r\ncontent-type: font/woff2\r\ncontent-length: 5212\r\netag: W/\"5212-1766123972331\"\r\nlast-modified: Fri, 19 Dec 2025 05:59:32 GMT\r\nstrict-transport-security: max-age=31536000\r\naccept-ranges: bytes\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":5212,"size_decoded":0,"mime_type":"font/woff2","magic":"Web Open Font Format (Version 2), TrueType, length 5212, version 1.0","md5":"0080bb9b021fc0823608910adc2e5fdb","sha1":"b03c86fc4fb5e0542122925d2eb2468cdc842dd3","sha256":"a72e9b48fd851011d2e52a77ae7f72b6de42e4647182c7bae3ca49edf3347af4","sha512":"aa68b80986d5ebce07a92a36839e2b7f4365932ac12c992864ebb4a4e49ab9964e39464d9da1b79a0f963947a669176c3f65b23ef4e4203e520a790bfe6b0756","ssdeep":"96:vSvxwJyBbfhD1WrBqAFtlzkqV4tQWGRGQX/rZHhxm9Sy4kUf6:vS5H1p4FtlwqV4tOGQXtBxm9SpkUi","tlshash":"94b18f888c661528cf387a353840367dc9a3130db636e49acae41f1b57ab78a0159761","first_seen":"2024-02-11T04:26:44Z","last_seen":"2026-08-11T08:26:52.962465Z","times_seen":8160,"resource_available":false,"data":null}},"time_used":327,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":327,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2025-12-20","alert":"Sinkholed","trigger":"bluewhaleusen.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2025-12-20","alert":"Sinkholed","trigger":"bluewhaleusen.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2025-12-20","alert":"Sinkholed","trigger":"bluewhaleusen.com","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2025-12-20","alert":"Sinkholed","trigger":"bluewhaleusen.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2025-12-20","alert":"Phishing Block","trigger":"bluewhaleusen.com","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"bluewhaleusen.com/wap/api/category!recommend.action?\u0026pageSize=50\u0026pageNum=1\u0026lang=en","fqdn":"bluewhaleusen.com","domain":"bluewhaleusen.com","tld":"com"},"ip":{"addr":"118.107.9.252","port":443,"asn":152194,"as":"CTG Server Limited","country":"Singapore","country_code":"SG"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"https://bluewhaleusen.com/","date":"2025-12-20T07:01:22.978Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"bluewhaleusen.com","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Fri, 19 Dec 2025 05:22:57 GMT","end":"Thu, 19 Mar 2026 05:22:56 GMT"},"fingerprint":{"sha1":"23:4C:94:04:E1:25:E0:EA:D1:85:17:4C:09:FC:E0:DA:D0:01:E6:62","sha256":"AC:EF:45:40:E0:37:3A:BD:B9:C9:32:F5:6B:B1:B8:92:BE:33:89:43:FA:25:17:17:7C:CA:50:4E:0B:CD:25:EB"}}},"request":{"raw":"POST /wap/api/category!recommend.action?\u0026pageSize=50\u0026pageNum=1\u0026lang=en HTTP/1.1\r\nHost: bluewhaleusen.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/json, text/plain, */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nContent-Type: application/x-www-form-urlencoded\r\nOrigin: https://bluewhaleusen.com\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\nContent-Length: 0\r\n\r\n","headers":null,"cookies":null,"method":"POST"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Sat, 20 Dec 2025 07:01:23 GMT\r\ncontent-type: application/json;charset=UTF-8\r\nvary: Accept-Encoding, Origin, Access-Control-Request-Method, Access-Control-Request-Headers\r\naccess-control-allow-origin: *\r\nstrict-transport-security: max-age=31536000\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":7436,"size_decoded":0,"mime_type":"application/json; charset=UTF-8","magic":"JSON text data","md5":"ac1a4afa6b1fc8b3164a0f8af7f0ced9","sha1":"c46ac122e6d656545e4ea951c9b7db78619469c3","sha256":"bcba5451d77015d7f06d6b5f56d5bbec1cca0bf075a622fedc7dd625fb75e26d","sha512":"1ed5137ce4378a52f894821bb78f3c4d22a8158abc87a16613573c92026c5e317f3f499515a2401c279ebd1aa82c43b034b9a55598c093702c71c11d7110f539","ssdeep":"192:5VsNdzoHaIDsGJTN1o1xzvxVRbQKgDCU70NUbcxhYuI3PnU7xG60gkAxpHPUL4CU:5VcF4DBm1hvPQmU7YTxhKU7s60RAszUN","tlshash":"b7e174a9ffe83c6d4b8486d1168725cfe4a0e03b9fd70ec604fdde448aa676a057c164","first_seen":"2025-12-19T18:50:43.965059Z","last_seen":"2025-12-20T07:02:05.126293Z","times_seen":2,"resource_available":false,"data":null}},"time_used":332,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":332,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2025-12-20","alert":"Sinkholed","trigger":"bluewhaleusen.com","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2025-12-20","alert":"Sinkholed","trigger":"bluewhaleusen.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2025-12-20","alert":"Phishing Block","trigger":"bluewhaleusen.com","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2025-12-20","alert":"Sinkholed","trigger":"bluewhaleusen.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2025-12-20","alert":"Sinkholed","trigger":"bluewhaleusen.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"imgtest1.s3.amazonaws.com/type/2023-04-14/d26d36b6-6435-4071-a1ed-647cf4e9214b.png","fqdn":"imgtest1.s3.amazonaws.com","domain":"imgtest1.s3.amazonaws.com","tld":"s3.amazonaws.com"},"ip":{"addr":"16.15.207.90","port":443,"asn":14618,"as":"AMAZON-AES","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://bluewhaleusen.com/","date":"2025-12-20T07:01:23.352Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"P256","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.s3.amazonaws.com","organization":""},"issuer":{"commonName":"Amazon RSA 2048 M01","organization":"Amazon"},"validity":{"start":"Fri, 14 Feb 2025 00:00:00 GMT","end":"Sat, 07 Feb 2026 23:59:59 GMT"},"fingerprint":{"sha1":"2E:BA:63:64:95:A8:CE:55:DD:7E:EB:A9:98:83:14:B1:6F:6B:61:69","sha256":"00:D7:0B:CC:1F:82:6B:F6:D9:2E:55:1A:BA:88:38:33:19:09:5B:85:49:41:5E:DA:A1:97:B9:D2:0A:3B:13:52"}}},"request":{"raw":"GET /type/2023-04-14/d26d36b6-6435-4071-a1ed-647cf4e9214b.png HTTP/1.1\r\nHost: imgtest1.s3.amazonaws.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nx-amz-id-2: SVJCNUO8zq+8M5O/F3qyULQuPC6byMHfYTiyoFf6cKeeAKQFEWjbv0Trhqvgh+YwztxNfyzvl1JI2G7MLI7edFGgc3xdusOI\r\nx-amz-request-id: CRNSTJV6MX5JK7B4\r\nDate: Sat, 20 Dec 2025 07:01:25 GMT\r\nLast-Modified: Thu, 23 May 2024 01:50:34 GMT\r\nETag: \"60e10d77ebe5877fc1c9385748e2cf72\"\r\nx-amz-server-side-encryption: AES256\r\nAccept-Ranges: bytes\r\nContent-Type: image/png\r\nContent-Length: 180465\r\nServer: AmazonS3\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Amazon S3","description":"Amazon S3 or Amazon Simple Storage Service is a service offered by Amazon Web Services (AWS) that provides object storage through a web service interface.","website":"https://aws.amazon.com/s3/","common_platform_enumeration":"","icon":"Amazon S3.svg","categories":["CDN"]},{"name":"Amazon Web Services","description":"Amazon Web Services (AWS) is a comprehensive cloud services platform offering compute power, database storage, content delivery and other functionality.","website":"https://aws.amazon.com/","common_platform_enumeration":"","icon":"Amazon Web Services.svg","categories":["PaaS"]}],"data":{"size":180465,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 500 x 500, 8-bit/color RGBA, non-interlaced","md5":"60e10d77ebe5877fc1c9385748e2cf72","sha1":"77082da3f7af090dbcf9ac692bf2ba4e0d699aec","sha256":"f1343ddaa389f3aca6568d15637793f510925e7f88d13a6ff93591a326a66c48","sha512":"1a4999d20713081b41425f1f82ed3e7b5003e8f7024b18986a6f1e759e0cc797f7a0003c2d0e208d14261df253681ebe2795836541ff4ebb82b8763fbe5ce182","ssdeep":"3072:TrvxlqyFWPMUAy9v42Jxd3BDRnD748ezoCrW4rlfBoKamBYuWhNJwhi1nkx:Tr5AxXZvDJH3bnn7etB5fxzYhJb1nu","tlshash":"ca041269530c763929af82bccfdac921eff0210d0a74d75911cbf8e90a7a0bb91f2515","first_seen":"2024-02-11T04:26:49Z","last_seen":"2026-08-11T08:26:52.954315Z","times_seen":9688,"resource_available":false,"data":null}},"time_used":1107,"timings":{"blocked":-1,"dns":2,"connect":94,"send":0,"wait":120,"receive":284,"ssl":602},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"mall-test.s3.amazonaws.com/test/2023-03-28/60a1fbda-8b7a-4e10-8330-6b90300f8177.jpg","fqdn":"mall-test.s3.amazonaws.com","domain":"mall-test.s3.amazonaws.com","tld":"s3.amazonaws.com"},"ip":{"addr":"3.5.30.74","port":443,"asn":14618,"as":"AMAZON-AES","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://bluewhaleusen.com/","date":"2025-12-20T07:01:23.460Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"P256","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"s3.amazonaws.com","organization":""},"issuer":{"commonName":"Amazon RSA 2048 M01","organization":"Amazon"},"validity":{"start":"Fri, 19 Sep 2025 00:00:00 GMT","end":"Sun, 23 Aug 2026 23:59:59 GMT"},"fingerprint":{"sha1":"48:FD:CD:50:85:6A:51:E7:71:E4:CB:E0:03:81:E1:EC:4E:AD:9E:C7","sha256":"D7:11:81:F4:91:03:0D:C6:A5:DE:8A:EF:AA:58:14:BA:AD:33:B5:11:8B:D5:F0:33:53:8B:AF:49:82:E9:4B:A4"}}},"request":{"raw":"GET /test/2023-03-28/60a1fbda-8b7a-4e10-8330-6b90300f8177.jpg HTTP/1.1\r\nHost: mall-test.s3.amazonaws.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nx-amz-id-2: gSDAAZ7/9i6994bCEcHm9K23fKW19/NA+ka6u4UlH2ntxXWMxbqKuhhjEuQqkNvF56juZ0+4h5jPDP1jsAFJeWQZaFkL7Y4s\r\nx-amz-request-id: S19K2TWR5BAW7H5C\r\nDate: Sat, 20 Dec 2025 07:01:24 GMT\r\nLast-Modified: Wed, 22 May 2024 20:49:55 GMT\r\nETag: \"6c940aad2dc2544cd2897468bb9fd97e\"\r\nx-amz-server-side-encryption: AES256\r\nAccept-Ranges: bytes\r\nContent-Type: image/jpeg\r\nContent-Length: 68214\r\nServer: AmazonS3\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Amazon Web Services","description":"Amazon Web Services (AWS) is a comprehensive cloud services platform offering compute power, database storage, content delivery and other functionality.","website":"https://aws.amazon.com/","common_platform_enumeration":"","icon":"Amazon Web Services.svg","categories":["PaaS"]},{"name":"Amazon S3","description":"Amazon S3 or Amazon Simple Storage Service is a service offered by Amazon Web Services (AWS) that provides object storage through a web service interface.","website":"https://aws.amazon.com/s3/","common_platform_enumeration":"","icon":"Amazon S3.svg","categories":["CDN"]}],"data":{"size":68214,"size_decoded":0,"mime_type":"image/jpeg","magic":"JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 1500x1402, components 3","md5":"6c940aad2dc2544cd2897468bb9fd97e","sha1":"f72f714028b0db42c1ceadeb3bc0778347189736","sha256":"830c5b0169830cac824ae8d0298c5072a7c9c3e1ee9842303d5999480581c0c7","sha512":"e72e299e873c5e0388d40d8d18826cf5ebe692ba77e5b690e971d83a9b09a19bfb971c15f340e0aa723d50348c1dec3fd3ba62e25d0d4391192a3021244ea183","ssdeep":"1536:0o2PzgSD6MwWin41mI5QZahL+96BlxtYjTa0Kb0of:WD6BV4xuaI92YjTZKQof","tlshash":"80630291e1b0c897e821c7ba60407063f565cfa9f550dacbf36a49a4b2a1f450f2ddd1","first_seen":"2024-02-19T23:01:28Z","last_seen":"2026-08-09T04:44:19.228212Z","times_seen":7525,"resource_available":false,"data":null}},"time_used":656,"timings":{"blocked":426,"dns":0,"connect":0,"send":0,"wait":135,"receive":95,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"imgtest1.s3.amazonaws.com/selle/2023-11-06/e2e57f13-bf6d-48e0-be0a-1a881b082e8c.jpg","fqdn":"imgtest1.s3.amazonaws.com","domain":"imgtest1.s3.amazonaws.com","tld":"s3.amazonaws.com"},"ip":{"addr":"16.15.207.90","port":443,"asn":14618,"as":"AMAZON-AES","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://bluewhaleusen.com/","date":"2025-12-20T07:01:24.231Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"P256","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.s3.amazonaws.com","organization":""},"issuer":{"commonName":"Amazon RSA 2048 M01","organization":"Amazon"},"validity":{"start":"Fri, 14 Feb 2025 00:00:00 GMT","end":"Sat, 07 Feb 2026 23:59:59 GMT"},"fingerprint":{"sha1":"2E:BA:63:64:95:A8:CE:55:DD:7E:EB:A9:98:83:14:B1:6F:6B:61:69","sha256":"00:D7:0B:CC:1F:82:6B:F6:D9:2E:55:1A:BA:88:38:33:19:09:5B:85:49:41:5E:DA:A1:97:B9:D2:0A:3B:13:52"}}},"request":{"raw":"GET /selle/2023-11-06/e2e57f13-bf6d-48e0-be0a-1a881b082e8c.jpg HTTP/1.1\r\nHost: imgtest1.s3.amazonaws.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nx-amz-id-2: XvEmo9lvG0T2Ixj6OncYRrLnRF9siS1tpTA5nbr+4QdBySmTan/21DADsetk053+Bdz3yk2QvSkweeoPCHu5R2Dwsosyl+1e\r\nx-amz-request-id: CRNMXSRX09J15Q14\r\nDate: Sat, 20 Dec 2025 07:01:25 GMT\r\nLast-Modified: Thu, 23 May 2024 01:44:45 GMT\r\nETag: \"292f81f90fe6cd140ff2e3d5ed135a71\"\r\nx-amz-server-side-encryption: AES256\r\nAccept-Ranges: bytes\r\nContent-Type: image/jpeg\r\nContent-Length: 91249\r\nServer: AmazonS3\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Amazon S3","description":"Amazon S3 or Amazon Simple Storage Service is a service offered by Amazon Web Services (AWS) that provides object storage through a web service interface.","website":"https://aws.amazon.com/s3/","common_platform_enumeration":"","icon":"Amazon S3.svg","categories":["CDN"]},{"name":"Amazon Web Services","description":"Amazon Web Services (AWS) is a comprehensive cloud services platform offering compute power, database storage, content delivery and other functionality.","website":"https://aws.amazon.com/","common_platform_enumeration":"","icon":"Amazon Web Services.svg","categories":["PaaS"]}],"data":{"size":91249,"size_decoded":0,"mime_type":"image/jpeg","magic":"JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, progressive, precision 8, 1078x774, components 3","md5":"292f81f90fe6cd140ff2e3d5ed135a71","sha1":"0f4330a32fd09325d535bfeb90e423a3ee421f44","sha256":"d88ba58bbf925231866abf29db5bee81900e5e7cdb49cca4509264528a7ee976","sha512":"ae6a21497015b12bf1b99dc4301fef11d5616d40ec3e1f4d12a011a89d59c7824ee3dc00d5963a78099f598ef715fd4389ce4bf9b23dbbbcfe1ba317a513c9de","ssdeep":"1536:Lnembrn6M4ZkHJgptZaGEISdc9sth3ZtAMOxh3W75UCerd:Lnembrn6M4ZcJI40Se9s3AMOn3W75eZ","tlshash":"4f93e2c532615903d39d4b7a1e8912d21210ff7d21c2497be9d64d2f2e9da736a80cdf","first_seen":"2024-05-25T22:56:10Z","last_seen":"2026-08-11T08:26:52.909341Z","times_seen":870,"resource_available":false,"data":null}},"time_used":366,"timings":{"blocked":243,"dns":0,"connect":0,"send":0,"wait":120,"receive":3,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"bluewhaleusen.com/css/chunk-47e41fee.0e701f5c.css","fqdn":"bluewhaleusen.com","domain":"bluewhaleusen.com","tld":"com"},"ip":{"addr":"118.107.9.252","port":443,"asn":152194,"as":"CTG Server Limited","country":"Singapore","country_code":"SG"},"is_navigation_request":false,"resource_type":"other","requested_by":"https://bluewhaleusen.com/","date":"2025-12-20T07:01:24.621Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"bluewhaleusen.com","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Fri, 19 Dec 2025 05:22:57 GMT","end":"Thu, 19 Mar 2026 05:22:56 GMT"},"fingerprint":{"sha1":"23:4C:94:04:E1:25:E0:EA:D1:85:17:4C:09:FC:E0:DA:D0:01:E6:62","sha256":"AC:EF:45:40:E0:37:3A:BD:B9:C9:32:F5:6B:B1:B8:92:BE:33:89:43:FA:25:17:17:7C:CA:50:4E:0B:CD:25:EB"}}},"request":{"raw":"GET /css/chunk-47e41fee.0e701f5c.css HTTP/1.1\r\nHost: bluewhaleusen.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nX-Moz: prefetch\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Sat, 20 Dec 2025 07:01:24 GMT\r\ncontent-type: text/css\r\nvary: Accept-Encoding\r\netag: W/\"2911-1766123972327\"\r\nlast-modified: Fri, 19 Dec 2025 05:59:32 GMT\r\nstrict-transport-security: max-age=31536000\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":2911,"size_decoded":0,"mime_type":"text/css","magic":"ASCII text, with very long lines (2911), with no line terminators","md5":"ccea655bea4bc170e3aaa0f2f26510ee","sha1":"1259c05c03dfc98dc7f24d470689316ce0bd9141","sha256":"0417838141e75f770427672acfbbaf935e495175cc8431d1a95ff1853902dcf7","sha512":"861aaec4e19464a7f373e1627ff2e2e21060a291d64b39290946344f1ddd72d89cbfcec2245f553ff1933023db5dc0d95c6374859c8eb768c69e9a3220c8afff","ssdeep":"","tlshash":"e851d0523a4d7619913bf2a8f5c1bd8c32a0b1679353d2079ecf5c199cabfc2352da48","first_seen":"2024-03-15T18:45:47Z","last_seen":"2026-06-06T14:40:04.504296Z","times_seen":1032,"resource_available":false,"data":null}},"time_used":327,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":327,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2025-12-20","alert":"Sinkholed","trigger":"bluewhaleusen.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2025-12-20","alert":"Sinkholed","trigger":"bluewhaleusen.com","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2025-12-20","alert":"Phishing Block","trigger":"bluewhaleusen.com","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2025-12-20","alert":"Sinkholed","trigger":"bluewhaleusen.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2025-12-20","alert":"Sinkholed","trigger":"bluewhaleusen.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"bluewhaleusen.com/css/chunk-c842ca02.85ee17e2.css","fqdn":"bluewhaleusen.com","domain":"bluewhaleusen.com","tld":"com"},"ip":{"addr":"118.107.9.252","port":443,"asn":152194,"as":"CTG Server Limited","country":"Singapore","country_code":"SG"},"is_navigation_request":false,"resource_type":"other","requested_by":"https://bluewhaleusen.com/","date":"2025-12-20T07:01:25.649Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"bluewhaleusen.com","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Fri, 19 Dec 2025 05:22:57 GMT","end":"Thu, 19 Mar 2026 05:22:56 GMT"},"fingerprint":{"sha1":"23:4C:94:04:E1:25:E0:EA:D1:85:17:4C:09:FC:E0:DA:D0:01:E6:62","sha256":"AC:EF:45:40:E0:37:3A:BD:B9:C9:32:F5:6B:B1:B8:92:BE:33:89:43:FA:25:17:17:7C:CA:50:4E:0B:CD:25:EB"}}},"request":{"raw":"GET /css/chunk-c842ca02.85ee17e2.css HTTP/1.1\r\nHost: bluewhaleusen.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nX-Moz: prefetch\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Sat, 20 Dec 2025 07:01:25 GMT\r\ncontent-type: text/css\r\ncontent-length: 410\r\netag: W/\"410-1766123972328\"\r\nlast-modified: Fri, 19 Dec 2025 05:59:32 GMT\r\nstrict-transport-security: max-age=31536000\r\naccept-ranges: bytes\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":410,"size_decoded":0,"mime_type":"text/css","magic":"ASCII text, with very long lines (410), with no line terminators","md5":"fc805b781c89c799b666c4fbc4aeb200","sha1":"fd06224fae1c2c2bde5a18ae89ad003e03d5fef3","sha256":"a69b97003c8dfe86e112829516ab7dd637a12b08508d6cb9049741ea93868576","sha512":"2c06b84040f5df4f5486d754fa36dc5acfd67741c94e929f9c94994c1e7e71898c1fb336dc6be4e8568c2bd0c449b0e34e8f392cee6452d08874382a90856bf6","ssdeep":"","tlshash":"09e0a942010a1e2b2563f42ad0820707b665fb37eb42d2409ee00a080f9b30a38383e6","first_seen":"2024-02-11T04:26:47Z","last_seen":"2026-06-06T14:40:04.364867Z","times_seen":6986,"resource_available":false,"data":null}},"time_used":327,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":327,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2025-12-20","alert":"Sinkholed","trigger":"bluewhaleusen.com","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2025-12-20","alert":"Sinkholed","trigger":"bluewhaleusen.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2025-12-20","alert":"Sinkholed","trigger":"bluewhaleusen.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2025-12-20","alert":"Sinkholed","trigger":"bluewhaleusen.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2025-12-20","alert":"Phishing Block","trigger":"bluewhaleusen.com","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"mall-test.s3.amazonaws.com/test/2023-03-28/f70eeeb1-a83c-4724-bd3e-7c6dc72637c1.jpg","fqdn":"mall-test.s3.amazonaws.com","domain":"mall-test.s3.amazonaws.com","tld":"s3.amazonaws.com"},"ip":{"addr":"3.5.30.74","port":443,"asn":14618,"as":"AMAZON-AES","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://bluewhaleusen.com/","date":"2025-12-20T07:01:23.452Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"P256","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"s3.amazonaws.com","organization":""},"issuer":{"commonName":"Amazon RSA 2048 M01","organization":"Amazon"},"validity":{"start":"Fri, 19 Sep 2025 00:00:00 GMT","end":"Sun, 23 Aug 2026 23:59:59 GMT"},"fingerprint":{"sha1":"48:FD:CD:50:85:6A:51:E7:71:E4:CB:E0:03:81:E1:EC:4E:AD:9E:C7","sha256":"D7:11:81:F4:91:03:0D:C6:A5:DE:8A:EF:AA:58:14:BA:AD:33:B5:11:8B:D5:F0:33:53:8B:AF:49:82:E9:4B:A4"}}},"request":{"raw":"GET /test/2023-03-28/f70eeeb1-a83c-4724-bd3e-7c6dc72637c1.jpg HTTP/1.1\r\nHost: mall-test.s3.amazonaws.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nx-amz-id-2: 8k7ilwW7WIg6RwcMRLAFhE2Vrc51ljgxD6uf3XkDbVahnmvsqqYlJmUbYbxJSmiPJwGjGHhnJ5U3m3Z5JpoKCwatoE+xqpw7\r\nx-amz-request-id: S19QQHCTJVTHR9AF\r\nDate: Sat, 20 Dec 2025 07:01:24 GMT\r\nLast-Modified: Wed, 22 May 2024 20:55:25 GMT\r\nETag: \"c37d660217f7d4c257006d2042c09e5e\"\r\nx-amz-server-side-encryption: AES256\r\nAccept-Ranges: bytes\r\nContent-Type: image/jpeg\r\nContent-Length: 53094\r\nServer: AmazonS3\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Amazon S3","description":"Amazon S3 or Amazon Simple Storage Service is a service offered by Amazon Web Services (AWS) that provides object storage through a web service interface.","website":"https://aws.amazon.com/s3/","common_platform_enumeration":"","icon":"Amazon S3.svg","categories":["CDN"]},{"name":"Amazon Web Services","description":"Amazon Web Services (AWS) is a comprehensive cloud services platform offering compute power, database storage, content delivery and other functionality.","website":"https://aws.amazon.com/","common_platform_enumeration":"","icon":"Amazon Web Services.svg","categories":["PaaS"]}],"data":{"size":53094,"size_decoded":0,"mime_type":"image/jpeg","magic":"JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 1326x1393, components 3","md5":"c37d660217f7d4c257006d2042c09e5e","sha1":"ea529657eb74db371f9a05e1c3d720cfd06c11ac","sha256":"ffe20fabb47fca3b0a55a877370f03f6168625efb804473ba88443d0e0513a38","sha512":"e7dea1d699abd674bf433eb4a6896fa8965b448b59361912ed8d587cfe4064471572162570a9080ecf0c20c21161b10507e386fc543116bd3a58e99b788f7a21","ssdeep":"1536:UYC4y9UKjX6lny922L7cDHc93ykbqdhVSbnm:U+kNwy9xfwcskyVInm","tlshash":"f933f18383a0e8d1f1cf6370402c9726e5cae52193f7c3939a1ece057575f997e52494","first_seen":"2024-02-11T04:26:45Z","last_seen":"2026-08-09T04:44:19.195556Z","times_seen":7674,"resource_available":false,"data":null}},"time_used":685,"timings":{"blocked":237,"dns":13,"connect":95,"send":0,"wait":109,"receive":96,"ssl":109},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"bluewhaleusen.com/img/right3.7d93ea42.jpeg","fqdn":"bluewhaleusen.com","domain":"bluewhaleusen.com","tld":"com"},"ip":{"addr":"118.107.9.252","port":443,"asn":152194,"as":"CTG Server Limited","country":"Singapore","country_code":"SG"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://bluewhaleusen.com/","date":"2025-12-20T07:01:24.288Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"bluewhaleusen.com","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Fri, 19 Dec 2025 05:22:57 GMT","end":"Thu, 19 Mar 2026 05:22:56 GMT"},"fingerprint":{"sha1":"23:4C:94:04:E1:25:E0:EA:D1:85:17:4C:09:FC:E0:DA:D0:01:E6:62","sha256":"AC:EF:45:40:E0:37:3A:BD:B9:C9:32:F5:6B:B1:B8:92:BE:33:89:43:FA:25:17:17:7C:CA:50:4E:0B:CD:25:EB"}}},"request":{"raw":"GET /img/right3.7d93ea42.jpeg HTTP/1.1\r\nHost: bluewhaleusen.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Sat, 20 Dec 2025 07:01:24 GMT\r\ncontent-type: image/jpeg\r\nvary: Accept-Encoding\r\netag: W/\"5498-1766123972340\"\r\nlast-modified: Fri, 19 Dec 2025 05:59:32 GMT\r\nstrict-transport-security: max-age=31536000\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":5498,"size_decoded":0,"mime_type":"image/jpeg","magic":"JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 242x154, components 3","md5":"7d93ea42b0f3ec512403c4f5978e034e","sha1":"81ce6087a121e350ec95dab1e386f3804b83cbe1","sha256":"e854f7ceccd5259b486859db7cc270805b11a1762a11f1a74ca43a02bfd2fac9","sha512":"925345e3c5175fbf16314f08470e1191eb4d4a7c33aa15c20ed8d9b78d370effcd49c53f7144b4e0b2428bd0509ca05c83009c41bb42ace995857808ee10415a","ssdeep":"96:Wh4GDfN2qrFHk8A3CrwfOIngvJlMde582vqxe2CjEploBUs3:EZ7XFHk8A39QhDQVoBX","tlshash":"d0b18e9fb6cb3d90f766043be4ca1d5922d67b0614d067fc80a87a0f98bbc714e10868","first_seen":"2024-02-19T23:01:28Z","last_seen":"2026-08-11T08:26:52.904576Z","times_seen":416,"resource_available":false,"data":null}},"time_used":328,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":328,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2025-12-20","alert":"Sinkholed","trigger":"bluewhaleusen.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2025-12-20","alert":"Sinkholed","trigger":"bluewhaleusen.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2025-12-20","alert":"Sinkholed","trigger":"bluewhaleusen.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2025-12-20","alert":"Phishing Block","trigger":"bluewhaleusen.com","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2025-12-20","alert":"Sinkholed","trigger":"bluewhaleusen.com","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"bluewhaleusen.com/img/right4.c4ebbaa9.jpeg","fqdn":"bluewhaleusen.com","domain":"bluewhaleusen.com","tld":"com"},"ip":{"addr":"118.107.9.252","port":443,"asn":152194,"as":"CTG Server Limited","country":"Singapore","country_code":"SG"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://bluewhaleusen.com/","date":"2025-12-20T07:01:24.289Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"bluewhaleusen.com","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Fri, 19 Dec 2025 05:22:57 GMT","end":"Thu, 19 Mar 2026 05:22:56 GMT"},"fingerprint":{"sha1":"23:4C:94:04:E1:25:E0:EA:D1:85:17:4C:09:FC:E0:DA:D0:01:E6:62","sha256":"AC:EF:45:40:E0:37:3A:BD:B9:C9:32:F5:6B:B1:B8:92:BE:33:89:43:FA:25:17:17:7C:CA:50:4E:0B:CD:25:EB"}}},"request":{"raw":"GET /img/right4.c4ebbaa9.jpeg HTTP/1.1\r\nHost: bluewhaleusen.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Sat, 20 Dec 2025 07:01:24 GMT\r\ncontent-type: image/jpeg\r\nvary: Accept-Encoding\r\netag: W/\"4704-1766123972354\"\r\nlast-modified: Fri, 19 Dec 2025 05:59:32 GMT\r\nstrict-transport-security: max-age=31536000\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":4704,"size_decoded":0,"mime_type":"image/jpeg","magic":"JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 242x152, components 3","md5":"c4ebbaa9596cefc52a8ef83be74bddd0","sha1":"c9096ba4316dfecd3256cad10bc3433d830e2891","sha256":"a157b8c76a2827e6e363e939d4ca8fb9766460eddc3e78cdbd6e63bccdd1ebd0","sha512":"d2241a4f50814ec3579576085c9086059508f6b04dea353e9c00ff44168e820cb7f02d967a992f84de12caab31ee46d94509be798bca0d7f4d3be8f9fe81a4ee","ssdeep":"96:Wh+tAid+HAua4Aqt9u4F3DRBfO18AB/x0qaZIPdwR3ODcpOfxukRbnCRTVMfn:E+tJ+gBvEwgRyHSIPmR3OD485hn66","tlshash":"59a17e9bcffa688bff121f7bb124245975810e036a01eaf344014d7ab927c718743596","first_seen":"2024-02-19T23:01:28Z","last_seen":"2026-08-11T08:26:52.970194Z","times_seen":422,"resource_available":false,"data":null}},"time_used":329,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":329,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2025-12-20","alert":"Sinkholed","trigger":"bluewhaleusen.com","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2025-12-20","alert":"Sinkholed","trigger":"bluewhaleusen.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2025-12-20","alert":"Phishing Block","trigger":"bluewhaleusen.com","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2025-12-20","alert":"Sinkholed","trigger":"bluewhaleusen.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2025-12-20","alert":"Sinkholed","trigger":"bluewhaleusen.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"bluewhaleusen.com/js/chunk-7829c5cc.c94c4f87.js","fqdn":"bluewhaleusen.com","domain":"bluewhaleusen.com","tld":"com"},"ip":{"addr":"118.107.9.252","port":443,"asn":152194,"as":"CTG Server Limited","country":"Singapore","country_code":"SG"},"is_navigation_request":false,"resource_type":"other","requested_by":"https://bluewhaleusen.com/","date":"2025-12-20T07:01:27.595Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"bluewhaleusen.com","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Fri, 19 Dec 2025 05:22:57 GMT","end":"Thu, 19 Mar 2026 05:22:56 GMT"},"fingerprint":{"sha1":"23:4C:94:04:E1:25:E0:EA:D1:85:17:4C:09:FC:E0:DA:D0:01:E6:62","sha256":"AC:EF:45:40:E0:37:3A:BD:B9:C9:32:F5:6B:B1:B8:92:BE:33:89:43:FA:25:17:17:7C:CA:50:4E:0B:CD:25:EB"}}},"request":{"raw":"GET /js/chunk-7829c5cc.c94c4f87.js HTTP/1.1\r\nHost: bluewhaleusen.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nX-Moz: prefetch\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Sat, 20 Dec 2025 07:01:27 GMT\r\ncontent-type: application/javascript\r\nvary: Accept-Encoding\r\netag: W/\"9702-1766123972312\"\r\nlast-modified: Fri, 19 Dec 2025 05:59:32 GMT\r\nstrict-transport-security: max-age=31536000\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":9702,"size_decoded":0,"mime_type":"application/javascript","magic":"JavaScript source, Unicode text, UTF-8 text, with very long lines (9552), with no line terminators","md5":"c572811c027ef8b8b559a4ccd33f77f6","sha1":"82eef2523734ba1db4572c79b76e24e6118021ea","sha256":"76ac7efd28f4eb61fe7446791e250dd0cfa5030443a26e6da04d35ca3cbf4fcf","sha512":"5967c640c9c0f4d1a40bd4193e44a092bc264cb99815840e29cbd82d163640d51d220c8e51d71939c28de852fbf74664b7105be8afceb9e0b0784f2d2ce7139e","ssdeep":"96:Z7HSwIt2klMoS6UDERryOur95qpOVMbRn/X61kFGZFSho0dvZTxQ4fApxYD+Q:csqpEERr5up55VMbh/YkFGZFSrdvr7Mi","tlshash":"9c12f98dba51f8de076760da706fb016f29212657c0d1592f2b688f739add1c232372a","first_seen":"2025-04-08T10:46:39.914891Z","last_seen":"2026-06-06T14:40:04.356635Z","times_seen":151,"resource_available":false,"data":null}},"time_used":328,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":328,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2025-12-20","alert":"Phishing Block","trigger":"bluewhaleusen.com","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2025-12-20","alert":"Sinkholed","trigger":"bluewhaleusen.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2025-12-20","alert":"Sinkholed","trigger":"bluewhaleusen.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2025-12-20","alert":"Sinkholed","trigger":"bluewhaleusen.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2025-12-20","alert":"Sinkholed","trigger":"bluewhaleusen.com","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"mall-test.s3.amazonaws.com/test/2023-03-28/3cba5c51-596c-43b4-bb0f-801b2551a36f.jpg","fqdn":"mall-test.s3.amazonaws.com","domain":"mall-test.s3.amazonaws.com","tld":"s3.amazonaws.com"},"ip":{"addr":"3.5.30.74","port":443,"asn":14618,"as":"AMAZON-AES","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://bluewhaleusen.com/","date":"2025-12-20T07:01:23.619Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"P256","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"s3.amazonaws.com","organization":""},"issuer":{"commonName":"Amazon RSA 2048 M01","organization":"Amazon"},"validity":{"start":"Fri, 19 Sep 2025 00:00:00 GMT","end":"Sun, 23 Aug 2026 23:59:59 GMT"},"fingerprint":{"sha1":"48:FD:CD:50:85:6A:51:E7:71:E4:CB:E0:03:81:E1:EC:4E:AD:9E:C7","sha256":"D7:11:81:F4:91:03:0D:C6:A5:DE:8A:EF:AA:58:14:BA:AD:33:B5:11:8B:D5:F0:33:53:8B:AF:49:82:E9:4B:A4"}}},"request":{"raw":"GET /test/2023-03-28/3cba5c51-596c-43b4-bb0f-801b2551a36f.jpg HTTP/1.1\r\nHost: mall-test.s3.amazonaws.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nx-amz-id-2: AWx282YgQfvaYgabM7DsI3ra279Lg3iqYqNfCwGW3+uQqrJiKtfxfZ8BH3atdCqsvfuWDQ7/5qBrM1oXMZMLPY9qiOWR7G+m\r\nx-amz-request-id: CRNRGWFG9B7KH6BW\r\nDate: Sat, 20 Dec 2025 07:01:25 GMT\r\nLast-Modified: Wed, 22 May 2024 20:48:38 GMT\r\nETag: \"d08309c8a906abec10902eb9239abe8c\"\r\nx-amz-server-side-encryption: AES256\r\nAccept-Ranges: bytes\r\nContent-Type: image/jpeg\r\nContent-Length: 96181\r\nServer: AmazonS3\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Amazon S3","description":"Amazon S3 or Amazon Simple Storage Service is a service offered by Amazon Web Services (AWS) that provides object storage through a web service interface.","website":"https://aws.amazon.com/s3/","common_platform_enumeration":"","icon":"Amazon S3.svg","categories":["CDN"]},{"name":"Amazon Web Services","description":"Amazon Web Services (AWS) is a comprehensive cloud services platform offering compute power, database storage, content delivery and other functionality.","website":"https://aws.amazon.com/","common_platform_enumeration":"","icon":"Amazon Web Services.svg","categories":["PaaS"]}],"data":{"size":96181,"size_decoded":0,"mime_type":"image/jpeg","magic":"JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 1339x726, components 3","md5":"d08309c8a906abec10902eb9239abe8c","sha1":"aeda5384b198a7af5ef2e0b674dee8b5c8e9cd19","sha256":"56c0b42a383410b485eea554fc8466494ff737bb0ba87173a3d96078572e767c","sha512":"4a5eed14cffc98e81ee7c0c244ecd0b818e296d0f91384b50f84f6eaba25c4e0d9377123d66cf882eac33ff1cba8abe1666fc2b9be26d2d36bb5f45176b44f66","ssdeep":"1536:8187L7QI5Bqn/gHbTCESOzFpIqtIhH5v9TKWs73I4m7dR34F9ncu:j7QISInlppItH5lu3Gx1WCu","tlshash":"229312964b888a58c07c2a7e84ce130fb9b1ff14b511724b9bc116b87fb74da98ddc51","first_seen":"2024-03-15T18:45:45Z","last_seen":"2026-08-11T08:26:52.891444Z","times_seen":2481,"resource_available":false,"data":null}},"time_used":648,"timings":{"blocked":510,"dns":0,"connect":0,"send":0,"wait":135,"receive":3,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"mall-test.s3.amazonaws.com/test/2023-03-28/24d6b74e-f4eb-44d4-86fc-bba207f24d23.jpg","fqdn":"mall-test.s3.amazonaws.com","domain":"mall-test.s3.amazonaws.com","tld":"s3.amazonaws.com"},"ip":{"addr":"3.5.30.74","port":443,"asn":14618,"as":"AMAZON-AES","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://bluewhaleusen.com/","date":"2025-12-20T07:01:23.651Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"P256","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"s3.amazonaws.com","organization":""},"issuer":{"commonName":"Amazon RSA 2048 M01","organization":"Amazon"},"validity":{"start":"Fri, 19 Sep 2025 00:00:00 GMT","end":"Sun, 23 Aug 2026 23:59:59 GMT"},"fingerprint":{"sha1":"48:FD:CD:50:85:6A:51:E7:71:E4:CB:E0:03:81:E1:EC:4E:AD:9E:C7","sha256":"D7:11:81:F4:91:03:0D:C6:A5:DE:8A:EF:AA:58:14:BA:AD:33:B5:11:8B:D5:F0:33:53:8B:AF:49:82:E9:4B:A4"}}},"request":{"raw":"GET /test/2023-03-28/24d6b74e-f4eb-44d4-86fc-bba207f24d23.jpg HTTP/1.1\r\nHost: mall-test.s3.amazonaws.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nx-amz-id-2: hPxDcb05eLiKcRKy/Nl49lvWNl/uw7D1ecvCy+OdoG959FNeulind4fChWnCDvnXziuyJfou6qFM3yL9p36C0Ek6yU8RBHN/\r\nx-amz-request-id: CRNZHWNBQAHQNVM4\r\nDate: Sat, 20 Dec 2025 07:01:25 GMT\r\nLast-Modified: Wed, 22 May 2024 20:47:46 GMT\r\nETag: \"9be647a74de795386541434285edbd8d\"\r\nx-amz-server-side-encryption: AES256\r\nAccept-Ranges: bytes\r\nContent-Type: image/jpeg\r\nContent-Length: 96163\r\nServer: AmazonS3\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Amazon S3","description":"Amazon S3 or Amazon Simple Storage Service is a service offered by Amazon Web Services (AWS) that provides object storage through a web service interface.","website":"https://aws.amazon.com/s3/","common_platform_enumeration":"","icon":"Amazon S3.svg","categories":["CDN"]},{"name":"Amazon Web Services","description":"Amazon Web Services (AWS) is a comprehensive cloud services platform offering compute power, database storage, content delivery and other functionality.","website":"https://aws.amazon.com/","common_platform_enumeration":"","icon":"Amazon Web Services.svg","categories":["PaaS"]}],"data":{"size":96163,"size_decoded":0,"mime_type":"image/jpeg","magic":"JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 1125x1500, components 3","md5":"9be647a74de795386541434285edbd8d","sha1":"b503f1ec4dcbb115539579fff23d285ec01d8748","sha256":"6947267bc07c27d8485e3a3894124696aa1ba4508f3ceb62fb5f418b95a7fed8","sha512":"2582c3ee33760146f1361c15033d5de58eba750efc02284495aa1b16d07dbe871a87959c2fc5b85588ff2ad53625d22a622638185edbba7e080ae2fb8a97a91c","ssdeep":"1536:EtvRpIwrSu08Tz7lp0RRZhNrJCJbmvU6Vt+CgTVTdJFrqGssfQWkIfYEnDIzclFd:8vRUuhTflpyzCaU6vTgRTJKsQWkwhGct","tlshash":"439312914b80d763ee3d733669b9e7724edb5f260a35812a0f1c080c6dcf992e61e54e","first_seen":"2024-02-19T23:01:29Z","last_seen":"2026-08-09T04:44:19.288878Z","times_seen":7310,"resource_available":false,"data":null}},"time_used":969,"timings":{"blocked":858,"dns":0,"connect":0,"send":0,"wait":108,"receive":3,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"bluewhaleusen.com/css/chunk-8501b9c2.e3d69890.css","fqdn":"bluewhaleusen.com","domain":"bluewhaleusen.com","tld":"com"},"ip":{"addr":"118.107.9.252","port":443,"asn":152194,"as":"CTG Server Limited","country":"Singapore","country_code":"SG"},"is_navigation_request":false,"resource_type":"other","requested_by":"https://bluewhaleusen.com/","date":"2025-12-20T07:01:25.316Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"bluewhaleusen.com","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Fri, 19 Dec 2025 05:22:57 GMT","end":"Thu, 19 Mar 2026 05:22:56 GMT"},"fingerprint":{"sha1":"23:4C:94:04:E1:25:E0:EA:D1:85:17:4C:09:FC:E0:DA:D0:01:E6:62","sha256":"AC:EF:45:40:E0:37:3A:BD:B9:C9:32:F5:6B:B1:B8:92:BE:33:89:43:FA:25:17:17:7C:CA:50:4E:0B:CD:25:EB"}}},"request":{"raw":"GET /css/chunk-8501b9c2.e3d69890.css HTTP/1.1\r\nHost: bluewhaleusen.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nX-Moz: prefetch\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Sat, 20 Dec 2025 07:01:25 GMT\r\ncontent-type: text/css\r\nvary: Accept-Encoding\r\netag: W/\"2934-1766123972328\"\r\nlast-modified: Fri, 19 Dec 2025 05:59:32 GMT\r\nstrict-transport-security: max-age=31536000\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":2934,"size_decoded":0,"mime_type":"text/css","magic":"ASCII text, with very long lines (2934), with no line terminators","md5":"6c9c06504aeaa44eceb02b42501b4d05","sha1":"f44d6b5f35027749a0816164f09b9bed1890ddfa","sha256":"f00be6b0aedab8ac5e7de13774b195a7ea74e9ebb240a077a80f953ce6ee868e","sha512":"915e73c6db5b1607e430494b9064be658f02e64a04af9de8f3c615fc034bcd7fb8dd609a3df2f40ee8f652f430d94fe31e6ae3080ed2c7242c3bb72f6073c923","ssdeep":"","tlshash":"df511fa139392a7c4837e067b1d5d5af70a8f25bc0b786cd8ca1335e9cc32422d126ce","first_seen":"2024-02-19T23:01:29Z","last_seen":"2026-06-06T14:40:04.330347Z","times_seen":964,"resource_available":false,"data":null}},"time_used":326,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":326,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2025-12-20","alert":"Sinkholed","trigger":"bluewhaleusen.com","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2025-12-20","alert":"Sinkholed","trigger":"bluewhaleusen.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2025-12-20","alert":"Sinkholed","trigger":"bluewhaleusen.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2025-12-20","alert":"Phishing Block","trigger":"bluewhaleusen.com","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2025-12-20","alert":"Sinkholed","trigger":"bluewhaleusen.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"bluewhaleusen.com/css/chunk-8ac79d50.badabe5f.css","fqdn":"bluewhaleusen.com","domain":"bluewhaleusen.com","tld":"com"},"ip":{"addr":"118.107.9.252","port":443,"asn":152194,"as":"CTG Server Limited","country":"Singapore","country_code":"SG"},"is_navigation_request":false,"resource_type":"other","requested_by":"https://bluewhaleusen.com/","date":"2025-12-20T07:01:25.594Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"bluewhaleusen.com","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Fri, 19 Dec 2025 05:22:57 GMT","end":"Thu, 19 Mar 2026 05:22:56 GMT"},"fingerprint":{"sha1":"23:4C:94:04:E1:25:E0:EA:D1:85:17:4C:09:FC:E0:DA:D0:01:E6:62","sha256":"AC:EF:45:40:E0:37:3A:BD:B9:C9:32:F5:6B:B1:B8:92:BE:33:89:43:FA:25:17:17:7C:CA:50:4E:0B:CD:25:EB"}}},"request":{"raw":"GET /css/chunk-8ac79d50.badabe5f.css HTTP/1.1\r\nHost: bluewhaleusen.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nX-Moz: prefetch\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Sat, 20 Dec 2025 07:01:25 GMT\r\ncontent-type: text/css\r\nvary: Accept-Encoding\r\netag: W/\"6412-1766123972325\"\r\nlast-modified: Fri, 19 Dec 2025 05:59:32 GMT\r\nstrict-transport-security: max-age=31536000\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":6412,"size_decoded":0,"mime_type":"text/css","magic":"ASCII text, with very long lines (6412), with no line terminators","md5":"0633ee4661855b6bbe621c11916c84cc","sha1":"4c0a2a81e69522697b1cbaa7338158639c4aa12c","sha256":"fac6b26cf761221c13291fbb469530d8d6caecfc22f09faa1a9e562bf15ad127","sha512":"b2441da78e3cf4a5c847805eac6921d852bd2f17db15b012485357a438eb0d41d84c853e8ca0784803fefd8a7315d0426b19bc78f310cb23ca2a9818fa232830","ssdeep":"96:+jWBPlmQKmYqqxrnY1vfqQrFvniDypkpNhD93JlyIqdUPY8:+jGPlmQKd1b8vfqQZiepkpNhh+IqdUg8","tlshash":"90d161b2b5b5426a7d3fe3b822d4e4ac75049551e8629be6fed4d028cbc2ff35410b08","first_seen":"2024-02-11T04:26:50Z","last_seen":"2026-06-06T14:40:04.50503Z","times_seen":5236,"resource_available":false,"data":null}},"time_used":327,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":327,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2025-12-20","alert":"Sinkholed","trigger":"bluewhaleusen.com","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2025-12-20","alert":"Sinkholed","trigger":"bluewhaleusen.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2025-12-20","alert":"Phishing Block","trigger":"bluewhaleusen.com","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2025-12-20","alert":"Sinkholed","trigger":"bluewhaleusen.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2025-12-20","alert":"Sinkholed","trigger":"bluewhaleusen.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"bluewhaleusen.com/","fqdn":"bluewhaleusen.com","domain":"bluewhaleusen.com","tld":"com"},"ip":{"addr":"118.107.9.252","port":443,"asn":152194,"as":"CTG Server Limited","country":"Singapore","country_code":"SG"},"is_navigation_request":true,"resource_type":"document","requested_by":"","date":"2025-12-20T07:01:18.076Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"bluewhaleusen.com","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Fri, 19 Dec 2025 05:22:57 GMT","end":"Thu, 19 Mar 2026 05:22:56 GMT"},"fingerprint":{"sha1":"23:4C:94:04:E1:25:E0:EA:D1:85:17:4C:09:FC:E0:DA:D0:01:E6:62","sha256":"AC:EF:45:40:E0:37:3A:BD:B9:C9:32:F5:6B:B1:B8:92:BE:33:89:43:FA:25:17:17:7C:CA:50:4E:0B:CD:25:EB"}}},"request":{"raw":"GET / HTTP/1.1\r\nHost: bluewhaleusen.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nUpgrade-Insecure-Requests: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: document\r\nSec-Fetch-Mode: navigate\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Sat, 20 Dec 2025 07:01:18 GMT\r\ncontent-type: text/html\r\nvary: Accept-Encoding\r\netag: W/\"7289-1766123972323\"\r\nlast-modified: Fri, 19 Dec 2025 05:59:32 GMT\r\nstrict-transport-security: max-age=31536000\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":7289,"size_decoded":0,"mime_type":"text/html","magic":"HTML document, Unicode text, UTF-8 text, with very long lines (5351)","md5":"a06cc1215c791d39838fa2641a2ec4e5","sha1":"f5991d8ebca061a8970e80d858662863f118aea7","sha256":"8dd91e0924057ec9428b6b392ea526d6853cdae59a276afececfedabdfbfbcd9","sha512":"042b0337c6a3530f83d74944cfa37b8108e97133bff4b937c3e157479a970a4d7d795ad961681b3ea9c896304bc1c8492ca4f549390b938dc840182aa00c4fec","ssdeep":"96:sCckG7+f82tAHhvDYEp2NVNtclFVHBpp7je79cV8mLo97o4:sCcufJt2vDYbNVNtclF5vp7yaV8o4","tlshash":"e0e10eb9da50608fe9f0ce879e69e72beacf8c7b1530e040e258944ecd64fd4512b943","first_seen":"2025-09-22T09:44:07.662247Z","last_seen":"2025-12-20T07:02:05.139515Z","times_seen":9,"resource_available":false,"data":null}},"time_used":1653,"timings":{"blocked":663,"dns":1,"connect":328,"send":0,"wait":327,"receive":0,"ssl":332},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2025-12-20","alert":"Sinkholed","trigger":"bluewhaleusen.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2025-12-20","alert":"Sinkholed","trigger":"bluewhaleusen.com","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2025-12-20","alert":"Phishing Block","trigger":"bluewhaleusen.com","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2025-12-20","alert":"Sinkholed","trigger":"bluewhaleusen.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2025-12-20","alert":"Sinkholed","trigger":"bluewhaleusen.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"imgtest1.s3.amazonaws.com/type/2023-04-14/9f9c23cc-7abd-41ee-a116-01eed9d588a5.jpg","fqdn":"imgtest1.s3.amazonaws.com","domain":"imgtest1.s3.amazonaws.com","tld":"s3.amazonaws.com"},"ip":{"addr":"16.15.207.90","port":443,"asn":14618,"as":"AMAZON-AES","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://bluewhaleusen.com/","date":"2025-12-20T07:01:23.412Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"P256","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.s3.amazonaws.com","organization":""},"issuer":{"commonName":"Amazon RSA 2048 M01","organization":"Amazon"},"validity":{"start":"Fri, 14 Feb 2025 00:00:00 GMT","end":"Sat, 07 Feb 2026 23:59:59 GMT"},"fingerprint":{"sha1":"2E:BA:63:64:95:A8:CE:55:DD:7E:EB:A9:98:83:14:B1:6F:6B:61:69","sha256":"00:D7:0B:CC:1F:82:6B:F6:D9:2E:55:1A:BA:88:38:33:19:09:5B:85:49:41:5E:DA:A1:97:B9:D2:0A:3B:13:52"}}},"request":{"raw":"GET /type/2023-04-14/9f9c23cc-7abd-41ee-a116-01eed9d588a5.jpg HTTP/1.1\r\nHost: imgtest1.s3.amazonaws.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nx-amz-id-2: IBCc4WTAp9aMbzvR9PkcJML6t/craueydKuxsPAaT1lmMMWuo/M+j9HNAwm0Z+vuYxYtC7xk7eF0FrWxnQJWwLW00mXLDYC2\r\nx-amz-request-id: CRNVNVC6XCYP3ESK\r\nDate: Sat, 20 Dec 2025 07:01:25 GMT\r\nLast-Modified: Thu, 23 May 2024 01:50:34 GMT\r\nETag: \"8d6323e7fdd7e06d404af122b2c85f3f\"\r\nx-amz-server-side-encryption: AES256\r\nAccept-Ranges: bytes\r\nContent-Type: image/jpeg\r\nContent-Length: 22652\r\nServer: AmazonS3\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Amazon S3","description":"Amazon S3 or Amazon Simple Storage Service is a service offered by Amazon Web Services (AWS) that provides object storage through a web service interface.","website":"https://aws.amazon.com/s3/","common_platform_enumeration":"","icon":"Amazon S3.svg","categories":["CDN"]},{"name":"Amazon Web Services","description":"Amazon Web Services (AWS) is a comprehensive cloud services platform offering compute power, database storage, content delivery and other functionality.","website":"https://aws.amazon.com/","common_platform_enumeration":"","icon":"Amazon Web Services.svg","categories":["PaaS"]}],"data":{"size":22652,"size_decoded":0,"mime_type":"image/jpeg","magic":"JPEG image data, Exif standard: [TIFF image data, little-endian, direntries=0], baseline, precision 8, 500x500, components 3","md5":"8d6323e7fdd7e06d404af122b2c85f3f","sha1":"a5d01f7b4ad71db23c48fa3f117f7cfcc444e189","sha256":"8e2b0eddf8d540aaa3b2076eefe4ba494c7acabed1f15431bafffe5bd3513f72","sha512":"6fc93fb49c82210ca205c6d6dd0831f9016eb24e3a5fbd5072106d5f2b44adb98d39c7df922da930f53d2cbfc28176810e7f2692011d556155f4785c8b314c19","ssdeep":"384:g1oAebo8+5LM5Y3W9rtPwKbJO5Uq6/ECRgQPifCiN:g1o39+dMmKrtPwUqSyQPmCq","tlshash":"eea2be61f8803733c585636c4cbea112585584f288f9e8aba674cee9f2d4c879c49ce6","first_seen":"2024-02-11T04:26:46Z","last_seen":"2026-08-11T08:26:52.909861Z","times_seen":9870,"resource_available":false,"data":null}},"time_used":816,"timings":{"blocked":694,"dns":0,"connect":0,"send":0,"wait":120,"receive":2,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"imgtest1.s3.amazonaws.com/type/2023-04-14/d8d17705-42b6-4aa5-ae9c-82d7e8cc7bdd.jpg","fqdn":"imgtest1.s3.amazonaws.com","domain":"imgtest1.s3.amazonaws.com","tld":"s3.amazonaws.com"},"ip":{"addr":"16.15.207.90","port":443,"asn":14618,"as":"AMAZON-AES","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://bluewhaleusen.com/","date":"2025-12-20T07:01:23.413Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"P256","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.s3.amazonaws.com","organization":""},"issuer":{"commonName":"Amazon RSA 2048 M01","organization":"Amazon"},"validity":{"start":"Fri, 14 Feb 2025 00:00:00 GMT","end":"Sat, 07 Feb 2026 23:59:59 GMT"},"fingerprint":{"sha1":"2E:BA:63:64:95:A8:CE:55:DD:7E:EB:A9:98:83:14:B1:6F:6B:61:69","sha256":"00:D7:0B:CC:1F:82:6B:F6:D9:2E:55:1A:BA:88:38:33:19:09:5B:85:49:41:5E:DA:A1:97:B9:D2:0A:3B:13:52"}}},"request":{"raw":"GET /type/2023-04-14/d8d17705-42b6-4aa5-ae9c-82d7e8cc7bdd.jpg HTTP/1.1\r\nHost: imgtest1.s3.amazonaws.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nx-amz-id-2: MpXcER+jHptSATK/Fg33hG7W/htj1IhVTBzzCri0q0DjKi+HBjoAHPOqPzF/l2EVsC7oXwSKH7idsW/E2owviBSMnDS0JREv\r\nx-amz-request-id: CRNS4BRXKR4MWE5Q\r\nDate: Sat, 20 Dec 2025 07:01:25 GMT\r\nLast-Modified: Thu, 23 May 2024 01:50:34 GMT\r\nETag: \"1e463b0bfc58cbe93de38ad62f2ac7ee\"\r\nx-amz-server-side-encryption: AES256\r\nAccept-Ranges: bytes\r\nContent-Type: image/jpeg\r\nContent-Length: 21173\r\nServer: AmazonS3\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Amazon S3","description":"Amazon S3 or Amazon Simple Storage Service is a service offered by Amazon Web Services (AWS) that provides object storage through a web service interface.","website":"https://aws.amazon.com/s3/","common_platform_enumeration":"","icon":"Amazon S3.svg","categories":["CDN"]},{"name":"Amazon Web Services","description":"Amazon Web Services (AWS) is a comprehensive cloud services platform offering compute power, database storage, content delivery and other functionality.","website":"https://aws.amazon.com/","common_platform_enumeration":"","icon":"Amazon Web Services.svg","categories":["PaaS"]}],"data":{"size":21173,"size_decoded":0,"mime_type":"image/jpeg","magic":"JPEG image data, Exif standard: [TIFF image data, little-endian, direntries=0], baseline, precision 8, 500x500, components 3","md5":"1e463b0bfc58cbe93de38ad62f2ac7ee","sha1":"ae83334518cc12da8587ae98f78a5dd7de9b7a98","sha256":"de1fc345b3fe2ed5fbac321243e8814cd39a37a5554fa0d6b665284da90a6e28","sha512":"e29d51e79e7609dd12e1477a117b2af83259505557ba520681172019687275acc73b92129559a74a03b0f5fdd649c169f5301acbab3c599515ff1a89c1cc4afc","ssdeep":"384:ADUu/oKRfXu/25fNvZ4ZpZKbPzjApEZWZ7CJTa/kKfwu:96b9fNvZDfAEWjvou","tlshash":"0d92d01ded906352d745e472b7e7daae1d0c09d8a31c98286af1cc0b98363193f774c6","first_seen":"2024-02-11T04:26:46Z","last_seen":"2026-08-11T08:26:52.968252Z","times_seen":9497,"resource_available":false,"data":null}},"time_used":1036,"timings":{"blocked":921,"dns":0,"connect":0,"send":0,"wait":114,"receive":1,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"mall-test.s3.amazonaws.com/pc/gp/B0842PRXT6/61tbbK8RkHL._AC_SL1000_.jpg","fqdn":"mall-test.s3.amazonaws.com","domain":"mall-test.s3.amazonaws.com","tld":"s3.amazonaws.com"},"ip":{"addr":"3.5.30.74","port":443,"asn":14618,"as":"AMAZON-AES","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://bluewhaleusen.com/","date":"2025-12-20T07:01:23.628Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"P256","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"s3.amazonaws.com","organization":""},"issuer":{"commonName":"Amazon RSA 2048 M01","organization":"Amazon"},"validity":{"start":"Fri, 19 Sep 2025 00:00:00 GMT","end":"Sun, 23 Aug 2026 23:59:59 GMT"},"fingerprint":{"sha1":"48:FD:CD:50:85:6A:51:E7:71:E4:CB:E0:03:81:E1:EC:4E:AD:9E:C7","sha256":"D7:11:81:F4:91:03:0D:C6:A5:DE:8A:EF:AA:58:14:BA:AD:33:B5:11:8B:D5:F0:33:53:8B:AF:49:82:E9:4B:A4"}}},"request":{"raw":"GET /pc/gp/B0842PRXT6/61tbbK8RkHL._AC_SL1000_.jpg HTTP/1.1\r\nHost: mall-test.s3.amazonaws.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nx-amz-id-2: fmHqCszxvOBxSq6FF/2yZsiplKFlMbkMnVgUclw+B5y5rDtq3czJ1zHi9bc5D3mpUs33ig6YnbiuMsZPSSublrvkQwFh/VAP\r\nx-amz-request-id: CRNK2CPGQA2MWNDE\r\nDate: Sat, 20 Dec 2025 07:01:25 GMT\r\nLast-Modified: Wed, 22 May 2024 02:59:56 GMT\r\nETag: \"63e2fd337fbf2929ce3fe246e90ba31a\"\r\nx-amz-server-side-encryption: AES256\r\nx-amz-meta-sha256: 2fb50a8c3ba54fbd84dc3342532f989e76ca7540832b7c4931d8ca33db55213c\r\nx-amz-meta-s3b-last-modified: 20231026T124629Z\r\nAccept-Ranges: bytes\r\nContent-Type: image/jpeg\r\nContent-Length: 75594\r\nServer: AmazonS3\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Amazon S3","description":"Amazon S3 or Amazon Simple Storage Service is a service offered by Amazon Web Services (AWS) that provides object storage through a web service interface.","website":"https://aws.amazon.com/s3/","common_platform_enumeration":"","icon":"Amazon S3.svg","categories":["CDN"]},{"name":"Amazon Web Services","description":"Amazon Web Services (AWS) is a comprehensive cloud services platform offering compute power, database storage, content delivery and other functionality.","website":"https://aws.amazon.com/","common_platform_enumeration":"","icon":"Amazon Web Services.svg","categories":["PaaS"]}],"data":{"size":75594,"size_decoded":0,"mime_type":"image/jpeg","magic":"JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 960x687, components 3","md5":"63e2fd337fbf2929ce3fe246e90ba31a","sha1":"bf2750fce56ef9ad51e4a5d8a50abdc336c058c3","sha256":"2fb50a8c3ba54fbd84dc3342532f989e76ca7540832b7c4931d8ca33db55213c","sha512":"64a18a9024eba918294bf2bc6d7ba454fe08f1f1ce6dccf2b30f08dc6d2b0a81eb96f47bfbf99e0a74c50180b9c4b0ed4d657a38da176ba2106c81b49b808e01","ssdeep":"1536:Ub+La/D2TkPb7Jg4T9L9KLKTs2ZWvPA8UJIIZcbV2JUwgrDx1Gxz0:FW20Sgsys2YI87jMJUt1+o","tlshash":"867302b3fbb063b5d52498b121054e29bf939a38f8c09ab3a962873734e4ecc58c5595","first_seen":"2024-03-15T18:45:45Z","last_seen":"2026-08-11T08:26:52.950558Z","times_seen":2269,"resource_available":false,"data":null}},"time_used":824,"timings":{"blocked":701,"dns":0,"connect":0,"send":0,"wait":121,"receive":2,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"bluewhaleusen.com/img/lottery.097412e9.png","fqdn":"bluewhaleusen.com","domain":"bluewhaleusen.com","tld":"com"},"ip":{"addr":"118.107.9.252","port":443,"asn":152194,"as":"CTG Server Limited","country":"Singapore","country_code":"SG"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://bluewhaleusen.com/","date":"2025-12-20T07:01:24.226Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"bluewhaleusen.com","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Fri, 19 Dec 2025 05:22:57 GMT","end":"Thu, 19 Mar 2026 05:22:56 GMT"},"fingerprint":{"sha1":"23:4C:94:04:E1:25:E0:EA:D1:85:17:4C:09:FC:E0:DA:D0:01:E6:62","sha256":"AC:EF:45:40:E0:37:3A:BD:B9:C9:32:F5:6B:B1:B8:92:BE:33:89:43:FA:25:17:17:7C:CA:50:4E:0B:CD:25:EB"}}},"request":{"raw":"GET /img/lottery.097412e9.png HTTP/1.1\r\nHost: bluewhaleusen.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Sat, 20 Dec 2025 07:01:24 GMT\r\ncontent-type: image/png\r\nvary: Accept-Encoding\r\netag: W/\"19141-1766123972343\"\r\nlast-modified: Fri, 19 Dec 2025 05:59:32 GMT\r\nstrict-transport-security: max-age=31536000\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":19141,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 260 x 208, 8-bit colormap, non-interlaced","md5":"097412e9be2f1b4a66d84b9c0f406bc7","sha1":"46512e835ebb6a099099e7788eef3634b43ffa49","sha256":"14bf87fd0722e17e5ddb8cf9ab9642eb5145a884798fe8790cdbfa61549357b9","sha512":"796154cb3df7f3feb9615dfadba89b31855fa587034449d6f880bb3d861d5f6db72e1f629b21ed480d2a6dc7cddcc7d5e2fb288e041452d5f2aff57e3a386b2d","ssdeep":"384:zUGUI9q8FbLgzvgRHeVxV7Ph3Q1d4AtyW3g3BMQtCnk1r:QERFXSvgRHerV7PJAdpxgqQtCnk9","tlshash":"df82d1ea0770dfe1bb60d632aecae0fed8dbefeed1f59914c55124113445202a5350d2","first_seen":"2024-09-28T07:38:18.485402Z","last_seen":"2026-05-27T20:53:28.319934Z","times_seen":46,"resource_available":false,"data":null}},"time_used":345,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":345,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2025-12-20","alert":"Sinkholed","trigger":"bluewhaleusen.com","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2025-12-20","alert":"Sinkholed","trigger":"bluewhaleusen.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2025-12-20","alert":"Phishing Block","trigger":"bluewhaleusen.com","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2025-12-20","alert":"Sinkholed","trigger":"bluewhaleusen.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2025-12-20","alert":"Sinkholed","trigger":"bluewhaleusen.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"bluewhaleusen.com/js/chunk-21f21164.2011c704.js","fqdn":"bluewhaleusen.com","domain":"bluewhaleusen.com","tld":"com"},"ip":{"addr":"118.107.9.252","port":443,"asn":152194,"as":"CTG Server Limited","country":"Singapore","country_code":"SG"},"is_navigation_request":false,"resource_type":"other","requested_by":"https://bluewhaleusen.com/","date":"2025-12-20T07:01:26.304Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"bluewhaleusen.com","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Fri, 19 Dec 2025 05:22:57 GMT","end":"Thu, 19 Mar 2026 05:22:56 GMT"},"fingerprint":{"sha1":"23:4C:94:04:E1:25:E0:EA:D1:85:17:4C:09:FC:E0:DA:D0:01:E6:62","sha256":"AC:EF:45:40:E0:37:3A:BD:B9:C9:32:F5:6B:B1:B8:92:BE:33:89:43:FA:25:17:17:7C:CA:50:4E:0B:CD:25:EB"}}},"request":{"raw":"GET /js/chunk-21f21164.2011c704.js HTTP/1.1\r\nHost: bluewhaleusen.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nX-Moz: prefetch\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Sat, 20 Dec 2025 07:01:26 GMT\r\ncontent-type: application/javascript\r\nvary: Accept-Encoding\r\netag: W/\"12297-1766123972321\"\r\nlast-modified: Fri, 19 Dec 2025 05:59:32 GMT\r\nstrict-transport-security: max-age=31536000\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":12297,"size_decoded":0,"mime_type":"application/javascript","magic":"JavaScript source, Unicode text, UTF-8 text, with very long lines (12265), with no line terminators","md5":"d671effa00366c5014466e8958f70763","sha1":"67db18be91e8fb2756a2222917bd0a7e6adf5110","sha256":"71a93fe68007b617b01845c7de1d5512edf3831a2a49cdecf8c676350429223b","sha512":"9adac0cc164237efa309757781c188e3ebaac2ee8fc3acbe0d1112508f013cad7eb6d582db5c734573a11dfc44431024cdd07cef3392050b3dfaa3133ca8ea46","ssdeep":"192:UBl3gEnnMv9fnS9gHJJhDJ7fNcj1iXcFWq2I5eAW0Tu8M5hHBaSLob:MRnMv9Bp97fNcjVWfc05hq","tlshash":"2e42a60a7153b42e5c6b81a1300e7420b6743fe94805d08abab8ddf977d8c64732efa9","first_seen":"2025-04-08T11:27:57.643054Z","last_seen":"2026-05-31T13:48:58.204968Z","times_seen":97,"resource_available":false,"data":null}},"time_used":327,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":327,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2025-12-20","alert":"Sinkholed","trigger":"bluewhaleusen.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2025-12-20","alert":"Sinkholed","trigger":"bluewhaleusen.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2025-12-20","alert":"Sinkholed","trigger":"bluewhaleusen.com","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2025-12-20","alert":"Phishing Block","trigger":"bluewhaleusen.com","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2025-12-20","alert":"Sinkholed","trigger":"bluewhaleusen.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"bluewhaleusen.com/js/chunk-7537f99d.5f606b93.js","fqdn":"bluewhaleusen.com","domain":"bluewhaleusen.com","tld":"com"},"ip":{"addr":"118.107.9.252","port":443,"asn":152194,"as":"CTG Server Limited","country":"Singapore","country_code":"SG"},"is_navigation_request":false,"resource_type":"other","requested_by":"https://bluewhaleusen.com/","date":"2025-12-20T07:01:27.350Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"bluewhaleusen.com","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Fri, 19 Dec 2025 05:22:57 GMT","end":"Thu, 19 Mar 2026 05:22:56 GMT"},"fingerprint":{"sha1":"23:4C:94:04:E1:25:E0:EA:D1:85:17:4C:09:FC:E0:DA:D0:01:E6:62","sha256":"AC:EF:45:40:E0:37:3A:BD:B9:C9:32:F5:6B:B1:B8:92:BE:33:89:43:FA:25:17:17:7C:CA:50:4E:0B:CD:25:EB"}}},"request":{"raw":"GET /js/chunk-7537f99d.5f606b93.js HTTP/1.1\r\nHost: bluewhaleusen.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nX-Moz: prefetch\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Sat, 20 Dec 2025 07:01:27 GMT\r\ncontent-type: application/javascript\r\nvary: Accept-Encoding\r\netag: W/\"11731-1766123972305\"\r\nlast-modified: Fri, 19 Dec 2025 05:59:32 GMT\r\nstrict-transport-security: max-age=31536000\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":11731,"size_decoded":0,"mime_type":"application/javascript","magic":"JavaScript source, ASCII text, with very long lines (11731), with no line terminators","md5":"643fbc57d025917dea2ae3245964ea9f","sha1":"77d42548ba2c769a097e9dd8f7ee69e3f11d33c8","sha256":"3b1c258f9020256878e569bc189b108429bc52952073c3d523e0323d7ef58b4d","sha512":"bcb69c0b8fbe96cadf3cbe79a6bdb99b615255f0c0c7698263bdea2eb702b5075ce2dff170c6296d75cbb5d93aaeec6a2535945ad22ed4d4fb53b2dc19ec9397","ssdeep":"192:X33sODCMSXc6UJ6gCA95PR90wXEWFs5d24urH6+SVu+4ceN6IrI3O:XnsAKXjUOMZUOEw6j4+4ceNF","tlshash":"e1320a4eb0b6e6f8849b00223006677474717bd5f00859e9b7fcdce85949ea8272b77e","first_seen":"2025-04-08T11:27:57.696377Z","last_seen":"2026-06-06T14:40:04.326933Z","times_seen":61,"resource_available":false,"data":null}},"time_used":329,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":329,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2025-12-20","alert":"Sinkholed","trigger":"bluewhaleusen.com","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2025-12-20","alert":"Sinkholed","trigger":"bluewhaleusen.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2025-12-20","alert":"Phishing Block","trigger":"bluewhaleusen.com","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2025-12-20","alert":"Sinkholed","trigger":"bluewhaleusen.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2025-12-20","alert":"Sinkholed","trigger":"bluewhaleusen.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"bluewhaleusen.com/js/chunk-7ad50525.62f91600.js","fqdn":"bluewhaleusen.com","domain":"bluewhaleusen.com","tld":"com"},"ip":{"addr":"118.107.9.252","port":443,"asn":152194,"as":"CTG Server Limited","country":"Singapore","country_code":"SG"},"is_navigation_request":false,"resource_type":"other","requested_by":"https://bluewhaleusen.com/","date":"2025-12-20T07:01:27.686Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"bluewhaleusen.com","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Fri, 19 Dec 2025 05:22:57 GMT","end":"Thu, 19 Mar 2026 05:22:56 GMT"},"fingerprint":{"sha1":"23:4C:94:04:E1:25:E0:EA:D1:85:17:4C:09:FC:E0:DA:D0:01:E6:62","sha256":"AC:EF:45:40:E0:37:3A:BD:B9:C9:32:F5:6B:B1:B8:92:BE:33:89:43:FA:25:17:17:7C:CA:50:4E:0B:CD:25:EB"}}},"request":{"raw":"GET /js/chunk-7ad50525.62f91600.js HTTP/1.1\r\nHost: bluewhaleusen.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nX-Moz: prefetch\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Sat, 20 Dec 2025 07:01:27 GMT\r\ncontent-type: application/javascript\r\nvary: Accept-Encoding\r\netag: W/\"5317-1766123972323\"\r\nlast-modified: Fri, 19 Dec 2025 05:59:32 GMT\r\nstrict-transport-security: max-age=31536000\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":5317,"size_decoded":0,"mime_type":"application/javascript","magic":"JavaScript source, Unicode text, UTF-8 text, with very long lines (5315), with no line terminators","md5":"24b1aa1d637ee80971d0d5d405a68ab7","sha1":"5e47c60ee23b178bb05a77aa17e0d1e5c44bdbdc","sha256":"b678955a8de297b97376c4e55fb84b3e3a09946547fd50e496cf6b5c337e84e1","sha512":"ab930027ad5e4c47b17b9d93c3eedb8d4e732a44b06e0260c8c75a0db476771bf32340b4d24db05a0dae4e6cf5639d226f535e449a32e70dc33a410778ab7adb","ssdeep":"48:lD58E7P2r0j+WWWgS10+u4jQAF2GB2N5YDWVET/KtLS1gRSpDzwZSkVxUiFN7YEq:l7j+WbsSBkLSoLVYIZ3mmJwQPit8F4R","tlshash":"7fb1c885b043706cc55ba422310e6a75f4a62fb0f401c8aef73ddce49984d14772ebb9","first_seen":"2025-04-08T10:46:39.919275Z","last_seen":"2026-06-06T14:40:04.524798Z","times_seen":151,"resource_available":false,"data":null}},"time_used":327,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":327,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2025-12-20","alert":"Sinkholed","trigger":"bluewhaleusen.com","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2025-12-20","alert":"Sinkholed","trigger":"bluewhaleusen.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2025-12-20","alert":"Sinkholed","trigger":"bluewhaleusen.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2025-12-20","alert":"Sinkholed","trigger":"bluewhaleusen.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2025-12-20","alert":"Phishing Block","trigger":"bluewhaleusen.com","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"imgtest1.s3.amazonaws.com/type/2023-08-14/29e5a33a-f02d-43f6-b4ce-5edb8be1577a.jpg","fqdn":"imgtest1.s3.amazonaws.com","domain":"imgtest1.s3.amazonaws.com","tld":"s3.amazonaws.com"},"ip":{"addr":"16.15.207.90","port":443,"asn":14618,"as":"AMAZON-AES","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://bluewhaleusen.com/","date":"2025-12-20T07:01:23.411Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"P256","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.s3.amazonaws.com","organization":""},"issuer":{"commonName":"Amazon RSA 2048 M01","organization":"Amazon"},"validity":{"start":"Fri, 14 Feb 2025 00:00:00 GMT","end":"Sat, 07 Feb 2026 23:59:59 GMT"},"fingerprint":{"sha1":"2E:BA:63:64:95:A8:CE:55:DD:7E:EB:A9:98:83:14:B1:6F:6B:61:69","sha256":"00:D7:0B:CC:1F:82:6B:F6:D9:2E:55:1A:BA:88:38:33:19:09:5B:85:49:41:5E:DA:A1:97:B9:D2:0A:3B:13:52"}}},"request":{"raw":"GET /type/2023-08-14/29e5a33a-f02d-43f6-b4ce-5edb8be1577a.jpg HTTP/1.1\r\nHost: imgtest1.s3.amazonaws.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nx-amz-id-2: yBs5ZH9n93SZgaz7ogFc0ta/gDt7z7VGfIsRw6W4UElE81pYTJd0O2LppmJiQRv6VEjzWGSvenMLU/xieIgiBMBg/dnSTtj8\r\nx-amz-request-id: CRNWS624NPF1YV18\r\nDate: Sat, 20 Dec 2025 07:01:25 GMT\r\nLast-Modified: Thu, 23 May 2024 01:50:35 GMT\r\nETag: \"a7d470fbe103fb9a6784c6e3bd450ccc\"\r\nx-amz-server-side-encryption: AES256\r\nAccept-Ranges: bytes\r\nContent-Type: image/jpeg\r\nContent-Length: 96012\r\nServer: AmazonS3\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Amazon Web Services","description":"Amazon Web Services (AWS) is a comprehensive cloud services platform offering compute power, database storage, content delivery and other functionality.","website":"https://aws.amazon.com/","common_platform_enumeration":"","icon":"Amazon Web Services.svg","categories":["PaaS"]},{"name":"Amazon S3","description":"Amazon S3 or Amazon Simple Storage Service is a service offered by Amazon Web Services (AWS) that provides object storage through a web service interface.","website":"https://aws.amazon.com/s3/","common_platform_enumeration":"","icon":"Amazon S3.svg","categories":["CDN"]}],"data":{"size":96012,"size_decoded":0,"mime_type":"image/jpeg","magic":"JPEG image data, baseline, precision 8, 500x500, components 3","md5":"a7d470fbe103fb9a6784c6e3bd450ccc","sha1":"cef53fa7fec6b069bc298b96adc02886d48a2bd6","sha256":"4529834992120ae959682d5dfc40e76a46db199fdbe4b20fd77e5d1ce92accd0","sha512":"e429d8efffecef5f79cbdab092f84a5054126fb33ee4b22d8e50861cba8d10edc49b41b5d0b8d02d997428b0f661816cca586b58f15d10cab9629375de8ff737","ssdeep":"1536:Kvlkpltm3DoZ3IUr1vvliVOHylrocmmIqeWJ6BHlCJsSEBT+qScNiHoDqlSBvP:Kvl2tm3DotIUrxtiVaylroc0dPHQJlsZ","tlshash":"1f93f19fdd0acc318b46e0ea7a85c1a364b9c25354d0f97f5739d8b6c09c7b99802cc9","first_seen":"2024-02-11T04:26:46Z","last_seen":"2026-08-11T08:26:52.896993Z","times_seen":9654,"resource_available":false,"data":null}},"time_used":848,"timings":{"blocked":641,"dns":0,"connect":0,"send":0,"wait":112,"receive":95,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"mall-test.s3.amazonaws.com/pc/gp/B07XGP7HTW/81fwoaIeEOL._AC_SL1500_.jpg","fqdn":"mall-test.s3.amazonaws.com","domain":"mall-test.s3.amazonaws.com","tld":"s3.amazonaws.com"},"ip":{"addr":"3.5.30.74","port":443,"asn":14618,"as":"AMAZON-AES","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://bluewhaleusen.com/","date":"2025-12-20T07:01:23.443Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"P256","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"s3.amazonaws.com","organization":""},"issuer":{"commonName":"Amazon RSA 2048 M01","organization":"Amazon"},"validity":{"start":"Fri, 19 Sep 2025 00:00:00 GMT","end":"Sun, 23 Aug 2026 23:59:59 GMT"},"fingerprint":{"sha1":"48:FD:CD:50:85:6A:51:E7:71:E4:CB:E0:03:81:E1:EC:4E:AD:9E:C7","sha256":"D7:11:81:F4:91:03:0D:C6:A5:DE:8A:EF:AA:58:14:BA:AD:33:B5:11:8B:D5:F0:33:53:8B:AF:49:82:E9:4B:A4"}}},"request":{"raw":"GET /pc/gp/B07XGP7HTW/81fwoaIeEOL._AC_SL1500_.jpg HTTP/1.1\r\nHost: mall-test.s3.amazonaws.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nx-amz-id-2: Nq0wpH4J3RtFEwM9pxCAvloyb7QNtmj7lKyoWnSUN83R10reqxioXuQuDYG2z8OSca5dq25bGArYlDPJEsmFDixfDn4+/23n\r\nx-amz-request-id: S19MBNKSWX48S2A1\r\nDate: Sat, 20 Dec 2025 07:01:24 GMT\r\nLast-Modified: Wed, 22 May 2024 02:33:56 GMT\r\nETag: \"ddcaef2c6aac08fffa6008f8116d4863\"\r\nx-amz-server-side-encryption: AES256\r\nx-amz-meta-sha256: 805c8fc4de4d9c9903f475acad7422ecf82ac2ccf5bf0a442a1686d1f3fa2026\r\nx-amz-meta-s3b-last-modified: 20231026T130616Z\r\nAccept-Ranges: bytes\r\nContent-Type: image/jpeg\r\nContent-Length: 237068\r\nServer: AmazonS3\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Amazon Web Services","description":"Amazon Web Services (AWS) is a comprehensive cloud services platform offering compute power, database storage, content delivery and other functionality.","website":"https://aws.amazon.com/","common_platform_enumeration":"","icon":"Amazon Web Services.svg","categories":["PaaS"]},{"name":"Amazon S3","description":"Amazon S3 or Amazon Simple Storage Service is a service offered by Amazon Web Services (AWS) that provides object storage through a web service interface.","website":"https://aws.amazon.com/s3/","common_platform_enumeration":"","icon":"Amazon S3.svg","categories":["CDN"]}],"data":{"size":237068,"size_decoded":0,"mime_type":"image/jpeg","magic":"JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 910x1500, components 3","md5":"ddcaef2c6aac08fffa6008f8116d4863","sha1":"5dfd62507f633aa81445a44811bb63809316c059","sha256":"805c8fc4de4d9c9903f475acad7422ecf82ac2ccf5bf0a442a1686d1f3fa2026","sha512":"95bef3e1700d32e6085d333d6564db07c4e9d6ca15f68db74153bfd184d8742022929332333565410ac220335e3cc373033aaedecbd28c5f7e9ac7fccc528d7e","ssdeep":"6144:p+zpCBaXboUhv83vTJMuOeo4q0l/l0yBsiaDkKhPbqTswCTh:p+pXboUhv8oe3lBBZcWoxh","tlshash":"933423f5eea10b8adb466b3489c02f21507e42e18d4dacb643f2e76245dd0d8d3ad672","first_seen":"2024-03-15T18:45:45Z","last_seen":"2026-08-11T08:26:52.927517Z","times_seen":2364,"resource_available":false,"data":null}},"time_used":839,"timings":{"blocked":223,"dns":11,"connect":96,"send":0,"wait":116,"receive":281,"ssl":108},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"mall-test.s3.amazonaws.com/test/2023-03-28/e06b455c-8412-4866-b1b3-653027bd1c10.jpg","fqdn":"mall-test.s3.amazonaws.com","domain":"mall-test.s3.amazonaws.com","tld":"s3.amazonaws.com"},"ip":{"addr":"3.5.30.74","port":443,"asn":14618,"as":"AMAZON-AES","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://bluewhaleusen.com/","date":"2025-12-20T07:01:23.458Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"P256","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"s3.amazonaws.com","organization":""},"issuer":{"commonName":"Amazon RSA 2048 M01","organization":"Amazon"},"validity":{"start":"Fri, 19 Sep 2025 00:00:00 GMT","end":"Sun, 23 Aug 2026 23:59:59 GMT"},"fingerprint":{"sha1":"48:FD:CD:50:85:6A:51:E7:71:E4:CB:E0:03:81:E1:EC:4E:AD:9E:C7","sha256":"D7:11:81:F4:91:03:0D:C6:A5:DE:8A:EF:AA:58:14:BA:AD:33:B5:11:8B:D5:F0:33:53:8B:AF:49:82:E9:4B:A4"}}},"request":{"raw":"GET /test/2023-03-28/e06b455c-8412-4866-b1b3-653027bd1c10.jpg HTTP/1.1\r\nHost: mall-test.s3.amazonaws.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nx-amz-id-2: zYBOGJr8IsbNjRkpbsZIxFPHQuF+3+yDsVGA749ROEb637JBFoUGfEFoXPsz2VA+st6aIih3ztRTvwKjPfpgYnFu96nv8udi\r\nx-amz-request-id: S19K3P4YFFA3GQYY\r\nDate: Sat, 20 Dec 2025 07:01:24 GMT\r\nLast-Modified: Wed, 22 May 2024 20:54:36 GMT\r\nETag: \"c204487a7d3a52dd08d0cb8bd82d4383\"\r\nx-amz-server-side-encryption: AES256\r\nAccept-Ranges: bytes\r\nContent-Type: image/jpeg\r\nContent-Length: 116417\r\nServer: AmazonS3\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Amazon S3","description":"Amazon S3 or Amazon Simple Storage Service is a service offered by Amazon Web Services (AWS) that provides object storage through a web service interface.","website":"https://aws.amazon.com/s3/","common_platform_enumeration":"","icon":"Amazon S3.svg","categories":["CDN"]},{"name":"Amazon Web Services","description":"Amazon Web Services (AWS) is a comprehensive cloud services platform offering compute power, database storage, content delivery and other functionality.","website":"https://aws.amazon.com/","common_platform_enumeration":"","icon":"Amazon Web Services.svg","categories":["PaaS"]}],"data":{"size":116417,"size_decoded":0,"mime_type":"image/jpeg","magic":"JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 1500x1500, components 3","md5":"c204487a7d3a52dd08d0cb8bd82d4383","sha1":"0d1d0939727c3ce06382233272c124b3e0d023e8","sha256":"522ae93f5824674a9d56c6bd1e7973d5b98b171fbf00cd8e36369a842d416b6e","sha512":"c22785e439d2531161a142ac57571ad5d611562164b20454af4dd5e655c0e36b33d7e3331f77d5d9a7261a70ca92b3f1d5f34bd11eda38aebb5b0af30b1716b4","ssdeep":"1536:Vs2stZYxtS5hzAjXqCSe9lMKHKoyqBxglgPqUN0OWw2axsLUUNIBorXcQxs8ASz1:q2ssmhWXqCSclqoJvOTw2fLTN0EX08VT","tlshash":"8db312936325991bc7ed04734ab352bc6f719903775c5324bb01a42e59399c8ecccb5e","first_seen":"2024-02-19T23:01:28Z","last_seen":"2026-08-09T04:44:19.210951Z","times_seen":7453,"resource_available":false,"data":null}},"time_used":672,"timings":{"blocked":362,"dns":0,"connect":0,"send":0,"wait":120,"receive":190,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"mall-test.s3.amazonaws.com/test/2023-03-28/83ac7d5d-fa38-4678-af79-63b4066ea171.jpg","fqdn":"mall-test.s3.amazonaws.com","domain":"mall-test.s3.amazonaws.com","tld":"s3.amazonaws.com"},"ip":{"addr":"3.5.30.74","port":443,"asn":14618,"as":"AMAZON-AES","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://bluewhaleusen.com/","date":"2025-12-20T07:01:23.459Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_CHACHA20_POLY1305_SHA256","key_group_name":"P256","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"s3.amazonaws.com","organization":""},"issuer":{"commonName":"Amazon RSA 2048 M01","organization":"Amazon"},"validity":{"start":"Fri, 19 Sep 2025 00:00:00 GMT","end":"Sun, 23 Aug 2026 23:59:59 GMT"},"fingerprint":{"sha1":"48:FD:CD:50:85:6A:51:E7:71:E4:CB:E0:03:81:E1:EC:4E:AD:9E:C7","sha256":"D7:11:81:F4:91:03:0D:C6:A5:DE:8A:EF:AA:58:14:BA:AD:33:B5:11:8B:D5:F0:33:53:8B:AF:49:82:E9:4B:A4"}}},"request":{"raw":"GET /test/2023-03-28/83ac7d5d-fa38-4678-af79-63b4066ea171.jpg HTTP/1.1\r\nHost: mall-test.s3.amazonaws.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nx-amz-id-2: VHmoqFqgALAI+/xtMjeoZnJB4Q6IKke6iElC5p0gHmzu5c8ZJePV66MRBDb+Ipf9EWr/hmjgpbsQjL5z1C+4KsM1yRnO4pbA\r\nx-amz-request-id: S19VXZJC304MF3KB\r\nDate: Sat, 20 Dec 2025 07:01:24 GMT\r\nLast-Modified: Wed, 22 May 2024 20:51:12 GMT\r\nETag: \"7fac67ccc5152addd1ee354754ded6f8\"\r\nx-amz-server-side-encryption: AES256\r\nAccept-Ranges: bytes\r\nContent-Type: image/jpeg\r\nContent-Length: 138263\r\nServer: AmazonS3\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Amazon Web Services","description":"Amazon Web Services (AWS) is a comprehensive cloud services platform offering compute power, database storage, content delivery and other functionality.","website":"https://aws.amazon.com/","common_platform_enumeration":"","icon":"Amazon Web Services.svg","categories":["PaaS"]},{"name":"Amazon S3","description":"Amazon S3 or Amazon Simple Storage Service is a service offered by Amazon Web Services (AWS) that provides object storage through a web service interface.","website":"https://aws.amazon.com/s3/","common_platform_enumeration":"","icon":"Amazon S3.svg","categories":["CDN"]}],"data":{"size":138263,"size_decoded":0,"mime_type":"image/jpeg","magic":"JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 1500x1448, components 3","md5":"7fac67ccc5152addd1ee354754ded6f8","sha1":"76a721dd33cbe5db8b2b88cec77411504ecac3a8","sha256":"793dc1d79d43111b0d0f51a97639335a2e3b9e183fccf7f9977d4ee211f0abab","sha512":"5838f6f3db5cf29c41bea30d3ffa90a3fcb6621bf31b7ced36bfe2a5e7e9b73c1e3ea4704eb410a18d7ff851d63732f9946f8b5731599ec4ca99842cc5b0b944","ssdeep":"3072:/P49i9HHzuA3rNAKsr+2cStuOt/IaQnNuq01y8e6eJwfNNJaJT:/aixukN6Clst/IFNzP0NNJWT","tlshash":"c7d312fd4380ccd9e222a971610f53ace81735f209889d815b6df9a6f6512b4ffc9a12","first_seen":"2024-02-19T23:01:28Z","last_seen":"2026-08-09T04:44:19.246833Z","times_seen":7562,"resource_available":false,"data":null}},"time_used":628,"timings":{"blocked":421,"dns":0,"connect":0,"send":0,"wait":111,"receive":96,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"imgtest1.s3.amazonaws.com/shopAvatar/2023-11-23/1e60a570-fd75-42c1-b3b9-3c040b0cc19e.png","fqdn":"imgtest1.s3.amazonaws.com","domain":"imgtest1.s3.amazonaws.com","tld":"s3.amazonaws.com"},"ip":{"addr":"16.15.207.90","port":443,"asn":14618,"as":"AMAZON-AES","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://bluewhaleusen.com/","date":"2025-12-20T07:01:24.232Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"P256","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.s3.amazonaws.com","organization":""},"issuer":{"commonName":"Amazon RSA 2048 M01","organization":"Amazon"},"validity":{"start":"Fri, 14 Feb 2025 00:00:00 GMT","end":"Sat, 07 Feb 2026 23:59:59 GMT"},"fingerprint":{"sha1":"2E:BA:63:64:95:A8:CE:55:DD:7E:EB:A9:98:83:14:B1:6F:6B:61:69","sha256":"00:D7:0B:CC:1F:82:6B:F6:D9:2E:55:1A:BA:88:38:33:19:09:5B:85:49:41:5E:DA:A1:97:B9:D2:0A:3B:13:52"}}},"request":{"raw":"GET /shopAvatar/2023-11-23/1e60a570-fd75-42c1-b3b9-3c040b0cc19e.png HTTP/1.1\r\nHost: imgtest1.s3.amazonaws.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nx-amz-id-2: K8MhKA25yHZfxAg38d68wUoDYeP8r87/wRBUR4MvjG2svpOOcJeL3yDmWTZng6q8QtI1NhnITcYvEtch4X8aPDQzQDFcVtKB\r\nx-amz-request-id: CRNN9MDARG1GWZ34\r\nDate: Sat, 20 Dec 2025 07:01:25 GMT\r\nLast-Modified: Thu, 23 May 2024 01:45:32 GMT\r\nETag: \"3224e47c70fef9289898672d8fa26d2a\"\r\nx-amz-server-side-encryption: AES256\r\nAccept-Ranges: bytes\r\nContent-Type: image/png\r\nContent-Length: 1521350\r\nServer: AmazonS3\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Amazon S3","description":"Amazon S3 or Amazon Simple Storage Service is a service offered by Amazon Web Services (AWS) that provides object storage through a web service interface.","website":"https://aws.amazon.com/s3/","common_platform_enumeration":"","icon":"Amazon S3.svg","categories":["CDN"]},{"name":"Amazon Web Services","description":"Amazon Web Services (AWS) is a comprehensive cloud services platform offering compute power, database storage, content delivery and other functionality.","website":"https://aws.amazon.com/","common_platform_enumeration":"","icon":"Amazon Web Services.svg","categories":["PaaS"]}],"data":{"size":1521350,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 936 x 936, 8-bit/color RGBA, non-interlaced","md5":"d4ad8c8f28bbff0552707fa501cf07cf","sha1":"6dc1348a98aa7efc61489e2bc7f95cefb44f4a09","sha256":"a8c5a04357bad806ad855cef0f92ef998bfc2e0cd8a390818df436cf40d6efde","sha512":"9ca2c9b123ef136a260b5bc2a1a0a900a29e45034ea01184e89ddae6e0a302812fe0c74771958d398cc59a9ef13737429aa37297fbfdcde96293f608ad42d367","ssdeep":"24576:wp4vxIrg4fman4ZmBk2/MqGj9jKKxrijvB:wevxZ4frBkA2QKMB","tlshash":"75253315d425b107fbc79a75d98617833cfe1421b3abb04d0fe48a1af972e726898137","first_seen":"2025-07-28T06:58:14.003726Z","last_seen":"2026-08-11T08:26:52.945599Z","times_seen":435,"resource_available":false,"data":null}},"time_used":594,"timings":{"blocked":246,"dns":0,"connect":0,"send":0,"wait":108,"receive":240,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"bluewhaleusen.com/css/chunk-79bc161e.c3acef98.css","fqdn":"bluewhaleusen.com","domain":"bluewhaleusen.com","tld":"com"},"ip":{"addr":"118.107.9.252","port":443,"asn":152194,"as":"CTG Server Limited","country":"Singapore","country_code":"SG"},"is_navigation_request":false,"resource_type":"other","requested_by":"https://bluewhaleusen.com/","date":"2025-12-20T07:01:25.262Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"bluewhaleusen.com","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Fri, 19 Dec 2025 05:22:57 GMT","end":"Thu, 19 Mar 2026 05:22:56 GMT"},"fingerprint":{"sha1":"23:4C:94:04:E1:25:E0:EA:D1:85:17:4C:09:FC:E0:DA:D0:01:E6:62","sha256":"AC:EF:45:40:E0:37:3A:BD:B9:C9:32:F5:6B:B1:B8:92:BE:33:89:43:FA:25:17:17:7C:CA:50:4E:0B:CD:25:EB"}}},"request":{"raw":"GET /css/chunk-79bc161e.c3acef98.css HTTP/1.1\r\nHost: bluewhaleusen.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nX-Moz: prefetch\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Sat, 20 Dec 2025 07:01:25 GMT\r\ncontent-type: text/css\r\nvary: Accept-Encoding\r\netag: W/\"6834-1766123972329\"\r\nlast-modified: Fri, 19 Dec 2025 05:59:32 GMT\r\nstrict-transport-security: max-age=31536000\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":6834,"size_decoded":0,"mime_type":"text/css","magic":"ASCII text, with very long lines (6834), with no line terminators","md5":"f7b1de25905c81c373dba149d03c31f9","sha1":"862e37406535632dfb53a15f6a89c16efb3c94df","sha256":"e75dbd8d3fa49fec96c2b893018aed78a616974cb812b015636553d832881751","sha512":"5a2f0034e39196a38ce44b9d9cc46301069bf252b4f092c46db65bcd45a55ed05a6b53bc8241f14a5f5390b530394bcfb0ffea60b21c9262d0b669e07fd1707d","ssdeep":"96:Zsivfdy8lOFD1vq80WV/LPxDmvo6SOwUu50NJj9MC2:Zz33lSD1v30I/LPxDWrhxuuz+","tlshash":"56e10ff2f231112f7426953be18389e8bc86b10dd3ffc656ff84b514daa9182063518e","first_seen":"2024-03-24T18:07:06Z","last_seen":"2026-08-11T08:26:52.961835Z","times_seen":2036,"resource_available":false,"data":null}},"time_used":327,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":327,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2025-12-20","alert":"Sinkholed","trigger":"bluewhaleusen.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2025-12-20","alert":"Sinkholed","trigger":"bluewhaleusen.com","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2025-12-20","alert":"Sinkholed","trigger":"bluewhaleusen.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2025-12-20","alert":"Phishing Block","trigger":"bluewhaleusen.com","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2025-12-20","alert":"Sinkholed","trigger":"bluewhaleusen.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"bluewhaleusen.com/js/chunk-2d2212c4.3496023f.js","fqdn":"bluewhaleusen.com","domain":"bluewhaleusen.com","tld":"com"},"ip":{"addr":"118.107.9.252","port":443,"asn":152194,"as":"CTG Server Limited","country":"Singapore","country_code":"SG"},"is_navigation_request":false,"resource_type":"other","requested_by":"https://bluewhaleusen.com/","date":"2025-12-20T07:01:26.636Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"bluewhaleusen.com","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Fri, 19 Dec 2025 05:22:57 GMT","end":"Thu, 19 Mar 2026 05:22:56 GMT"},"fingerprint":{"sha1":"23:4C:94:04:E1:25:E0:EA:D1:85:17:4C:09:FC:E0:DA:D0:01:E6:62","sha256":"AC:EF:45:40:E0:37:3A:BD:B9:C9:32:F5:6B:B1:B8:92:BE:33:89:43:FA:25:17:17:7C:CA:50:4E:0B:CD:25:EB"}}},"request":{"raw":"GET /js/chunk-2d2212c4.3496023f.js HTTP/1.1\r\nHost: bluewhaleusen.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nX-Moz: prefetch\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Sat, 20 Dec 2025 07:01:26 GMT\r\ncontent-type: application/javascript\r\nvary: Accept-Encoding\r\netag: W/\"10854-1766123972305\"\r\nlast-modified: Fri, 19 Dec 2025 05:59:32 GMT\r\nstrict-transport-security: max-age=31536000\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":10854,"size_decoded":0,"mime_type":"application/javascript","magic":"JavaScript source, ASCII text, with very long lines (10854), with no line terminators","md5":"fd1a0fd4ddb71dbf85ddce324c46e8f4","sha1":"6a7840cc198aa30708be964ed3ac01f87b653871","sha256":"951e06203fa4ba6c932c23aabe6ccbfe87ce3f557fd3bc648fbad33a643d2014","sha512":"5ad635de686183a58eefbc98f475ed43c01f960fe1fc7d2e545606d4005060d016c5bd5203e4f5f4d38ecae7d8d0d6ae28101ee1d00c44a8dac33d42cc08526d","ssdeep":"192:f/sOYPMSXr6GqgCI9pn5VsFyeyVu+4ceiyEufVx6IrI36:ns7NX2782yD4+4ceiafnj","tlshash":"1622f80eb466a9b8885b41223106b27471766fd1f00854adf7bcccf45689eb8372b37e","first_seen":"2025-04-08T11:27:57.691024Z","last_seen":"2026-06-06T14:40:04.37147Z","times_seen":64,"resource_available":false,"data":null}},"time_used":327,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":327,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2025-12-20","alert":"Sinkholed","trigger":"bluewhaleusen.com","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2025-12-20","alert":"Sinkholed","trigger":"bluewhaleusen.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2025-12-20","alert":"Sinkholed","trigger":"bluewhaleusen.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2025-12-20","alert":"Phishing Block","trigger":"bluewhaleusen.com","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2025-12-20","alert":"Sinkholed","trigger":"bluewhaleusen.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"bluewhaleusen.com/js/chunk-6ae12620.ee4ddc86.js","fqdn":"bluewhaleusen.com","domain":"bluewhaleusen.com","tld":"com"},"ip":{"addr":"118.107.9.252","port":443,"asn":152194,"as":"CTG Server Limited","country":"Singapore","country_code":"SG"},"is_navigation_request":false,"resource_type":"other","requested_by":"https://bluewhaleusen.com/","date":"2025-12-20T07:01:27.285Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"bluewhaleusen.com","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Fri, 19 Dec 2025 05:22:57 GMT","end":"Thu, 19 Mar 2026 05:22:56 GMT"},"fingerprint":{"sha1":"23:4C:94:04:E1:25:E0:EA:D1:85:17:4C:09:FC:E0:DA:D0:01:E6:62","sha256":"AC:EF:45:40:E0:37:3A:BD:B9:C9:32:F5:6B:B1:B8:92:BE:33:89:43:FA:25:17:17:7C:CA:50:4E:0B:CD:25:EB"}}},"request":{"raw":"GET /js/chunk-6ae12620.ee4ddc86.js HTTP/1.1\r\nHost: bluewhaleusen.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nX-Moz: prefetch\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Sat, 20 Dec 2025 07:01:27 GMT\r\ncontent-type: application/javascript\r\nvary: Accept-Encoding\r\netag: W/\"1166-1766123972305\"\r\nlast-modified: Fri, 19 Dec 2025 05:59:32 GMT\r\nstrict-transport-security: max-age=31536000\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":1166,"size_decoded":0,"mime_type":"application/javascript","magic":"JavaScript source, Unicode text, UTF-8 text, with very long lines (1158), with no line terminators","md5":"720b211362da7bdba57d103392a21ece","sha1":"e0802613146daa04aa13f2f5e819e4fdad8271e1","sha256":"544b85ab032be80a8be414efa375c109f60f08df4fa93944fe53cd573710b6e7","sha512":"b843e18931465fd464fbf7b2e972f19328692cbc3fda0f4b85859280ff545d580a035694cfcab136cde5b1626943d2f7370ed190603ddcf91575d0a9deca1552","ssdeep":"","tlshash":"9121f113a092784d5c6ea541210f2134f4f09dd64c1be8e1a778c8e6e2b2daa3a5f23d","first_seen":"2025-04-08T11:27:57.69713Z","last_seen":"2026-06-06T14:40:04.512028Z","times_seen":62,"resource_available":false,"data":null}},"time_used":327,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":327,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2025-12-20","alert":"Sinkholed","trigger":"bluewhaleusen.com","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2025-12-20","alert":"Sinkholed","trigger":"bluewhaleusen.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2025-12-20","alert":"Sinkholed","trigger":"bluewhaleusen.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2025-12-20","alert":"Phishing Block","trigger":"bluewhaleusen.com","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2025-12-20","alert":"Sinkholed","trigger":"bluewhaleusen.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"bluewhaleusen.com/img/zd.7857e3f2.png","fqdn":"bluewhaleusen.com","domain":"bluewhaleusen.com","tld":"com"},"ip":{"addr":"118.107.9.252","port":443,"asn":152194,"as":"CTG Server Limited","country":"Singapore","country_code":"SG"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://bluewhaleusen.com/","date":"2025-12-20T07:01:22.834Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"bluewhaleusen.com","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Fri, 19 Dec 2025 05:22:57 GMT","end":"Thu, 19 Mar 2026 05:22:56 GMT"},"fingerprint":{"sha1":"23:4C:94:04:E1:25:E0:EA:D1:85:17:4C:09:FC:E0:DA:D0:01:E6:62","sha256":"AC:EF:45:40:E0:37:3A:BD:B9:C9:32:F5:6B:B1:B8:92:BE:33:89:43:FA:25:17:17:7C:CA:50:4E:0B:CD:25:EB"}}},"request":{"raw":"GET /img/zd.7857e3f2.png HTTP/1.1\r\nHost: bluewhaleusen.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Sat, 20 Dec 2025 07:01:23 GMT\r\ncontent-type: image/png\r\nvary: Accept-Encoding\r\netag: W/\"14770-1766123972344\"\r\nlast-modified: Fri, 19 Dec 2025 05:59:32 GMT\r\nstrict-transport-security: max-age=31536000\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":14770,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 656 x 500, 8-bit colormap, non-interlaced","md5":"7857e3f262cd92fc4c1628cfed84504b","sha1":"c6a1fd89fd78644cc34a811bc73198a475208540","sha256":"de2bfee73dbee58da60ad3331ae186927f49973367fa6a2a6b3a31e51eff9f69","sha512":"acadab42dcd2e231fed556903265eccd27189835f340fe0de2a99902330f9878043a47147764ad2436d9fae0469e841861dfd03b7126e7fe7c1393bdc47fa823","ssdeep":"384:xbFvWjJqmFVCc1yZCXXZtYkBn3NwSvshkoXPtFuJIJ:RFvwj1yZCXXzHNhpyl8JQ","tlshash":"5662c04cb44419abd2b1d0ba600bc59b7fe0d2d1beca82300347bc5b0ca96d59279b6c","first_seen":"2024-04-12T10:02:46Z","last_seen":"2026-06-06T14:40:04.384588Z","times_seen":238,"resource_available":false,"data":null}},"time_used":330,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":330,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2025-12-20","alert":"Sinkholed","trigger":"bluewhaleusen.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2025-12-20","alert":"Sinkholed","trigger":"bluewhaleusen.com","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2025-12-20","alert":"Sinkholed","trigger":"bluewhaleusen.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2025-12-20","alert":"Sinkholed","trigger":"bluewhaleusen.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2025-12-20","alert":"Phishing Block","trigger":"bluewhaleusen.com","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"imgtest1.s3.amazonaws.com/test/2023-03-07/78b9c29f-800a-499a-a640-a12d95b6cc7c.jpg","fqdn":"imgtest1.s3.amazonaws.com","domain":"imgtest1.s3.amazonaws.com","tld":"s3.amazonaws.com"},"ip":{"addr":"16.15.207.90","port":443,"asn":14618,"as":"AMAZON-AES","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://bluewhaleusen.com/","date":"2025-12-20T07:01:23.457Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"P256","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.s3.amazonaws.com","organization":""},"issuer":{"commonName":"Amazon RSA 2048 M01","organization":"Amazon"},"validity":{"start":"Fri, 14 Feb 2025 00:00:00 GMT","end":"Sat, 07 Feb 2026 23:59:59 GMT"},"fingerprint":{"sha1":"2E:BA:63:64:95:A8:CE:55:DD:7E:EB:A9:98:83:14:B1:6F:6B:61:69","sha256":"00:D7:0B:CC:1F:82:6B:F6:D9:2E:55:1A:BA:88:38:33:19:09:5B:85:49:41:5E:DA:A1:97:B9:D2:0A:3B:13:52"}}},"request":{"raw":"GET /test/2023-03-07/78b9c29f-800a-499a-a640-a12d95b6cc7c.jpg HTTP/1.1\r\nHost: imgtest1.s3.amazonaws.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nx-amz-id-2: h7HOeWXz366k8gR80xfmx6zQ6qX2iJgpUBYqntHhmJb9CxW9kcNlqUz0P7Y3XaYqfU8jhrDUmOpEbHYUSdCZ8FVnuVLM3BLO\r\nx-amz-request-id: CRNWERQBTX6YZKR7\r\nDate: Sat, 20 Dec 2025 07:01:25 GMT\r\nLast-Modified: Thu, 23 May 2024 01:47:07 GMT\r\nETag: \"013fe4aba3bf16f7e54fc87414f2fcc9\"\r\nx-amz-server-side-encryption: AES256\r\nAccept-Ranges: bytes\r\nContent-Type: image/jpeg\r\nContent-Length: 48075\r\nServer: AmazonS3\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Amazon Web Services","description":"Amazon Web Services (AWS) is a comprehensive cloud services platform offering compute power, database storage, content delivery and other functionality.","website":"https://aws.amazon.com/","common_platform_enumeration":"","icon":"Amazon Web Services.svg","categories":["PaaS"]},{"name":"Amazon S3","description":"Amazon S3 or Amazon Simple Storage Service is a service offered by Amazon Web Services (AWS) that provides object storage through a web service interface.","website":"https://aws.amazon.com/s3/","common_platform_enumeration":"","icon":"Amazon S3.svg","categories":["CDN"]}],"data":{"size":48075,"size_decoded":0,"mime_type":"image/jpeg","magic":"JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 857x1050, components 3","md5":"013fe4aba3bf16f7e54fc87414f2fcc9","sha1":"78d37fb3e926e07ff603a0e1d2246523301dbf9c","sha256":"0ea676e6317e0aa668ec454888b2f5a28b97008372616a9b73246ea783643b4c","sha512":"aa8e69c89fad117f57c1d46dedba44e56721d6d8fb70b89b67e51e1ccdb5a8f3398c3ec85fe0d5f69827c0624bd1918b92b21e99f65801e1397232e705f3e881","ssdeep":"768:1cS2+ioGBA89RGlxoPquyl4Y2RKMmjbTai8u6JZfHRAQTGyGsp7+i/27pUi:45tBA8uH2RfmjbTTH6JZfHR79pzuei","tlshash":"8223f12856424859d5a1c1ba507e4def23c2b132bfc692c770cbf2481bea7a9f254e61","first_seen":"2024-02-19T23:01:28Z","last_seen":"2026-08-09T04:44:19.227554Z","times_seen":7391,"resource_available":false,"data":null}},"time_used":912,"timings":{"blocked":709,"dns":0,"connect":0,"send":0,"wait":109,"receive":94,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"bluewhaleusen.com/img/banner_01.f68b4caf.png","fqdn":"bluewhaleusen.com","domain":"bluewhaleusen.com","tld":"com"},"ip":{"addr":"118.107.9.252","port":443,"asn":152194,"as":"CTG Server Limited","country":"Singapore","country_code":"SG"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://bluewhaleusen.com/","date":"2025-12-20T07:01:24.225Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"bluewhaleusen.com","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Fri, 19 Dec 2025 05:22:57 GMT","end":"Thu, 19 Mar 2026 05:22:56 GMT"},"fingerprint":{"sha1":"23:4C:94:04:E1:25:E0:EA:D1:85:17:4C:09:FC:E0:DA:D0:01:E6:62","sha256":"AC:EF:45:40:E0:37:3A:BD:B9:C9:32:F5:6B:B1:B8:92:BE:33:89:43:FA:25:17:17:7C:CA:50:4E:0B:CD:25:EB"}}},"request":{"raw":"GET /img/banner_01.f68b4caf.png HTTP/1.1\r\nHost: bluewhaleusen.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Sat, 20 Dec 2025 07:01:24 GMT\r\ncontent-type: image/png\r\nvary: Accept-Encoding\r\netag: W/\"91520-1766123972358\"\r\nlast-modified: Fri, 19 Dec 2025 05:59:32 GMT\r\nstrict-transport-security: max-age=31536000\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":91520,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 1200 x 352, 8-bit colormap, non-interlaced","md5":"f68b4caf26d9bba7119274424075bb2f","sha1":"a303a85f922aa99f31e1303f45ea5caae3a954ed","sha256":"32a406c113955820bf69f8def7caa84b3436c8f81f4040f4d415f4b51ebfcf59","sha512":"6ece800a2efcc355c1c3a214bd27f28859c7f02f9ef9afd5cb662aff87047a0353fdff2c43a5bcdbd3f6b8de1b08d5defb9c1afcd50430487385a944f32cffe7","ssdeep":"1536:jADy/0wycEblpfJ2vWFTjh4tLf8ltr1jZAoUdpxAMzk:j5GDhhfeLf8ltR+p+/","tlshash":"dd9312e10f0a616585118552389cf93274e40bbaef7323cfaede06527714ae86eddd8c","first_seen":"2024-02-19T23:01:28Z","last_seen":"2026-07-09T07:07:04.485839Z","times_seen":356,"resource_available":false,"data":null}},"time_used":331,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":331,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2025-12-20","alert":"Phishing Block","trigger":"bluewhaleusen.com","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2025-12-20","alert":"Sinkholed","trigger":"bluewhaleusen.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2025-12-20","alert":"Sinkholed","trigger":"bluewhaleusen.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2025-12-20","alert":"Sinkholed","trigger":"bluewhaleusen.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2025-12-20","alert":"Sinkholed","trigger":"bluewhaleusen.com","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"bluewhaleusen.com/css/chunk-2bdc7c1c.d10fa6e7.css","fqdn":"bluewhaleusen.com","domain":"bluewhaleusen.com","tld":"com"},"ip":{"addr":"118.107.9.252","port":443,"asn":152194,"as":"CTG Server Limited","country":"Singapore","country_code":"SG"},"is_navigation_request":false,"resource_type":"other","requested_by":"https://bluewhaleusen.com/","date":"2025-12-20T07:01:24.275Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"bluewhaleusen.com","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Fri, 19 Dec 2025 05:22:57 GMT","end":"Thu, 19 Mar 2026 05:22:56 GMT"},"fingerprint":{"sha1":"23:4C:94:04:E1:25:E0:EA:D1:85:17:4C:09:FC:E0:DA:D0:01:E6:62","sha256":"AC:EF:45:40:E0:37:3A:BD:B9:C9:32:F5:6B:B1:B8:92:BE:33:89:43:FA:25:17:17:7C:CA:50:4E:0B:CD:25:EB"}}},"request":{"raw":"GET /css/chunk-2bdc7c1c.d10fa6e7.css HTTP/1.1\r\nHost: bluewhaleusen.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nX-Moz: prefetch\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Sat, 20 Dec 2025 07:01:24 GMT\r\ncontent-type: text/css\r\nvary: Accept-Encoding\r\netag: W/\"15177-1766123972324\"\r\nlast-modified: Fri, 19 Dec 2025 05:59:32 GMT\r\nstrict-transport-security: max-age=31536000\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":15177,"size_decoded":0,"mime_type":"text/css","magic":"ASCII text, with very long lines (15177), with no line terminators","md5":"e8f0d8a145ea382f2121421c8087d314","sha1":"2141f6a0814533f4403f813ab214c0db606ed844","sha256":"b3ade7cf169fe446ca4328caeedaa6e148e424a1c1bd5b6cfa17da8314e97eb5","sha512":"152dd11cf62faf5e0c57b51da6ee42af53261ef2bb2717bcbfb892afbc74968cdf6cc04a0a2f4a81266f072c212878851f47759d59e208af85b0802f15e03931","ssdeep":"384:iCQRDeBzT8lN9lc1J41+qFkV0vD5rw/CVFcjTK:iTe2lAJ4EFaDm0Fc/K","tlshash":"1462d87365a0963a76b79a7931c4a4ce7067e923c11742bdab59f13cc8c72a3263134e","first_seen":"2024-02-19T23:01:27Z","last_seen":"2026-07-09T07:07:04.493375Z","times_seen":101,"resource_available":false,"data":null}},"time_used":328,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":328,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2025-12-20","alert":"Sinkholed","trigger":"bluewhaleusen.com","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2025-12-20","alert":"Sinkholed","trigger":"bluewhaleusen.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2025-12-20","alert":"Phishing Block","trigger":"bluewhaleusen.com","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2025-12-20","alert":"Sinkholed","trigger":"bluewhaleusen.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2025-12-20","alert":"Sinkholed","trigger":"bluewhaleusen.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"bluewhaleusen.com/css/chunk-2d2212c4.0ac19f58.css","fqdn":"bluewhaleusen.com","domain":"bluewhaleusen.com","tld":"com"},"ip":{"addr":"118.107.9.252","port":443,"asn":152194,"as":"CTG Server Limited","country":"Singapore","country_code":"SG"},"is_navigation_request":false,"resource_type":"other","requested_by":"https://bluewhaleusen.com/","date":"2025-12-20T07:01:24.280Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"bluewhaleusen.com","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Fri, 19 Dec 2025 05:22:57 GMT","end":"Thu, 19 Mar 2026 05:22:56 GMT"},"fingerprint":{"sha1":"23:4C:94:04:E1:25:E0:EA:D1:85:17:4C:09:FC:E0:DA:D0:01:E6:62","sha256":"AC:EF:45:40:E0:37:3A:BD:B9:C9:32:F5:6B:B1:B8:92:BE:33:89:43:FA:25:17:17:7C:CA:50:4E:0B:CD:25:EB"}}},"request":{"raw":"GET /css/chunk-2d2212c4.0ac19f58.css HTTP/1.1\r\nHost: bluewhaleusen.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nX-Moz: prefetch\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Sat, 20 Dec 2025 07:01:24 GMT\r\ncontent-type: text/css\r\nvary: Accept-Encoding\r\netag: W/\"7020-1766123972329\"\r\nlast-modified: Fri, 19 Dec 2025 05:59:32 GMT\r\nstrict-transport-security: max-age=31536000\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":7020,"size_decoded":0,"mime_type":"text/css","magic":"ASCII text, with very long lines (7020), with no line terminators","md5":"3ff63057d453e7905816d415bb041db8","sha1":"f4f4d9466e57dbcdcc27f85955f6d5739d531111","sha256":"f3218c20f75db6879f1a8122333e30a7a9d8b4eccd9e8b4653a13ecb75e4b14f","sha512":"cb8bdf7bd90ea453555f77338d6b061ac65a08342fc665a8fe8c7eb16ebd18b3e37ba599126c7d5de0633585760ca46b80ead813303761b14a37d73ceb7a7a91","ssdeep":"192:IzCQIXiDe53zb/UboRyRD5liqF6+llu1JfSt5Xe:iCQRDeBzT8lN9lc1JK7e","tlshash":"18e13bf5e076d025ab3bd1a6b0e0a8e53814c923ec9742e57754761cccc36a32766b4c","first_seen":"2024-02-19T23:01:30Z","last_seen":"2026-06-06T14:40:04.518082Z","times_seen":220,"resource_available":false,"data":null}},"time_used":327,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":327,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2025-12-20","alert":"Sinkholed","trigger":"bluewhaleusen.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2025-12-20","alert":"Sinkholed","trigger":"bluewhaleusen.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2025-12-20","alert":"Sinkholed","trigger":"bluewhaleusen.com","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2025-12-20","alert":"Phishing Block","trigger":"bluewhaleusen.com","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2025-12-20","alert":"Sinkholed","trigger":"bluewhaleusen.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"mall-test.s3.amazonaws.com/test/2023-03-28/f6acb799-6e3d-40d7-9dea-f88b73ddc661.jpg","fqdn":"mall-test.s3.amazonaws.com","domain":"mall-test.s3.amazonaws.com","tld":"s3.amazonaws.com"},"ip":{"addr":"3.5.30.74","port":443,"asn":14618,"as":"AMAZON-AES","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://bluewhaleusen.com/","date":"2025-12-20T07:01:24.647Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_CHACHA20_POLY1305_SHA256","key_group_name":"P256","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"s3.amazonaws.com","organization":""},"issuer":{"commonName":"Amazon RSA 2048 M01","organization":"Amazon"},"validity":{"start":"Fri, 19 Sep 2025 00:00:00 GMT","end":"Sun, 23 Aug 2026 23:59:59 GMT"},"fingerprint":{"sha1":"48:FD:CD:50:85:6A:51:E7:71:E4:CB:E0:03:81:E1:EC:4E:AD:9E:C7","sha256":"D7:11:81:F4:91:03:0D:C6:A5:DE:8A:EF:AA:58:14:BA:AD:33:B5:11:8B:D5:F0:33:53:8B:AF:49:82:E9:4B:A4"}}},"request":{"raw":"GET /test/2023-03-28/f6acb799-6e3d-40d7-9dea-f88b73ddc661.jpg HTTP/1.1\r\nHost: mall-test.s3.amazonaws.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nx-amz-id-2: nFDmCXgqxRSlnXRfmuiMx8jo3m8esC+VpeoM1ZiNFg/uX7pBz5mnlIa1WnuFHbFhjc536WHdKCL/EptpfVIFXZVwVvsQpdwm\r\nx-amz-request-id: CRNZ467RPZGP98M1\r\nDate: Sat, 20 Dec 2025 07:01:25 GMT\r\nLast-Modified: Wed, 22 May 2024 20:55:24 GMT\r\nETag: \"188e058e6f7fbe9ad0a5f77351993576\"\r\nx-amz-server-side-encryption: AES256\r\nAccept-Ranges: bytes\r\nContent-Type: image/jpeg\r\nContent-Length: 58343\r\nServer: AmazonS3\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Amazon Web Services","description":"Amazon Web Services (AWS) is a comprehensive cloud services platform offering compute power, database storage, content delivery and other functionality.","website":"https://aws.amazon.com/","common_platform_enumeration":"","icon":"Amazon Web Services.svg","categories":["PaaS"]},{"name":"Amazon S3","description":"Amazon S3 or Amazon Simple Storage Service is a service offered by Amazon Web Services (AWS) that provides object storage through a web service interface.","website":"https://aws.amazon.com/s3/","common_platform_enumeration":"","icon":"Amazon S3.svg","categories":["CDN"]}],"data":{"size":58343,"size_decoded":0,"mime_type":"image/jpeg","magic":"JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 887x658, components 3","md5":"188e058e6f7fbe9ad0a5f77351993576","sha1":"5aa78ff88b30cbd54edb475d4275fc0d4218497f","sha256":"0c05def09a06513f1f4642a32933517dae2a570113bee37d42eb032886be835d","sha512":"bdf8a4a595692fbe4e7852b784846f1a76a87e36bde4e0a4d20eb190020965784572ee99ea2df88e46b3f22048cc6b2a04fd179d1796a7ab3b4911a699a230a8","ssdeep":"768:1708n17R4+OZnvTjYIoH3etV6CFmPxPoLsRkmVNIHEGjLF8asgzZ0vc/aT39Carl:d07BTjYfXet3mZPoLgknF8BgkB5rDZ","tlshash":"3643f260337882f3f1bbb8386b8d3a1a5b55b4975382cdef11126db2ab07a51745438f","first_seen":"2024-03-15T18:45:47Z","last_seen":"2026-08-11T08:26:52.989387Z","times_seen":2477,"resource_available":false,"data":null}},"time_used":183,"timings":{"blocked":17,"dns":0,"connect":0,"send":0,"wait":165,"receive":1,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"mall-test.s3.amazonaws.com/test/2023-03-28/4d106467-e1bb-4199-91a3-14c09c397800.jpg","fqdn":"mall-test.s3.amazonaws.com","domain":"mall-test.s3.amazonaws.com","tld":"s3.amazonaws.com"},"ip":{"addr":"3.5.30.74","port":443,"asn":14618,"as":"AMAZON-AES","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://bluewhaleusen.com/","date":"2025-12-20T07:01:24.702Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"P256","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"s3.amazonaws.com","organization":""},"issuer":{"commonName":"Amazon RSA 2048 M01","organization":"Amazon"},"validity":{"start":"Fri, 19 Sep 2025 00:00:00 GMT","end":"Sun, 23 Aug 2026 23:59:59 GMT"},"fingerprint":{"sha1":"48:FD:CD:50:85:6A:51:E7:71:E4:CB:E0:03:81:E1:EC:4E:AD:9E:C7","sha256":"D7:11:81:F4:91:03:0D:C6:A5:DE:8A:EF:AA:58:14:BA:AD:33:B5:11:8B:D5:F0:33:53:8B:AF:49:82:E9:4B:A4"}}},"request":{"raw":"GET /test/2023-03-28/4d106467-e1bb-4199-91a3-14c09c397800.jpg HTTP/1.1\r\nHost: mall-test.s3.amazonaws.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nx-amz-id-2: Az74X0xfY0GLd6DfNqAzqfMzNwCK1GGGZGY3Jf+RXGUZCG7htmCZf37oXLm4WfXSvYMRWy3rHodgJhtvu5xQ+Olkb3grtIBI\r\nx-amz-request-id: CRNTT3K0E3DQEQ3B\r\nDate: Sat, 20 Dec 2025 07:01:25 GMT\r\nLast-Modified: Wed, 22 May 2024 20:49:13 GMT\r\nETag: \"14d9f42f2c63b1613cc542428d426122\"\r\nx-amz-server-side-encryption: AES256\r\nAccept-Ranges: bytes\r\nContent-Type: image/jpeg\r\nContent-Length: 82584\r\nServer: AmazonS3\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Amazon S3","description":"Amazon S3 or Amazon Simple Storage Service is a service offered by Amazon Web Services (AWS) that provides object storage through a web service interface.","website":"https://aws.amazon.com/s3/","common_platform_enumeration":"","icon":"Amazon S3.svg","categories":["CDN"]},{"name":"Amazon Web Services","description":"Amazon Web Services (AWS) is a comprehensive cloud services platform offering compute power, database storage, content delivery and other functionality.","website":"https://aws.amazon.com/","common_platform_enumeration":"","icon":"Amazon Web Services.svg","categories":["PaaS"]}],"data":{"size":82584,"size_decoded":0,"mime_type":"image/jpeg","magic":"JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 1470x1500, components 3","md5":"14d9f42f2c63b1613cc542428d426122","sha1":"00e4462aa838f47df6791daf815e8eb0a5cd4bdb","sha256":"755dcfb51fca83949bf37ee825b678dab8b0cdd28d284dc614d367e147e6464f","sha512":"f306d811d90201f184c9381f938e563403ccdea51be8dcaa96f6a040424410bb313194077dbb6431ded01deeed1b7fd7d0698b962ffd3c6c2b04d3f886619cb8","ssdeep":"1536:GnQEa9MqP9A4s7zP1m7+PpzKo0Rm6c2/DJfjgo48h58th4WsEP208:7EadHUj07+PENRmLmlf94AetuWN8","tlshash":"e78302ed3bcea846f6ff59bc185ff48469120935eb324643e31274d8c6b86328f25465","first_seen":"2024-02-19T23:01:29Z","last_seen":"2026-08-09T04:44:19.290352Z","times_seen":7169,"resource_available":false,"data":null}},"time_used":300,"timings":{"blocked":183,"dns":0,"connect":0,"send":0,"wait":115,"receive":2,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"bluewhaleusen.com/css/chunk-8574639a.7840c12a.css","fqdn":"bluewhaleusen.com","domain":"bluewhaleusen.com","tld":"com"},"ip":{"addr":"118.107.9.252","port":443,"asn":152194,"as":"CTG Server Limited","country":"Singapore","country_code":"SG"},"is_navigation_request":false,"resource_type":"other","requested_by":"https://bluewhaleusen.com/","date":"2025-12-20T07:01:25.317Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"bluewhaleusen.com","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Fri, 19 Dec 2025 05:22:57 GMT","end":"Thu, 19 Mar 2026 05:22:56 GMT"},"fingerprint":{"sha1":"23:4C:94:04:E1:25:E0:EA:D1:85:17:4C:09:FC:E0:DA:D0:01:E6:62","sha256":"AC:EF:45:40:E0:37:3A:BD:B9:C9:32:F5:6B:B1:B8:92:BE:33:89:43:FA:25:17:17:7C:CA:50:4E:0B:CD:25:EB"}}},"request":{"raw":"GET /css/chunk-8574639a.7840c12a.css HTTP/1.1\r\nHost: bluewhaleusen.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nX-Moz: prefetch\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Sat, 20 Dec 2025 07:01:25 GMT\r\ncontent-type: text/css\r\nvary: Accept-Encoding\r\netag: W/\"1392-1766123972326\"\r\nlast-modified: Fri, 19 Dec 2025 05:59:32 GMT\r\nstrict-transport-security: max-age=31536000\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":1392,"size_decoded":0,"mime_type":"text/css","magic":"ASCII text, with very long lines (1392), with no line terminators","md5":"eddc635fcf3cb8f345a6c8bbcc9b6036","sha1":"7a3f2d798cb53dffe7cf6c52e071c865d5523bf9","sha256":"e77e73c25992fab28ae631f7d15520056b9106d43b95f0e07d73c49f5b89d984","sha512":"43c604de6411e0e4f6bc49e2bbd34338ebbb33d4b57be4b8f6707e35c5f31ec387c53308175d54075b64d61c6f10261c1b2ed4b4bda60af37255c2887cd02fdf","ssdeep":"","tlshash":"dc21f4f86136523660f3b437286142e67aa8faef51e1a10d6e8a504c9467f025f33c46","first_seen":"2024-02-19T23:01:29Z","last_seen":"2026-06-06T14:40:04.483586Z","times_seen":1365,"resource_available":false,"data":null}},"time_used":327,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":327,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2025-12-20","alert":"Sinkholed","trigger":"bluewhaleusen.com","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2025-12-20","alert":"Sinkholed","trigger":"bluewhaleusen.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2025-12-20","alert":"Sinkholed","trigger":"bluewhaleusen.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2025-12-20","alert":"Phishing Block","trigger":"bluewhaleusen.com","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2025-12-20","alert":"Sinkholed","trigger":"bluewhaleusen.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"bluewhaleusen.com/css/chunk-2bdc7c1c.d10fa6e7.css","fqdn":"bluewhaleusen.com","domain":"bluewhaleusen.com","tld":"com"},"ip":{"addr":"118.107.9.252","port":443,"asn":152194,"as":"CTG Server Limited","country":"Singapore","country_code":"SG"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://bluewhaleusen.com/","date":"2025-12-20T07:01:22.389Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"bluewhaleusen.com","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Fri, 19 Dec 2025 05:22:57 GMT","end":"Thu, 19 Mar 2026 05:22:56 GMT"},"fingerprint":{"sha1":"23:4C:94:04:E1:25:E0:EA:D1:85:17:4C:09:FC:E0:DA:D0:01:E6:62","sha256":"AC:EF:45:40:E0:37:3A:BD:B9:C9:32:F5:6B:B1:B8:92:BE:33:89:43:FA:25:17:17:7C:CA:50:4E:0B:CD:25:EB"}}},"request":{"raw":"GET /css/chunk-2bdc7c1c.d10fa6e7.css HTTP/1.1\r\nHost: bluewhaleusen.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Sat, 20 Dec 2025 07:01:22 GMT\r\ncontent-type: text/css\r\nvary: Accept-Encoding\r\netag: W/\"15177-1766123972324\"\r\nlast-modified: Fri, 19 Dec 2025 05:59:32 GMT\r\nstrict-transport-security: max-age=31536000\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":15177,"size_decoded":0,"mime_type":"text/css","magic":"ASCII text, with very long lines (15177), with no line terminators","md5":"e8f0d8a145ea382f2121421c8087d314","sha1":"2141f6a0814533f4403f813ab214c0db606ed844","sha256":"b3ade7cf169fe446ca4328caeedaa6e148e424a1c1bd5b6cfa17da8314e97eb5","sha512":"152dd11cf62faf5e0c57b51da6ee42af53261ef2bb2717bcbfb892afbc74968cdf6cc04a0a2f4a81266f072c212878851f47759d59e208af85b0802f15e03931","ssdeep":"384:iCQRDeBzT8lN9lc1J41+qFkV0vD5rw/CVFcjTK:iTe2lAJ4EFaDm0Fc/K","tlshash":"1462d87365a0963a76b79a7931c4a4ce7067e923c11742bdab59f13cc8c72a3263134e","first_seen":"2024-02-19T23:01:27Z","last_seen":"2026-07-09T07:07:04.493375Z","times_seen":101,"resource_available":false,"data":null}},"time_used":328,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":328,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2025-12-20","alert":"Phishing Block","trigger":"bluewhaleusen.com","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2025-12-20","alert":"Sinkholed","trigger":"bluewhaleusen.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2025-12-20","alert":"Sinkholed","trigger":"bluewhaleusen.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2025-12-20","alert":"Sinkholed","trigger":"bluewhaleusen.com","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2025-12-20","alert":"Sinkholed","trigger":"bluewhaleusen.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"imgtest1.s3.amazonaws.com/type/2023-03-29/06f91542-f535-445e-b3aa-04e3fb05fe8a.jpg","fqdn":"imgtest1.s3.amazonaws.com","domain":"imgtest1.s3.amazonaws.com","tld":"s3.amazonaws.com"},"ip":{"addr":"16.15.207.90","port":443,"asn":14618,"as":"AMAZON-AES","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://bluewhaleusen.com/","date":"2025-12-20T07:01:23.391Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"P256","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.s3.amazonaws.com","organization":""},"issuer":{"commonName":"Amazon RSA 2048 M01","organization":"Amazon"},"validity":{"start":"Fri, 14 Feb 2025 00:00:00 GMT","end":"Sat, 07 Feb 2026 23:59:59 GMT"},"fingerprint":{"sha1":"2E:BA:63:64:95:A8:CE:55:DD:7E:EB:A9:98:83:14:B1:6F:6B:61:69","sha256":"00:D7:0B:CC:1F:82:6B:F6:D9:2E:55:1A:BA:88:38:33:19:09:5B:85:49:41:5E:DA:A1:97:B9:D2:0A:3B:13:52"}}},"request":{"raw":"GET /type/2023-03-29/06f91542-f535-445e-b3aa-04e3fb05fe8a.jpg HTTP/1.1\r\nHost: imgtest1.s3.amazonaws.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nx-amz-id-2: W1kF0LviANKhjRuUWKWBZ5IcP/J92QKwAod1L11VeqL1ldd0+bb2b9uK0dn+OtSDFA4C6oxNhS0MX2WefW5+VSq8tCpZ5dT7\r\nx-amz-request-id: CRNMD676K9HMDV8E\r\nDate: Sat, 20 Dec 2025 07:01:25 GMT\r\nLast-Modified: Sun, 01 Sep 2024 17:37:17 GMT\r\nETag: \"1b8714109ac1c300a6848b18f4b10531\"\r\nx-amz-server-side-encryption: AES256\r\nAccept-Ranges: bytes\r\nContent-Type: image/jpeg\r\nContent-Length: 27057\r\nServer: AmazonS3\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Amazon Web Services","description":"Amazon Web Services (AWS) is a comprehensive cloud services platform offering compute power, database storage, content delivery and other functionality.","website":"https://aws.amazon.com/","common_platform_enumeration":"","icon":"Amazon Web Services.svg","categories":["PaaS"]},{"name":"Amazon S3","description":"Amazon S3 or Amazon Simple Storage Service is a service offered by Amazon Web Services (AWS) that provides object storage through a web service interface.","website":"https://aws.amazon.com/s3/","common_platform_enumeration":"","icon":"Amazon S3.svg","categories":["CDN"]}],"data":{"size":27057,"size_decoded":0,"mime_type":"image/jpeg","magic":"JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, comment: \"CREATOR: gd-jpeg v1.0 (using IJG JPEG v80), quality = 90\", baseline, precision 8, 500x500, components 3","md5":"1b8714109ac1c300a6848b18f4b10531","sha1":"1c40a9917624327dcad395e8d0a9a204e24d73d0","sha256":"952d26075b0ffa3fd64c6add8791e566a5d7010f52382b468a3f1672c5496320","sha512":"4a5388c14a734141ce576fb7e988c90418774f74d2641dfda2714951ce30264714baaa6338374f69d053de8e232efa6e658ff156ac04412adcfa3d6c41a3b94c","ssdeep":"768:G7DH6SIfn5ChIqflgQY2z+CR8hUywK3cD:GRIRCm3QY2z+nCywKE","tlshash":"2ac29d5348089fc7b13ac361bf031e6daf96bf09d495beeb10920ac7bb34655ac4d128","first_seen":"2023-11-07T02:37:41Z","last_seen":"2026-08-11T08:26:52.951551Z","times_seen":9740,"resource_available":false,"data":null}},"time_used":716,"timings":{"blocked":587,"dns":0,"connect":0,"send":0,"wait":127,"receive":2,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"mall-test.s3.amazonaws.com/test/2023-03-28/1fe3d3fd-05fc-4b1d-a8fc-364e9d33fcc4.jpg","fqdn":"mall-test.s3.amazonaws.com","domain":"mall-test.s3.amazonaws.com","tld":"s3.amazonaws.com"},"ip":{"addr":"3.5.30.74","port":443,"asn":14618,"as":"AMAZON-AES","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://bluewhaleusen.com/","date":"2025-12-20T07:01:23.456Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"P256","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"s3.amazonaws.com","organization":""},"issuer":{"commonName":"Amazon RSA 2048 M01","organization":"Amazon"},"validity":{"start":"Fri, 19 Sep 2025 00:00:00 GMT","end":"Sun, 23 Aug 2026 23:59:59 GMT"},"fingerprint":{"sha1":"48:FD:CD:50:85:6A:51:E7:71:E4:CB:E0:03:81:E1:EC:4E:AD:9E:C7","sha256":"D7:11:81:F4:91:03:0D:C6:A5:DE:8A:EF:AA:58:14:BA:AD:33:B5:11:8B:D5:F0:33:53:8B:AF:49:82:E9:4B:A4"}}},"request":{"raw":"GET /test/2023-03-28/1fe3d3fd-05fc-4b1d-a8fc-364e9d33fcc4.jpg HTTP/1.1\r\nHost: mall-test.s3.amazonaws.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nx-amz-id-2: cPZM6/YUDHcSNSnEvZqVPD4Yp0HivgLkU+YVF+9ZORvJcpHtS7yI6AqZUlNlZiChHJawgbFPO5n1hT1IfK6V5py9lwA9msFz\r\nx-amz-request-id: S19H9NP4B1SNXCZ5\r\nDate: Sat, 20 Dec 2025 07:01:24 GMT\r\nLast-Modified: Wed, 22 May 2024 20:47:35 GMT\r\nETag: \"ccff69006dcd3e1ecc8e139bfe9c5a9c\"\r\nx-amz-server-side-encryption: AES256\r\nAccept-Ranges: bytes\r\nContent-Type: image/jpeg\r\nContent-Length: 12326\r\nServer: AmazonS3\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Amazon S3","description":"Amazon S3 or Amazon Simple Storage Service is a service offered by Amazon Web Services (AWS) that provides object storage through a web service interface.","website":"https://aws.amazon.com/s3/","common_platform_enumeration":"","icon":"Amazon S3.svg","categories":["CDN"]},{"name":"Amazon Web Services","description":"Amazon Web Services (AWS) is a comprehensive cloud services platform offering compute power, database storage, content delivery and other functionality.","website":"https://aws.amazon.com/","common_platform_enumeration":"","icon":"Amazon Web Services.svg","categories":["PaaS"]}],"data":{"size":12326,"size_decoded":0,"mime_type":"image/jpeg","magic":"JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 1060x507, components 3","md5":"ccff69006dcd3e1ecc8e139bfe9c5a9c","sha1":"723f319128c6d63041259ce5725aaf670ef7f890","sha256":"d3e206d3a678978521738381d06e6fdd5e0371d55a6429cbf8f526c66cde11aa","sha512":"67a316dfe938235480a09e76e0bc23d4555ac73edafa80ad8ba860e9f4dbaf96cbbad1c4d5df1316ed77be2e41e943f336e9e1815bd2f7c834e6d64fd87358e8","ssdeep":"384:1K1hYtA+jmAI17ZItgLQWG1y5p/RDp8Wq:1tDjG9LXGstDaWq","tlshash":"e142ae55ed8640e4c938bff4463b42245a1aee3cafb0b1d60b964ca7ea126401f4ddbd","first_seen":"2024-02-19T23:01:28Z","last_seen":"2026-08-09T04:44:19.208457Z","times_seen":7702,"resource_available":false,"data":null}},"time_used":616,"timings":{"blocked":241,"dns":14,"connect":95,"send":0,"wait":121,"receive":1,"ssl":108},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"bluewhaleusen.com/img/right2.25e8da4c.jpeg","fqdn":"bluewhaleusen.com","domain":"bluewhaleusen.com","tld":"com"},"ip":{"addr":"118.107.9.252","port":443,"asn":152194,"as":"CTG Server Limited","country":"Singapore","country_code":"SG"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://bluewhaleusen.com/","date":"2025-12-20T07:01:24.287Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"bluewhaleusen.com","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Fri, 19 Dec 2025 05:22:57 GMT","end":"Thu, 19 Mar 2026 05:22:56 GMT"},"fingerprint":{"sha1":"23:4C:94:04:E1:25:E0:EA:D1:85:17:4C:09:FC:E0:DA:D0:01:E6:62","sha256":"AC:EF:45:40:E0:37:3A:BD:B9:C9:32:F5:6B:B1:B8:92:BE:33:89:43:FA:25:17:17:7C:CA:50:4E:0B:CD:25:EB"}}},"request":{"raw":"GET /img/right2.25e8da4c.jpeg HTTP/1.1\r\nHost: bluewhaleusen.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Sat, 20 Dec 2025 07:01:24 GMT\r\ncontent-type: image/jpeg\r\nvary: Accept-Encoding\r\netag: W/\"6980-1766123972362\"\r\nlast-modified: Fri, 19 Dec 2025 05:59:32 GMT\r\nstrict-transport-security: max-age=31536000\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":6980,"size_decoded":0,"mime_type":"image/jpeg","magic":"JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 242x154, components 3","md5":"25e8da4c4b1263171fbf7413200e71bc","sha1":"3e1fb68f1cf14cbf55be70f0e6dc594dbf65329d","sha256":"3ebc5071b1ab7f3a8af777c3bafc8f92199e1a4a3371089479f6a309c64ee09f","sha512":"da4e8bcb866441475ac17723ca3c9aa8ce2be55120f65fc1b49ddcf5d1372c361496dae3ef874f2a8c26e050f64d62a6cf1c29d41cb3e6bc688b3fad293c8af5","ssdeep":"192:EGIAChhHACQc4X2g7B0WiYHgv+YLX8RrI9GMftmR:4ACPHACQcBg7BUYHgv/Qt","tlshash":"0ee1adacdfc4a976df2da13f45613a1a36236b0bbfd39bbb65486d20dc55cb012d0050","first_seen":"2024-02-19T23:01:28Z","last_seen":"2026-08-11T08:26:52.958697Z","times_seen":416,"resource_available":false,"data":null}},"time_used":327,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":327,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2025-12-20","alert":"Sinkholed","trigger":"bluewhaleusen.com","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2025-12-20","alert":"Phishing Block","trigger":"bluewhaleusen.com","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2025-12-20","alert":"Sinkholed","trigger":"bluewhaleusen.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2025-12-20","alert":"Sinkholed","trigger":"bluewhaleusen.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2025-12-20","alert":"Sinkholed","trigger":"bluewhaleusen.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"bluewhaleusen.com/css/chunk-6140a976.c70dd4a7.css","fqdn":"bluewhaleusen.com","domain":"bluewhaleusen.com","tld":"com"},"ip":{"addr":"118.107.9.252","port":443,"asn":152194,"as":"CTG Server Limited","country":"Singapore","country_code":"SG"},"is_navigation_request":false,"resource_type":"other","requested_by":"https://bluewhaleusen.com/","date":"2025-12-20T07:01:24.628Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"bluewhaleusen.com","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Fri, 19 Dec 2025 05:22:57 GMT","end":"Thu, 19 Mar 2026 05:22:56 GMT"},"fingerprint":{"sha1":"23:4C:94:04:E1:25:E0:EA:D1:85:17:4C:09:FC:E0:DA:D0:01:E6:62","sha256":"AC:EF:45:40:E0:37:3A:BD:B9:C9:32:F5:6B:B1:B8:92:BE:33:89:43:FA:25:17:17:7C:CA:50:4E:0B:CD:25:EB"}}},"request":{"raw":"GET /css/chunk-6140a976.c70dd4a7.css HTTP/1.1\r\nHost: bluewhaleusen.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nX-Moz: prefetch\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Sat, 20 Dec 2025 07:01:24 GMT\r\ncontent-type: text/css\r\ncontent-length: 111\r\netag: W/\"111-1766123972328\"\r\nlast-modified: Fri, 19 Dec 2025 05:59:32 GMT\r\nstrict-transport-security: max-age=31536000\r\naccept-ranges: bytes\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":111,"size_decoded":0,"mime_type":"text/css","magic":"ASCII text, with no line terminators","md5":"6fa0ecf4147c8ce0222c50c699e3807a","sha1":"a77f07547a33f9b6ec67e6eed37629f508f97a6b","sha256":"6943a6d74dcebdb81ed9b48152a94e537946bd452b87590c4179c966722f5719","sha512":"8cc93fbb80c2bbce59ed5c2bf12fbe7ca0c49da27fa32ef1bbaafbf84aace700d4e60931ad95010ae4f7a5405b3e6f475e9ebf8431beb768ddf5d95ac4efb1ef","ssdeep":"","tlshash":"66b0123a734b04fc8c2ff0203f5988b87ec13322e11924035f9c8024451e7027c30210","first_seen":"2024-02-11T04:26:49Z","last_seen":"2026-06-06T14:40:04.445601Z","times_seen":8474,"resource_available":false,"data":null}},"time_used":326,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":326,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2025-12-20","alert":"Sinkholed","trigger":"bluewhaleusen.com","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2025-12-20","alert":"Sinkholed","trigger":"bluewhaleusen.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2025-12-20","alert":"Phishing Block","trigger":"bluewhaleusen.com","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2025-12-20","alert":"Sinkholed","trigger":"bluewhaleusen.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2025-12-20","alert":"Sinkholed","trigger":"bluewhaleusen.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"bluewhaleusen.com/js/chunk-2d216070.6f18bc8a.js","fqdn":"bluewhaleusen.com","domain":"bluewhaleusen.com","tld":"com"},"ip":{"addr":"118.107.9.252","port":443,"asn":152194,"as":"CTG Server Limited","country":"Singapore","country_code":"SG"},"is_navigation_request":false,"resource_type":"other","requested_by":"https://bluewhaleusen.com/","date":"2025-12-20T07:01:26.594Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"bluewhaleusen.com","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Fri, 19 Dec 2025 05:22:57 GMT","end":"Thu, 19 Mar 2026 05:22:56 GMT"},"fingerprint":{"sha1":"23:4C:94:04:E1:25:E0:EA:D1:85:17:4C:09:FC:E0:DA:D0:01:E6:62","sha256":"AC:EF:45:40:E0:37:3A:BD:B9:C9:32:F5:6B:B1:B8:92:BE:33:89:43:FA:25:17:17:7C:CA:50:4E:0B:CD:25:EB"}}},"request":{"raw":"GET /js/chunk-2d216070.6f18bc8a.js HTTP/1.1\r\nHost: bluewhaleusen.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nX-Moz: prefetch\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Sat, 20 Dec 2025 07:01:26 GMT\r\ncontent-type: application/javascript\r\ncontent-length: 371\r\netag: W/\"371-1766123972308\"\r\nlast-modified: Fri, 19 Dec 2025 05:59:32 GMT\r\nstrict-transport-security: max-age=31536000\r\naccept-ranges: bytes\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":371,"size_decoded":0,"mime_type":"application/javascript","magic":"JavaScript source, ASCII text, with very long lines (371), with no line terminators","md5":"7669c29098998eb84edefdc24294f960","sha1":"26cc7266d1f0c666a252628498f3ec292234f1a3","sha256":"df12a06d14739404cd7eb88cb43de5628268cd5bfd982ae24001ea699ce071aa","sha512":"3f6a111ca2b6b22d451f182f47878fd9302c9bae2528d2829c55f1e9752a51b6cc87a4ee17c63ad2908aa2c08d9191435d162f160c77ac8c8516d87cbbd4a550","ssdeep":"","tlshash":"a3e0c07820537ebc435c30ce227f5593c85b1c090ed754e12ed0c499a27561f4520b99","first_seen":"2024-09-28T07:44:49.473991Z","last_seen":"2026-06-06T14:40:04.509104Z","times_seen":152,"resource_available":false,"data":null}},"time_used":327,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":327,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2025-12-20","alert":"Sinkholed","trigger":"bluewhaleusen.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2025-12-20","alert":"Sinkholed","trigger":"bluewhaleusen.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2025-12-20","alert":"Sinkholed","trigger":"bluewhaleusen.com","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2025-12-20","alert":"Phishing Block","trigger":"bluewhaleusen.com","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2025-12-20","alert":"Sinkholed","trigger":"bluewhaleusen.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"bluewhaleusen.com/wap/api/newOnlinechat!unread.action?lang=en","fqdn":"bluewhaleusen.com","domain":"bluewhaleusen.com","tld":"com"},"ip":{"addr":"118.107.9.252","port":443,"asn":152194,"as":"CTG Server Limited","country":"Singapore","country_code":"SG"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"https://bluewhaleusen.com/","date":"2025-12-20T07:01:22.988Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"bluewhaleusen.com","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Fri, 19 Dec 2025 05:22:57 GMT","end":"Thu, 19 Mar 2026 05:22:56 GMT"},"fingerprint":{"sha1":"23:4C:94:04:E1:25:E0:EA:D1:85:17:4C:09:FC:E0:DA:D0:01:E6:62","sha256":"AC:EF:45:40:E0:37:3A:BD:B9:C9:32:F5:6B:B1:B8:92:BE:33:89:43:FA:25:17:17:7C:CA:50:4E:0B:CD:25:EB"}}},"request":{"raw":"GET /wap/api/newOnlinechat!unread.action?lang=en HTTP/1.1\r\nHost: bluewhaleusen.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/json, text/plain, */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Sat, 20 Dec 2025 07:01:23 GMT\r\ncontent-type: application/json;charset=UTF-8\r\nvary: Accept-Encoding, Origin, Access-Control-Request-Method, Access-Control-Request-Headers\r\nstrict-transport-security: max-age=31536000\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":32,"size_decoded":0,"mime_type":"application/json; charset=UTF-8","magic":"JSON text data","md5":"472e9a7530675f76d965067fcba6278d","sha1":"e1fdae764ba06c37792e7b2a2549c88cf3350b09","sha256":"26de7e215697f7b90d77581633fd7fe0b379ba230d1a9c1a0b502ed862b3f5bd","sha512":"7f765b18a1b6f5818daf3905ed24ae9f4283248ac7a41bfcca65dd1be696c9a741d510629b6134940784b3cb832fe3be7fa76881cb2d01f226e1246a70039e7a","ssdeep":"","tlshash":"47800000280e2c0b08032088a88c3a0080ae22a308c0cb308e8cab3080ae2b22000830","first_seen":"2024-02-19T23:01:28Z","last_seen":"2026-08-11T08:26:52.925376Z","times_seen":8777,"resource_available":false,"data":null}},"time_used":424,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":424,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2025-12-20","alert":"Sinkholed","trigger":"bluewhaleusen.com","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2025-12-20","alert":"Phishing Block","trigger":"bluewhaleusen.com","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2025-12-20","alert":"Sinkholed","trigger":"bluewhaleusen.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2025-12-20","alert":"Sinkholed","trigger":"bluewhaleusen.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2025-12-20","alert":"Sinkholed","trigger":"bluewhaleusen.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"bluewhaleusen.com/css/app.c8421c31.css","fqdn":"bluewhaleusen.com","domain":"bluewhaleusen.com","tld":"com"},"ip":{"addr":"118.107.9.252","port":443,"asn":152194,"as":"CTG Server Limited","country":"Singapore","country_code":"SG"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://bluewhaleusen.com/","date":"2025-12-20T07:01:19.282Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"bluewhaleusen.com","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Fri, 19 Dec 2025 05:22:57 GMT","end":"Thu, 19 Mar 2026 05:22:56 GMT"},"fingerprint":{"sha1":"23:4C:94:04:E1:25:E0:EA:D1:85:17:4C:09:FC:E0:DA:D0:01:E6:62","sha256":"AC:EF:45:40:E0:37:3A:BD:B9:C9:32:F5:6B:B1:B8:92:BE:33:89:43:FA:25:17:17:7C:CA:50:4E:0B:CD:25:EB"}}},"request":{"raw":"GET /css/app.c8421c31.css HTTP/1.1\r\nHost: bluewhaleusen.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Sat, 20 Dec 2025 07:01:19 GMT\r\ncontent-type: text/css\r\nvary: Accept-Encoding\r\netag: W/\"236420-1766123972326\"\r\nlast-modified: Fri, 19 Dec 2025 05:59:32 GMT\r\nstrict-transport-security: max-age=31536000\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":236420,"size_decoded":0,"mime_type":"text/css","magic":"ASCII text, with very long lines (65536), with no line terminators","md5":"52a25058cecc3f12718b102cc7ff25d4","sha1":"96947a901512a312feaa379eb10abdf9d37970c1","sha256":"8df62d59ad260756341a47ae19f700293ac55b5ccd52ea633c44f4ccef4ee7d9","sha512":"afd6cee80fb6736ab4f78908eca1f4f289efe19e83db35fec5f73587d2b28d8e73b802ff73e54aea724c62ea5a03afac26e4735f3466c884ee0c717e89675bbe","ssdeep":"1536:QgXC6l3028Y7SrW3YeWXA1u9w4HCe/l4RdgW9cMEcWAp7KO6iZkJgYu8e0r8kvXc:5dFJWTPL4Q+05q2pe","tlshash":"4b34b610db17217b222be66d75c0ba886f28c323d9725b7bfd95741ccae64891163e0f","first_seen":"2025-07-22T13:04:23.393237Z","last_seen":"2025-12-20T07:02:05.157466Z","times_seen":25,"resource_available":false,"data":null}},"time_used":336,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":336,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2025-12-20","alert":"Sinkholed","trigger":"bluewhaleusen.com","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2025-12-20","alert":"Sinkholed","trigger":"bluewhaleusen.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2025-12-20","alert":"Sinkholed","trigger":"bluewhaleusen.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2025-12-20","alert":"Sinkholed","trigger":"bluewhaleusen.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2025-12-20","alert":"Phishing Block","trigger":"bluewhaleusen.com","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"shop-shangcheng-shangchuan2.s3.amazonaws.com/type/2024-09-01/087efb4b-f057-45a7-b70b-5a072bae6599.jpg","fqdn":"shop-shangcheng-shangchuan2.s3.amazonaws.com","domain":"shop-shangcheng-shangchuan2.s3.amazonaws.com","tld":"s3.amazonaws.com"},"ip":{"addr":"3.5.27.242","port":443,"asn":14618,"as":"AMAZON-AES","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://bluewhaleusen.com/","date":"2025-12-20T07:01:23.315Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"P256","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"s3.amazonaws.com","organization":""},"issuer":{"commonName":"Amazon RSA 2048 M01","organization":"Amazon"},"validity":{"start":"Fri, 19 Sep 2025 00:00:00 GMT","end":"Sun, 23 Aug 2026 23:59:59 GMT"},"fingerprint":{"sha1":"48:FD:CD:50:85:6A:51:E7:71:E4:CB:E0:03:81:E1:EC:4E:AD:9E:C7","sha256":"D7:11:81:F4:91:03:0D:C6:A5:DE:8A:EF:AA:58:14:BA:AD:33:B5:11:8B:D5:F0:33:53:8B:AF:49:82:E9:4B:A4"}}},"request":{"raw":"GET /type/2024-09-01/087efb4b-f057-45a7-b70b-5a072bae6599.jpg HTTP/1.1\r\nHost: shop-shangcheng-shangchuan2.s3.amazonaws.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 403 Forbidden\r\nx-amz-request-id: CRNP18Z3FTPV400P\r\nx-amz-id-2: 53BHdiOmbLpHMGxoc+2jJUTj5UfypCrojtz2yZ7xzFadRYvO2uX55j9tT+z+o/apGKLT4qeyGRgMCA4zVJn83ZYaxzkjeiOYecsDt2I/1OE=\r\nContent-Type: application/xml\r\nTransfer-Encoding: chunked\r\nDate: Sat, 20 Dec 2025 07:01:23 GMT\r\nServer: AmazonS3\r\n\r\n","headers":null,"cookies":null,"status_code":"403","status_text":"Forbidden","fingerprints":[{"name":"Amazon S3","description":"Amazon S3 or Amazon Simple Storage Service is a service offered by Amazon Web Services (AWS) that provides object storage through a web service interface.","website":"https://aws.amazon.com/s3/","common_platform_enumeration":"","icon":"Amazon S3.svg","categories":["CDN"]},{"name":"Amazon Web Services","description":"Amazon Web Services (AWS) is a comprehensive cloud services platform offering compute power, database storage, content delivery and other functionality.","website":"https://aws.amazon.com/","common_platform_enumeration":"","icon":"Amazon Web Services.svg","categories":["PaaS"]}],"data":{"size":0,"size_decoded":0,"mime_type":"application/xml","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-08-11T16:57:26.648985Z","times_seen":17840002,"resource_available":true,"data":null}},"time_used":1411,"timings":{"blocked":657,"dns":23,"connect":92,"send":0,"wait":100,"receive":0,"ssl":536},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"mall-test.s3.amazonaws.com/test/2023-03-28/9a213d9c-85e4-4845-ba6f-92cdb3aadc7c.jpg","fqdn":"mall-test.s3.amazonaws.com","domain":"mall-test.s3.amazonaws.com","tld":"s3.amazonaws.com"},"ip":{"addr":"3.5.30.74","port":443,"asn":14618,"as":"AMAZON-AES","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://bluewhaleusen.com/","date":"2025-12-20T07:01:23.656Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"P256","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"s3.amazonaws.com","organization":""},"issuer":{"commonName":"Amazon RSA 2048 M01","organization":"Amazon"},"validity":{"start":"Fri, 19 Sep 2025 00:00:00 GMT","end":"Sun, 23 Aug 2026 23:59:59 GMT"},"fingerprint":{"sha1":"48:FD:CD:50:85:6A:51:E7:71:E4:CB:E0:03:81:E1:EC:4E:AD:9E:C7","sha256":"D7:11:81:F4:91:03:0D:C6:A5:DE:8A:EF:AA:58:14:BA:AD:33:B5:11:8B:D5:F0:33:53:8B:AF:49:82:E9:4B:A4"}}},"request":{"raw":"GET /test/2023-03-28/9a213d9c-85e4-4845-ba6f-92cdb3aadc7c.jpg HTTP/1.1\r\nHost: mall-test.s3.amazonaws.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nx-amz-id-2: WXUYqo0YiGkCsr8SXPzSBXlTWTIRPgCZpfxehRaTaPBY4cQT9H7yyXcnJlOudATRy0UTdPXemF0SHSx3namUrjFpohVvZIvo\r\nx-amz-request-id: CRNWAJAPTDJ3JGVY\r\nDate: Sat, 20 Dec 2025 07:01:25 GMT\r\nLast-Modified: Wed, 22 May 2024 20:52:01 GMT\r\nETag: \"79f3749e1ce4bf0c9b013f036b12791b\"\r\nx-amz-server-side-encryption: AES256\r\nAccept-Ranges: bytes\r\nContent-Type: image/jpeg\r\nContent-Length: 214318\r\nServer: AmazonS3\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Amazon S3","description":"Amazon S3 or Amazon Simple Storage Service is a service offered by Amazon Web Services (AWS) that provides object storage through a web service interface.","website":"https://aws.amazon.com/s3/","common_platform_enumeration":"","icon":"Amazon S3.svg","categories":["CDN"]},{"name":"Amazon Web Services","description":"Amazon Web Services (AWS) is a comprehensive cloud services platform offering compute power, database storage, content delivery and other functionality.","website":"https://aws.amazon.com/","common_platform_enumeration":"","icon":"Amazon Web Services.svg","categories":["PaaS"]}],"data":{"size":214318,"size_decoded":0,"mime_type":"image/jpeg","magic":"JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 1500x1492, components 3","md5":"79f3749e1ce4bf0c9b013f036b12791b","sha1":"2383c153836375b545a5a5d7c0587ce23bbf1785","sha256":"516a56ae2089333d31ff7eef34b9942743c8b077a55dae222d567e90f58b553d","sha512":"e162bb540582b4bab16f6a0f6a72904ff3be287a953d66b4d02b5a63378ac09a8f932ea9df364267c7b2bb91f64bd11e7425b116285cd82c063f6929b744ccf3","ssdeep":"3072:Ho4OmbHzuE6nENQor3/n5uuZYsV6ilOAn4DJfBg0ThTGlPVjDLQ8CBPMDY:IyUmb/n40iilOAqhTBGZOCY","tlshash":"e22412d80f233e94f604b131c79d339d1a3af6e7b9e70672790699921c3886d3e513a8","first_seen":"2024-02-19T23:01:29Z","last_seen":"2026-08-09T04:44:19.257986Z","times_seen":7320,"resource_available":false,"data":null}},"time_used":1003,"timings":{"blocked":884,"dns":0,"connect":0,"send":0,"wait":113,"receive":6,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"mall-test.s3.amazonaws.com/avatar/2023-03-21/0d5a21f1-ed79-4cc9-8779-240cb4bf5732.png","fqdn":"mall-test.s3.amazonaws.com","domain":"mall-test.s3.amazonaws.com","tld":"s3.amazonaws.com"},"ip":{"addr":"3.5.30.74","port":443,"asn":14618,"as":"AMAZON-AES","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://bluewhaleusen.com/","date":"2025-12-20T07:01:24.260Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"P256","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"s3.amazonaws.com","organization":""},"issuer":{"commonName":"Amazon RSA 2048 M01","organization":"Amazon"},"validity":{"start":"Fri, 19 Sep 2025 00:00:00 GMT","end":"Sun, 23 Aug 2026 23:59:59 GMT"},"fingerprint":{"sha1":"48:FD:CD:50:85:6A:51:E7:71:E4:CB:E0:03:81:E1:EC:4E:AD:9E:C7","sha256":"D7:11:81:F4:91:03:0D:C6:A5:DE:8A:EF:AA:58:14:BA:AD:33:B5:11:8B:D5:F0:33:53:8B:AF:49:82:E9:4B:A4"}}},"request":{"raw":"GET /avatar/2023-03-21/0d5a21f1-ed79-4cc9-8779-240cb4bf5732.png HTTP/1.1\r\nHost: mall-test.s3.amazonaws.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nx-amz-id-2: Joe37pPViIliWGMc5PbW/KlXezhdUOupAqt43xT2A6dt/WVVZlxW57A9P5xOrrcTQLmQHryF0iHZXLlLThqIUzMYgNBQmQCZ\r\nx-amz-request-id: CRNGYT9D9CN3M2FR\r\nDate: Sat, 20 Dec 2025 07:01:25 GMT\r\nLast-Modified: Tue, 21 May 2024 17:21:39 GMT\r\nETag: \"7175102fc4616889be030062b226e3a3\"\r\nx-amz-server-side-encryption: AES256\r\nx-amz-meta-myval: test\r\nAccept-Ranges: bytes\r\nContent-Type: application/octet-stream\r\nContent-Length: 67611\r\nServer: AmazonS3\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Amazon Web Services","description":"Amazon Web Services (AWS) is a comprehensive cloud services platform offering compute power, database storage, content delivery and other functionality.","website":"https://aws.amazon.com/","common_platform_enumeration":"","icon":"Amazon Web Services.svg","categories":["PaaS"]},{"name":"Amazon S3","description":"Amazon S3 or Amazon Simple Storage Service is a service offered by Amazon Web Services (AWS) that provides object storage through a web service interface.","website":"https://aws.amazon.com/s3/","common_platform_enumeration":"","icon":"Amazon S3.svg","categories":["CDN"]}],"data":{"size":67611,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 265 x 227, 8-bit/color RGB, non-interlaced","md5":"7175102fc4616889be030062b226e3a3","sha1":"be71c0c658b31579b771392f78bd595d79736263","sha256":"514fe41fbd4810bf3f4c32bf00fe1a52b3c8554155f35522f273d07e2efe573c","sha512":"d14997044494b712da27781a9d0cd05e21eee861e125c176c5a114cce3373f6ad0ffc0a25fc4f255b9f57119e8a67f812cfe332f5ee4ad249474f756b01b4d78","ssdeep":"1536:bHy816ssKdZahzOGNATlKjrL17FlmryIEbywHhUZ9gX1pjoJA9Rk7P:Dy816xKdOyGNATmp9TryDqdo+fmP","tlshash":"c263022203e5a5ff5bd28da8fefd4320648900be1d5d4d7ac642cec4bad7d26426897c","first_seen":"2024-02-19T23:01:29Z","last_seen":"2026-06-22T12:09:53.766337Z","times_seen":2306,"resource_available":false,"data":null}},"time_used":480,"timings":{"blocked":369,"dns":0,"connect":0,"send":0,"wait":109,"receive":2,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"bluewhaleusen.com/img/right1.fa614e85.jpeg","fqdn":"bluewhaleusen.com","domain":"bluewhaleusen.com","tld":"com"},"ip":{"addr":"118.107.9.252","port":443,"asn":152194,"as":"CTG Server Limited","country":"Singapore","country_code":"SG"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://bluewhaleusen.com/","date":"2025-12-20T07:01:24.285Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"bluewhaleusen.com","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Fri, 19 Dec 2025 05:22:57 GMT","end":"Thu, 19 Mar 2026 05:22:56 GMT"},"fingerprint":{"sha1":"23:4C:94:04:E1:25:E0:EA:D1:85:17:4C:09:FC:E0:DA:D0:01:E6:62","sha256":"AC:EF:45:40:E0:37:3A:BD:B9:C9:32:F5:6B:B1:B8:92:BE:33:89:43:FA:25:17:17:7C:CA:50:4E:0B:CD:25:EB"}}},"request":{"raw":"GET /img/right1.fa614e85.jpeg HTTP/1.1\r\nHost: bluewhaleusen.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Sat, 20 Dec 2025 07:01:24 GMT\r\ncontent-type: image/jpeg\r\nvary: Accept-Encoding\r\netag: W/\"4805-1766123972361\"\r\nlast-modified: Fri, 19 Dec 2025 05:59:32 GMT\r\nstrict-transport-security: max-age=31536000\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":4805,"size_decoded":0,"mime_type":"image/jpeg","magic":"JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 242x154, components 3","md5":"fa614e8564bd8fa171946cee9c08504c","sha1":"5ad655b83ee431328fd0f99245fc9ba34f921478","sha256":"6679a46d4c1ad7d989cfebb329c48714ecb8b737239e33e05bbd07cf6a228734","sha512":"e8151e57150ee33a29e7c6a436556874696b187531be777b7ed2441f5ee927ac77d47c546bf5c8026f3a3ac6c64102ef9a5eeec7f17720bac2250e27be35f0e7","ssdeep":"96:WhS4TkAFMLFwDLyk6KPTLPwrAO824idlifhcL1qYIwEfRHNRXb9z:EdFMJiOklLLGvG83ELRXF","tlshash":"4fa18d4f67b66c5eebba8b7c042c8f982912dc1159321fb905a05c199d2fcfad9603d1","first_seen":"2024-02-19T23:01:28Z","last_seen":"2026-08-11T08:26:52.929563Z","times_seen":413,"resource_available":false,"data":null}},"time_used":327,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":327,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2025-12-20","alert":"Phishing Block","trigger":"bluewhaleusen.com","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2025-12-20","alert":"Sinkholed","trigger":"bluewhaleusen.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2025-12-20","alert":"Sinkholed","trigger":"bluewhaleusen.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2025-12-20","alert":"Sinkholed","trigger":"bluewhaleusen.com","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2025-12-20","alert":"Sinkholed","trigger":"bluewhaleusen.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"bluewhaleusen.com/img/right6.d31ff0c9.jpeg","fqdn":"bluewhaleusen.com","domain":"bluewhaleusen.com","tld":"com"},"ip":{"addr":"118.107.9.252","port":443,"asn":152194,"as":"CTG Server Limited","country":"Singapore","country_code":"SG"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://bluewhaleusen.com/","date":"2025-12-20T07:01:24.291Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"bluewhaleusen.com","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Fri, 19 Dec 2025 05:22:57 GMT","end":"Thu, 19 Mar 2026 05:22:56 GMT"},"fingerprint":{"sha1":"23:4C:94:04:E1:25:E0:EA:D1:85:17:4C:09:FC:E0:DA:D0:01:E6:62","sha256":"AC:EF:45:40:E0:37:3A:BD:B9:C9:32:F5:6B:B1:B8:92:BE:33:89:43:FA:25:17:17:7C:CA:50:4E:0B:CD:25:EB"}}},"request":{"raw":"GET /img/right6.d31ff0c9.jpeg HTTP/1.1\r\nHost: bluewhaleusen.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Sat, 20 Dec 2025 07:01:24 GMT\r\ncontent-type: image/jpeg\r\nvary: Accept-Encoding\r\netag: W/\"5088-1766123972371\"\r\nlast-modified: Fri, 19 Dec 2025 05:59:32 GMT\r\nstrict-transport-security: max-age=31536000\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":5088,"size_decoded":0,"mime_type":"image/jpeg","magic":"JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 242x152, components 3","md5":"d31ff0c92e1350ed230b476c5a6abe57","sha1":"f522efafd87db548b2668b87aba1275611d020ab","sha256":"e751d8d2c37716c80619a6134d0e39db5b9fc5584cc790f28760e8cccad3ea23","sha512":"e8a0c93d1ea07f200b6df3d93b57c80597cfdfa78e66e1ebea084b50f859d5438f3f7e2d0000727b1d33b080f31d6afdd2fd9c0c0fd61257aee09a076e7fd6d1","ssdeep":"96:Whx3YqBhBnFMEKYhu/hCbjftpvzaHZx+RxXP+1VHaWccmRAi5sx:EZdn2E2+nba5uZ+1VHatN6","tlshash":"c5a15c81f653a917db8292b095a47f100b116c372be277ba9a02581c1887ef21439b96","first_seen":"2024-02-19T23:01:29Z","last_seen":"2026-08-11T08:26:52.964916Z","times_seen":420,"resource_available":false,"data":null}},"time_used":603,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":603,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2025-12-20","alert":"Phishing Block","trigger":"bluewhaleusen.com","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2025-12-20","alert":"Sinkholed","trigger":"bluewhaleusen.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2025-12-20","alert":"Sinkholed","trigger":"bluewhaleusen.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2025-12-20","alert":"Sinkholed","trigger":"bluewhaleusen.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2025-12-20","alert":"Sinkholed","trigger":"bluewhaleusen.com","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"imgtest1.s3.amazonaws.com/type/2023-03-29/fd370537-bc59-4d31-a9c8-e7bbfebb9c9f.jpg","fqdn":"imgtest1.s3.amazonaws.com","domain":"imgtest1.s3.amazonaws.com","tld":"s3.amazonaws.com"},"ip":{"addr":"16.15.207.90","port":443,"asn":14618,"as":"AMAZON-AES","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://bluewhaleusen.com/","date":"2025-12-20T07:01:23.377Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"P256","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.s3.amazonaws.com","organization":""},"issuer":{"commonName":"Amazon RSA 2048 M01","organization":"Amazon"},"validity":{"start":"Fri, 14 Feb 2025 00:00:00 GMT","end":"Sat, 07 Feb 2026 23:59:59 GMT"},"fingerprint":{"sha1":"2E:BA:63:64:95:A8:CE:55:DD:7E:EB:A9:98:83:14:B1:6F:6B:61:69","sha256":"00:D7:0B:CC:1F:82:6B:F6:D9:2E:55:1A:BA:88:38:33:19:09:5B:85:49:41:5E:DA:A1:97:B9:D2:0A:3B:13:52"}}},"request":{"raw":"GET /type/2023-03-29/fd370537-bc59-4d31-a9c8-e7bbfebb9c9f.jpg HTTP/1.1\r\nHost: imgtest1.s3.amazonaws.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nx-amz-id-2: Y8Ptv58okR2uSD6PszScIKo8NxkcWZ83wAl9H1zHsRJrKinXE7/2oVkAe0aEMzFXkVeCeLSgayVL1bUnkTVLo4B/XrnZtYNm\r\nx-amz-request-id: S19N5PDNETMQFVHR\r\nDate: Sat, 20 Dec 2025 07:01:24 GMT\r\nLast-Modified: Sun, 01 Sep 2024 17:37:19 GMT\r\nETag: \"87706f749b341f09c0d4f313a08fc43e\"\r\nx-amz-server-side-encryption: AES256\r\nAccept-Ranges: bytes\r\nContent-Type: image/jpeg\r\nContent-Length: 29992\r\nServer: AmazonS3\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Amazon S3","description":"Amazon S3 or Amazon Simple Storage Service is a service offered by Amazon Web Services (AWS) that provides object storage through a web service interface.","website":"https://aws.amazon.com/s3/","common_platform_enumeration":"","icon":"Amazon S3.svg","categories":["CDN"]},{"name":"Amazon Web Services","description":"Amazon Web Services (AWS) is a comprehensive cloud services platform offering compute power, database storage, content delivery and other functionality.","website":"https://aws.amazon.com/","common_platform_enumeration":"","icon":"Amazon Web Services.svg","categories":["PaaS"]}],"data":{"size":29992,"size_decoded":0,"mime_type":"image/jpeg","magic":"JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, comment: \"CREATOR: gd-jpeg v1.0 (using IJG JPEG v80), quality = 90\", baseline, precision 8, 500x500, components 3","md5":"87706f749b341f09c0d4f313a08fc43e","sha1":"1509845938ec37024267488237d11e718cde9f13","sha256":"b7fe2721d939005c3d167ba39f1512ee5ba880a08fe370ab93dab990ff0a914f","sha512":"862ad1c48221a29e8fbeeef1be46b06d77617afd44de9e63598e0f746aa0277ef3c79366454df627aa6c12f465440d729d9157ba768922c90a574439df2d195c","ssdeep":"768:Gv6RenUljXtCiU+uKMHNDBp56HJJg0+Fz7P:GVnUlJFiuJ6FfP","tlshash":"67d2ad27aa50afd7b448d7a2ff030d862fda522c41d439de81d76b436b18b77480d1ad","first_seen":"2023-11-07T02:37:43Z","last_seen":"2026-08-11T08:26:52.937898Z","times_seen":9954,"resource_available":false,"data":null}},"time_used":561,"timings":{"blocked":446,"dns":0,"connect":0,"send":0,"wait":114,"receive":1,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"mall-test.s3.amazonaws.com/pachong/gaoqing/B07DWPTLJR/514KL6gAvYL._AC_SL1000_.jpg","fqdn":"mall-test.s3.amazonaws.com","domain":"mall-test.s3.amazonaws.com","tld":"s3.amazonaws.com"},"ip":{"addr":"3.5.30.74","port":443,"asn":14618,"as":"AMAZON-AES","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://bluewhaleusen.com/","date":"2025-12-20T07:01:23.635Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"P256","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"s3.amazonaws.com","organization":""},"issuer":{"commonName":"Amazon RSA 2048 M01","organization":"Amazon"},"validity":{"start":"Fri, 19 Sep 2025 00:00:00 GMT","end":"Sun, 23 Aug 2026 23:59:59 GMT"},"fingerprint":{"sha1":"48:FD:CD:50:85:6A:51:E7:71:E4:CB:E0:03:81:E1:EC:4E:AD:9E:C7","sha256":"D7:11:81:F4:91:03:0D:C6:A5:DE:8A:EF:AA:58:14:BA:AD:33:B5:11:8B:D5:F0:33:53:8B:AF:49:82:E9:4B:A4"}}},"request":{"raw":"GET /pachong/gaoqing/B07DWPTLJR/514KL6gAvYL._AC_SL1000_.jpg HTTP/1.1\r\nHost: mall-test.s3.amazonaws.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nx-amz-id-2: P46+0uKx0Cwp1VsfdGDZMQYFSupCs11zTITx/L3s1vksVOPpyyaC1OfjS4V9jdqs+Ggqy8C8e59FDEltTIeHrQuWuNCYJSyr\r\nx-amz-request-id: CRNZDWN2X7QR1DSW\r\nDate: Sat, 20 Dec 2025 07:01:25 GMT\r\nLast-Modified: Tue, 21 May 2024 18:47:46 GMT\r\nETag: \"333bc9f8102abd9920062f747fd1aece\"\r\nx-amz-server-side-encryption: AES256\r\nx-amz-meta-sha256: 45252b2a7e6e7d31e4b51f95f215232c8cc5de8eb6d719a60ee4aa70022d8f70\r\nx-amz-meta-s3b-last-modified: 20230415T142418Z\r\nAccept-Ranges: bytes\r\nContent-Type: image/jpeg\r\nContent-Length: 30129\r\nServer: AmazonS3\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Amazon Web Services","description":"Amazon Web Services (AWS) is a comprehensive cloud services platform offering compute power, database storage, content delivery and other functionality.","website":"https://aws.amazon.com/","common_platform_enumeration":"","icon":"Amazon Web Services.svg","categories":["PaaS"]},{"name":"Amazon S3","description":"Amazon S3 or Amazon Simple Storage Service is a service offered by Amazon Web Services (AWS) that provides object storage through a web service interface.","website":"https://aws.amazon.com/s3/","common_platform_enumeration":"","icon":"Amazon S3.svg","categories":["CDN"]}],"data":{"size":30129,"size_decoded":0,"mime_type":"image/jpeg","magic":"JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 888x970, components 3","md5":"333bc9f8102abd9920062f747fd1aece","sha1":"e9e549efd4c0bff166582969196d4c48963d64c5","sha256":"45252b2a7e6e7d31e4b51f95f215232c8cc5de8eb6d719a60ee4aa70022d8f70","sha512":"c5b4682553f9430c4d889d864ea2c426e13264803531b8fe3781edadf67ef75dcb4b92a5f7b1e3f828cd768945dafb8746d7b0ca1fcaeefceb40a0fb2e16b600","ssdeep":"768:1rqMSN/4n00wwRelfNwPFdMOHhXhEM773zrWjYV0+aF16JO3j:sMSa0rwR6lwPFzhXhEgnrbVzaFkJ4j","tlshash":"fcd2e1b57b17c379e8b3217b8749638f9ed9cdb52126025f1149b9343c61d644cad8cc","first_seen":"2024-02-19T23:01:28Z","last_seen":"2026-08-09T04:44:19.288125Z","times_seen":7248,"resource_available":false,"data":null}},"time_used":874,"timings":{"blocked":758,"dns":0,"connect":0,"send":0,"wait":110,"receive":6,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"mall-test.s3.amazonaws.com/test/2023-03-28/445c45cc-a9b2-4753-8903-eb823436e494.jpg","fqdn":"mall-test.s3.amazonaws.com","domain":"mall-test.s3.amazonaws.com","tld":"s3.amazonaws.com"},"ip":{"addr":"3.5.30.74","port":443,"asn":14618,"as":"AMAZON-AES","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://bluewhaleusen.com/","date":"2025-12-20T07:01:24.650Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"P256","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"s3.amazonaws.com","organization":""},"issuer":{"commonName":"Amazon RSA 2048 M01","organization":"Amazon"},"validity":{"start":"Fri, 19 Sep 2025 00:00:00 GMT","end":"Sun, 23 Aug 2026 23:59:59 GMT"},"fingerprint":{"sha1":"48:FD:CD:50:85:6A:51:E7:71:E4:CB:E0:03:81:E1:EC:4E:AD:9E:C7","sha256":"D7:11:81:F4:91:03:0D:C6:A5:DE:8A:EF:AA:58:14:BA:AD:33:B5:11:8B:D5:F0:33:53:8B:AF:49:82:E9:4B:A4"}}},"request":{"raw":"GET /test/2023-03-28/445c45cc-a9b2-4753-8903-eb823436e494.jpg HTTP/1.1\r\nHost: mall-test.s3.amazonaws.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nx-amz-id-2: 10BeOMaOnH8Cx8HEVAJezZ1AHrJpSbQJ4EkupvlA2qos0Q0q922Y8QI5jA5/2VjM27+a2R2eqvOKkdxQ0UW92Xq9/z08wqfU\r\nx-amz-request-id: CRNPGTKWS0RV6WB7\r\nDate: Sat, 20 Dec 2025 07:01:25 GMT\r\nLast-Modified: Wed, 22 May 2024 20:48:54 GMT\r\nETag: \"07f95e174804bff3d97c5b13f915cf7d\"\r\nx-amz-server-side-encryption: AES256\r\nAccept-Ranges: bytes\r\nContent-Type: image/jpeg\r\nContent-Length: 157447\r\nServer: AmazonS3\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Amazon Web Services","description":"Amazon Web Services (AWS) is a comprehensive cloud services platform offering compute power, database storage, content delivery and other functionality.","website":"https://aws.amazon.com/","common_platform_enumeration":"","icon":"Amazon Web Services.svg","categories":["PaaS"]},{"name":"Amazon S3","description":"Amazon S3 or Amazon Simple Storage Service is a service offered by Amazon Web Services (AWS) that provides object storage through a web service interface.","website":"https://aws.amazon.com/s3/","common_platform_enumeration":"","icon":"Amazon S3.svg","categories":["CDN"]}],"data":{"size":157447,"size_decoded":0,"mime_type":"image/jpeg","magic":"JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 1261x1459, components 3","md5":"07f95e174804bff3d97c5b13f915cf7d","sha1":"fd90a34dd34b37bf7d1c3f62c563c35d2ac8b82a","sha256":"872dcd22912f0f77f949b0642a505d3955f616d070da19c652f4312243eee5c4","sha512":"33010f75dbb816564d931260fb29a588407a9367f82140ccc3bfc33472a049cc8015a5a955832192affe139118dae18a3d5d2a4395227feb2cb0223b7dbc705d","ssdeep":"3072:UUwHcs93dkA8nkSsanKc4hUm1wyHhJ0qmz2WBJBrDymn8hKB1HoT:hs9tkXbsanKJOqCq85D58MB1IT","tlshash":"a0f312537850ac65dd7a4332a3266918bcc0e364dcbdc988417b9d4b87a811b6dbfbcc","first_seen":"2024-03-15T18:45:46Z","last_seen":"2026-08-11T08:26:52.921452Z","times_seen":2476,"resource_available":false,"data":null}},"time_used":184,"timings":{"blocked":45,"dns":0,"connect":0,"send":0,"wait":136,"receive":3,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"mall-test.s3.amazonaws.com/test/2023-03-28/908e2a95-723f-40aa-ac29-581a9ee153f5.jpg","fqdn":"mall-test.s3.amazonaws.com","domain":"mall-test.s3.amazonaws.com","tld":"s3.amazonaws.com"},"ip":{"addr":"3.5.30.74","port":443,"asn":14618,"as":"AMAZON-AES","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://bluewhaleusen.com/","date":"2025-12-20T07:01:24.654Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"P256","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"s3.amazonaws.com","organization":""},"issuer":{"commonName":"Amazon RSA 2048 M01","organization":"Amazon"},"validity":{"start":"Fri, 19 Sep 2025 00:00:00 GMT","end":"Sun, 23 Aug 2026 23:59:59 GMT"},"fingerprint":{"sha1":"48:FD:CD:50:85:6A:51:E7:71:E4:CB:E0:03:81:E1:EC:4E:AD:9E:C7","sha256":"D7:11:81:F4:91:03:0D:C6:A5:DE:8A:EF:AA:58:14:BA:AD:33:B5:11:8B:D5:F0:33:53:8B:AF:49:82:E9:4B:A4"}}},"request":{"raw":"GET /test/2023-03-28/908e2a95-723f-40aa-ac29-581a9ee153f5.jpg HTTP/1.1\r\nHost: mall-test.s3.amazonaws.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nx-amz-id-2: 4YXTtwOvRW2Auggmh4/tQjwFMkKNGYvIweGW2A2o1sz7GXWGGRsHcT8Wtu/b4ynitWBNvpwjPWMjiITJm+w8ZmvOvYQBJcKz\r\nx-amz-request-id: CRNS5GXV0D7JHK2A\r\nDate: Sat, 20 Dec 2025 07:01:25 GMT\r\nLast-Modified: Wed, 22 May 2024 20:51:40 GMT\r\nETag: \"c5a47705795cdbc1e8729597ae3590c0\"\r\nx-amz-server-side-encryption: AES256\r\nAccept-Ranges: bytes\r\nContent-Type: image/jpeg\r\nContent-Length: 116736\r\nServer: AmazonS3\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Amazon Web Services","description":"Amazon Web Services (AWS) is a comprehensive cloud services platform offering compute power, database storage, content delivery and other functionality.","website":"https://aws.amazon.com/","common_platform_enumeration":"","icon":"Amazon Web Services.svg","categories":["PaaS"]},{"name":"Amazon S3","description":"Amazon S3 or Amazon Simple Storage Service is a service offered by Amazon Web Services (AWS) that provides object storage through a web service interface.","website":"https://aws.amazon.com/s3/","common_platform_enumeration":"","icon":"Amazon S3.svg","categories":["CDN"]}],"data":{"size":116736,"size_decoded":0,"mime_type":"image/jpeg","magic":"JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 1500x890, components 3","md5":"c5a47705795cdbc1e8729597ae3590c0","sha1":"dc331981dd3aeb0e2ef49a5339b9de6fc874a6b1","sha256":"2c4fb62978884f281072fa2aac50acd32f422cd139a6e8c703c644263f3cfefe","sha512":"64b217eb462365a15e408992e9f6cafc4da3aeff8be47a4a0d9cf1eec22ae84b8c49db9e0bde58eeb4c3218d3503147fa72fb222e07dd10f09e08108934f491c","ssdeep":"3072:5e2yg9EXZZEXO06Ae3UYn/HFkdOQRC+p/o:ZyeEXmO06AuUYnNkkQRC+p/o","tlshash":"82b313ed627148c6e96c04b5587ec05c8a31138bb6d8af6f30fe1d221bcda512edf549","first_seen":"2024-03-15T18:45:46Z","last_seen":"2026-08-11T08:26:52.952483Z","times_seen":2430,"resource_available":false,"data":null}},"time_used":204,"timings":{"blocked":87,"dns":0,"connect":0,"send":0,"wait":114,"receive":3,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"bluewhaleusen.com/css/chunk-9d964e9e.1a94a034.css","fqdn":"bluewhaleusen.com","domain":"bluewhaleusen.com","tld":"com"},"ip":{"addr":"118.107.9.252","port":443,"asn":152194,"as":"CTG Server Limited","country":"Singapore","country_code":"SG"},"is_navigation_request":false,"resource_type":"other","requested_by":"https://bluewhaleusen.com/","date":"2025-12-20T07:01:25.625Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"bluewhaleusen.com","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Fri, 19 Dec 2025 05:22:57 GMT","end":"Thu, 19 Mar 2026 05:22:56 GMT"},"fingerprint":{"sha1":"23:4C:94:04:E1:25:E0:EA:D1:85:17:4C:09:FC:E0:DA:D0:01:E6:62","sha256":"AC:EF:45:40:E0:37:3A:BD:B9:C9:32:F5:6B:B1:B8:92:BE:33:89:43:FA:25:17:17:7C:CA:50:4E:0B:CD:25:EB"}}},"request":{"raw":"GET /css/chunk-9d964e9e.1a94a034.css HTTP/1.1\r\nHost: bluewhaleusen.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nX-Moz: prefetch\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Sat, 20 Dec 2025 07:01:25 GMT\r\ncontent-type: text/css\r\ncontent-length: 428\r\netag: W/\"428-1766123972324\"\r\nlast-modified: Fri, 19 Dec 2025 05:59:32 GMT\r\nstrict-transport-security: max-age=31536000\r\naccept-ranges: bytes\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":428,"size_decoded":0,"mime_type":"text/css","magic":"ASCII text, with very long lines (428), with no line terminators","md5":"839113b3a06297a1185b208299520527","sha1":"df67e42e507fdf888b4f0b1706a0bd54e09763ff","sha256":"ae7439473b984cf35ac3a8199ea3a3ccd8c794d239d0e36fec25cd4a3f0222ac","sha512":"da16c62f7431636915bdfa092d4468b66770272aca96b2e4c27d1bf9cd36b044dc03acb199486e709a3a82c272c9ab6ffe79305e116376d596ec30e3523dbf6b","ssdeep":"","tlshash":"2de0a0a051072a3b2563f0b6a8c20427b655f7abe91291107be305092e7b38a68373e8","first_seen":"2024-02-11T04:26:49Z","last_seen":"2026-06-06T14:40:04.363745Z","times_seen":6807,"resource_available":false,"data":null}},"time_used":327,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":327,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2025-12-20","alert":"Sinkholed","trigger":"bluewhaleusen.com","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2025-12-20","alert":"Phishing Block","trigger":"bluewhaleusen.com","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2025-12-20","alert":"Sinkholed","trigger":"bluewhaleusen.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2025-12-20","alert":"Sinkholed","trigger":"bluewhaleusen.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2025-12-20","alert":"Sinkholed","trigger":"bluewhaleusen.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"bluewhaleusen.com/css/chunk-f12f1418.190a6d02.css","fqdn":"bluewhaleusen.com","domain":"bluewhaleusen.com","tld":"com"},"ip":{"addr":"118.107.9.252","port":443,"asn":152194,"as":"CTG Server Limited","country":"Singapore","country_code":"SG"},"is_navigation_request":false,"resource_type":"other","requested_by":"https://bluewhaleusen.com/","date":"2025-12-20T07:01:25.973Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"bluewhaleusen.com","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Fri, 19 Dec 2025 05:22:57 GMT","end":"Thu, 19 Mar 2026 05:22:56 GMT"},"fingerprint":{"sha1":"23:4C:94:04:E1:25:E0:EA:D1:85:17:4C:09:FC:E0:DA:D0:01:E6:62","sha256":"AC:EF:45:40:E0:37:3A:BD:B9:C9:32:F5:6B:B1:B8:92:BE:33:89:43:FA:25:17:17:7C:CA:50:4E:0B:CD:25:EB"}}},"request":{"raw":"GET /css/chunk-f12f1418.190a6d02.css HTTP/1.1\r\nHost: bluewhaleusen.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nX-Moz: prefetch\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Sat, 20 Dec 2025 07:01:26 GMT\r\ncontent-type: text/css\r\nvary: Accept-Encoding\r\netag: W/\"5629-1766123972329\"\r\nlast-modified: Fri, 19 Dec 2025 05:59:32 GMT\r\nstrict-transport-security: max-age=31536000\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":5629,"size_decoded":0,"mime_type":"text/css","magic":"ASCII text, with very long lines (5629), with no line terminators","md5":"87bcaba95fd3b86a38d6208dbc93b658","sha1":"58d58c63dd9dc96e89cc040839a7c108ab2c04bb","sha256":"e2a324832d33c0bd9e3ec1123e5e8096ba0c745821d60056456f67298d4970a1","sha512":"c125c6410b061f56fa109edf7e7a2a29aefa2aa2f8b6b0a8e89c343f1327faa696301f7e10165b1bf0e78e539f8f1091d21c5b95d24d4bd295897c543bdd1476","ssdeep":"96:GXzpE85mAIJ75iEOOOOOOOOOOOoMSh53zb7DHHnUboUINlSzNDYcIGlwNqftSiYo:IzCQIXiDe53zb/UboRyRD5liqF6+lluQ","tlshash":"d4c15b59e53990297c2114b7b1811cc2bc25c82ae65e45b2b756bb18c8c34e32b3d79d","first_seen":"2024-04-14T17:36:32Z","last_seen":"2026-06-06T14:40:04.505636Z","times_seen":345,"resource_available":false,"data":null}},"time_used":327,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":327,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2025-12-20","alert":"Sinkholed","trigger":"bluewhaleusen.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2025-12-20","alert":"Sinkholed","trigger":"bluewhaleusen.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2025-12-20","alert":"Sinkholed","trigger":"bluewhaleusen.com","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2025-12-20","alert":"Phishing Block","trigger":"bluewhaleusen.com","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2025-12-20","alert":"Sinkholed","trigger":"bluewhaleusen.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"bluewhaleusen.com/js/chunk-08bbc53e.70d0b01b.js","fqdn":"bluewhaleusen.com","domain":"bluewhaleusen.com","tld":"com"},"ip":{"addr":"118.107.9.252","port":443,"asn":152194,"as":"CTG Server Limited","country":"Singapore","country_code":"SG"},"is_navigation_request":false,"resource_type":"other","requested_by":"https://bluewhaleusen.com/","date":"2025-12-20T07:01:25.989Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"bluewhaleusen.com","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Fri, 19 Dec 2025 05:22:57 GMT","end":"Thu, 19 Mar 2026 05:22:56 GMT"},"fingerprint":{"sha1":"23:4C:94:04:E1:25:E0:EA:D1:85:17:4C:09:FC:E0:DA:D0:01:E6:62","sha256":"AC:EF:45:40:E0:37:3A:BD:B9:C9:32:F5:6B:B1:B8:92:BE:33:89:43:FA:25:17:17:7C:CA:50:4E:0B:CD:25:EB"}}},"request":{"raw":"GET /js/chunk-08bbc53e.70d0b01b.js HTTP/1.1\r\nHost: bluewhaleusen.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nX-Moz: prefetch\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Sat, 20 Dec 2025 07:01:26 GMT\r\ncontent-type: application/javascript\r\nvary: Accept-Encoding\r\netag: W/\"17487-1766123972305\"\r\nlast-modified: Fri, 19 Dec 2025 05:59:32 GMT\r\nstrict-transport-security: max-age=31536000\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":17487,"size_decoded":0,"mime_type":"application/javascript","magic":"JavaScript source, Unicode text, UTF-8 text, with very long lines (17479), with no line terminators","md5":"df7b2c6baa98d4748c13f827936c2c47","sha1":"f5fa7e5c16ccd9b01004199d1716a2f326266175","sha256":"921647bd8952cfec5f84b44dba07386590f747c72b3bd1736900aabe8177fe7a","sha512":"4b9f7a22f8d461be8881263066f1a5ec843a2af8356a08a627640823e0bf631a6792f7df29f5b8bb6477f632a195000a6743e0c2d0a18a87ce0785a9d4fe78e5","ssdeep":"192:Sl8rBcVzhJgFaz9Y7zcqv0Q5zd0z4uzUhHYk8GhPdt3eQOkOVNC5l:SirBc9hJgICcqvPo4uL+lTOg","tlshash":"1c725c53b60df45d4e379991363e39a5a2832664b00865dbf77eccfa13c8c24391ab39","first_seen":"2025-04-08T11:27:57.690087Z","last_seen":"2026-06-06T14:40:04.391006Z","times_seen":98,"resource_available":false,"data":null}},"time_used":328,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":328,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2025-12-20","alert":"Sinkholed","trigger":"bluewhaleusen.com","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2025-12-20","alert":"Phishing Block","trigger":"bluewhaleusen.com","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2025-12-20","alert":"Sinkholed","trigger":"bluewhaleusen.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2025-12-20","alert":"Sinkholed","trigger":"bluewhaleusen.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2025-12-20","alert":"Sinkholed","trigger":"bluewhaleusen.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"bluewhaleusen.com/js/chunk-7c918dfd.68ffa1db.js","fqdn":"bluewhaleusen.com","domain":"bluewhaleusen.com","tld":"com"},"ip":{"addr":"118.107.9.252","port":443,"asn":152194,"as":"CTG Server Limited","country":"Singapore","country_code":"SG"},"is_navigation_request":false,"resource_type":"other","requested_by":"https://bluewhaleusen.com/","date":"2025-12-20T07:01:27.695Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"bluewhaleusen.com","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Fri, 19 Dec 2025 05:22:57 GMT","end":"Thu, 19 Mar 2026 05:22:56 GMT"},"fingerprint":{"sha1":"23:4C:94:04:E1:25:E0:EA:D1:85:17:4C:09:FC:E0:DA:D0:01:E6:62","sha256":"AC:EF:45:40:E0:37:3A:BD:B9:C9:32:F5:6B:B1:B8:92:BE:33:89:43:FA:25:17:17:7C:CA:50:4E:0B:CD:25:EB"}}},"request":{"raw":"GET /js/chunk-7c918dfd.68ffa1db.js HTTP/1.1\r\nHost: bluewhaleusen.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nX-Moz: prefetch\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Sat, 20 Dec 2025 07:01:27 GMT\r\ncontent-type: application/javascript\r\nvary: Accept-Encoding\r\netag: W/\"11659-1766123972321\"\r\nlast-modified: Fri, 19 Dec 2025 05:59:32 GMT\r\nstrict-transport-security: max-age=31536000\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":11659,"size_decoded":0,"mime_type":"application/javascript","magic":"JavaScript source, Unicode text, UTF-8 text, with very long lines (11617), with no line terminators","md5":"8fdf7a2947bb7e8a14b94c835330302e","sha1":"65e73addbf283b488697307b4a512356d3b82821","sha256":"19baa51b45557a87c644c86c68cb8de845812ca722ef9c820a25719c45c42e8e","sha512":"26e97423f7a35ed9cd45235478d82c61b68b6456238714c3b61351ae0442c6c4b1ef6dd2ac82551a71dfe5fa6247c7f94d0bedb270cb5df26d9a400902d7e641","ssdeep":"192:dBl3gH0tyB73Gm/zHfmA4WhyS7BaSLF6LDS3Q5:ZcAo72mjGWbFA5","tlshash":"7832e84c7283f8ad09a750b0704fb907f1a9695138099696f7b4caf539bcd0e6326f39","first_seen":"2025-04-08T10:46:39.860939Z","last_seen":"2026-06-06T14:40:04.358677Z","times_seen":151,"resource_available":false,"data":null}},"time_used":327,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":327,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2025-12-20","alert":"Sinkholed","trigger":"bluewhaleusen.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2025-12-20","alert":"Sinkholed","trigger":"bluewhaleusen.com","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2025-12-20","alert":"Sinkholed","trigger":"bluewhaleusen.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2025-12-20","alert":"Phishing Block","trigger":"bluewhaleusen.com","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2025-12-20","alert":"Sinkholed","trigger":"bluewhaleusen.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"bluewhaleusen.com/css/vendors~app.38d4edbf.css","fqdn":"bluewhaleusen.com","domain":"bluewhaleusen.com","tld":"com"},"ip":{"addr":"118.107.9.252","port":443,"asn":152194,"as":"CTG Server Limited","country":"Singapore","country_code":"SG"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://bluewhaleusen.com/","date":"2025-12-20T07:01:19.284Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"bluewhaleusen.com","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Fri, 19 Dec 2025 05:22:57 GMT","end":"Thu, 19 Mar 2026 05:22:56 GMT"},"fingerprint":{"sha1":"23:4C:94:04:E1:25:E0:EA:D1:85:17:4C:09:FC:E0:DA:D0:01:E6:62","sha256":"AC:EF:45:40:E0:37:3A:BD:B9:C9:32:F5:6B:B1:B8:92:BE:33:89:43:FA:25:17:17:7C:CA:50:4E:0B:CD:25:EB"}}},"request":{"raw":"GET /css/vendors~app.38d4edbf.css HTTP/1.1\r\nHost: bluewhaleusen.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Sat, 20 Dec 2025 07:01:19 GMT\r\ncontent-type: text/css\r\nvary: Accept-Encoding\r\netag: W/\"248173-1766123972327\"\r\nlast-modified: Fri, 19 Dec 2025 05:59:32 GMT\r\nstrict-transport-security: max-age=31536000\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":248173,"size_decoded":0,"mime_type":"text/css","magic":"ASCII text, with very long lines (65536), with no line terminators","md5":"7e2c553a0ebf6e3a82ae07ec78c9a275","sha1":"579d69c6381a05da2c87a55d88301788536820dc","sha256":"28d5dd7be3b9ecdecae26c5c84811a181f5eb03df646096eca8171b5ab6f9f5b","sha512":"b82a19b7b473a320b1a3f99db0badecef4ad997d367d1138bd2adfa6b97268f906a688be68b6455a0b48c1c724907e7489bc30c1a48ceeb180174abe973de7f1","ssdeep":"1536:O28Y7SrW3YeWXA1u9w4HCe/l4JrgW9cMERw4B78O6iZkJgYu8e210kSDDvIc/ehG:TtKw/27eDLL6ob6v7f65WCXkb","tlshash":"ae34b6109b17203bb22bda6d74d0ba892f25c313d8334b7afe95790cc6d64991263e5f","first_seen":"2024-04-14T17:36:31Z","last_seen":"2026-08-02T11:36:27.425139Z","times_seen":219,"resource_available":false,"data":null}},"time_used":336,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":336,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2025-12-20","alert":"Sinkholed","trigger":"bluewhaleusen.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2025-12-20","alert":"Sinkholed","trigger":"bluewhaleusen.com","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2025-12-20","alert":"Sinkholed","trigger":"bluewhaleusen.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2025-12-20","alert":"Phishing Block","trigger":"bluewhaleusen.com","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2025-12-20","alert":"Sinkholed","trigger":"bluewhaleusen.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"imgtest1.s3.amazonaws.com/type/2023-03-29/d80b2606-3bc7-47a2-bee9-d040619a34a6.jpg","fqdn":"imgtest1.s3.amazonaws.com","domain":"imgtest1.s3.amazonaws.com","tld":"s3.amazonaws.com"},"ip":{"addr":"16.15.207.90","port":443,"asn":14618,"as":"AMAZON-AES","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://bluewhaleusen.com/","date":"2025-12-20T07:01:23.341Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"P256","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.s3.amazonaws.com","organization":""},"issuer":{"commonName":"Amazon RSA 2048 M01","organization":"Amazon"},"validity":{"start":"Fri, 14 Feb 2025 00:00:00 GMT","end":"Sat, 07 Feb 2026 23:59:59 GMT"},"fingerprint":{"sha1":"2E:BA:63:64:95:A8:CE:55:DD:7E:EB:A9:98:83:14:B1:6F:6B:61:69","sha256":"00:D7:0B:CC:1F:82:6B:F6:D9:2E:55:1A:BA:88:38:33:19:09:5B:85:49:41:5E:DA:A1:97:B9:D2:0A:3B:13:52"}}},"request":{"raw":"GET /type/2023-03-29/d80b2606-3bc7-47a2-bee9-d040619a34a6.jpg HTTP/1.1\r\nHost: imgtest1.s3.amazonaws.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nx-amz-id-2: SVp+XGZ7O5c8sHGyEgbFGL7oSRmgAfUbMH/Zp4xt6GRcaWK6r+VZ3w4jiDmNrjb6oPJQSTVmFB4VZbb1Zqt2cocUHjHie6Hu\r\nx-amz-request-id: S19N7PV1HSR0NKG2\r\nDate: Sat, 20 Dec 2025 07:01:24 GMT\r\nLast-Modified: Sun, 01 Sep 2024 17:37:19 GMT\r\nETag: \"ad3bb72e6cf979df37c56cc70e70710c\"\r\nx-amz-server-side-encryption: AES256\r\nAccept-Ranges: bytes\r\nContent-Type: image/jpeg\r\nContent-Length: 46207\r\nServer: AmazonS3\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Amazon Web Services","description":"Amazon Web Services (AWS) is a comprehensive cloud services platform offering compute power, database storage, content delivery and other functionality.","website":"https://aws.amazon.com/","common_platform_enumeration":"","icon":"Amazon Web Services.svg","categories":["PaaS"]},{"name":"Amazon S3","description":"Amazon S3 or Amazon Simple Storage Service is a service offered by Amazon Web Services (AWS) that provides object storage through a web service interface.","website":"https://aws.amazon.com/s3/","common_platform_enumeration":"","icon":"Amazon S3.svg","categories":["CDN"]}],"data":{"size":46207,"size_decoded":0,"mime_type":"image/jpeg","magic":"JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, comment: \"CREATOR: gd-jpeg v1.0 (using IJG JPEG v80), quality = 90\", baseline, precision 8, 500x500, components 3","md5":"ad3bb72e6cf979df37c56cc70e70710c","sha1":"f0bff01c9d923ad55250ef7de41afae41cbe3f90","sha256":"50294b071e29cc9e8afdac176dd2fbc62f4c36265d5f494d96a7ab2908c1a643","sha512":"1fc3e1b07a86c34fb8c9720f8ff8c2a584cfb6dfe7b4e34d53f2f0555e558fe95f5a62bad4a6874a64e081cddae0defe530870d76dcf1551ca45ee570b582ce8","ssdeep":"768:GOSu2YQp+gujkfsasYaYtu/tgiE/c1tcDkV2FynHs5d4RX3S6cqUrolLoDzT6S51:GOt2YQVujkfTJaYg/wU1SYSJ4JcrsLo/","tlshash":"4f23e09b86804fdbf03acbc53f272d985b41fa0944d0b4fbd1e986af1f65622285c48c","first_seen":"2023-11-07T02:37:44Z","last_seen":"2026-08-11T08:26:52.920568Z","times_seen":9920,"resource_available":false,"data":null}},"time_used":734,"timings":{"blocked":259,"dns":0,"connect":94,"send":0,"wait":120,"receive":97,"ssl":150},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"imgtest1.s3.amazonaws.com/type/2023-03-29/2df406e9-dc70-492e-a7d5-4db89889fe58.jpg","fqdn":"imgtest1.s3.amazonaws.com","domain":"imgtest1.s3.amazonaws.com","tld":"s3.amazonaws.com"},"ip":{"addr":"16.15.207.90","port":443,"asn":14618,"as":"AMAZON-AES","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://bluewhaleusen.com/","date":"2025-12-20T07:01:23.371Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"P256","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.s3.amazonaws.com","organization":""},"issuer":{"commonName":"Amazon RSA 2048 M01","organization":"Amazon"},"validity":{"start":"Fri, 14 Feb 2025 00:00:00 GMT","end":"Sat, 07 Feb 2026 23:59:59 GMT"},"fingerprint":{"sha1":"2E:BA:63:64:95:A8:CE:55:DD:7E:EB:A9:98:83:14:B1:6F:6B:61:69","sha256":"00:D7:0B:CC:1F:82:6B:F6:D9:2E:55:1A:BA:88:38:33:19:09:5B:85:49:41:5E:DA:A1:97:B9:D2:0A:3B:13:52"}}},"request":{"raw":"GET /type/2023-03-29/2df406e9-dc70-492e-a7d5-4db89889fe58.jpg HTTP/1.1\r\nHost: imgtest1.s3.amazonaws.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nx-amz-id-2: HcMpNKMqNTC1v0saLkv3QaZLj+HL5GOjDEZVducElFumac5VusrJNEqRzE+Uv9tUgSGLwLwTegKaJhF4rIi80MBRIM0N7Nvz\r\nx-amz-request-id: S19KF9M6RN6NRXA8\r\nDate: Sat, 20 Dec 2025 07:01:24 GMT\r\nLast-Modified: Sun, 01 Sep 2024 17:37:18 GMT\r\nETag: \"882acb8a590986400f716b14ce87dbd7\"\r\nx-amz-server-side-encryption: AES256\r\nAccept-Ranges: bytes\r\nContent-Type: image/jpeg\r\nContent-Length: 27557\r\nServer: AmazonS3\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Amazon Web Services","description":"Amazon Web Services (AWS) is a comprehensive cloud services platform offering compute power, database storage, content delivery and other functionality.","website":"https://aws.amazon.com/","common_platform_enumeration":"","icon":"Amazon Web Services.svg","categories":["PaaS"]},{"name":"Amazon S3","description":"Amazon S3 or Amazon Simple Storage Service is a service offered by Amazon Web Services (AWS) that provides object storage through a web service interface.","website":"https://aws.amazon.com/s3/","common_platform_enumeration":"","icon":"Amazon S3.svg","categories":["CDN"]}],"data":{"size":27557,"size_decoded":0,"mime_type":"image/jpeg","magic":"JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, comment: \"CREATOR: gd-jpeg v1.0 (using IJG JPEG v80), quality = 90\", baseline, precision 8, 500x500, components 3","md5":"882acb8a590986400f716b14ce87dbd7","sha1":"69d9585cebff24ca05746278353d9723ac581960","sha256":"1c488a620a2342179fea9b5325ea4b5e0e450de64f3bc3383c67e3040242d1e0","sha512":"21cc314fbc6d011adc782475102dcc061e67ed01e1162a9046700b1375b1841701831af77286cc0fead58c997eeba79f5e1d141cdb124ed7881fbe71315c65a6","ssdeep":"768:GG5AJy9ToRwVbgiqHgdBAe9u4p58OsHIE7W6lWG:GGis9sRwVbgiBdieWHTlWG","tlshash":"40c27c039c854ad3b575c391ff468f6d3b8aaf08fc5672e710e11eda37a01424c9da6a","first_seen":"2023-11-07T02:37:41Z","last_seen":"2026-08-11T08:26:52.937378Z","times_seen":10083,"resource_available":false,"data":null}},"time_used":561,"timings":{"blocked":444,"dns":0,"connect":0,"send":0,"wait":115,"receive":2,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"mall-test.s3.amazonaws.com/pachong/gaoqing/B0BMQ8WCNF/91fTDjI24bL._AC_SL1500_.jpg","fqdn":"mall-test.s3.amazonaws.com","domain":"mall-test.s3.amazonaws.com","tld":"s3.amazonaws.com"},"ip":{"addr":"3.5.30.74","port":443,"asn":14618,"as":"AMAZON-AES","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://bluewhaleusen.com/","date":"2025-12-20T07:01:23.624Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"P256","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"s3.amazonaws.com","organization":""},"issuer":{"commonName":"Amazon RSA 2048 M01","organization":"Amazon"},"validity":{"start":"Fri, 19 Sep 2025 00:00:00 GMT","end":"Sun, 23 Aug 2026 23:59:59 GMT"},"fingerprint":{"sha1":"48:FD:CD:50:85:6A:51:E7:71:E4:CB:E0:03:81:E1:EC:4E:AD:9E:C7","sha256":"D7:11:81:F4:91:03:0D:C6:A5:DE:8A:EF:AA:58:14:BA:AD:33:B5:11:8B:D5:F0:33:53:8B:AF:49:82:E9:4B:A4"}}},"request":{"raw":"GET /pachong/gaoqing/B0BMQ8WCNF/91fTDjI24bL._AC_SL1500_.jpg HTTP/1.1\r\nHost: mall-test.s3.amazonaws.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nx-amz-id-2: gCzWuSZ2NU6NZxPR0twYogGPeGqJR/A9munBuAPCVK9d7aMdC+WThhjzPBznsSvrNbj8kXGi5PIGkFiPUOOipuC5GrPtCuuR\r\nx-amz-request-id: CRNW6YVAS06DK4TP\r\nDate: Sat, 20 Dec 2025 07:01:25 GMT\r\nLast-Modified: Tue, 21 May 2024 22:38:25 GMT\r\nETag: \"d97df150aeb10281fef09028e4d07108\"\r\nx-amz-server-side-encryption: AES256\r\nx-amz-meta-sha256: 720fe80f1335b908e06827689e13021992f6c937ea3d4677e68ba28730e529c2\r\nx-amz-meta-s3b-last-modified: 20230414T110922Z\r\nAccept-Ranges: bytes\r\nContent-Type: image/jpeg\r\nContent-Length: 414495\r\nServer: AmazonS3\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Amazon Web Services","description":"Amazon Web Services (AWS) is a comprehensive cloud services platform offering compute power, database storage, content delivery and other functionality.","website":"https://aws.amazon.com/","common_platform_enumeration":"","icon":"Amazon Web Services.svg","categories":["PaaS"]},{"name":"Amazon S3","description":"Amazon S3 or Amazon Simple Storage Service is a service offered by Amazon Web Services (AWS) that provides object storage through a web service interface.","website":"https://aws.amazon.com/s3/","common_platform_enumeration":"","icon":"Amazon S3.svg","categories":["CDN"]}],"data":{"size":414495,"size_decoded":0,"mime_type":"image/jpeg","magic":"JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 1500x1229, components 3","md5":"d97df150aeb10281fef09028e4d07108","sha1":"a7606a2e5b733d842b2af8379dfdbd82c216311b","sha256":"720fe80f1335b908e06827689e13021992f6c937ea3d4677e68ba28730e529c2","sha512":"878e28a4eb570611bf54e4287cb7ff3cf5a039ec4459d4364bb632410fc0e182941f7120f2a9b6852732a68d31748fcebf9a948e656b87eed226b8f9cb4d284a","ssdeep":"12288:S5A9jNzghSx78Ew0WXf/sJStZ50HN2kYH6aXvFhI9:S5+0ynWXnsJYzo2kYTXvTY","tlshash":"db94238d1f8ec82ce01f6db3bc6134d0112d2fd97659dad5dae56f46005e2a49ccf2a8","first_seen":"2024-03-15T18:45:45Z","last_seen":"2026-08-11T08:26:52.963229Z","times_seen":2449,"resource_available":false,"data":null}},"time_used":915,"timings":{"blocked":701,"dns":0,"connect":0,"send":0,"wait":110,"receive":104,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"mall-test.s3.amazonaws.com/test/2023-03-28/60bcf681-c939-4679-bde0-509eccd7574b.jpg","fqdn":"mall-test.s3.amazonaws.com","domain":"mall-test.s3.amazonaws.com","tld":"s3.amazonaws.com"},"ip":{"addr":"3.5.30.74","port":443,"asn":14618,"as":"AMAZON-AES","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://bluewhaleusen.com/","date":"2025-12-20T07:01:23.659Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"P256","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"s3.amazonaws.com","organization":""},"issuer":{"commonName":"Amazon RSA 2048 M01","organization":"Amazon"},"validity":{"start":"Fri, 19 Sep 2025 00:00:00 GMT","end":"Sun, 23 Aug 2026 23:59:59 GMT"},"fingerprint":{"sha1":"48:FD:CD:50:85:6A:51:E7:71:E4:CB:E0:03:81:E1:EC:4E:AD:9E:C7","sha256":"D7:11:81:F4:91:03:0D:C6:A5:DE:8A:EF:AA:58:14:BA:AD:33:B5:11:8B:D5:F0:33:53:8B:AF:49:82:E9:4B:A4"}}},"request":{"raw":"GET /test/2023-03-28/60bcf681-c939-4679-bde0-509eccd7574b.jpg HTTP/1.1\r\nHost: mall-test.s3.amazonaws.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nx-amz-id-2: 32f/EmHjHAS0EA18EAr67CBbXXnMHq/sxkfxrhZ0n/MY6UBejzvKMHNNL0/1ADBmzTaPXlivxwaFBN+zF2yciGfobrPk18Ed\r\nx-amz-request-id: CRNHZCCDQPCJPM0V\r\nDate: Sat, 20 Dec 2025 07:01:25 GMT\r\nLast-Modified: Wed, 22 May 2024 20:49:56 GMT\r\nETag: \"ec86b66965224b96bab443b8410395d1\"\r\nx-amz-server-side-encryption: AES256\r\nAccept-Ranges: bytes\r\nContent-Type: image/jpeg\r\nContent-Length: 146526\r\nServer: AmazonS3\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Amazon Web Services","description":"Amazon Web Services (AWS) is a comprehensive cloud services platform offering compute power, database storage, content delivery and other functionality.","website":"https://aws.amazon.com/","common_platform_enumeration":"","icon":"Amazon Web Services.svg","categories":["PaaS"]},{"name":"Amazon S3","description":"Amazon S3 or Amazon Simple Storage Service is a service offered by Amazon Web Services (AWS) that provides object storage through a web service interface.","website":"https://aws.amazon.com/s3/","common_platform_enumeration":"","icon":"Amazon S3.svg","categories":["CDN"]}],"data":{"size":146526,"size_decoded":0,"mime_type":"image/jpeg","magic":"JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 1306x1476, components 3","md5":"ec86b66965224b96bab443b8410395d1","sha1":"53b8c9b7a8a7aa82d70fd8b4ec6e3cdbd2ef37af","sha256":"4807823160aae195643949285d31c04cd2748742c243cf1ad55e04cf2c302d77","sha512":"ec04ffe990fc2220c95fd2ad387d62989ef863818ad9d26b0240b4c9130c95c537ad457b16d3e654302a2a07aabec6e6a9dd1b7a64fe613fa44e28e007accefe","ssdeep":"3072:4nGWpQdBtg6vmu+rXVV2xOxairAYONXsecAyFdBo8ZoWKv:iGWMmu+RVAYOPcAYtmWKv","tlshash":"5ce312526f51b006dbfa6c31b59ba629dc31a007a34398fb782d4638f8d73de7749281","first_seen":"2024-02-19T23:01:29Z","last_seen":"2026-08-09T04:44:19.305947Z","times_seen":7271,"resource_available":false,"data":null}},"time_used":1004,"timings":{"blocked":883,"dns":0,"connect":0,"send":0,"wait":118,"receive":3,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"mall-test.s3.amazonaws.com/avatar/2023-03-22/e2693638-a8e8-40b8-b503-46fd93510048.png","fqdn":"mall-test.s3.amazonaws.com","domain":"mall-test.s3.amazonaws.com","tld":"s3.amazonaws.com"},"ip":{"addr":"3.5.30.74","port":443,"asn":14618,"as":"AMAZON-AES","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://bluewhaleusen.com/","date":"2025-12-20T07:01:24.263Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"P256","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"s3.amazonaws.com","organization":""},"issuer":{"commonName":"Amazon RSA 2048 M01","organization":"Amazon"},"validity":{"start":"Fri, 19 Sep 2025 00:00:00 GMT","end":"Sun, 23 Aug 2026 23:59:59 GMT"},"fingerprint":{"sha1":"48:FD:CD:50:85:6A:51:E7:71:E4:CB:E0:03:81:E1:EC:4E:AD:9E:C7","sha256":"D7:11:81:F4:91:03:0D:C6:A5:DE:8A:EF:AA:58:14:BA:AD:33:B5:11:8B:D5:F0:33:53:8B:AF:49:82:E9:4B:A4"}}},"request":{"raw":"GET /avatar/2023-03-22/e2693638-a8e8-40b8-b503-46fd93510048.png HTTP/1.1\r\nHost: mall-test.s3.amazonaws.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nx-amz-id-2: Lv1sNYS/XU1/JhYZEVZ5pVbx+o+AE6fQ0LSZsQPUZSRu0ukcbL133EjQmqhfBhlbBkHzEY6zDtVXStKVvITnNbN2Gzz2U/ed\r\nx-amz-request-id: CRNSTTY04WB03HDX\r\nDate: Sat, 20 Dec 2025 07:01:25 GMT\r\nLast-Modified: Tue, 21 May 2024 17:21:40 GMT\r\nETag: \"40fb52c897d51c6334e0ee6e3f8e8032\"\r\nx-amz-server-side-encryption: AES256\r\nx-amz-meta-myval: test\r\nAccept-Ranges: bytes\r\nContent-Type: application/octet-stream\r\nContent-Length: 14775\r\nServer: AmazonS3\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Amazon Web Services","description":"Amazon Web Services (AWS) is a comprehensive cloud services platform offering compute power, database storage, content delivery and other functionality.","website":"https://aws.amazon.com/","common_platform_enumeration":"","icon":"Amazon Web Services.svg","categories":["PaaS"]},{"name":"Amazon S3","description":"Amazon S3 or Amazon Simple Storage Service is a service offered by Amazon Web Services (AWS) that provides object storage through a web service interface.","website":"https://aws.amazon.com/s3/","common_platform_enumeration":"","icon":"Amazon S3.svg","categories":["CDN"]}],"data":{"size":14775,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 591 x 521, 8-bit/color RGB, non-interlaced","md5":"40fb52c897d51c6334e0ee6e3f8e8032","sha1":"955b62341fbcad6215f3c0a2378e3969110b4b3e","sha256":"d7811c821cb49a4c1d8222afd5bde67e8d10af95e8d8a40f90e2320cdc82c551","sha512":"b9285da8e31609503fb716b8cbe12bb873e5eb7826c65f1d7ba603fdac0783edb4ae1751b049026028578aa83ba20e227de5e56e19cd2bb55ed27312ce479c84","ssdeep":"384:h5PD9aaDTfXQXE/+HjUbM+paOUiHPRlUgnkBd7k:h5P8aDT4XXMMkaOU2RlUskX4","tlshash":"5662372e08431aaa30935ef59e801171b97171ddb7d52394b14adf3723d5a73fab8830","first_seen":"2024-02-19T23:01:29Z","last_seen":"2026-06-22T12:09:53.858417Z","times_seen":2043,"resource_available":false,"data":null}},"time_used":508,"timings":{"blocked":397,"dns":0,"connect":0,"send":0,"wait":110,"receive":1,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"bluewhaleusen.com/css/chunk-4c0f0b53.7da50378.css","fqdn":"bluewhaleusen.com","domain":"bluewhaleusen.com","tld":"com"},"ip":{"addr":"118.107.9.252","port":443,"asn":152194,"as":"CTG Server Limited","country":"Singapore","country_code":"SG"},"is_navigation_request":false,"resource_type":"other","requested_by":"https://bluewhaleusen.com/","date":"2025-12-20T07:01:24.622Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"bluewhaleusen.com","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Fri, 19 Dec 2025 05:22:57 GMT","end":"Thu, 19 Mar 2026 05:22:56 GMT"},"fingerprint":{"sha1":"23:4C:94:04:E1:25:E0:EA:D1:85:17:4C:09:FC:E0:DA:D0:01:E6:62","sha256":"AC:EF:45:40:E0:37:3A:BD:B9:C9:32:F5:6B:B1:B8:92:BE:33:89:43:FA:25:17:17:7C:CA:50:4E:0B:CD:25:EB"}}},"request":{"raw":"GET /css/chunk-4c0f0b53.7da50378.css HTTP/1.1\r\nHost: bluewhaleusen.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nX-Moz: prefetch\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Sat, 20 Dec 2025 07:01:24 GMT\r\ncontent-type: text/css\r\ncontent-length: 971\r\netag: W/\"971-1766123972325\"\r\nlast-modified: Fri, 19 Dec 2025 05:59:32 GMT\r\nstrict-transport-security: max-age=31536000\r\naccept-ranges: bytes\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":971,"size_decoded":0,"mime_type":"text/css","magic":"ASCII text, with very long lines (971), with no line terminators","md5":"364b94b45eaf72b8e38bf5dc4b2348f9","sha1":"869691808bc786803fba4730ffaecb8c2c95a975","sha256":"2da93f714bc866a0e4f302d78c7e5d14d291c27551b29d27969cb57089a191d4","sha512":"a33a5504a3284c5c20c32c7385f61833fada6b1d13e575231c0153a9fdf87d61b7a62caf829e6a22187ec6c8699b87ed13dec945c814e12be7034015716509a0","ssdeep":"","tlshash":"ca119bf151081435b867f26475d055fe316ef343a233446daea4b3a6ce93a9b12212ce","first_seen":"2024-02-11T04:26:47Z","last_seen":"2026-06-06T14:40:04.434707Z","times_seen":7560,"resource_available":false,"data":null}},"time_used":327,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":327,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2025-12-20","alert":"Sinkholed","trigger":"bluewhaleusen.com","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2025-12-20","alert":"Sinkholed","trigger":"bluewhaleusen.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2025-12-20","alert":"Phishing Block","trigger":"bluewhaleusen.com","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2025-12-20","alert":"Sinkholed","trigger":"bluewhaleusen.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2025-12-20","alert":"Sinkholed","trigger":"bluewhaleusen.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"bluewhaleusen.com/css/chunk-c6d7a01a.e67f7f3e.css","fqdn":"bluewhaleusen.com","domain":"bluewhaleusen.com","tld":"com"},"ip":{"addr":"118.107.9.252","port":443,"asn":152194,"as":"CTG Server Limited","country":"Singapore","country_code":"SG"},"is_navigation_request":false,"resource_type":"other","requested_by":"https://bluewhaleusen.com/","date":"2025-12-20T07:01:25.639Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"bluewhaleusen.com","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Fri, 19 Dec 2025 05:22:57 GMT","end":"Thu, 19 Mar 2026 05:22:56 GMT"},"fingerprint":{"sha1":"23:4C:94:04:E1:25:E0:EA:D1:85:17:4C:09:FC:E0:DA:D0:01:E6:62","sha256":"AC:EF:45:40:E0:37:3A:BD:B9:C9:32:F5:6B:B1:B8:92:BE:33:89:43:FA:25:17:17:7C:CA:50:4E:0B:CD:25:EB"}}},"request":{"raw":"GET /css/chunk-c6d7a01a.e67f7f3e.css HTTP/1.1\r\nHost: bluewhaleusen.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nX-Moz: prefetch\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Sat, 20 Dec 2025 07:01:25 GMT\r\ncontent-type: text/css\r\nvary: Accept-Encoding\r\netag: W/\"3807-1766123972328\"\r\nlast-modified: Fri, 19 Dec 2025 05:59:32 GMT\r\nstrict-transport-security: max-age=31536000\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":3807,"size_decoded":0,"mime_type":"text/css","magic":"ASCII text, with very long lines (3807), with no line terminators","md5":"d5c5cf21c0ac8cf32937fd5577eba50b","sha1":"49b8872bf19a1f9c7f9e78b19497e8b89ca2ccfb","sha256":"4531f24949afa7812c1f59876406ea88233df11ccaa72f9a7f559e55416dcc6d","sha512":"bd7965d44b3c3d8fe1e112a9097b029319ea0eb7bd67e9a52912b44344edf8f28493123a0ac5bfdca0181a551d03990a1ce84044abd3abace820f386e04ba5f8","ssdeep":"","tlshash":"04710e60ba22231f6a72f6fa55c0a1dc370aa21be19345dfdd49c40ec6df3a79174b60","first_seen":"2024-02-19T23:01:30Z","last_seen":"2026-06-06T14:40:04.519006Z","times_seen":1117,"resource_available":false,"data":null}},"time_used":329,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":329,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2025-12-20","alert":"Sinkholed","trigger":"bluewhaleusen.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2025-12-20","alert":"Sinkholed","trigger":"bluewhaleusen.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2025-12-20","alert":"Phishing Block","trigger":"bluewhaleusen.com","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2025-12-20","alert":"Sinkholed","trigger":"bluewhaleusen.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2025-12-20","alert":"Sinkholed","trigger":"bluewhaleusen.com","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"bluewhaleusen.com/css/chunk-08bbc53e.27a370f9.css","fqdn":"bluewhaleusen.com","domain":"bluewhaleusen.com","tld":"com"},"ip":{"addr":"118.107.9.252","port":443,"asn":152194,"as":"CTG Server Limited","country":"Singapore","country_code":"SG"},"is_navigation_request":false,"resource_type":"other","requested_by":"https://bluewhaleusen.com/","date":"2025-12-20T07:01:23.240Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"bluewhaleusen.com","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Fri, 19 Dec 2025 05:22:57 GMT","end":"Thu, 19 Mar 2026 05:22:56 GMT"},"fingerprint":{"sha1":"23:4C:94:04:E1:25:E0:EA:D1:85:17:4C:09:FC:E0:DA:D0:01:E6:62","sha256":"AC:EF:45:40:E0:37:3A:BD:B9:C9:32:F5:6B:B1:B8:92:BE:33:89:43:FA:25:17:17:7C:CA:50:4E:0B:CD:25:EB"}}},"request":{"raw":"GET /css/chunk-08bbc53e.27a370f9.css HTTP/1.1\r\nHost: bluewhaleusen.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nX-Moz: prefetch\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Sat, 20 Dec 2025 07:01:23 GMT\r\ncontent-type: text/css\r\nvary: Accept-Encoding\r\netag: W/\"4695-1766123972329\"\r\nlast-modified: Fri, 19 Dec 2025 05:59:32 GMT\r\nstrict-transport-security: max-age=31536000\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":4695,"size_decoded":0,"mime_type":"text/css","magic":"ASCII text, with very long lines (4695), with no line terminators","md5":"2abfc31d2a6752d6d66f5fa21c7fa262","sha1":"63116607f3b72d74be9d1bdd5050ac15859f7243","sha256":"9159959031e6a701bd2e9e5baaa03c4f14d6c2530977a9e013c8af24c4838a37","sha512":"ec6bd33bd4a69b9e93485dfa272e08170ac3c17b0aec5f291b716c1e370435f6bf26fd7b2139aa75790defcf2223f4deeec07818a549334ba069f8a307201127","ssdeep":"96:VQrF215xix1yXSl6nS65EaOYIj8MRSLRsR7S6m0Z8u/j/20RO5sR5WFs5E:VQKM8F9","tlshash":"77a1b050b15e162b687bfad9187cdd4cb0d6fe2ac1324b76ed9f24148882e733622235","first_seen":"2024-02-11T04:26:48Z","last_seen":"2026-06-06T14:40:04.500613Z","times_seen":5224,"resource_available":false,"data":null}},"time_used":335,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":335,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2025-12-20","alert":"Sinkholed","trigger":"bluewhaleusen.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2025-12-20","alert":"Phishing Block","trigger":"bluewhaleusen.com","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2025-12-20","alert":"Sinkholed","trigger":"bluewhaleusen.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2025-12-20","alert":"Sinkholed","trigger":"bluewhaleusen.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2025-12-20","alert":"Sinkholed","trigger":"bluewhaleusen.com","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"imgtest1.s3.amazonaws.com/type/2023-03-29/40488675-237a-40d9-b2d3-e5d53b0e6455.jpg","fqdn":"imgtest1.s3.amazonaws.com","domain":"imgtest1.s3.amazonaws.com","tld":"s3.amazonaws.com"},"ip":{"addr":"16.15.207.90","port":443,"asn":14618,"as":"AMAZON-AES","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://bluewhaleusen.com/","date":"2025-12-20T07:01:23.348Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"P256","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.s3.amazonaws.com","organization":""},"issuer":{"commonName":"Amazon RSA 2048 M01","organization":"Amazon"},"validity":{"start":"Fri, 14 Feb 2025 00:00:00 GMT","end":"Sat, 07 Feb 2026 23:59:59 GMT"},"fingerprint":{"sha1":"2E:BA:63:64:95:A8:CE:55:DD:7E:EB:A9:98:83:14:B1:6F:6B:61:69","sha256":"00:D7:0B:CC:1F:82:6B:F6:D9:2E:55:1A:BA:88:38:33:19:09:5B:85:49:41:5E:DA:A1:97:B9:D2:0A:3B:13:52"}}},"request":{"raw":"GET /type/2023-03-29/40488675-237a-40d9-b2d3-e5d53b0e6455.jpg HTTP/1.1\r\nHost: imgtest1.s3.amazonaws.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nx-amz-id-2: zXtl23I82yX1LxE3bsRMpY7ELDCxXP6FV8cuP+fJrMH8oVw9TywddMFGS6TmpbSSD5/qUIU/64ZJcyXOIJZTkMDvEPPLsb9D\r\nx-amz-request-id: S19K01QR6A6GX526\r\nDate: Sat, 20 Dec 2025 07:01:24 GMT\r\nLast-Modified: Sun, 01 Sep 2024 17:37:18 GMT\r\nETag: \"a5941f987a0fe015714bc8b8cde4baff\"\r\nx-amz-server-side-encryption: AES256\r\nAccept-Ranges: bytes\r\nContent-Type: image/jpeg\r\nContent-Length: 44216\r\nServer: AmazonS3\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Amazon S3","description":"Amazon S3 or Amazon Simple Storage Service is a service offered by Amazon Web Services (AWS) that provides object storage through a web service interface.","website":"https://aws.amazon.com/s3/","common_platform_enumeration":"","icon":"Amazon S3.svg","categories":["CDN"]},{"name":"Amazon Web Services","description":"Amazon Web Services (AWS) is a comprehensive cloud services platform offering compute power, database storage, content delivery and other functionality.","website":"https://aws.amazon.com/","common_platform_enumeration":"","icon":"Amazon Web Services.svg","categories":["PaaS"]}],"data":{"size":44216,"size_decoded":0,"mime_type":"image/jpeg","magic":"JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, comment: \"CREATOR: gd-jpeg v1.0 (using IJG JPEG v80), quality = 90\", baseline, precision 8, 500x500, components 3","md5":"a5941f987a0fe015714bc8b8cde4baff","sha1":"88c88146f9813942943df5777e08d4486db3040a","sha256":"41da4ebe3b85b5ca006db2a633baa60593618feeb72f3db99e110d74e1cbd918","sha512":"937d3c4add07ef443e201c34e73eef5cf558a781c5112a81719a989e4ff4c2cc29f2bf35739cec929988409694a4518fe862820b2fb6c18d71b4195954700628","ssdeep":"768:GTRG9BPKCHP1oTrfNz7uVdkyQ5CmHjrYaBsDTtk9GbLf+H:GT8QgP1oTzB0dkyQ5Cm7Bs/u9+CH","tlshash":"52139d478e489f835014d3fd3e079e6d6b891b0c59893aef19b31eab3f216521c8e54e","first_seen":"2023-11-07T02:37:43Z","last_seen":"2026-08-11T08:26:52.899113Z","times_seen":9939,"resource_available":false,"data":null}},"time_used":770,"timings":{"blocked":257,"dns":4,"connect":108,"send":0,"wait":137,"receive":109,"ssl":153},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"mall-test.s3.amazonaws.com/test/2023-03-28/d242b41f-a56b-4d36-86c6-d91b086f2e80.jpg","fqdn":"mall-test.s3.amazonaws.com","domain":"mall-test.s3.amazonaws.com","tld":"s3.amazonaws.com"},"ip":{"addr":"3.5.30.74","port":443,"asn":14618,"as":"AMAZON-AES","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://bluewhaleusen.com/","date":"2025-12-20T07:01:23.473Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"P256","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"s3.amazonaws.com","organization":""},"issuer":{"commonName":"Amazon RSA 2048 M01","organization":"Amazon"},"validity":{"start":"Fri, 19 Sep 2025 00:00:00 GMT","end":"Sun, 23 Aug 2026 23:59:59 GMT"},"fingerprint":{"sha1":"48:FD:CD:50:85:6A:51:E7:71:E4:CB:E0:03:81:E1:EC:4E:AD:9E:C7","sha256":"D7:11:81:F4:91:03:0D:C6:A5:DE:8A:EF:AA:58:14:BA:AD:33:B5:11:8B:D5:F0:33:53:8B:AF:49:82:E9:4B:A4"}}},"request":{"raw":"GET /test/2023-03-28/d242b41f-a56b-4d36-86c6-d91b086f2e80.jpg HTTP/1.1\r\nHost: mall-test.s3.amazonaws.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nx-amz-id-2: RLSfv7Cc+/MiVnfr9ALCt9pEXGCGyX0YzGDihy4+EClMbJoVZjbCQbMAuS8tfETsp2QxtEylkh+PPW6/dQO3y801R2/8v1ig\r\nx-amz-request-id: CRNGAT2726AK6TH7\r\nDate: Sat, 20 Dec 2025 07:01:25 GMT\r\nLast-Modified: Wed, 22 May 2024 20:54:04 GMT\r\nETag: \"9eaa232e9d3003f7a969175be379afca\"\r\nx-amz-server-side-encryption: AES256\r\nAccept-Ranges: bytes\r\nContent-Type: image/jpeg\r\nContent-Length: 97622\r\nServer: AmazonS3\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Amazon Web Services","description":"Amazon Web Services (AWS) is a comprehensive cloud services platform offering compute power, database storage, content delivery and other functionality.","website":"https://aws.amazon.com/","common_platform_enumeration":"","icon":"Amazon Web Services.svg","categories":["PaaS"]},{"name":"Amazon S3","description":"Amazon S3 or Amazon Simple Storage Service is a service offered by Amazon Web Services (AWS) that provides object storage through a web service interface.","website":"https://aws.amazon.com/s3/","common_platform_enumeration":"","icon":"Amazon S3.svg","categories":["CDN"]}],"data":{"size":97622,"size_decoded":0,"mime_type":"image/jpeg","magic":"JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 1095x1077, components 3","md5":"9eaa232e9d3003f7a969175be379afca","sha1":"64d4d553fc1340b9d1e932e111c6059f03fdf5cd","sha256":"3219dde1f8200c3350e1a01e6d83e5840cf68f87e27e901ec9c77275021bef14","sha512":"f5d2569f4ec4273aa4872652759595e4f673ab811ea934cef5787a699b324dcdce5e08b3a0e01598109b1bca4fb9fb4d53924a622aa313cfb857a55c1aa4f18d","ssdeep":"1536:g3RruCk+XBAvF6JUyCUW1SBzuAN6dv4rhX2YKk2NY65QQ+nXjuFebpIrZlb4CjGj:ghru+RAvxyfW3i6p4rlXcY6aQ+nsUKlM","tlshash":"dc9302bb5ac94169c6cca33399254513fa58c0a621630dffba95db0b25dfa4039c39e3","first_seen":"2024-02-19T23:01:28Z","last_seen":"2026-08-09T04:44:19.30218Z","times_seen":7236,"resource_available":false,"data":null}},"time_used":956,"timings":{"blocked":836,"dns":0,"connect":0,"send":0,"wait":118,"receive":2,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"mall-test.s3.amazonaws.com/test/2023-03-28/c568cc14-8506-4b6e-85dd-bfd46f7a8607.jpg","fqdn":"mall-test.s3.amazonaws.com","domain":"mall-test.s3.amazonaws.com","tld":"s3.amazonaws.com"},"ip":{"addr":"3.5.30.74","port":443,"asn":14618,"as":"AMAZON-AES","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://bluewhaleusen.com/","date":"2025-12-20T07:01:23.610Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"P256","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"s3.amazonaws.com","organization":""},"issuer":{"commonName":"Amazon RSA 2048 M01","organization":"Amazon"},"validity":{"start":"Fri, 19 Sep 2025 00:00:00 GMT","end":"Sun, 23 Aug 2026 23:59:59 GMT"},"fingerprint":{"sha1":"48:FD:CD:50:85:6A:51:E7:71:E4:CB:E0:03:81:E1:EC:4E:AD:9E:C7","sha256":"D7:11:81:F4:91:03:0D:C6:A5:DE:8A:EF:AA:58:14:BA:AD:33:B5:11:8B:D5:F0:33:53:8B:AF:49:82:E9:4B:A4"}}},"request":{"raw":"GET /test/2023-03-28/c568cc14-8506-4b6e-85dd-bfd46f7a8607.jpg HTTP/1.1\r\nHost: mall-test.s3.amazonaws.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nx-amz-id-2: C5dI0XzvYQlhft3bQMQAGH/vQsZ5z8iDmnRk3nst/7yMW6tfAJm0+C59+kzYfY4GHrWLPHiHCYwi9nOfRAo3x4f8zMUb5tkK\r\nx-amz-request-id: CRNKNNP1RMZKVWNZ\r\nDate: Sat, 20 Dec 2025 07:01:25 GMT\r\nLast-Modified: Wed, 22 May 2024 20:53:37 GMT\r\nETag: \"69ea9ab0655294c4e81cb9123f9b84ed\"\r\nx-amz-server-side-encryption: AES256\r\nAccept-Ranges: bytes\r\nContent-Type: image/jpeg\r\nContent-Length: 117788\r\nServer: AmazonS3\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Amazon S3","description":"Amazon S3 or Amazon Simple Storage Service is a service offered by Amazon Web Services (AWS) that provides object storage through a web service interface.","website":"https://aws.amazon.com/s3/","common_platform_enumeration":"","icon":"Amazon S3.svg","categories":["CDN"]},{"name":"Amazon Web Services","description":"Amazon Web Services (AWS) is a comprehensive cloud services platform offering compute power, database storage, content delivery and other functionality.","website":"https://aws.amazon.com/","common_platform_enumeration":"","icon":"Amazon Web Services.svg","categories":["PaaS"]}],"data":{"size":117788,"size_decoded":0,"mime_type":"image/jpeg","magic":"JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 1500x1500, components 3","md5":"69ea9ab0655294c4e81cb9123f9b84ed","sha1":"249e0e3b9f9c8ebb9d3c2b0e8f96db0bbbb96233","sha256":"49bd15612e8028f820eea86b82dafa4d5e439225445e527cf5a3232ed060d942","sha512":"4e05f275f9d9ccecc1ff61aaf45278811f0062aced05aac2d3d4c7648c4be9e1130cda1ec819a3a4503006a7c49b87fe94e1bc71657c2ad2708080425857f71e","ssdeep":"1536:3edS0foEyCuEPL1TVLKPXCTmcgFbbLmWEDBygAcq5qtlDRVtU+e+aPZl6ejI9li5:zCAEP/ICIbCWEBHAcq5ylFVBIuNuV/lr","tlshash":"18b31204277e7cc1c2f9a176c8b1567a57b5c74ee2dd9714ab5a3401cfe3a202e10aab","first_seen":"2024-03-15T18:45:45Z","last_seen":"2026-08-11T08:26:52.953459Z","times_seen":2412,"resource_available":false,"data":null}},"time_used":700,"timings":{"blocked":487,"dns":0,"connect":0,"send":0,"wait":118,"receive":95,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"mall-test.s3.amazonaws.com/test/2023-03-28/2c9882e2-5834-48ac-9326-2fcb50e3f03d.jpg","fqdn":"mall-test.s3.amazonaws.com","domain":"mall-test.s3.amazonaws.com","tld":"s3.amazonaws.com"},"ip":{"addr":"3.5.30.74","port":443,"asn":14618,"as":"AMAZON-AES","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://bluewhaleusen.com/","date":"2025-12-20T07:01:23.641Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"P256","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"s3.amazonaws.com","organization":""},"issuer":{"commonName":"Amazon RSA 2048 M01","organization":"Amazon"},"validity":{"start":"Fri, 19 Sep 2025 00:00:00 GMT","end":"Sun, 23 Aug 2026 23:59:59 GMT"},"fingerprint":{"sha1":"48:FD:CD:50:85:6A:51:E7:71:E4:CB:E0:03:81:E1:EC:4E:AD:9E:C7","sha256":"D7:11:81:F4:91:03:0D:C6:A5:DE:8A:EF:AA:58:14:BA:AD:33:B5:11:8B:D5:F0:33:53:8B:AF:49:82:E9:4B:A4"}}},"request":{"raw":"GET /test/2023-03-28/2c9882e2-5834-48ac-9326-2fcb50e3f03d.jpg HTTP/1.1\r\nHost: mall-test.s3.amazonaws.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nx-amz-id-2: kZyDMf5gDioLIvw/fPjj8jSxyTQmP8B+TVQYh1InTCs2pLYWkNSs551T3zRsC/i4eXkv1OC7kiFRA95z95m4+DBqq/ebdvbF\r\nx-amz-request-id: CRNHJKQNQ4GRH90B\r\nDate: Sat, 20 Dec 2025 07:01:25 GMT\r\nLast-Modified: Wed, 22 May 2024 20:48:03 GMT\r\nETag: \"e20b3cf0277fa3099d6972dd28d24abc\"\r\nx-amz-server-side-encryption: AES256\r\nAccept-Ranges: bytes\r\nContent-Type: image/jpeg\r\nContent-Length: 15607\r\nServer: AmazonS3\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Amazon Web Services","description":"Amazon Web Services (AWS) is a comprehensive cloud services platform offering compute power, database storage, content delivery and other functionality.","website":"https://aws.amazon.com/","common_platform_enumeration":"","icon":"Amazon Web Services.svg","categories":["PaaS"]},{"name":"Amazon S3","description":"Amazon S3 or Amazon Simple Storage Service is a service offered by Amazon Web Services (AWS) that provides object storage through a web service interface.","website":"https://aws.amazon.com/s3/","common_platform_enumeration":"","icon":"Amazon S3.svg","categories":["CDN"]}],"data":{"size":15607,"size_decoded":0,"mime_type":"image/jpeg","magic":"JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 802x521, components 3","md5":"e20b3cf0277fa3099d6972dd28d24abc","sha1":"84d0691dcf51b356061d534f15b0d525a74ca14d","sha256":"4c7f74a7416671cabecb63179e3ccffca56fa748572c201b258b4a386b56c27d","sha512":"4b46eef72d81a1487e47a8424dba9e855df286ebb4841e4fdfb5208b65c2483a3f3a148e529b1711aba34da55d3493c4292f2b4b40b050ff9f8130d40cba6f97","ssdeep":"384:1o70easHMM6iAWmDWgBefzTEtnnRo8sKNdyqbAafK:1o7aHdWmDWmyvya1kA6K","tlshash":"7062ce521a0f3984e86d297e452f27b04b679ee3f12f0c91307ac112d2e49e0ad9e0fd","first_seen":"2024-03-15T18:45:45Z","last_seen":"2026-06-11T23:31:05.332006Z","times_seen":2298,"resource_available":false,"data":null}},"time_used":900,"timings":{"blocked":789,"dns":0,"connect":0,"send":0,"wait":111,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"mall-test.s3.amazonaws.com/test/2023-03-28/f7afcb31-8430-46eb-9114-c2bacf56fc71.jpg","fqdn":"mall-test.s3.amazonaws.com","domain":"mall-test.s3.amazonaws.com","tld":"s3.amazonaws.com"},"ip":{"addr":"3.5.30.74","port":443,"asn":14618,"as":"AMAZON-AES","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://bluewhaleusen.com/","date":"2025-12-20T07:01:23.649Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"P256","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"s3.amazonaws.com","organization":""},"issuer":{"commonName":"Amazon RSA 2048 M01","organization":"Amazon"},"validity":{"start":"Fri, 19 Sep 2025 00:00:00 GMT","end":"Sun, 23 Aug 2026 23:59:59 GMT"},"fingerprint":{"sha1":"48:FD:CD:50:85:6A:51:E7:71:E4:CB:E0:03:81:E1:EC:4E:AD:9E:C7","sha256":"D7:11:81:F4:91:03:0D:C6:A5:DE:8A:EF:AA:58:14:BA:AD:33:B5:11:8B:D5:F0:33:53:8B:AF:49:82:E9:4B:A4"}}},"request":{"raw":"GET /test/2023-03-28/f7afcb31-8430-46eb-9114-c2bacf56fc71.jpg HTTP/1.1\r\nHost: mall-test.s3.amazonaws.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nx-amz-id-2: WQUeFU6qiuSQSCrDIz8N03gl3ZiX6pct4C5/D2eiWYE15RKuk/bivcLQaJVls8pBhmydWTZN/shInMykHmpEUNlzlgjRpe2W\r\nx-amz-request-id: CRNG238XX18960YB\r\nDate: Sat, 20 Dec 2025 07:01:25 GMT\r\nLast-Modified: Wed, 22 May 2024 20:55:26 GMT\r\nETag: \"4c85719fadd1dd49d50764ebb37f8bf4\"\r\nx-amz-server-side-encryption: AES256\r\nAccept-Ranges: bytes\r\nContent-Type: image/jpeg\r\nContent-Length: 41611\r\nServer: AmazonS3\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Amazon Web Services","description":"Amazon Web Services (AWS) is a comprehensive cloud services platform offering compute power, database storage, content delivery and other functionality.","website":"https://aws.amazon.com/","common_platform_enumeration":"","icon":"Amazon Web Services.svg","categories":["PaaS"]},{"name":"Amazon S3","description":"Amazon S3 or Amazon Simple Storage Service is a service offered by Amazon Web Services (AWS) that provides object storage through a web service interface.","website":"https://aws.amazon.com/s3/","common_platform_enumeration":"","icon":"Amazon S3.svg","categories":["CDN"]}],"data":{"size":41611,"size_decoded":0,"mime_type":"image/jpeg","magic":"JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 724x889, components 3","md5":"4c85719fadd1dd49d50764ebb37f8bf4","sha1":"202bd373f578df56177fa741f81f7961a7d0a9d6","sha256":"ee62d20d0f0ec21165f8f72ccdcae8656724084b83fb33275674a13ab9d9c283","sha512":"5226eaff0fba868be39aad762b79a4354cb46e4c839a841e5dac176ab4daeacef5dfdd0449a9f0c8b5294d64033bfb6048d635ca4e2f5c231588def6bca34a9e","ssdeep":"768:1CSqOAnN5XScHDhNwdErLTQCBLnVh0xiS/aNBFx2yggiujl+fhBQUkypJ:gvOQ5XSYDDUe3QCxVg9y3F1Xiwl+fhBF","tlshash":"8913f064273d5020c5c106be425bb6cc1fe5017dabf789423ae45cbfe469f92aca1887","first_seen":"2024-02-19T23:01:28Z","last_seen":"2026-08-09T04:44:19.270416Z","times_seen":7375,"resource_available":false,"data":null}},"time_used":981,"timings":{"blocked":860,"dns":0,"connect":0,"send":0,"wait":119,"receive":2,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"mall-test.s3.amazonaws.com/pc/gp910/B08GDC6BXT/51nqa1O5NVL._AC_UL1000_.jpg","fqdn":"mall-test.s3.amazonaws.com","domain":"mall-test.s3.amazonaws.com","tld":"s3.amazonaws.com"},"ip":{"addr":"3.5.30.74","port":443,"asn":14618,"as":"AMAZON-AES","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://bluewhaleusen.com/","date":"2025-12-20T07:01:24.681Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"P256","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"s3.amazonaws.com","organization":""},"issuer":{"commonName":"Amazon RSA 2048 M01","organization":"Amazon"},"validity":{"start":"Fri, 19 Sep 2025 00:00:00 GMT","end":"Sun, 23 Aug 2026 23:59:59 GMT"},"fingerprint":{"sha1":"48:FD:CD:50:85:6A:51:E7:71:E4:CB:E0:03:81:E1:EC:4E:AD:9E:C7","sha256":"D7:11:81:F4:91:03:0D:C6:A5:DE:8A:EF:AA:58:14:BA:AD:33:B5:11:8B:D5:F0:33:53:8B:AF:49:82:E9:4B:A4"}}},"request":{"raw":"GET /pc/gp910/B08GDC6BXT/51nqa1O5NVL._AC_UL1000_.jpg HTTP/1.1\r\nHost: mall-test.s3.amazonaws.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nx-amz-id-2: Tcxl4nhZw0KDVZDve83lurGPoY6aneU/gqjmWXiQFREf9lqONUi3pxfWo80i5a+O+uaVOmIFwxgPaB54UfWCbQNBWMjVRJ1L\r\nx-amz-request-id: CRNHZ51N9VWEHHNC\r\nDate: Sat, 20 Dec 2025 07:01:25 GMT\r\nLast-Modified: Wed, 22 May 2024 13:50:55 GMT\r\nETag: \"cb24f33cb4ff359a439a0d73bb6d2752\"\r\nx-amz-server-side-encryption: AES256\r\nAccept-Ranges: bytes\r\nContent-Type: image/jpeg\r\nContent-Length: 35067\r\nServer: AmazonS3\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Amazon S3","description":"Amazon S3 or Amazon Simple Storage Service is a service offered by Amazon Web Services (AWS) that provides object storage through a web service interface.","website":"https://aws.amazon.com/s3/","common_platform_enumeration":"","icon":"Amazon S3.svg","categories":["CDN"]},{"name":"Amazon Web Services","description":"Amazon Web Services (AWS) is a comprehensive cloud services platform offering compute power, database storage, content delivery and other functionality.","website":"https://aws.amazon.com/","common_platform_enumeration":"","icon":"Amazon Web Services.svg","categories":["PaaS"]}],"data":{"size":35067,"size_decoded":0,"mime_type":"image/jpeg","magic":"JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 650x1000, components 3","md5":"cb24f33cb4ff359a439a0d73bb6d2752","sha1":"c2cd25233de083ef231ecb1e99144800c46e6d02","sha256":"e0c66d00c9f5ac611d2f61f078eb40db018df1c3af4046bca89a51d4d4088a86","sha512":"d0ae7b1278b28519a69abd0b69d83bf426d16ef8e87f2008c2c3eeb5ec0c32dcd725f968a87a6285abeff6e855ecf59a4cf4891eb12abb14a2f62dc74fb90ef6","ssdeep":"768:1K+IIdonHnMKYMvOjEXpdfUbHHOXMG5NUnLlRFdHLebFEPslsnQrqXU2:IPI2sBM22obHHFacR+ZxsnQEb","tlshash":"97f201b39248d715c8684bfe18bf1ae7fa8c90e00daf594245300c52be5ff902a1b5f9","first_seen":"2024-03-15T18:45:46Z","last_seen":"2026-08-11T08:26:52.906059Z","times_seen":2297,"resource_available":false,"data":null}},"time_used":270,"timings":{"blocked":154,"dns":0,"connect":0,"send":0,"wait":114,"receive":2,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"bluewhaleusen.com/js/chunk-2bdc7c1c.3b2a0fb6.js","fqdn":"bluewhaleusen.com","domain":"bluewhaleusen.com","tld":"com"},"ip":{"addr":"118.107.9.252","port":443,"asn":152194,"as":"CTG Server Limited","country":"Singapore","country_code":"SG"},"is_navigation_request":false,"resource_type":"other","requested_by":"https://bluewhaleusen.com/","date":"2025-12-20T07:01:26.324Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"bluewhaleusen.com","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Fri, 19 Dec 2025 05:22:57 GMT","end":"Thu, 19 Mar 2026 05:22:56 GMT"},"fingerprint":{"sha1":"23:4C:94:04:E1:25:E0:EA:D1:85:17:4C:09:FC:E0:DA:D0:01:E6:62","sha256":"AC:EF:45:40:E0:37:3A:BD:B9:C9:32:F5:6B:B1:B8:92:BE:33:89:43:FA:25:17:17:7C:CA:50:4E:0B:CD:25:EB"}}},"request":{"raw":"GET /js/chunk-2bdc7c1c.3b2a0fb6.js HTTP/1.1\r\nHost: bluewhaleusen.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nX-Moz: prefetch\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Sat, 20 Dec 2025 07:01:26 GMT\r\ncontent-type: application/javascript\r\nvary: Accept-Encoding\r\netag: W/\"33190-1766123972304\"\r\nlast-modified: Fri, 19 Dec 2025 05:59:32 GMT\r\nstrict-transport-security: max-age=31536000\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":33190,"size_decoded":0,"mime_type":"application/javascript","magic":"JavaScript source, Unicode text, UTF-8 text, with very long lines (33154), with no line terminators","md5":"744c54446e61f5d1b905361d15c85998","sha1":"5c3a6c929e695a790797aa763ea7863cbff0d7ab","sha256":"d8910170ab8c5baaca72f9b047faa7e14c49f97d907e4c137fee23629107c1c3","sha512":"df57b73849df42965644f26b84a1ed37d0e75079d7165a14b96928369ca0065aebe547c803c7b384976f4ff62cc63c1a174eee52ed367e42b421729e168c6bb0","ssdeep":"384:/XWsnfX8q8V8bTpAtlfs/0NbuGoalAS22Hn/jvjs4WvzsL5cU+18e:/pMqs7s/gbuGXH/fsMLDe","tlshash":"56e20a4ba4c2687d899a6159241b2658b8323fc5e041c8d6b53cfdf4e2f8e34772b76c","first_seen":"2025-04-08T11:27:57.64892Z","last_seen":"2026-06-06T14:40:04.34261Z","times_seen":66,"resource_available":true,"data":null}},"time_used":329,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":329,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2025-12-20","alert":"Sinkholed","trigger":"bluewhaleusen.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2025-12-20","alert":"Sinkholed","trigger":"bluewhaleusen.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2025-12-20","alert":"Phishing Block","trigger":"bluewhaleusen.com","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2025-12-20","alert":"Sinkholed","trigger":"bluewhaleusen.com","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2025-12-20","alert":"Sinkholed","trigger":"bluewhaleusen.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"bluewhaleusen.com/wap/api/banner!bannerList.action?pageNum=1\u0026pageSize=8\u0026type=pc\u0026imgType=1\u0026lang=en","fqdn":"bluewhaleusen.com","domain":"bluewhaleusen.com","tld":"com"},"ip":{"addr":"118.107.9.252","port":443,"asn":152194,"as":"CTG Server Limited","country":"Singapore","country_code":"SG"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"https://bluewhaleusen.com/","date":"2025-12-20T07:01:22.976Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"bluewhaleusen.com","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Fri, 19 Dec 2025 05:22:57 GMT","end":"Thu, 19 Mar 2026 05:22:56 GMT"},"fingerprint":{"sha1":"23:4C:94:04:E1:25:E0:EA:D1:85:17:4C:09:FC:E0:DA:D0:01:E6:62","sha256":"AC:EF:45:40:E0:37:3A:BD:B9:C9:32:F5:6B:B1:B8:92:BE:33:89:43:FA:25:17:17:7C:CA:50:4E:0B:CD:25:EB"}}},"request":{"raw":"POST /wap/api/banner!bannerList.action?pageNum=1\u0026pageSize=8\u0026type=pc\u0026imgType=1\u0026lang=en HTTP/1.1\r\nHost: bluewhaleusen.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/json, text/plain, */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nContent-Type: application/x-www-form-urlencoded\r\nOrigin: https://bluewhaleusen.com\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\nContent-Length: 0\r\n\r\n","headers":null,"cookies":null,"method":"POST"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Sat, 20 Dec 2025 07:01:23 GMT\r\ncontent-type: application/json;charset=UTF-8\r\nvary: Accept-Encoding, Origin, Access-Control-Request-Method, Access-Control-Request-Headers\r\naccess-control-allow-origin: *\r\nstrict-transport-security: max-age=31536000\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":886,"size_decoded":0,"mime_type":"application/json; charset=UTF-8","magic":"JSON text data","md5":"20ffe353d0c008095d31123609084e28","sha1":"5b7b417774f625e722dc7294271ff390a9995fb9","sha256":"d5bbdc35eb63ae5e36d3cef1601852be138b0e8be2d780fb1c9ef4a72b14e11e","sha512":"699f37a17b92ff775fca98d59728100c7d51c5e4452b7bbbaa5ba4304cda981edacbef100fd0cd04b9843f2bd4bfc488323723fc505227d628eac42d1dd8f567","ssdeep":"","tlshash":"8e119c1617c8d05d1ac07f83cbceb5c5e6acdb072c989a09d6aeef1c0916b386428327","first_seen":"2025-04-09T11:45:10.466571Z","last_seen":"2026-06-06T14:40:04.350195Z","times_seen":181,"resource_available":false,"data":null}},"time_used":329,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":329,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2025-12-20","alert":"Sinkholed","trigger":"bluewhaleusen.com","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2025-12-20","alert":"Phishing Block","trigger":"bluewhaleusen.com","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2025-12-20","alert":"Sinkholed","trigger":"bluewhaleusen.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2025-12-20","alert":"Sinkholed","trigger":"bluewhaleusen.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2025-12-20","alert":"Sinkholed","trigger":"bluewhaleusen.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"bluewhaleusen.com/wap/api/sellerGoods!recommend_new.action?type=0\u0026pageSize=24\u0026pageNum=1\u0026lang=en","fqdn":"bluewhaleusen.com","domain":"bluewhaleusen.com","tld":"com"},"ip":{"addr":"118.107.9.252","port":443,"asn":152194,"as":"CTG Server Limited","country":"Singapore","country_code":"SG"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"https://bluewhaleusen.com/","date":"2025-12-20T07:01:22.983Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"bluewhaleusen.com","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Fri, 19 Dec 2025 05:22:57 GMT","end":"Thu, 19 Mar 2026 05:22:56 GMT"},"fingerprint":{"sha1":"23:4C:94:04:E1:25:E0:EA:D1:85:17:4C:09:FC:E0:DA:D0:01:E6:62","sha256":"AC:EF:45:40:E0:37:3A:BD:B9:C9:32:F5:6B:B1:B8:92:BE:33:89:43:FA:25:17:17:7C:CA:50:4E:0B:CD:25:EB"}}},"request":{"raw":"POST /wap/api/sellerGoods!recommend_new.action?type=0\u0026pageSize=24\u0026pageNum=1\u0026lang=en HTTP/1.1\r\nHost: bluewhaleusen.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/json, text/plain, */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nContent-Type: application/x-www-form-urlencoded\r\nOrigin: https://bluewhaleusen.com\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\nContent-Length: 0\r\n\r\n","headers":null,"cookies":null,"method":"POST"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Sat, 20 Dec 2025 07:01:23 GMT\r\ncontent-type: application/json;charset=UTF-8\r\nvary: Accept-Encoding, Origin, Access-Control-Request-Method, Access-Control-Request-Headers\r\naccess-control-allow-origin: *\r\nstrict-transport-security: max-age=31536000\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":121565,"size_decoded":0,"mime_type":"application/json; charset=UTF-8","magic":"JSON text data","md5":"801571e8a195c07001a5af255c12ef6d","sha1":"2bbb0d0aff6481ee587928fb124f62adc94bb916","sha256":"f14157136265af79c5df20bf90d7f2981fd87652a28bc0f77cd8a0a5754990ed","sha512":"f336d578bdea6e2a636c7caec786d6576f833bb32bba26c97f495da54829641ba093d59ac52e2e0cf0281b2a10c5373ce4930a167be007738adf5f8d8ed16e54","ssdeep":"3072:FVnTA3qf/41jxc+kuGqArnBx5ymCPSaxM75jS+ePX/cz/P:OrwBz","tlshash":"e7c3d852c79881350f64019544273bae94fd8217ef734f99ae3cde387aac8f6766608c","first_seen":"2025-12-19T18:50:43.937634Z","last_seen":"2025-12-20T07:02:05.177076Z","times_seen":2,"resource_available":false,"data":null}},"time_used":370,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":370,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2025-12-20","alert":"Sinkholed","trigger":"bluewhaleusen.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2025-12-20","alert":"Sinkholed","trigger":"bluewhaleusen.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2025-12-20","alert":"Sinkholed","trigger":"bluewhaleusen.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2025-12-20","alert":"Phishing Block","trigger":"bluewhaleusen.com","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2025-12-20","alert":"Sinkholed","trigger":"bluewhaleusen.com","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"imgtest1.s3.amazonaws.com/type/2023-03-29/97f3899d-51d4-4cd2-9720-0af99206dabb.jpg","fqdn":"imgtest1.s3.amazonaws.com","domain":"imgtest1.s3.amazonaws.com","tld":"s3.amazonaws.com"},"ip":{"addr":"16.15.207.90","port":443,"asn":14618,"as":"AMAZON-AES","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://bluewhaleusen.com/","date":"2025-12-20T07:01:23.373Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"P256","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.s3.amazonaws.com","organization":""},"issuer":{"commonName":"Amazon RSA 2048 M01","organization":"Amazon"},"validity":{"start":"Fri, 14 Feb 2025 00:00:00 GMT","end":"Sat, 07 Feb 2026 23:59:59 GMT"},"fingerprint":{"sha1":"2E:BA:63:64:95:A8:CE:55:DD:7E:EB:A9:98:83:14:B1:6F:6B:61:69","sha256":"00:D7:0B:CC:1F:82:6B:F6:D9:2E:55:1A:BA:88:38:33:19:09:5B:85:49:41:5E:DA:A1:97:B9:D2:0A:3B:13:52"}}},"request":{"raw":"GET /type/2023-03-29/97f3899d-51d4-4cd2-9720-0af99206dabb.jpg HTTP/1.1\r\nHost: imgtest1.s3.amazonaws.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nx-amz-id-2: UN9NldHQr0n5oSTBYCRrEVfNbGjIz4ziK/sUTPcuvz5x9ErVBGFEonSY5TzEKGnuCpYAv/OXogiMBKRSa+BtEJ1ZwEiVaPaP\r\nx-amz-request-id: S19H85T7QVS0VNMT\r\nDate: Sat, 20 Dec 2025 07:01:24 GMT\r\nLast-Modified: Sun, 01 Sep 2024 17:37:18 GMT\r\nETag: \"74ce2539c3d1d018eb92f94dd3b9bd23\"\r\nx-amz-server-side-encryption: AES256\r\nAccept-Ranges: bytes\r\nContent-Type: image/jpeg\r\nContent-Length: 40407\r\nServer: AmazonS3\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Amazon Web Services","description":"Amazon Web Services (AWS) is a comprehensive cloud services platform offering compute power, database storage, content delivery and other functionality.","website":"https://aws.amazon.com/","common_platform_enumeration":"","icon":"Amazon Web Services.svg","categories":["PaaS"]},{"name":"Amazon S3","description":"Amazon S3 or Amazon Simple Storage Service is a service offered by Amazon Web Services (AWS) that provides object storage through a web service interface.","website":"https://aws.amazon.com/s3/","common_platform_enumeration":"","icon":"Amazon S3.svg","categories":["CDN"]}],"data":{"size":40407,"size_decoded":0,"mime_type":"image/jpeg","magic":"JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, comment: \"CREATOR: gd-jpeg v1.0 (using IJG JPEG v80), quality = 90\", baseline, precision 8, 500x500, components 3","md5":"74ce2539c3d1d018eb92f94dd3b9bd23","sha1":"1ed07808d60d8ff4965899591136f4f1ccc880e3","sha256":"5a3f2be7dd8069790a3bb5098aa704996a51c1c689459abf286b29a0a99a3d26","sha512":"2b962643ae9c9c3aec2caae066500f422473d23eab84cd3dbf14dab1b1bcd25fa0cbf8914f6a540b724b78fef89f4c952873cc2de3e733886f9fe03a57aa3fec","ssdeep":"768:G26vbkDR8P2NFi0uyoJ6TlcoZVJixSS/+Q1irAGMk8P2x9rzcXyz:G2kQM8Fi1yZTlZVMxSmwXM5gcCz","tlshash":"a203e027dd508ec7b10dd3fc7faa7db8839d5a01a58473de20f51c96332584a4e6b458","first_seen":"2023-11-07T02:37:43Z","last_seen":"2026-08-11T08:26:52.985631Z","times_seen":9920,"resource_available":false,"data":null}},"time_used":564,"timings":{"blocked":446,"dns":0,"connect":0,"send":0,"wait":116,"receive":2,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"mall-test.s3.amazonaws.com/test/2023-03-28/304ce03b-5dd7-4e7f-a074-7d7c71886fb0.jpg","fqdn":"mall-test.s3.amazonaws.com","domain":"mall-test.s3.amazonaws.com","tld":"s3.amazonaws.com"},"ip":{"addr":"3.5.30.74","port":443,"asn":14618,"as":"AMAZON-AES","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://bluewhaleusen.com/","date":"2025-12-20T07:01:24.720Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"P256","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"s3.amazonaws.com","organization":""},"issuer":{"commonName":"Amazon RSA 2048 M01","organization":"Amazon"},"validity":{"start":"Fri, 19 Sep 2025 00:00:00 GMT","end":"Sun, 23 Aug 2026 23:59:59 GMT"},"fingerprint":{"sha1":"48:FD:CD:50:85:6A:51:E7:71:E4:CB:E0:03:81:E1:EC:4E:AD:9E:C7","sha256":"D7:11:81:F4:91:03:0D:C6:A5:DE:8A:EF:AA:58:14:BA:AD:33:B5:11:8B:D5:F0:33:53:8B:AF:49:82:E9:4B:A4"}}},"request":{"raw":"GET /test/2023-03-28/304ce03b-5dd7-4e7f-a074-7d7c71886fb0.jpg HTTP/1.1\r\nHost: mall-test.s3.amazonaws.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nx-amz-id-2: Wsx1Mhw4qhhMfhb7DcgblTdfTrX01kNlKvQfviyFuUf+hn4J75+TWGJY+MP5Ok0U59fAXyF18joBg11utJ+ZZsCIzaLPyHsi\r\nx-amz-request-id: CRNTXH4SY129Y2NN\r\nDate: Sat, 20 Dec 2025 07:01:25 GMT\r\nLast-Modified: Wed, 22 May 2024 20:48:11 GMT\r\nETag: \"a3fdf184d72fcd6264f3e56d08724060\"\r\nx-amz-server-side-encryption: AES256\r\nAccept-Ranges: bytes\r\nContent-Type: image/jpeg\r\nContent-Length: 55808\r\nServer: AmazonS3\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Amazon Web Services","description":"Amazon Web Services (AWS) is a comprehensive cloud services platform offering compute power, database storage, content delivery and other functionality.","website":"https://aws.amazon.com/","common_platform_enumeration":"","icon":"Amazon Web Services.svg","categories":["PaaS"]},{"name":"Amazon S3","description":"Amazon S3 or Amazon Simple Storage Service is a service offered by Amazon Web Services (AWS) that provides object storage through a web service interface.","website":"https://aws.amazon.com/s3/","common_platform_enumeration":"","icon":"Amazon S3.svg","categories":["CDN"]}],"data":{"size":55808,"size_decoded":0,"mime_type":"image/jpeg","magic":"JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 594x745, components 3","md5":"a3fdf184d72fcd6264f3e56d08724060","sha1":"44b803a692f1d5a4ceaa59481d693e1af0493826","sha256":"804ba7da443132d09e928652b04212b8481c8da88e893fe4b7a76a4771e9deaa","sha512":"aa6d53262762a2593f8116f30c265ceda536a839a0bbe103d2c74e0d2e5d7377b4b57e49127a97e371faa4edfcdd114bf615536dca4545d1ca9ee03cfb8e05ed","ssdeep":"1536:8ief0738AoLCzSNcSHs5PFajgsARfcA/U/qLFa5R:zgYzSXoPF0gsARfcaLyR","tlshash":"1543f21eb368dec9c3f68dcc483ead85788cf4392bd30b19558316a3d09e9ea8579161","first_seen":"2024-02-19T23:01:29Z","last_seen":"2026-08-09T04:44:19.185572Z","times_seen":6870,"resource_available":false,"data":null}},"time_used":350,"timings":{"blocked":234,"dns":0,"connect":0,"send":0,"wait":114,"receive":2,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"bluewhaleusen.com/js/chunk-373439d1.2159a2d7.js","fqdn":"bluewhaleusen.com","domain":"bluewhaleusen.com","tld":"com"},"ip":{"addr":"118.107.9.252","port":443,"asn":152194,"as":"CTG Server Limited","country":"Singapore","country_code":"SG"},"is_navigation_request":false,"resource_type":"other","requested_by":"https://bluewhaleusen.com/","date":"2025-12-20T07:01:26.664Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"bluewhaleusen.com","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Fri, 19 Dec 2025 05:22:57 GMT","end":"Thu, 19 Mar 2026 05:22:56 GMT"},"fingerprint":{"sha1":"23:4C:94:04:E1:25:E0:EA:D1:85:17:4C:09:FC:E0:DA:D0:01:E6:62","sha256":"AC:EF:45:40:E0:37:3A:BD:B9:C9:32:F5:6B:B1:B8:92:BE:33:89:43:FA:25:17:17:7C:CA:50:4E:0B:CD:25:EB"}}},"request":{"raw":"GET /js/chunk-373439d1.2159a2d7.js HTTP/1.1\r\nHost: bluewhaleusen.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nX-Moz: prefetch\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Sat, 20 Dec 2025 07:01:26 GMT\r\ncontent-type: application/javascript\r\nvary: Accept-Encoding\r\netag: W/\"25162-1766123972311\"\r\nlast-modified: Fri, 19 Dec 2025 05:59:32 GMT\r\nstrict-transport-security: max-age=31536000\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":25162,"size_decoded":0,"mime_type":"application/javascript","magic":"JavaScript source, Unicode text, UTF-8 text, with very long lines (25161), with no line terminators","md5":"2f4b36ce4aa479df10d0891a4166f77d","sha1":"237ef6ae4679e3b23db24e9bc76099dfd100e370","sha256":"f67b9a5cd311a9cf099691be424f52958566d2609fd83c9464636a5bbdf2134f","sha512":"dba8f1a54f964aa0ce6ce57c8036736963bd128f11c95e36788f618e76803525ed484490d233c0d290ab30f1e1eb1528114e629b611d2b51d407429431435fef","ssdeep":"384:MY8191Ag35rkpz1rXtpdbLkrTUAAIH/3tEM+DU7d9a8:MYkqMYpTLEhT/WYN","tlshash":"1bb207dc74e1f0ad42f334e000aba443b27b5a1aa84c1825e355d8d47836aded77bf69","first_seen":"2024-10-08T03:40:27Z","last_seen":"2026-06-06T14:40:04.299129Z","times_seen":285,"resource_available":false,"data":null}},"time_used":328,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":328,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2025-12-20","alert":"Sinkholed","trigger":"bluewhaleusen.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2025-12-20","alert":"Sinkholed","trigger":"bluewhaleusen.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2025-12-20","alert":"Phishing Block","trigger":"bluewhaleusen.com","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2025-12-20","alert":"Sinkholed","trigger":"bluewhaleusen.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2025-12-20","alert":"Sinkholed","trigger":"bluewhaleusen.com","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"bluewhaleusen.com/js/chunk-47e41fee.4525c280.js","fqdn":"bluewhaleusen.com","domain":"bluewhaleusen.com","tld":"com"},"ip":{"addr":"118.107.9.252","port":443,"asn":152194,"as":"CTG Server Limited","country":"Singapore","country_code":"SG"},"is_navigation_request":false,"resource_type":"other","requested_by":"https://bluewhaleusen.com/","date":"2025-12-20T07:01:26.990Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"bluewhaleusen.com","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Fri, 19 Dec 2025 05:22:57 GMT","end":"Thu, 19 Mar 2026 05:22:56 GMT"},"fingerprint":{"sha1":"23:4C:94:04:E1:25:E0:EA:D1:85:17:4C:09:FC:E0:DA:D0:01:E6:62","sha256":"AC:EF:45:40:E0:37:3A:BD:B9:C9:32:F5:6B:B1:B8:92:BE:33:89:43:FA:25:17:17:7C:CA:50:4E:0B:CD:25:EB"}}},"request":{"raw":"GET /js/chunk-47e41fee.4525c280.js HTTP/1.1\r\nHost: bluewhaleusen.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nX-Moz: prefetch\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Sat, 20 Dec 2025 07:01:27 GMT\r\ncontent-type: application/javascript\r\nvary: Accept-Encoding\r\netag: W/\"8030-1766123972305\"\r\nlast-modified: Fri, 19 Dec 2025 05:59:32 GMT\r\nstrict-transport-security: max-age=31536000\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":8030,"size_decoded":0,"mime_type":"application/javascript","magic":"JavaScript source, Unicode text, UTF-8 text, with very long lines (8006), with no line terminators","md5":"66cf19031fe0c0fcd0226b1671a867d5","sha1":"67dcb3513c892f9218a1b9b368b6d919c422366b","sha256":"318485b99afdc47b5bd8baf7525475544a79876e235d5b3b96b341953538f717","sha512":"2e8c9e1bc17dd77ce2663bcd200b16be93e9c7d605c8f2be562338429929d01e7a2406cfda4e2cab0953d22832f1c0c7965adc43e1023f172c698d89abbe1224","ssdeep":"96:sZdoIsZ5c9nl0UxLenJbGpiel4jEiq15zRbWVNifXZsSLyYiGcMpzqZG/zMQEUKN:4je5cFLeJbu5BfzAV6qgqIwhXC3b3k","tlshash":"59f1e845900178a4cf6f5181601a7bb8a4a53de1e806dc9ff7b8dcec91e9a66320f33d","first_seen":"2025-04-08T11:27:57.680869Z","last_seen":"2026-06-06T14:40:04.374965Z","times_seen":96,"resource_available":false,"data":null}},"time_used":327,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":327,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2025-12-20","alert":"Sinkholed","trigger":"bluewhaleusen.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2025-12-20","alert":"Sinkholed","trigger":"bluewhaleusen.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2025-12-20","alert":"Phishing Block","trigger":"bluewhaleusen.com","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2025-12-20","alert":"Sinkholed","trigger":"bluewhaleusen.com","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2025-12-20","alert":"Sinkholed","trigger":"bluewhaleusen.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"bluewhaleusen.com/js/chunk-ec9441c2.de8a6d33.js","fqdn":"bluewhaleusen.com","domain":"bluewhaleusen.com","tld":"com"},"ip":{"addr":"118.107.9.252","port":443,"asn":152194,"as":"CTG Server Limited","country":"Singapore","country_code":"SG"},"is_navigation_request":false,"resource_type":"other","requested_by":"https://bluewhaleusen.com/","date":"2025-12-20T07:01:28.285Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"bluewhaleusen.com","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Fri, 19 Dec 2025 05:22:57 GMT","end":"Thu, 19 Mar 2026 05:22:56 GMT"},"fingerprint":{"sha1":"23:4C:94:04:E1:25:E0:EA:D1:85:17:4C:09:FC:E0:DA:D0:01:E6:62","sha256":"AC:EF:45:40:E0:37:3A:BD:B9:C9:32:F5:6B:B1:B8:92:BE:33:89:43:FA:25:17:17:7C:CA:50:4E:0B:CD:25:EB"}}},"request":{"raw":"GET /js/chunk-ec9441c2.de8a6d33.js HTTP/1.1\r\nHost: bluewhaleusen.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nX-Moz: prefetch\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Sat, 20 Dec 2025 07:01:28 GMT\r\ncontent-type: application/javascript\r\nvary: Accept-Encoding\r\netag: W/\"4387-1766123972322\"\r\nlast-modified: Fri, 19 Dec 2025 05:59:32 GMT\r\nstrict-transport-security: max-age=31536000\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":4387,"size_decoded":0,"mime_type":"application/javascript","magic":"JavaScript source, ASCII text, with very long lines (4387), with no line terminators","md5":"b4c109cf1acf78d0def272c120c65417","sha1":"97a9b4d38437a552f1f2a49779aec92c570aab47","sha256":"af24aad13613a7910df2f19cc9d61d39bd66aae1c787e44a85b4b2739ddd6b75","sha512":"fba4e795f2a6c7ba97c9feebd08615038c0b7ea5d455b023d820c762767d9426a311118b9b294b1d5ceb619a0068e620bd8a527a5d28c09a9645a432a1c549c8","ssdeep":"96:wKHnACr3IIIIIIIIIIIIIIIpG8j75hZFZQrmmp4q+:jgWIIIIIIIIIIIIIIIPHZs6Rd","tlshash":"f591984ae8a2d3b1f67b152f654923101e218fec67a8c4487b715ebf32844be4b37394","first_seen":"2025-04-08T11:27:57.668427Z","last_seen":"2026-06-06T14:40:04.343601Z","times_seen":94,"resource_available":false,"data":null}},"time_used":327,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":327,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2025-12-20","alert":"Sinkholed","trigger":"bluewhaleusen.com","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2025-12-20","alert":"Sinkholed","trigger":"bluewhaleusen.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2025-12-20","alert":"Phishing Block","trigger":"bluewhaleusen.com","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2025-12-20","alert":"Sinkholed","trigger":"bluewhaleusen.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2025-12-20","alert":"Sinkholed","trigger":"bluewhaleusen.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"bluewhaleusen.com/img/BankCard.fbf05593.png","fqdn":"bluewhaleusen.com","domain":"bluewhaleusen.com","tld":"com"},"ip":{"addr":"118.107.9.252","port":443,"asn":152194,"as":"CTG Server Limited","country":"Singapore","country_code":"SG"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://bluewhaleusen.com/","date":"2025-12-20T07:01:22.829Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"bluewhaleusen.com","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Fri, 19 Dec 2025 05:22:57 GMT","end":"Thu, 19 Mar 2026 05:22:56 GMT"},"fingerprint":{"sha1":"23:4C:94:04:E1:25:E0:EA:D1:85:17:4C:09:FC:E0:DA:D0:01:E6:62","sha256":"AC:EF:45:40:E0:37:3A:BD:B9:C9:32:F5:6B:B1:B8:92:BE:33:89:43:FA:25:17:17:7C:CA:50:4E:0B:CD:25:EB"}}},"request":{"raw":"GET /img/BankCard.fbf05593.png HTTP/1.1\r\nHost: bluewhaleusen.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Sat, 20 Dec 2025 07:01:22 GMT\r\ncontent-type: image/png\r\nvary: Accept-Encoding\r\netag: W/\"21369-1766123972356\"\r\nlast-modified: Fri, 19 Dec 2025 05:59:32 GMT\r\nstrict-transport-security: max-age=31536000\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":21369,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 237 x 152, 8-bit colormap, non-interlaced","md5":"fbf055936bf1a8df746d4f5b92c1c636","sha1":"5fe69e70f57b80d589ed84108abeee1b5e53361d","sha256":"5ae6955ee19cc89def118b59308e87502ece7938f6883da58753cffe7d34f866","sha512":"02f001eb0aa7272e31fd8a615ec4c5f8275258d51b5ee46b75ead9b59e1b8dfecd02dfd9a44d1ba9053300bfc48a3cb384bf8e9c3cf1b23d2c59099495d3d3dc","ssdeep":"384:imq5rANLkQwbhEfdYVPqp2B3Mj+fPSVh3mf3XUMdVK94u0xXdt:+NA1kQDeVPE2XC7W8MdVuCdt","tlshash":"c6a2e1a61c990b508f5715242db3a6cc6c19a548f07fce16eb50bbf4d9660f9ceee403","first_seen":"2024-04-14T17:36:32Z","last_seen":"2026-05-31T13:48:58.251871Z","times_seen":144,"resource_available":false,"data":null}},"time_used":329,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":329,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2025-12-20","alert":"Sinkholed","trigger":"bluewhaleusen.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2025-12-20","alert":"Sinkholed","trigger":"bluewhaleusen.com","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2025-12-20","alert":"Phishing Block","trigger":"bluewhaleusen.com","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2025-12-20","alert":"Sinkholed","trigger":"bluewhaleusen.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2025-12-20","alert":"Sinkholed","trigger":"bluewhaleusen.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"bluewhaleusen.com/css/chunk-058fa281.0daa9b11.css","fqdn":"bluewhaleusen.com","domain":"bluewhaleusen.com","tld":"com"},"ip":{"addr":"118.107.9.252","port":443,"asn":152194,"as":"CTG Server Limited","country":"Singapore","country_code":"SG"},"is_navigation_request":false,"resource_type":"other","requested_by":"https://bluewhaleusen.com/","date":"2025-12-20T07:01:23.237Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"bluewhaleusen.com","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Fri, 19 Dec 2025 05:22:57 GMT","end":"Thu, 19 Mar 2026 05:22:56 GMT"},"fingerprint":{"sha1":"23:4C:94:04:E1:25:E0:EA:D1:85:17:4C:09:FC:E0:DA:D0:01:E6:62","sha256":"AC:EF:45:40:E0:37:3A:BD:B9:C9:32:F5:6B:B1:B8:92:BE:33:89:43:FA:25:17:17:7C:CA:50:4E:0B:CD:25:EB"}}},"request":{"raw":"GET /css/chunk-058fa281.0daa9b11.css HTTP/1.1\r\nHost: bluewhaleusen.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nX-Moz: prefetch\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Sat, 20 Dec 2025 07:01:23 GMT\r\ncontent-type: text/css\r\nvary: Accept-Encoding\r\netag: W/\"1374-1766123972324\"\r\nlast-modified: Fri, 19 Dec 2025 05:59:32 GMT\r\nstrict-transport-security: max-age=31536000\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":1374,"size_decoded":0,"mime_type":"text/css","magic":"ASCII text, with very long lines (1374), with no line terminators","md5":"7a0ea81bab09a5e259ac1884d3f72012","sha1":"d87441160241af9deea25169e8fb52a8537929e3","sha256":"b2217a779e1c0810181c9c1cc122bbd3ff1ce69d94164bf7b1e308cceb93e2c6","sha512":"a0d4c2bd68e73bc95ebe419ae4fa1a9210de9ff9e75bb7c3694bffa92fffb77dd7373bc7c3585ba1a9a67b9a3d0207afd87e34d630ba821177a70512c061bb98","ssdeep":"","tlshash":"e3215b00355e673edd37e67e64805abd6900e26bc453e227b9889405cecaa572813ed3","first_seen":"2024-02-19T23:01:30Z","last_seen":"2026-06-06T14:40:04.393299Z","times_seen":5043,"resource_available":false,"data":null}},"time_used":336,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":336,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2025-12-20","alert":"Sinkholed","trigger":"bluewhaleusen.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2025-12-20","alert":"Phishing Block","trigger":"bluewhaleusen.com","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2025-12-20","alert":"Sinkholed","trigger":"bluewhaleusen.com","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2025-12-20","alert":"Sinkholed","trigger":"bluewhaleusen.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2025-12-20","alert":"Sinkholed","trigger":"bluewhaleusen.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"bluewhaleusen.com/css/chunk-20104f2a.0f594967.css","fqdn":"bluewhaleusen.com","domain":"bluewhaleusen.com","tld":"com"},"ip":{"addr":"118.107.9.252","port":443,"asn":152194,"as":"CTG Server Limited","country":"Singapore","country_code":"SG"},"is_navigation_request":false,"resource_type":"other","requested_by":"https://bluewhaleusen.com/","date":"2025-12-20T07:01:23.242Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"bluewhaleusen.com","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Fri, 19 Dec 2025 05:22:57 GMT","end":"Thu, 19 Mar 2026 05:22:56 GMT"},"fingerprint":{"sha1":"23:4C:94:04:E1:25:E0:EA:D1:85:17:4C:09:FC:E0:DA:D0:01:E6:62","sha256":"AC:EF:45:40:E0:37:3A:BD:B9:C9:32:F5:6B:B1:B8:92:BE:33:89:43:FA:25:17:17:7C:CA:50:4E:0B:CD:25:EB"}}},"request":{"raw":"GET /css/chunk-20104f2a.0f594967.css HTTP/1.1\r\nHost: bluewhaleusen.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nX-Moz: prefetch\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Sat, 20 Dec 2025 07:01:23 GMT\r\ncontent-type: text/css\r\nvary: Accept-Encoding\r\netag: W/\"2488-1766123972329\"\r\nlast-modified: Fri, 19 Dec 2025 05:59:32 GMT\r\nstrict-transport-security: max-age=31536000\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":2488,"size_decoded":0,"mime_type":"text/css","magic":"ASCII text, with very long lines (2488), with no line terminators","md5":"4890366680b9e8d4c468a8489db5d4ac","sha1":"d23b2634a28b365388c81e06d4489149c75500a7","sha256":"0b9eaa9bf0012af1f82493c9cf550761f87f87c3a793be2c3c5484aa44cab4ba","sha512":"98d5ae88c2f3052aab4a1139d61329c29395cb24e33e9cb8313ecf136874191df1c32ee68db83dc7d28029a49c8a0c25cd49f02e27e4c6fdb368628d782af404","ssdeep":"","tlshash":"235158712490297457fefa2a9c8676ab3103fd93e61150cd7847871e8cdafd228e1768","first_seen":"2024-02-19T23:01:29Z","last_seen":"2026-06-06T14:40:04.501354Z","times_seen":2074,"resource_available":false,"data":null}},"time_used":336,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":336,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2025-12-20","alert":"Sinkholed","trigger":"bluewhaleusen.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2025-12-20","alert":"Phishing Block","trigger":"bluewhaleusen.com","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2025-12-20","alert":"Sinkholed","trigger":"bluewhaleusen.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2025-12-20","alert":"Sinkholed","trigger":"bluewhaleusen.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2025-12-20","alert":"Sinkholed","trigger":"bluewhaleusen.com","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"shop-shangcheng-shangchuan2.s3.amazonaws.com/type/2024-09-01/596407e8-c990-40ff-943c-d778dbc50224.png","fqdn":"shop-shangcheng-shangchuan2.s3.amazonaws.com","domain":"shop-shangcheng-shangchuan2.s3.amazonaws.com","tld":"s3.amazonaws.com"},"ip":{"addr":"3.5.27.242","port":443,"asn":14618,"as":"AMAZON-AES","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://bluewhaleusen.com/","date":"2025-12-20T07:01:23.319Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"P256","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"s3.amazonaws.com","organization":""},"issuer":{"commonName":"Amazon RSA 2048 M01","organization":"Amazon"},"validity":{"start":"Fri, 19 Sep 2025 00:00:00 GMT","end":"Sun, 23 Aug 2026 23:59:59 GMT"},"fingerprint":{"sha1":"48:FD:CD:50:85:6A:51:E7:71:E4:CB:E0:03:81:E1:EC:4E:AD:9E:C7","sha256":"D7:11:81:F4:91:03:0D:C6:A5:DE:8A:EF:AA:58:14:BA:AD:33:B5:11:8B:D5:F0:33:53:8B:AF:49:82:E9:4B:A4"}}},"request":{"raw":"GET /type/2024-09-01/596407e8-c990-40ff-943c-d778dbc50224.png HTTP/1.1\r\nHost: shop-shangcheng-shangchuan2.s3.amazonaws.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 403 Forbidden\r\nx-amz-request-id: S19QBHNTTA2NTT10\r\nx-amz-id-2: x9Ushyw3Gwa49YZS529iBEobgsLF3eNcwpFNYtKr7BfaHOCx/uH6kIYsi+GI2I3O/ld2A7kIo0yjGL48Upucl3DnVJDKLmsTXPIisQWuY68=\r\nContent-Type: application/xml\r\nTransfer-Encoding: chunked\r\nDate: Sat, 20 Dec 2025 07:01:23 GMT\r\nServer: AmazonS3\r\n\r\n","headers":null,"cookies":null,"status_code":"403","status_text":"Forbidden","fingerprints":[{"name":"Amazon S3","description":"Amazon S3 or Amazon Simple Storage Service is a service offered by Amazon Web Services (AWS) that provides object storage through a web service interface.","website":"https://aws.amazon.com/s3/","common_platform_enumeration":"","icon":"Amazon S3.svg","categories":["CDN"]},{"name":"Amazon Web Services","description":"Amazon Web Services (AWS) is a comprehensive cloud services platform offering compute power, database storage, content delivery and other functionality.","website":"https://aws.amazon.com/","common_platform_enumeration":"","icon":"Amazon Web Services.svg","categories":["PaaS"]}],"data":{"size":0,"size_decoded":0,"mime_type":"application/xml","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-08-11T16:57:26.648985Z","times_seen":17840002,"resource_available":true,"data":null}},"time_used":632,"timings":{"blocked":277,"dns":0,"connect":96,"send":0,"wait":101,"receive":0,"ssl":156},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"mall-test.s3.amazonaws.com/test/2023-03-28/d0fa772e-25da-44e1-a9d3-8fdfec84f7b9.jpg","fqdn":"mall-test.s3.amazonaws.com","domain":"mall-test.s3.amazonaws.com","tld":"s3.amazonaws.com"},"ip":{"addr":"3.5.30.74","port":443,"asn":14618,"as":"AMAZON-AES","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://bluewhaleusen.com/","date":"2025-12-20T07:01:23.468Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"P256","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"s3.amazonaws.com","organization":""},"issuer":{"commonName":"Amazon RSA 2048 M01","organization":"Amazon"},"validity":{"start":"Fri, 19 Sep 2025 00:00:00 GMT","end":"Sun, 23 Aug 2026 23:59:59 GMT"},"fingerprint":{"sha1":"48:FD:CD:50:85:6A:51:E7:71:E4:CB:E0:03:81:E1:EC:4E:AD:9E:C7","sha256":"D7:11:81:F4:91:03:0D:C6:A5:DE:8A:EF:AA:58:14:BA:AD:33:B5:11:8B:D5:F0:33:53:8B:AF:49:82:E9:4B:A4"}}},"request":{"raw":"GET /test/2023-03-28/d0fa772e-25da-44e1-a9d3-8fdfec84f7b9.jpg HTTP/1.1\r\nHost: mall-test.s3.amazonaws.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nx-amz-id-2: BJv3wr4HxA3p0rlDhW8HPB0xtYwlVFSttAeQPK7I3cFcAGm8PftqgWGQVNi0PYHi72Rcxj/UORcqhL7TKWYV1Eu2rNCrq3yw\r\nx-amz-request-id: CRNG21HR4SNAK056\r\nDate: Sat, 20 Dec 2025 07:01:25 GMT\r\nLast-Modified: Wed, 22 May 2024 20:54:01 GMT\r\nETag: \"2c56a052345660ad6a7c6e688a1a3058\"\r\nx-amz-server-side-encryption: AES256\r\nAccept-Ranges: bytes\r\nContent-Type: image/jpeg\r\nContent-Length: 166741\r\nServer: AmazonS3\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Amazon Web Services","description":"Amazon Web Services (AWS) is a comprehensive cloud services platform offering compute power, database storage, content delivery and other functionality.","website":"https://aws.amazon.com/","common_platform_enumeration":"","icon":"Amazon Web Services.svg","categories":["PaaS"]},{"name":"Amazon S3","description":"Amazon S3 or Amazon Simple Storage Service is a service offered by Amazon Web Services (AWS) that provides object storage through a web service interface.","website":"https://aws.amazon.com/s3/","common_platform_enumeration":"","icon":"Amazon S3.svg","categories":["CDN"]}],"data":{"size":166741,"size_decoded":0,"mime_type":"image/jpeg","magic":"JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 1500x1500, components 3","md5":"2c56a052345660ad6a7c6e688a1a3058","sha1":"0fc34a8a0d5743e9d81ecae6cdeff33826d18444","sha256":"26f3ba0fd2212969ade9b2461b240d4da8425282d4b4f9b7b40c2d7fd7dcb95e","sha512":"56761466613fe6f3d07ff0d1c8e525f979560761b976154d8819d3a927a553af5245007e90729a21c2c5dfdcd027e50bfe1f705603921b8107221e7b9ee9d31d","ssdeep":"3072:O5Rlx42wKJn9+MTwXUW+msjBQpN4J8BOzEtMBoN+kehPvasuZEbDSl5NXt5VR:MRlx1TwB+nQrozScotMfSl7NR","tlshash":"00f313950fe64c41e667703cb0f824306bb25894d2512daece6684410eee7fe6da717f","first_seen":"2024-02-19T23:01:28Z","last_seen":"2026-08-09T04:44:19.236264Z","times_seen":7259,"resource_available":false,"data":null}},"time_used":921,"timings":{"blocked":800,"dns":0,"connect":0,"send":0,"wait":115,"receive":6,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"mall-test.s3.amazonaws.com/test/2023-03-28/85c9fa3a-9c9f-44f1-aff5-1f72797dbdb2.jpg","fqdn":"mall-test.s3.amazonaws.com","domain":"mall-test.s3.amazonaws.com","tld":"s3.amazonaws.com"},"ip":{"addr":"3.5.30.74","port":443,"asn":14618,"as":"AMAZON-AES","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://bluewhaleusen.com/","date":"2025-12-20T07:01:23.615Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"P256","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"s3.amazonaws.com","organization":""},"issuer":{"commonName":"Amazon RSA 2048 M01","organization":"Amazon"},"validity":{"start":"Fri, 19 Sep 2025 00:00:00 GMT","end":"Sun, 23 Aug 2026 23:59:59 GMT"},"fingerprint":{"sha1":"48:FD:CD:50:85:6A:51:E7:71:E4:CB:E0:03:81:E1:EC:4E:AD:9E:C7","sha256":"D7:11:81:F4:91:03:0D:C6:A5:DE:8A:EF:AA:58:14:BA:AD:33:B5:11:8B:D5:F0:33:53:8B:AF:49:82:E9:4B:A4"}}},"request":{"raw":"GET /test/2023-03-28/85c9fa3a-9c9f-44f1-aff5-1f72797dbdb2.jpg HTTP/1.1\r\nHost: mall-test.s3.amazonaws.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nx-amz-id-2: bT69S+zu4PA+93jrDeWshrnueueyrlTRXZpX3hGapXjsLNVoUqUdOkE6ylFCyPErgLDA/ygpKzQKP4/fLNB12u8JmidTMbCj\r\nx-amz-request-id: CRNZHQH66G28XQZ8\r\nDate: Sat, 20 Dec 2025 07:01:25 GMT\r\nLast-Modified: Wed, 22 May 2024 20:51:16 GMT\r\nETag: \"b8913d9e5154ba64e3fe7bbb1e357d39\"\r\nx-amz-server-side-encryption: AES256\r\nAccept-Ranges: bytes\r\nContent-Type: image/jpeg\r\nContent-Length: 115039\r\nServer: AmazonS3\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Amazon S3","description":"Amazon S3 or Amazon Simple Storage Service is a service offered by Amazon Web Services (AWS) that provides object storage through a web service interface.","website":"https://aws.amazon.com/s3/","common_platform_enumeration":"","icon":"Amazon S3.svg","categories":["CDN"]},{"name":"Amazon Web Services","description":"Amazon Web Services (AWS) is a comprehensive cloud services platform offering compute power, database storage, content delivery and other functionality.","website":"https://aws.amazon.com/","common_platform_enumeration":"","icon":"Amazon Web Services.svg","categories":["PaaS"]}],"data":{"size":115039,"size_decoded":0,"mime_type":"image/jpeg","magic":"JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 1500x1214, components 3","md5":"b8913d9e5154ba64e3fe7bbb1e357d39","sha1":"099900879ee6c6ffc46886c6c7a51deb002620a5","sha256":"323c53514398146cf826ac3c7492cb33fdbf76048efb002dd7245cac6ac00de5","sha512":"1b3d93f1860985cf5a4523f0f637f212b67d23dc4083d74b905209fc50179efceef7878dc86d5f0a19a3e8fe499a5989dcb47f76445872f1551296dda4935dc6","ssdeep":"3072:tnAsQmUqLtgMVlm8Bq1u7PqMQq8+5AsIBYbu2ILf3rQX:BAq5SYlVg1GP50qC2ILDM","tlshash":"eeb3128b8363f8c8ff17a0b56f84b712e516042539b136840eed1614e27ea6f7d47e51","first_seen":"2024-03-15T18:45:45Z","last_seen":"2026-08-11T08:26:52.969686Z","times_seen":2461,"resource_available":false,"data":null}},"time_used":714,"timings":{"blocked":502,"dns":0,"connect":0,"send":0,"wait":116,"receive":96,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"imgtest1.s3.amazonaws.com/selle/2023-05-16/576efa67-81cd-428a-8bde-80d57cfb647d.jpg","fqdn":"imgtest1.s3.amazonaws.com","domain":"imgtest1.s3.amazonaws.com","tld":"s3.amazonaws.com"},"ip":{"addr":"16.15.207.90","port":443,"asn":14618,"as":"AMAZON-AES","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://bluewhaleusen.com/","date":"2025-12-20T07:01:24.236Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"P256","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.s3.amazonaws.com","organization":""},"issuer":{"commonName":"Amazon RSA 2048 M01","organization":"Amazon"},"validity":{"start":"Fri, 14 Feb 2025 00:00:00 GMT","end":"Sat, 07 Feb 2026 23:59:59 GMT"},"fingerprint":{"sha1":"2E:BA:63:64:95:A8:CE:55:DD:7E:EB:A9:98:83:14:B1:6F:6B:61:69","sha256":"00:D7:0B:CC:1F:82:6B:F6:D9:2E:55:1A:BA:88:38:33:19:09:5B:85:49:41:5E:DA:A1:97:B9:D2:0A:3B:13:52"}}},"request":{"raw":"GET /selle/2023-05-16/576efa67-81cd-428a-8bde-80d57cfb647d.jpg HTTP/1.1\r\nHost: imgtest1.s3.amazonaws.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nx-amz-id-2: N8bq/054gUjGM/5Fn5WDExdTnCokSVbM4bBJasX1lz7ZQdPQ1Kqdk/taJVfNYxLWhsFA3eCR26VFbEOrJuDF0oraGvLO2XeA\r\nx-amz-request-id: CRNX2FE8WR0RDQGR\r\nDate: Sat, 20 Dec 2025 07:01:25 GMT\r\nLast-Modified: Thu, 23 May 2024 01:44:21 GMT\r\nETag: \"78fed38df6c4b0312d8a91c509beafa5\"\r\nx-amz-server-side-encryption: AES256\r\nAccept-Ranges: bytes\r\nContent-Type: image/jpeg\r\nContent-Length: 157843\r\nServer: AmazonS3\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Amazon Web Services","description":"Amazon Web Services (AWS) is a comprehensive cloud services platform offering compute power, database storage, content delivery and other functionality.","website":"https://aws.amazon.com/","common_platform_enumeration":"","icon":"Amazon Web Services.svg","categories":["PaaS"]},{"name":"Amazon S3","description":"Amazon S3 or Amazon Simple Storage Service is a service offered by Amazon Web Services (AWS) that provides object storage through a web service interface.","website":"https://aws.amazon.com/s3/","common_platform_enumeration":"","icon":"Amazon S3.svg","categories":["CDN"]}],"data":{"size":157843,"size_decoded":0,"mime_type":"image/jpeg","magic":"JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 1500x1500, components 3","md5":"78fed38df6c4b0312d8a91c509beafa5","sha1":"513703e7631878f7bbfc8e7c73781e316c87335c","sha256":"fd89c86a8b6a78742cc14d754a5fcff661630041af1d6ce07fec8d5daf63d30b","sha512":"e27f66edba14bba4453b5487a6a84866e8bf142b415cc45ebd1dbe2e564f996e492f969605180cc7ffc1302bb919a48840d66b9aac7d892d5448a7a285fca320","ssdeep":"3072:iuz5VdowoflxLEZgd+4nwSbKKPteFg9g4/A6wfhHHNIqN6HECQ5fX4laFxo6:rzBowcoZ/zote16wp/oHE31Xyy","tlshash":"c7f312d5f2019331d7a41e32d4ea9bbe016157efab47af285a80f83d0c276b1b8d9056","first_seen":"2024-03-15T18:45:46Z","last_seen":"2026-08-09T04:44:19.26571Z","times_seen":1697,"resource_available":false,"data":null}},"time_used":463,"timings":{"blocked":341,"dns":0,"connect":0,"send":0,"wait":118,"receive":4,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"mall-test.s3.amazonaws.com/pc/gp13/B072P17XY7/71XaaByITlL._AC_UL1500_.jpg","fqdn":"mall-test.s3.amazonaws.com","domain":"mall-test.s3.amazonaws.com","tld":"s3.amazonaws.com"},"ip":{"addr":"3.5.30.74","port":443,"asn":14618,"as":"AMAZON-AES","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://bluewhaleusen.com/","date":"2025-12-20T07:01:24.683Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"P256","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"s3.amazonaws.com","organization":""},"issuer":{"commonName":"Amazon RSA 2048 M01","organization":"Amazon"},"validity":{"start":"Fri, 19 Sep 2025 00:00:00 GMT","end":"Sun, 23 Aug 2026 23:59:59 GMT"},"fingerprint":{"sha1":"48:FD:CD:50:85:6A:51:E7:71:E4:CB:E0:03:81:E1:EC:4E:AD:9E:C7","sha256":"D7:11:81:F4:91:03:0D:C6:A5:DE:8A:EF:AA:58:14:BA:AD:33:B5:11:8B:D5:F0:33:53:8B:AF:49:82:E9:4B:A4"}}},"request":{"raw":"GET /pc/gp13/B072P17XY7/71XaaByITlL._AC_UL1500_.jpg HTTP/1.1\r\nHost: mall-test.s3.amazonaws.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nx-amz-id-2: FcYGyx2YtGandFal1rGjtJEPD4Y1Shey2EaDZjcjgE0cBA1+uUYTXOUXL6/fd/tVrCL42ifugTBeFtqCxVlMN/g3AC608hB5\r\nx-amz-request-id: CRNKK6CTNSECXZ7T\r\nDate: Sat, 20 Dec 2025 07:01:25 GMT\r\nLast-Modified: Wed, 22 May 2024 11:55:37 GMT\r\nETag: \"c07031c87ba3f296b2a29ebb53a76efd\"\r\nx-amz-server-side-encryption: AES256\r\nx-amz-meta-sha256: 0f0b3c3fd5b39cff700214dbb4d052faa05dd997f97c50e949ff2ff957d9a07a\r\nx-amz-meta-s3b-last-modified: 20230429T135853Z\r\nAccept-Ranges: bytes\r\nContent-Type: image/jpeg\r\nContent-Length: 50291\r\nServer: AmazonS3\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Amazon S3","description":"Amazon S3 or Amazon Simple Storage Service is a service offered by Amazon Web Services (AWS) that provides object storage through a web service interface.","website":"https://aws.amazon.com/s3/","common_platform_enumeration":"","icon":"Amazon S3.svg","categories":["CDN"]},{"name":"Amazon Web Services","description":"Amazon Web Services (AWS) is a comprehensive cloud services platform offering compute power, database storage, content delivery and other functionality.","website":"https://aws.amazon.com/","common_platform_enumeration":"","icon":"Amazon Web Services.svg","categories":["PaaS"]}],"data":{"size":50291,"size_decoded":0,"mime_type":"image/jpeg","magic":"JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 546x1500, components 3","md5":"c07031c87ba3f296b2a29ebb53a76efd","sha1":"8797c19f69bbb48e4c42bd372747c9f72a59424f","sha256":"0f0b3c3fd5b39cff700214dbb4d052faa05dd997f97c50e949ff2ff957d9a07a","sha512":"65595c1eba2b03cf51675d61a3973bcf1237d19c85cefa96919172f3a54a7ed6dbd32877ccf384acc924349de486e770d07272aa2bf59eacbfdf8afa1d589ad0","ssdeep":"1536:+XiOB0fBqBhRvoS/ImRQ6o/Ka3yaegiBC:+SuvBTt7Jo/KW6C","tlshash":"0a330122c3c962f4f8011fbd0d03a1bb54991908570a9b3b376a6ab2c7641496fc7f6f","first_seen":"2024-03-15T18:45:46Z","last_seen":"2026-07-14T05:45:08.741567Z","times_seen":2423,"resource_available":false,"data":null}},"time_used":272,"timings":{"blocked":164,"dns":0,"connect":0,"send":0,"wait":107,"receive":1,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"bluewhaleusen.com/wap/api/syspara!getSyspara.action?code=show_video\u0026lang=en","fqdn":"bluewhaleusen.com","domain":"bluewhaleusen.com","tld":"com"},"ip":{"addr":"118.107.9.252","port":443,"asn":152194,"as":"CTG Server Limited","country":"Singapore","country_code":"SG"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"https://bluewhaleusen.com/","date":"2025-12-20T07:01:22.394Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"bluewhaleusen.com","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Fri, 19 Dec 2025 05:22:57 GMT","end":"Thu, 19 Mar 2026 05:22:56 GMT"},"fingerprint":{"sha1":"23:4C:94:04:E1:25:E0:EA:D1:85:17:4C:09:FC:E0:DA:D0:01:E6:62","sha256":"AC:EF:45:40:E0:37:3A:BD:B9:C9:32:F5:6B:B1:B8:92:BE:33:89:43:FA:25:17:17:7C:CA:50:4E:0B:CD:25:EB"}}},"request":{"raw":"POST /wap/api/syspara!getSyspara.action?code=show_video\u0026lang=en HTTP/1.1\r\nHost: bluewhaleusen.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/json, text/plain, */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nContent-Type: application/x-www-form-urlencoded\r\nOrigin: https://bluewhaleusen.com\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\nContent-Length: 0\r\n\r\n","headers":null,"cookies":null,"method":"POST"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Sat, 20 Dec 2025 07:01:22 GMT\r\ncontent-type: application/json;charset=UTF-8\r\nvary: Accept-Encoding, Origin, Access-Control-Request-Method, Access-Control-Request-Headers\r\naccess-control-allow-origin: *\r\nstrict-transport-security: max-age=31536000\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":52,"size_decoded":0,"mime_type":"application/json; charset=UTF-8","magic":"JSON text data","md5":"33878fb83944a3d98e0ae8fbb3688401","sha1":"95cddb60c569b28c039a3982e1a593a9c9b75411","sha256":"05ed22d88cd80fb42cb476b3e2826110e2d9c377c9104929b9b5ee381971db57","sha512":"91c65dedfad117e4715750c3696fe2a76e51de20406b1314da92f025f323586806c7467c01ff03e092e4cf9bba824e57487f9cc9608feb66018c29f5aea10dcc","ssdeep":"","tlshash":"2790220000080832000380283c0c3200808c0003008083088c080a2000ec0a00220028","first_seen":"2025-07-21T20:07:50.133523Z","last_seen":"2026-07-31T06:32:59.70664Z","times_seen":68,"resource_available":false,"data":null}},"time_used":347,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":347,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2025-12-20","alert":"Sinkholed","trigger":"bluewhaleusen.com","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2025-12-20","alert":"Sinkholed","trigger":"bluewhaleusen.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2025-12-20","alert":"Sinkholed","trigger":"bluewhaleusen.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2025-12-20","alert":"Phishing Block","trigger":"bluewhaleusen.com","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2025-12-20","alert":"Sinkholed","trigger":"bluewhaleusen.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"imgtest1.s3.amazonaws.com/test/2023-03-07/1b624419-30da-466f-9d2d-b0413cb30428.jpg","fqdn":"imgtest1.s3.amazonaws.com","domain":"imgtest1.s3.amazonaws.com","tld":"s3.amazonaws.com"},"ip":{"addr":"16.15.207.90","port":443,"asn":14618,"as":"AMAZON-AES","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://bluewhaleusen.com/","date":"2025-12-20T07:01:23.643Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"P256","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.s3.amazonaws.com","organization":""},"issuer":{"commonName":"Amazon RSA 2048 M01","organization":"Amazon"},"validity":{"start":"Fri, 14 Feb 2025 00:00:00 GMT","end":"Sat, 07 Feb 2026 23:59:59 GMT"},"fingerprint":{"sha1":"2E:BA:63:64:95:A8:CE:55:DD:7E:EB:A9:98:83:14:B1:6F:6B:61:69","sha256":"00:D7:0B:CC:1F:82:6B:F6:D9:2E:55:1A:BA:88:38:33:19:09:5B:85:49:41:5E:DA:A1:97:B9:D2:0A:3B:13:52"}}},"request":{"raw":"GET /test/2023-03-07/1b624419-30da-466f-9d2d-b0413cb30428.jpg HTTP/1.1\r\nHost: imgtest1.s3.amazonaws.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nx-amz-id-2: JjYFUQMdGZ9gnly8V2Ka35ZOO4K8gymw/OhAQn137321iQ1m4m8fYgYlzec7aaS4EOavF2FYtryPpjzopoaXJ1CN3aHP7sB7\r\nx-amz-request-id: CRNW7M6S6EQVWHBZ\r\nDate: Sat, 20 Dec 2025 07:01:25 GMT\r\nLast-Modified: Thu, 23 May 2024 01:45:54 GMT\r\nETag: \"dd9bf4005d21a4d398581ee790deffd0\"\r\nx-amz-server-side-encryption: AES256\r\nAccept-Ranges: bytes\r\nContent-Type: image/jpeg\r\nContent-Length: 88025\r\nServer: AmazonS3\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Amazon Web Services","description":"Amazon Web Services (AWS) is a comprehensive cloud services platform offering compute power, database storage, content delivery and other functionality.","website":"https://aws.amazon.com/","common_platform_enumeration":"","icon":"Amazon Web Services.svg","categories":["PaaS"]},{"name":"Amazon S3","description":"Amazon S3 or Amazon Simple Storage Service is a service offered by Amazon Web Services (AWS) that provides object storage through a web service interface.","website":"https://aws.amazon.com/s3/","common_platform_enumeration":"","icon":"Amazon S3.svg","categories":["CDN"]}],"data":{"size":88025,"size_decoded":0,"mime_type":"image/jpeg","magic":"JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 1500x1458, components 3","md5":"dd9bf4005d21a4d398581ee790deffd0","sha1":"03f62c4320e1236c0e1408079419e62e8043168a","sha256":"97d5ca61ef391b0128979a0e568af2d0d56fdcf41a5aff34ba1feb2f270402c2","sha512":"d89a23bfd4b1b9df695ffa803afc183c6577245165994405b7160bcda6c9d0331dd923dd40d9ec650055a9364324db0424b3919444d7a9089edb1f9841261743","ssdeep":"1536:EtK5Xgkq/61E5KYMb2QG4djBUKFQN0405AQZ9GWGCyLmgSOrH:EEgP0E5K+W4052pC4","tlshash":"b88302942b479630c09b61b0875e0e912c72cafe855f20cb439b9dac50d95e6ff134af","first_seen":"2024-02-19T23:01:28Z","last_seen":"2026-08-09T04:44:19.274628Z","times_seen":7339,"resource_available":false,"data":null}},"time_used":926,"timings":{"blocked":805,"dns":0,"connect":0,"send":0,"wait":118,"receive":3,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"mall-test.s3.amazonaws.com/avatar/2023-03-22/0fee4b69-98bf-4dd0-b2e9-a3eef7d8c9e2.jpg","fqdn":"mall-test.s3.amazonaws.com","domain":"mall-test.s3.amazonaws.com","tld":"s3.amazonaws.com"},"ip":{"addr":"3.5.30.74","port":443,"asn":14618,"as":"AMAZON-AES","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://bluewhaleusen.com/","date":"2025-12-20T07:01:24.268Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"P256","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"s3.amazonaws.com","organization":""},"issuer":{"commonName":"Amazon RSA 2048 M01","organization":"Amazon"},"validity":{"start":"Fri, 19 Sep 2025 00:00:00 GMT","end":"Sun, 23 Aug 2026 23:59:59 GMT"},"fingerprint":{"sha1":"48:FD:CD:50:85:6A:51:E7:71:E4:CB:E0:03:81:E1:EC:4E:AD:9E:C7","sha256":"D7:11:81:F4:91:03:0D:C6:A5:DE:8A:EF:AA:58:14:BA:AD:33:B5:11:8B:D5:F0:33:53:8B:AF:49:82:E9:4B:A4"}}},"request":{"raw":"GET /avatar/2023-03-22/0fee4b69-98bf-4dd0-b2e9-a3eef7d8c9e2.jpg HTTP/1.1\r\nHost: mall-test.s3.amazonaws.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nx-amz-id-2: 7OxSZpuxYiZEr5+j/uRIwUNhVIq90+milU9wnEyzvQvRPUyLw+iCdKR1wcaUQagwPx4a2J3hxgCPVN66u7KEoEtWTZd9BMV1\r\nx-amz-request-id: CRNWXD015NGY5DM5\r\nDate: Sat, 20 Dec 2025 07:01:25 GMT\r\nLast-Modified: Tue, 21 May 2024 17:21:39 GMT\r\nETag: \"2f880abf39197c23624ec02a97da066e\"\r\nx-amz-server-side-encryption: AES256\r\nx-amz-meta-myval: test\r\nAccept-Ranges: bytes\r\nContent-Type: application/octet-stream\r\nContent-Length: 6873\r\nServer: AmazonS3\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Amazon Web Services","description":"Amazon Web Services (AWS) is a comprehensive cloud services platform offering compute power, database storage, content delivery and other functionality.","website":"https://aws.amazon.com/","common_platform_enumeration":"","icon":"Amazon Web Services.svg","categories":["PaaS"]},{"name":"Amazon S3","description":"Amazon S3 or Amazon Simple Storage Service is a service offered by Amazon Web Services (AWS) that provides object storage through a web service interface.","website":"https://aws.amazon.com/s3/","common_platform_enumeration":"","icon":"Amazon S3.svg","categories":["CDN"]}],"data":{"size":6873,"size_decoded":0,"mime_type":"image/jpeg","magic":"JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, baseline, precision 8, 291x173, components 3","md5":"2f880abf39197c23624ec02a97da066e","sha1":"b25a02eeabb058144d354446b3d997210eb7ea14","sha256":"f937788f543bacca3b6d8e11e19123d8a727a46aa05b5bdcb0edd346d02ebc7b","sha512":"2f37634b59d4e1e2124b4c182b2bd349a72149ef956d584e7f6c8f23fd95481b02051f6ceaa8823e6db9641b55aa364eade03d1e14d0ebc259efd4b4600ed277","ssdeep":"192:bpSOyDwhDh0ht/pyBYnSu5HtAUGLW5pe9KIyoQk76AXRtL25V4:wFDwRAiOSMNP+WmIIfQ5C","tlshash":"36e19e13b51ba152ce247b78d7a362f213fcfa2b3d717621f9d06f5069f399aa911004","first_seen":"2024-02-19T23:01:29Z","last_seen":"2026-05-17T03:11:11.707162Z","times_seen":2027,"resource_available":false,"data":null}},"time_used":566,"timings":{"blocked":395,"dns":0,"connect":0,"send":0,"wait":171,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"mall-test.s3.amazonaws.com/test/2023-03-28/208bfce2-9f5e-4564-9ff0-3f42b091c6e1.jpg","fqdn":"mall-test.s3.amazonaws.com","domain":"mall-test.s3.amazonaws.com","tld":"s3.amazonaws.com"},"ip":{"addr":"3.5.30.74","port":443,"asn":14618,"as":"AMAZON-AES","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://bluewhaleusen.com/","date":"2025-12-20T07:01:24.689Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"P256","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"s3.amazonaws.com","organization":""},"issuer":{"commonName":"Amazon RSA 2048 M01","organization":"Amazon"},"validity":{"start":"Fri, 19 Sep 2025 00:00:00 GMT","end":"Sun, 23 Aug 2026 23:59:59 GMT"},"fingerprint":{"sha1":"48:FD:CD:50:85:6A:51:E7:71:E4:CB:E0:03:81:E1:EC:4E:AD:9E:C7","sha256":"D7:11:81:F4:91:03:0D:C6:A5:DE:8A:EF:AA:58:14:BA:AD:33:B5:11:8B:D5:F0:33:53:8B:AF:49:82:E9:4B:A4"}}},"request":{"raw":"GET /test/2023-03-28/208bfce2-9f5e-4564-9ff0-3f42b091c6e1.jpg HTTP/1.1\r\nHost: mall-test.s3.amazonaws.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nx-amz-id-2: 6UJhN4w7wWbCAhJftRrQRIB8sTpOH//3dd1n5RmpOgx7RPQtjxrI+9eehVOHTt20ZhkT9OVimMLFtRSoOMi/dc8FjXdgJ8UR\r\nx-amz-request-id: CRNXDRW99TY9HN8W\r\nDate: Sat, 20 Dec 2025 07:01:25 GMT\r\nLast-Modified: Wed, 22 May 2024 20:47:36 GMT\r\nETag: \"1994307f8b89af5cfce1809d993ccd77\"\r\nx-amz-server-side-encryption: AES256\r\nAccept-Ranges: bytes\r\nContent-Type: image/jpeg\r\nContent-Length: 70775\r\nServer: AmazonS3\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Amazon Web Services","description":"Amazon Web Services (AWS) is a comprehensive cloud services platform offering compute power, database storage, content delivery and other functionality.","website":"https://aws.amazon.com/","common_platform_enumeration":"","icon":"Amazon Web Services.svg","categories":["PaaS"]},{"name":"Amazon S3","description":"Amazon S3 or Amazon Simple Storage Service is a service offered by Amazon Web Services (AWS) that provides object storage through a web service interface.","website":"https://aws.amazon.com/s3/","common_platform_enumeration":"","icon":"Amazon S3.svg","categories":["CDN"]}],"data":{"size":70775,"size_decoded":0,"mime_type":"image/jpeg","magic":"JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 1419x1500, components 3","md5":"1994307f8b89af5cfce1809d993ccd77","sha1":"18a1e5b438175e9c250289af987baf9737f6eef3","sha256":"6fcf1c0fd9d63f09ab28bb88303bf4a07948cf20d7f2ada3b98d61b1c72c58b0","sha512":"44130d3baa426c9c78b487f7afc1be7a2aadcead85221802a975bcafa48cf828ea9269b51fdcd1c738e0a7fc03138f3e25317668713641cd8e24bae3648ecdb4","ssdeep":"1536:T+d12/duTA94befwkF/rN77EpdChj5oBzirrX6cRg3AF0:yfLTAueIkF/rN0pdCYRerqcRg3Aa","tlshash":"f76302f370c11441cc64d5b2b68d32b423769356fc2fd30c469e7b5b628983566e3ca9","first_seen":"2024-02-19T23:01:29Z","last_seen":"2026-08-09T04:44:19.255009Z","times_seen":7214,"resource_available":false,"data":null}},"time_used":289,"timings":{"blocked":169,"dns":0,"connect":0,"send":0,"wait":118,"receive":2,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"bluewhaleusen.com/css/chunk-6f6da97b.ba19ca45.css","fqdn":"bluewhaleusen.com","domain":"bluewhaleusen.com","tld":"com"},"ip":{"addr":"118.107.9.252","port":443,"asn":152194,"as":"CTG Server Limited","country":"Singapore","country_code":"SG"},"is_navigation_request":false,"resource_type":"other","requested_by":"https://bluewhaleusen.com/","date":"2025-12-20T07:01:24.975Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"bluewhaleusen.com","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Fri, 19 Dec 2025 05:22:57 GMT","end":"Thu, 19 Mar 2026 05:22:56 GMT"},"fingerprint":{"sha1":"23:4C:94:04:E1:25:E0:EA:D1:85:17:4C:09:FC:E0:DA:D0:01:E6:62","sha256":"AC:EF:45:40:E0:37:3A:BD:B9:C9:32:F5:6B:B1:B8:92:BE:33:89:43:FA:25:17:17:7C:CA:50:4E:0B:CD:25:EB"}}},"request":{"raw":"GET /css/chunk-6f6da97b.ba19ca45.css HTTP/1.1\r\nHost: bluewhaleusen.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nX-Moz: prefetch\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Sat, 20 Dec 2025 07:01:25 GMT\r\ncontent-type: text/css\r\ncontent-length: 922\r\netag: W/\"922-1766123972325\"\r\nlast-modified: Fri, 19 Dec 2025 05:59:32 GMT\r\nstrict-transport-security: max-age=31536000\r\naccept-ranges: bytes\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":922,"size_decoded":0,"mime_type":"text/css","magic":"ASCII text, with very long lines (922), with no line terminators","md5":"3701036a35bcea856e89f00d36781e8f","sha1":"b63d63b209ccc2d1402c31a15d1d83edfe17d7c9","sha256":"a1e235f84b6314672b83a7044c2002663ee3a911f57b6d40232c5a0677b4bc32","sha512":"704ff416fa3d339a2677f78c0648d1991b282fd126cf410e760f7268dcdcadd45e77cc9fddd37352fbd6bfec16b25b97fa60c12c3a07bff3d1bca84c13f91903","ssdeep":"","tlshash":"04119e73a125d932e9332d77674494def19188e2e6428739bee7690cc08eb539621304","first_seen":"2024-02-19T23:01:29Z","last_seen":"2026-06-06T14:40:04.321503Z","times_seen":2105,"resource_available":false,"data":null}},"time_used":327,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":327,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2025-12-20","alert":"Sinkholed","trigger":"bluewhaleusen.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2025-12-20","alert":"Phishing Block","trigger":"bluewhaleusen.com","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2025-12-20","alert":"Sinkholed","trigger":"bluewhaleusen.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2025-12-20","alert":"Sinkholed","trigger":"bluewhaleusen.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2025-12-20","alert":"Sinkholed","trigger":"bluewhaleusen.com","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"bluewhaleusen.com/css/chunk-83285f10.03c5e968.css","fqdn":"bluewhaleusen.com","domain":"bluewhaleusen.com","tld":"com"},"ip":{"addr":"118.107.9.252","port":443,"asn":152194,"as":"CTG Server Limited","country":"Singapore","country_code":"SG"},"is_navigation_request":false,"resource_type":"other","requested_by":"https://bluewhaleusen.com/","date":"2025-12-20T07:01:25.315Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"bluewhaleusen.com","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Fri, 19 Dec 2025 05:22:57 GMT","end":"Thu, 19 Mar 2026 05:22:56 GMT"},"fingerprint":{"sha1":"23:4C:94:04:E1:25:E0:EA:D1:85:17:4C:09:FC:E0:DA:D0:01:E6:62","sha256":"AC:EF:45:40:E0:37:3A:BD:B9:C9:32:F5:6B:B1:B8:92:BE:33:89:43:FA:25:17:17:7C:CA:50:4E:0B:CD:25:EB"}}},"request":{"raw":"GET /css/chunk-83285f10.03c5e968.css HTTP/1.1\r\nHost: bluewhaleusen.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nX-Moz: prefetch\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Sat, 20 Dec 2025 07:01:25 GMT\r\ncontent-type: text/css\r\nvary: Accept-Encoding\r\netag: W/\"1224-1766123972325\"\r\nlast-modified: Fri, 19 Dec 2025 05:59:32 GMT\r\nstrict-transport-security: max-age=31536000\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":1224,"size_decoded":0,"mime_type":"text/css","magic":"ASCII text, with very long lines (1224), with no line terminators","md5":"efff8542cb73c85ee85efd24535a5d2a","sha1":"d349fea54dd16de6874a420f79388407e2fd05cf","sha256":"0198f6533d83bd348a16ef7735fb444e4f4dab419e638d85ac95a4b700e44f50","sha512":"c78053b870e87027849f1478ef04aba055e91e98ce7d26c66b53cd7a58b8fda7bfadf4c9bf4612f0e0ba808029b2525045ec13059fdcd9c7d318d184ab60f126","ssdeep":"","tlshash":"d821c041719b32361477f8aa50a00275b811f3e79c1f4262fddbe2104bcb6273861e9e","first_seen":"2024-02-19T23:01:29Z","last_seen":"2026-06-06T14:40:04.423608Z","times_seen":974,"resource_available":false,"data":null}},"time_used":327,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":327,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2025-12-20","alert":"Sinkholed","trigger":"bluewhaleusen.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2025-12-20","alert":"Phishing Block","trigger":"bluewhaleusen.com","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2025-12-20","alert":"Sinkholed","trigger":"bluewhaleusen.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2025-12-20","alert":"Sinkholed","trigger":"bluewhaleusen.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2025-12-20","alert":"Sinkholed","trigger":"bluewhaleusen.com","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"bluewhaleusen.com/css/chunk-ec9441c2.f2bd8913.css","fqdn":"bluewhaleusen.com","domain":"bluewhaleusen.com","tld":"com"},"ip":{"addr":"118.107.9.252","port":443,"asn":152194,"as":"CTG Server Limited","country":"Singapore","country_code":"SG"},"is_navigation_request":false,"resource_type":"other","requested_by":"https://bluewhaleusen.com/","date":"2025-12-20T07:01:25.652Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"bluewhaleusen.com","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Fri, 19 Dec 2025 05:22:57 GMT","end":"Thu, 19 Mar 2026 05:22:56 GMT"},"fingerprint":{"sha1":"23:4C:94:04:E1:25:E0:EA:D1:85:17:4C:09:FC:E0:DA:D0:01:E6:62","sha256":"AC:EF:45:40:E0:37:3A:BD:B9:C9:32:F5:6B:B1:B8:92:BE:33:89:43:FA:25:17:17:7C:CA:50:4E:0B:CD:25:EB"}}},"request":{"raw":"GET /css/chunk-ec9441c2.f2bd8913.css HTTP/1.1\r\nHost: bluewhaleusen.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nX-Moz: prefetch\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Sat, 20 Dec 2025 07:01:25 GMT\r\ncontent-type: text/css\r\ncontent-length: 731\r\netag: W/\"731-1766123972324\"\r\nlast-modified: Fri, 19 Dec 2025 05:59:32 GMT\r\nstrict-transport-security: max-age=31536000\r\naccept-ranges: bytes\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":731,"size_decoded":0,"mime_type":"text/css","magic":"ASCII text, with very long lines (731), with no line terminators","md5":"04fddaebcf220f89065a61a8972e9ff6","sha1":"a72aaad63f69552c1bfc2ce529d0934877a151a5","sha256":"fde628e3bf1d28a032a27b15fb82ee652f593c2de925664d244ef73294ca3002","sha512":"91283184ba4be03fc8613a4cb7476f38560ea9ce179e380e14c783b1dbd2a7b001596670057aca7a28aa80f63ff390a69ddada5e8730d7ec4ab353382952985b","ssdeep":"","tlshash":"b30128f3d1100422c1f7e617e1826898ff95ccb2e753c0afad92551d82caad70ba7b15","first_seen":"2024-02-11T04:26:47Z","last_seen":"2026-06-06T14:40:04.35256Z","times_seen":8466,"resource_available":false,"data":null}},"time_used":326,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":326,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2025-12-20","alert":"Sinkholed","trigger":"bluewhaleusen.com","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2025-12-20","alert":"Sinkholed","trigger":"bluewhaleusen.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2025-12-20","alert":"Phishing Block","trigger":"bluewhaleusen.com","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2025-12-20","alert":"Sinkholed","trigger":"bluewhaleusen.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2025-12-20","alert":"Sinkholed","trigger":"bluewhaleusen.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"bluewhaleusen.com/css/chunk-dea9f6de.3ecf88fe.css","fqdn":"bluewhaleusen.com","domain":"bluewhaleusen.com","tld":"com"},"ip":{"addr":"118.107.9.252","port":443,"asn":152194,"as":"CTG Server Limited","country":"Singapore","country_code":"SG"},"is_navigation_request":false,"resource_type":"other","requested_by":"https://bluewhaleusen.com/","date":"2025-12-20T07:01:25.651Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"bluewhaleusen.com","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Fri, 19 Dec 2025 05:22:57 GMT","end":"Thu, 19 Mar 2026 05:22:56 GMT"},"fingerprint":{"sha1":"23:4C:94:04:E1:25:E0:EA:D1:85:17:4C:09:FC:E0:DA:D0:01:E6:62","sha256":"AC:EF:45:40:E0:37:3A:BD:B9:C9:32:F5:6B:B1:B8:92:BE:33:89:43:FA:25:17:17:7C:CA:50:4E:0B:CD:25:EB"}}},"request":{"raw":"GET /css/chunk-dea9f6de.3ecf88fe.css HTTP/1.1\r\nHost: bluewhaleusen.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nX-Moz: prefetch\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Sat, 20 Dec 2025 07:01:25 GMT\r\ncontent-type: text/css\r\nvary: Accept-Encoding\r\netag: W/\"3338-1766123972323\"\r\nlast-modified: Fri, 19 Dec 2025 05:59:32 GMT\r\nstrict-transport-security: max-age=31536000\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":3338,"size_decoded":0,"mime_type":"text/css","magic":"ASCII text, with very long lines (3338), with no line terminators","md5":"1bc5b8235f9e8d5bf3961279423cf630","sha1":"466627105df20f8e829d3db72a2617802b7b265a","sha256":"cc7c2d00d52891b7af0ae290785d54f087c4f61951893b7c7fd8c869f7a8047f","sha512":"a2c17506a8e46344978b7955c1c162a6fdb844d0ec51fce021c04aee33df5d44cae64f10a7a6bf5ec295a1210540e5b82c1f7e79b9d89aa14dc29e7531cd81ca","ssdeep":"","tlshash":"766110382130361c3b37922a25c8f54e2619a9e5f18995c9ba98c42f4edf769dcb0263","first_seen":"2024-02-11T04:26:48Z","last_seen":"2026-06-06T14:40:04.508224Z","times_seen":6672,"resource_available":false,"data":null}},"time_used":327,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":327,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2025-12-20","alert":"Sinkholed","trigger":"bluewhaleusen.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2025-12-20","alert":"Sinkholed","trigger":"bluewhaleusen.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2025-12-20","alert":"Sinkholed","trigger":"bluewhaleusen.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2025-12-20","alert":"Phishing Block","trigger":"bluewhaleusen.com","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2025-12-20","alert":"Sinkholed","trigger":"bluewhaleusen.com","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"bluewhaleusen.com/matashop2.svg","fqdn":"bluewhaleusen.com","domain":"bluewhaleusen.com","tld":"com"},"ip":{"addr":"118.107.9.252","port":443,"asn":152194,"as":"CTG Server Limited","country":"Singapore","country_code":"SG"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://bluewhaleusen.com/","date":"2025-12-20T07:01:22.223Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"bluewhaleusen.com","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Fri, 19 Dec 2025 05:22:57 GMT","end":"Thu, 19 Mar 2026 05:22:56 GMT"},"fingerprint":{"sha1":"23:4C:94:04:E1:25:E0:EA:D1:85:17:4C:09:FC:E0:DA:D0:01:E6:62","sha256":"AC:EF:45:40:E0:37:3A:BD:B9:C9:32:F5:6B:B1:B8:92:BE:33:89:43:FA:25:17:17:7C:CA:50:4E:0B:CD:25:EB"}}},"request":{"raw":"GET /matashop2.svg HTTP/1.1\r\nHost: bluewhaleusen.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"","headers":null,"cookies":null,"status_code":"","status_text":"","fingerprints":null,"data":{"size":0,"size_decoded":0,"mime_type":"","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-08-11T16:57:26.648985Z","times_seen":17840002,"resource_available":true,"data":null}},"time_used":327,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":327,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2025-12-20","alert":"Sinkholed","trigger":"bluewhaleusen.com","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2025-12-20","alert":"Sinkholed","trigger":"bluewhaleusen.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2025-12-20","alert":"Phishing Block","trigger":"bluewhaleusen.com","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2025-12-20","alert":"Sinkholed","trigger":"bluewhaleusen.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2025-12-20","alert":"Sinkholed","trigger":"bluewhaleusen.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"bluewhaleusen.com/img/argos.72fd36f0.png","fqdn":"bluewhaleusen.com","domain":"bluewhaleusen.com","tld":"com"},"ip":{"addr":"118.107.9.252","port":443,"asn":152194,"as":"CTG Server Limited","country":"Singapore","country_code":"SG"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://bluewhaleusen.com/","date":"2025-12-20T07:01:22.832Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"bluewhaleusen.com","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Fri, 19 Dec 2025 05:22:57 GMT","end":"Thu, 19 Mar 2026 05:22:56 GMT"},"fingerprint":{"sha1":"23:4C:94:04:E1:25:E0:EA:D1:85:17:4C:09:FC:E0:DA:D0:01:E6:62","sha256":"AC:EF:45:40:E0:37:3A:BD:B9:C9:32:F5:6B:B1:B8:92:BE:33:89:43:FA:25:17:17:7C:CA:50:4E:0B:CD:25:EB"}}},"request":{"raw":"GET /img/argos.72fd36f0.png HTTP/1.1\r\nHost: bluewhaleusen.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Sat, 20 Dec 2025 07:01:23 GMT\r\ncontent-type: image/png\r\nvary: Accept-Encoding\r\netag: W/\"14021-1766123972341\"\r\nlast-modified: Fri, 19 Dec 2025 05:59:32 GMT\r\nstrict-transport-security: max-age=31536000\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":14021,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 1024 x 1024, 8-bit colormap, non-interlaced","md5":"72fd36f0d2f325647f3117410aec1dd6","sha1":"7ee804c2afef0256e666952f16239780acc8de61","sha256":"c3041ec54bc45f4d7ac030cf08264a14272459bc059ad82c7e8bf501ee96e9b4","sha512":"1288bf9bb3ef598d80744253b06416d96a58aa89d2be7102dcec88c21f1a8fa36fd72ab9040f27bcaf2f24d1fea44c56ed857493834f5f1581c21883041ad6cd","ssdeep":"384:7T3q3eRuJHzW+tRWfF/Kc2hNCzP13TDTv2VOu68CAvkfChP3b:7TDSqec4hGNDfv2Vr6Csqb","tlshash":"99529d91c740f5f9db8406f629001bb133b62573ba3b2a75b6bb84541d7a7a87304fca","first_seen":"2024-02-19T23:01:28Z","last_seen":"2026-07-06T17:43:37.918653Z","times_seen":2046,"resource_available":false,"data":null}},"time_used":329,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":329,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2025-12-20","alert":"Sinkholed","trigger":"bluewhaleusen.com","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2025-12-20","alert":"Sinkholed","trigger":"bluewhaleusen.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2025-12-20","alert":"Phishing Block","trigger":"bluewhaleusen.com","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2025-12-20","alert":"Sinkholed","trigger":"bluewhaleusen.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2025-12-20","alert":"Sinkholed","trigger":"bluewhaleusen.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"imgtest1.s3.amazonaws.com/type/2023-11-01/b1365176-2126-4b52-893a-d823ba7fa752.png","fqdn":"imgtest1.s3.amazonaws.com","domain":"imgtest1.s3.amazonaws.com","tld":"s3.amazonaws.com"},"ip":{"addr":"16.15.207.90","port":443,"asn":14618,"as":"AMAZON-AES","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://bluewhaleusen.com/","date":"2025-12-20T07:01:23.416Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"P256","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.s3.amazonaws.com","organization":""},"issuer":{"commonName":"Amazon RSA 2048 M01","organization":"Amazon"},"validity":{"start":"Fri, 14 Feb 2025 00:00:00 GMT","end":"Sat, 07 Feb 2026 23:59:59 GMT"},"fingerprint":{"sha1":"2E:BA:63:64:95:A8:CE:55:DD:7E:EB:A9:98:83:14:B1:6F:6B:61:69","sha256":"00:D7:0B:CC:1F:82:6B:F6:D9:2E:55:1A:BA:88:38:33:19:09:5B:85:49:41:5E:DA:A1:97:B9:D2:0A:3B:13:52"}}},"request":{"raw":"GET /type/2023-11-01/b1365176-2126-4b52-893a-d823ba7fa752.png HTTP/1.1\r\nHost: imgtest1.s3.amazonaws.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nx-amz-id-2: zpCXMrpKdibPDXYPNeEHfVA6JhjyAy4Abyvw/rKg+7bUE2rjmzEpHGN3KMq8j1qLOKOFu3X9FBYwb8xWzbABVf5C47FhhmYB\r\nx-amz-request-id: CRNWP350KBVWP22D\r\nDate: Sat, 20 Dec 2025 07:01:25 GMT\r\nLast-Modified: Thu, 23 May 2024 01:50:36 GMT\r\nETag: \"57fc8f526d4275ea03d2bdbdc5576892\"\r\nx-amz-server-side-encryption: AES256\r\nAccept-Ranges: bytes\r\nContent-Type: image/png\r\nContent-Length: 170933\r\nServer: AmazonS3\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Amazon Web Services","description":"Amazon Web Services (AWS) is a comprehensive cloud services platform offering compute power, database storage, content delivery and other functionality.","website":"https://aws.amazon.com/","common_platform_enumeration":"","icon":"Amazon Web Services.svg","categories":["PaaS"]},{"name":"Amazon S3","description":"Amazon S3 or Amazon Simple Storage Service is a service offered by Amazon Web Services (AWS) that provides object storage through a web service interface.","website":"https://aws.amazon.com/s3/","common_platform_enumeration":"","icon":"Amazon S3.svg","categories":["CDN"]}],"data":{"size":170933,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 500 x 500, 8-bit/color RGBA, non-interlaced","md5":"57fc8f526d4275ea03d2bdbdc5576892","sha1":"648d7e45b5f40cefb1d18bb9c726fa2194627313","sha256":"5b08dd67e7ff0eb29804f686a825a0607fcfad5e509780a30adfea265bc26d6d","sha512":"046bbf2c489dd817458bb078c2a21eee87949f983e0924087800414acb782c41e1e777873e9bf43ad90c456a764044b9a142646b88ca61a2589c90e0a31b860b","ssdeep":"3072:uZZZCa4TScGLIk8FhGOovWdjezklGcjjltrXy2zm423z7LOOCAr:u3knH9GOusjezklGGltri2zm3fLNr","tlshash":"a1f31238ed7ef755a4fad15f910cada0a0f877204832a5813e37d7d437c98a192eb249","first_seen":"2024-02-19T23:01:28Z","last_seen":"2026-08-11T08:26:52.986397Z","times_seen":2515,"resource_available":false,"data":null}},"time_used":1063,"timings":{"blocked":940,"dns":0,"connect":0,"send":0,"wait":119,"receive":4,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"imgtest1.s3.amazonaws.com/test/2023-03-07/02a275d6-f6e2-4a03-863b-4f4a8e5553a2.jpg","fqdn":"imgtest1.s3.amazonaws.com","domain":"imgtest1.s3.amazonaws.com","tld":"s3.amazonaws.com"},"ip":{"addr":"16.15.207.90","port":443,"asn":14618,"as":"AMAZON-AES","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://bluewhaleusen.com/","date":"2025-12-20T07:01:23.463Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"P256","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.s3.amazonaws.com","organization":""},"issuer":{"commonName":"Amazon RSA 2048 M01","organization":"Amazon"},"validity":{"start":"Fri, 14 Feb 2025 00:00:00 GMT","end":"Sat, 07 Feb 2026 23:59:59 GMT"},"fingerprint":{"sha1":"2E:BA:63:64:95:A8:CE:55:DD:7E:EB:A9:98:83:14:B1:6F:6B:61:69","sha256":"00:D7:0B:CC:1F:82:6B:F6:D9:2E:55:1A:BA:88:38:33:19:09:5B:85:49:41:5E:DA:A1:97:B9:D2:0A:3B:13:52"}}},"request":{"raw":"GET /test/2023-03-07/02a275d6-f6e2-4a03-863b-4f4a8e5553a2.jpg HTTP/1.1\r\nHost: imgtest1.s3.amazonaws.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nx-amz-id-2: VLHhAtFjvK9Gkc8FgIduYqGldGYNL91Yfb5ou4sCAka+GwTubjoNJ4xxDEETBXRUgLur+ljZSM+44I3VuLxCzwFUjnf7vbUx\r\nx-amz-request-id: CRNQXX3CC6VE2J45\r\nDate: Sat, 20 Dec 2025 07:01:25 GMT\r\nLast-Modified: Thu, 23 May 2024 01:45:35 GMT\r\nETag: \"5a1dff9153a77d8a9378efd305a31020\"\r\nx-amz-server-side-encryption: AES256\r\nAccept-Ranges: bytes\r\nContent-Type: image/jpeg\r\nContent-Length: 224131\r\nServer: AmazonS3\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Amazon S3","description":"Amazon S3 or Amazon Simple Storage Service is a service offered by Amazon Web Services (AWS) that provides object storage through a web service interface.","website":"https://aws.amazon.com/s3/","common_platform_enumeration":"","icon":"Amazon S3.svg","categories":["CDN"]},{"name":"Amazon Web Services","description":"Amazon Web Services (AWS) is a comprehensive cloud services platform offering compute power, database storage, content delivery and other functionality.","website":"https://aws.amazon.com/","common_platform_enumeration":"","icon":"Amazon Web Services.svg","categories":["PaaS"]}],"data":{"size":224131,"size_decoded":0,"mime_type":"image/jpeg","magic":"JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 1220x1500, components 3","md5":"5a1dff9153a77d8a9378efd305a31020","sha1":"b280f6a2970151e339afd5e73361e0c6a734744e","sha256":"8ee4ccfa0296fd6e5c7ca878aa83aa308acc4699ede63a1cabc0be5af3798602","sha512":"abeb0d6350b6e478258e33713708899eff0b9a58db05b3137d5f869ae78214493b0829a025a3d5ffee54038c62d08ff38f0ae26a011960c0e5a08ed2ebd2e24e","ssdeep":"3072:/Oktuw2ZB4RVrrrV2GlegkDtLvyrA+PmwLiixr10oAIC1yQFMQLNXNP7g+UB2qDa:mktT2TCOGeLvIf/2IUyKb62qnGj","tlshash":"bc2412a0e302057ac0fd497d1cca4627eeaef7ba61eef102c42768103957736b574a67","first_seen":"2024-02-19T23:01:28Z","last_seen":"2026-08-09T04:44:19.235589Z","times_seen":7474,"resource_available":false,"data":null}},"time_used":1145,"timings":{"blocked":766,"dns":0,"connect":0,"send":0,"wait":161,"receive":218,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"mall-test.s3.amazonaws.com/test/2023-03-28/8f28f605-9543-48c6-a4c6-e8c636de7e5d.jpg","fqdn":"mall-test.s3.amazonaws.com","domain":"mall-test.s3.amazonaws.com","tld":"s3.amazonaws.com"},"ip":{"addr":"3.5.30.74","port":443,"asn":14618,"as":"AMAZON-AES","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://bluewhaleusen.com/","date":"2025-12-20T07:01:23.647Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"P256","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"s3.amazonaws.com","organization":""},"issuer":{"commonName":"Amazon RSA 2048 M01","organization":"Amazon"},"validity":{"start":"Fri, 19 Sep 2025 00:00:00 GMT","end":"Sun, 23 Aug 2026 23:59:59 GMT"},"fingerprint":{"sha1":"48:FD:CD:50:85:6A:51:E7:71:E4:CB:E0:03:81:E1:EC:4E:AD:9E:C7","sha256":"D7:11:81:F4:91:03:0D:C6:A5:DE:8A:EF:AA:58:14:BA:AD:33:B5:11:8B:D5:F0:33:53:8B:AF:49:82:E9:4B:A4"}}},"request":{"raw":"GET /test/2023-03-28/8f28f605-9543-48c6-a4c6-e8c636de7e5d.jpg HTTP/1.1\r\nHost: mall-test.s3.amazonaws.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nx-amz-id-2: UbZbVSxi+or7DvXbQXmw5inN3/aVSrTEgxvHQCD5RGyxhOlA4wKnWSAUR06EpxmCcL0RP+NSGVYTqYCHyun6/Vy58os7z6Qm\r\nx-amz-request-id: CRNR4NA0QDJTP241\r\nDate: Sat, 20 Dec 2025 07:01:25 GMT\r\nLast-Modified: Wed, 22 May 2024 20:51:37 GMT\r\nETag: \"57ccd4508cb9aa0770d6f99eb7d7aa41\"\r\nx-amz-server-side-encryption: AES256\r\nAccept-Ranges: bytes\r\nContent-Type: image/jpeg\r\nContent-Length: 43286\r\nServer: AmazonS3\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Amazon Web Services","description":"Amazon Web Services (AWS) is a comprehensive cloud services platform offering compute power, database storage, content delivery and other functionality.","website":"https://aws.amazon.com/","common_platform_enumeration":"","icon":"Amazon Web Services.svg","categories":["PaaS"]},{"name":"Amazon S3","description":"Amazon S3 or Amazon Simple Storage Service is a service offered by Amazon Web Services (AWS) that provides object storage through a web service interface.","website":"https://aws.amazon.com/s3/","common_platform_enumeration":"","icon":"Amazon S3.svg","categories":["CDN"]}],"data":{"size":43286,"size_decoded":0,"mime_type":"image/jpeg","magic":"JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 1258x715, components 3","md5":"57ccd4508cb9aa0770d6f99eb7d7aa41","sha1":"7b297c1fe1347760132907f13ee3ed23e053d9d4","sha256":"39111c493bd0463e579cf0032e909fdb655cc21522f36c4c14d7cd6aa9750dd0","sha512":"ffdd78eee99d87340cf1389a6d92b02d2a9153926ffe67637b6c53376e6d9137549a7e0bbaea224c78cdacc83e572b014492754138357ec1179ce28018523e65","ssdeep":"768:18mUreUHhdqjj4ULRe7ZXEjL8vnXGyve23R3lwt/5u2Uy8xQ:UNmjjpLRIejkXNve2h3lWx","tlshash":"0313f19fb28a6941f1480c7ed2b8769fec823732256d6577ed75931c1b3b4403d90ab1","first_seen":"2024-02-19T23:01:28Z","last_seen":"2026-08-09T04:44:19.275291Z","times_seen":7298,"resource_available":false,"data":null}},"time_used":930,"timings":{"blocked":804,"dns":0,"connect":0,"send":0,"wait":125,"receive":1,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"mall-test.s3.amazonaws.com/test/2023-03-28/acc8fc49-f110-45dc-ad47-ed783751d459.jpg","fqdn":"mall-test.s3.amazonaws.com","domain":"mall-test.s3.amazonaws.com","tld":"s3.amazonaws.com"},"ip":{"addr":"3.5.30.74","port":443,"asn":14618,"as":"AMAZON-AES","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://bluewhaleusen.com/","date":"2025-12-20T07:01:23.663Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_CHACHA20_POLY1305_SHA256","key_group_name":"P256","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"s3.amazonaws.com","organization":""},"issuer":{"commonName":"Amazon RSA 2048 M01","organization":"Amazon"},"validity":{"start":"Fri, 19 Sep 2025 00:00:00 GMT","end":"Sun, 23 Aug 2026 23:59:59 GMT"},"fingerprint":{"sha1":"48:FD:CD:50:85:6A:51:E7:71:E4:CB:E0:03:81:E1:EC:4E:AD:9E:C7","sha256":"D7:11:81:F4:91:03:0D:C6:A5:DE:8A:EF:AA:58:14:BA:AD:33:B5:11:8B:D5:F0:33:53:8B:AF:49:82:E9:4B:A4"}}},"request":{"raw":"GET /test/2023-03-28/acc8fc49-f110-45dc-ad47-ed783751d459.jpg HTTP/1.1\r\nHost: mall-test.s3.amazonaws.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nx-amz-id-2: xn6oO/1ldl+M/pRNj+4qyjWvhr8APBhQythM0T0p7OT84BEeFejIhsTqxeyYnvfl9pM1X4ZdLdITsmRVKSPO1qEBenuUib/S\r\nx-amz-request-id: CRNZQ8RP10N86GGM\r\nDate: Sat, 20 Dec 2025 07:01:25 GMT\r\nLast-Modified: Wed, 22 May 2024 20:52:42 GMT\r\nETag: \"c634a23e1cf05e83125aa10432132296\"\r\nx-amz-server-side-encryption: AES256\r\nAccept-Ranges: bytes\r\nContent-Type: image/jpeg\r\nContent-Length: 53448\r\nServer: AmazonS3\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Amazon Web Services","description":"Amazon Web Services (AWS) is a comprehensive cloud services platform offering compute power, database storage, content delivery and other functionality.","website":"https://aws.amazon.com/","common_platform_enumeration":"","icon":"Amazon Web Services.svg","categories":["PaaS"]},{"name":"Amazon S3","description":"Amazon S3 or Amazon Simple Storage Service is a service offered by Amazon Web Services (AWS) that provides object storage through a web service interface.","website":"https://aws.amazon.com/s3/","common_platform_enumeration":"","icon":"Amazon S3.svg","categories":["CDN"]}],"data":{"size":53448,"size_decoded":0,"mime_type":"image/jpeg","magic":"JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 1500x964, components 3","md5":"c634a23e1cf05e83125aa10432132296","sha1":"d852a10bd34b690c8e498ee73ae2d6c5faae1732","sha256":"5b09946f350ed1fd218a76b5910d839c13519d8e17a1db3e796de2073f40b98b","sha512":"44f4460f3699bf4cec57d45ab78de259706067c0574959c390412dda8723e23ce0c53d9bc273bbef08374e4f3951ad12a07df0ce7a7b81170fdc9b2f41b3584a","ssdeep":"768:13UWmYl3EprZ7Du4TLP9nMxJPbV5Oi5+MlzmD1lqktAYyjSy0PukXXM:RUu0rvXFMxVbVtlzYlIjFeDnM","tlshash":"8a33f2dd6b7180f5c62cccb79fd13ba76a1282bf52b50caf47a38e119184715384f199","first_seen":"2024-02-11T04:26:46Z","last_seen":"2026-08-09T04:44:19.298411Z","times_seen":7223,"resource_available":false,"data":null}},"time_used":1001,"timings":{"blocked":887,"dns":0,"connect":0,"send":0,"wait":113,"receive":1,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"mall-test.s3.amazonaws.com/test/2023-03-28/d9a4f743-88c7-49d5-8f27-acd79169d134.jpg","fqdn":"mall-test.s3.amazonaws.com","domain":"mall-test.s3.amazonaws.com","tld":"s3.amazonaws.com"},"ip":{"addr":"3.5.30.74","port":443,"asn":14618,"as":"AMAZON-AES","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://bluewhaleusen.com/","date":"2025-12-20T07:01:24.653Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"P256","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"s3.amazonaws.com","organization":""},"issuer":{"commonName":"Amazon RSA 2048 M01","organization":"Amazon"},"validity":{"start":"Fri, 19 Sep 2025 00:00:00 GMT","end":"Sun, 23 Aug 2026 23:59:59 GMT"},"fingerprint":{"sha1":"48:FD:CD:50:85:6A:51:E7:71:E4:CB:E0:03:81:E1:EC:4E:AD:9E:C7","sha256":"D7:11:81:F4:91:03:0D:C6:A5:DE:8A:EF:AA:58:14:BA:AD:33:B5:11:8B:D5:F0:33:53:8B:AF:49:82:E9:4B:A4"}}},"request":{"raw":"GET /test/2023-03-28/d9a4f743-88c7-49d5-8f27-acd79169d134.jpg HTTP/1.1\r\nHost: mall-test.s3.amazonaws.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nx-amz-id-2: CM9iW+svmQoRmRTJLeKHzfZUHTIPm0xyJ/WRfOjQocciVHF06+GbhHsD/ev/hNyGHfnzciK+P3Wc6pVx4fQrjnsHqClpUVn3\r\nx-amz-request-id: CRNS4R814FHD0B21\r\nDate: Sat, 20 Dec 2025 07:01:25 GMT\r\nLast-Modified: Wed, 22 May 2024 20:54:21 GMT\r\nETag: \"5eb7c18e0164431bc4ebd5432142d478\"\r\nx-amz-server-side-encryption: AES256\r\nAccept-Ranges: bytes\r\nContent-Type: image/jpeg\r\nContent-Length: 62006\r\nServer: AmazonS3\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Amazon Web Services","description":"Amazon Web Services (AWS) is a comprehensive cloud services platform offering compute power, database storage, content delivery and other functionality.","website":"https://aws.amazon.com/","common_platform_enumeration":"","icon":"Amazon Web Services.svg","categories":["PaaS"]},{"name":"Amazon S3","description":"Amazon S3 or Amazon Simple Storage Service is a service offered by Amazon Web Services (AWS) that provides object storage through a web service interface.","website":"https://aws.amazon.com/s3/","common_platform_enumeration":"","icon":"Amazon S3.svg","categories":["CDN"]}],"data":{"size":62006,"size_decoded":0,"mime_type":"image/jpeg","magic":"JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 992x798, components 3","md5":"5eb7c18e0164431bc4ebd5432142d478","sha1":"0e7463b4754fba04259090a3e6c70865b6acde18","sha256":"c8e8e1655371e5817147fb849721d215226bb8f03e99bee89e9b3217f91187ba","sha512":"0dfacb79d468692bb1e777bfc2311eb6ae4f4de8d4f1d4f273a6e918a7538cc7f7450c577a7978b281b8c7c8a8f1cd224675df0ed5af052e11f82ec4acbc3af5","ssdeep":"1536:VBqvv4Wcx0q5rQdsUVr80gBJB0t+QZb2sG1/:wv4Ws0gUyUVrRgBJo+QRGR","tlshash":"0c53128569a9b165db633ab88e06708efc0f2ca6eef70074210dd3d93074af1bd4a45c","first_seen":"2024-03-15T18:45:46Z","last_seen":"2026-08-11T08:26:52.942955Z","times_seen":2469,"resource_available":false,"data":null}},"time_used":194,"timings":{"blocked":84,"dns":0,"connect":0,"send":0,"wait":108,"receive":2,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"mall-test.s3.amazonaws.com/test/2023-03-28/f2601622-74c2-44a6-bc3d-374575d12a95.jpg","fqdn":"mall-test.s3.amazonaws.com","domain":"mall-test.s3.amazonaws.com","tld":"s3.amazonaws.com"},"ip":{"addr":"3.5.30.74","port":443,"asn":14618,"as":"AMAZON-AES","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://bluewhaleusen.com/","date":"2025-12-20T07:01:24.712Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"P256","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"s3.amazonaws.com","organization":""},"issuer":{"commonName":"Amazon RSA 2048 M01","organization":"Amazon"},"validity":{"start":"Fri, 19 Sep 2025 00:00:00 GMT","end":"Sun, 23 Aug 2026 23:59:59 GMT"},"fingerprint":{"sha1":"48:FD:CD:50:85:6A:51:E7:71:E4:CB:E0:03:81:E1:EC:4E:AD:9E:C7","sha256":"D7:11:81:F4:91:03:0D:C6:A5:DE:8A:EF:AA:58:14:BA:AD:33:B5:11:8B:D5:F0:33:53:8B:AF:49:82:E9:4B:A4"}}},"request":{"raw":"GET /test/2023-03-28/f2601622-74c2-44a6-bc3d-374575d12a95.jpg HTTP/1.1\r\nHost: mall-test.s3.amazonaws.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nx-amz-id-2: VmL44jggZfo49cUIJIqPy5JZ/sbVpUmtStfHXZY4UgTMXdk9qF8WAuGU+ETnfEXCKTEFoL+lj0SuiNpEfGoFL21dF0ujj0aq\r\nx-amz-request-id: CRNR4R8YVREC2YNJ\r\nDate: Sat, 20 Dec 2025 07:01:25 GMT\r\nLast-Modified: Wed, 22 May 2024 20:55:15 GMT\r\nETag: \"f383cfa9adc0f43a8d0f56f57daabda7\"\r\nx-amz-server-side-encryption: AES256\r\nAccept-Ranges: bytes\r\nContent-Type: image/jpeg\r\nContent-Length: 99197\r\nServer: AmazonS3\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Amazon Web Services","description":"Amazon Web Services (AWS) is a comprehensive cloud services platform offering compute power, database storage, content delivery and other functionality.","website":"https://aws.amazon.com/","common_platform_enumeration":"","icon":"Amazon Web Services.svg","categories":["PaaS"]},{"name":"Amazon S3","description":"Amazon S3 or Amazon Simple Storage Service is a service offered by Amazon Web Services (AWS) that provides object storage through a web service interface.","website":"https://aws.amazon.com/s3/","common_platform_enumeration":"","icon":"Amazon S3.svg","categories":["CDN"]}],"data":{"size":99197,"size_decoded":0,"mime_type":"image/jpeg","magic":"JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 1500x1177, components 3","md5":"f383cfa9adc0f43a8d0f56f57daabda7","sha1":"a2adc9d3b604386fee5ea6bb568c6e41c69e4dff","sha256":"2fc0a2e5ae1154c7db96eb4655ec0fcde8dffeb5a28805dce81a404fa5273b0f","sha512":"8c6abd4a504f6daa7777784dbb85ce326bc360eae817b37d632d238b62cbb0a53b5cb871ae153b6919d3a665ae7fa36c804e887a649efbe3889c9a854b2eee30","ssdeep":"1536:U4yqgb8EHMzbUJYXohxfnXAYEb1DHdEClNI6aTUtOE78yByKZmDwMuWxCUWgr/8D:Ujb8EH2ESW9n+E8NI6wpyEKZ71YCU38D","tlshash":"d2a31327dc05a180c5f514fb03eb8cbf0a6d1445b9ac985ebf06c9e27097a96cfd9512","first_seen":"2024-03-15T18:45:46Z","last_seen":"2026-05-17T03:11:11.744637Z","times_seen":2200,"resource_available":false,"data":null}},"time_used":361,"timings":{"blocked":240,"dns":0,"connect":0,"send":0,"wait":117,"receive":4,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"bluewhaleusen.com/wap/api/activity/lottery!getCurrentActivity.action?lang=en","fqdn":"bluewhaleusen.com","domain":"bluewhaleusen.com","tld":"com"},"ip":{"addr":"118.107.9.252","port":443,"asn":152194,"as":"CTG Server Limited","country":"Singapore","country_code":"SG"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"https://bluewhaleusen.com/","date":"2025-12-20T07:01:23.000Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"bluewhaleusen.com","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Fri, 19 Dec 2025 05:22:57 GMT","end":"Thu, 19 Mar 2026 05:22:56 GMT"},"fingerprint":{"sha1":"23:4C:94:04:E1:25:E0:EA:D1:85:17:4C:09:FC:E0:DA:D0:01:E6:62","sha256":"AC:EF:45:40:E0:37:3A:BD:B9:C9:32:F5:6B:B1:B8:92:BE:33:89:43:FA:25:17:17:7C:CA:50:4E:0B:CD:25:EB"}}},"request":{"raw":"GET /wap/api/activity/lottery!getCurrentActivity.action?lang=en HTTP/1.1\r\nHost: bluewhaleusen.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/json, text/plain, */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Sat, 20 Dec 2025 07:01:23 GMT\r\ncontent-type: application/json;charset=UTF-8\r\nvary: Accept-Encoding, Origin, Access-Control-Request-Method, Access-Control-Request-Headers\r\nstrict-transport-security: max-age=31536000\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":224,"size_decoded":0,"mime_type":"application/json; charset=UTF-8","magic":"JSON text data","md5":"78e5741d0f48875acfa60ce3abc5bd11","sha1":"7f688fc4e03cf5e526a364ce11df4e80a042624c","sha256":"5df3075bda3256e84e98933f2fbd7073a5cefbb21ad00554961b1bf8c239e869","sha512":"c53706584f99a1aa518c41c3a60cbf909aa6595ef9f6ca6460f3bdea6f7a7196433c714f417a025492da6e93e916ae81e56baf320333c5d748d48588199b44e4","ssdeep":"","tlshash":"b0d023e4165c7890c35f83c517ed71154d1db526446b163d2d1dde9481347a57d10c75","first_seen":"2025-04-07T10:59:20.436022Z","last_seen":"2026-08-11T08:26:52.925032Z","times_seen":219,"resource_available":false,"data":null}},"time_used":403,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":403,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2025-12-20","alert":"Sinkholed","trigger":"bluewhaleusen.com","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2025-12-20","alert":"Sinkholed","trigger":"bluewhaleusen.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2025-12-20","alert":"Sinkholed","trigger":"bluewhaleusen.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2025-12-20","alert":"Phishing Block","trigger":"bluewhaleusen.com","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2025-12-20","alert":"Sinkholed","trigger":"bluewhaleusen.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"bluewhaleusen.com/css/chunk-060a6d9e.615f6bf6.css","fqdn":"bluewhaleusen.com","domain":"bluewhaleusen.com","tld":"com"},"ip":{"addr":"118.107.9.252","port":443,"asn":152194,"as":"CTG Server Limited","country":"Singapore","country_code":"SG"},"is_navigation_request":false,"resource_type":"other","requested_by":"https://bluewhaleusen.com/","date":"2025-12-20T07:01:23.239Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"bluewhaleusen.com","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Fri, 19 Dec 2025 05:22:57 GMT","end":"Thu, 19 Mar 2026 05:22:56 GMT"},"fingerprint":{"sha1":"23:4C:94:04:E1:25:E0:EA:D1:85:17:4C:09:FC:E0:DA:D0:01:E6:62","sha256":"AC:EF:45:40:E0:37:3A:BD:B9:C9:32:F5:6B:B1:B8:92:BE:33:89:43:FA:25:17:17:7C:CA:50:4E:0B:CD:25:EB"}}},"request":{"raw":"GET /css/chunk-060a6d9e.615f6bf6.css HTTP/1.1\r\nHost: bluewhaleusen.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nX-Moz: prefetch\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Sat, 20 Dec 2025 07:01:23 GMT\r\ncontent-type: text/css\r\nvary: Accept-Encoding\r\netag: W/\"1594-1766123972326\"\r\nlast-modified: Fri, 19 Dec 2025 05:59:32 GMT\r\nstrict-transport-security: max-age=31536000\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":1594,"size_decoded":0,"mime_type":"text/css","magic":"ASCII text, with very long lines (1594), with no line terminators","md5":"7bb68d7264949b255c669843ea227988","sha1":"c37129a7f0dbda018bd10436c4812ca558ccca03","sha256":"e1e47844c3390d548f1cd51ea560bf6301ebc6163228d4bf728cfd0a10b5e70d","sha512":"af29987a4411e45d99202eed3f1ebb777ea971e2b4eb617f4232c504c4f83b247c6e6651bb83c7dd153a19306a521a1e4ff6e633c6faf12308f1eb631623f7eb","ssdeep":"","tlshash":"3b31761e3e491d18f833f71f21c24a5e3212a37385b6831a7c43e55afd470c67ab12a6","first_seen":"2024-02-11T04:26:50Z","last_seen":"2026-06-06T14:40:04.368662Z","times_seen":5573,"resource_available":false,"data":null}},"time_used":335,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":335,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2025-12-20","alert":"Phishing Block","trigger":"bluewhaleusen.com","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2025-12-20","alert":"Sinkholed","trigger":"bluewhaleusen.com","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2025-12-20","alert":"Sinkholed","trigger":"bluewhaleusen.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2025-12-20","alert":"Sinkholed","trigger":"bluewhaleusen.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2025-12-20","alert":"Sinkholed","trigger":"bluewhaleusen.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"bluewhaleusen.com/wap/api/banner!bannerList.action?pageNum=1\u0026pageSize=8\u0026type=pc\u0026imgType=0\u0026lang=en","fqdn":"bluewhaleusen.com","domain":"bluewhaleusen.com","tld":"com"},"ip":{"addr":"118.107.9.252","port":443,"asn":152194,"as":"CTG Server Limited","country":"Singapore","country_code":"SG"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"https://bluewhaleusen.com/","date":"2025-12-20T07:01:23.324Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"bluewhaleusen.com","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Fri, 19 Dec 2025 05:22:57 GMT","end":"Thu, 19 Mar 2026 05:22:56 GMT"},"fingerprint":{"sha1":"23:4C:94:04:E1:25:E0:EA:D1:85:17:4C:09:FC:E0:DA:D0:01:E6:62","sha256":"AC:EF:45:40:E0:37:3A:BD:B9:C9:32:F5:6B:B1:B8:92:BE:33:89:43:FA:25:17:17:7C:CA:50:4E:0B:CD:25:EB"}}},"request":{"raw":"POST /wap/api/banner!bannerList.action?pageNum=1\u0026pageSize=8\u0026type=pc\u0026imgType=0\u0026lang=en HTTP/1.1\r\nHost: bluewhaleusen.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/json, text/plain, */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nContent-Type: application/x-www-form-urlencoded\r\nOrigin: https://bluewhaleusen.com\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\nContent-Length: 0\r\n\r\n","headers":null,"cookies":null,"method":"POST"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Sat, 20 Dec 2025 07:01:23 GMT\r\ncontent-type: application/json;charset=UTF-8\r\nvary: Accept-Encoding, Origin, Access-Control-Request-Method, Access-Control-Request-Headers\r\naccess-control-allow-origin: *\r\nstrict-transport-security: max-age=31536000\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":44,"size_decoded":0,"mime_type":"application/json; charset=UTF-8","magic":"JSON text data","md5":"f2982955040e03da061e625bb0bf375c","sha1":"20181528c67d8f347372b93f90d96e7d6c3cfd0b","sha256":"aa16d955b045de5c2728a37653d3f51d5f24f6e43879c0214e7b015079356608","sha512":"503575abcbe6db127825c8225d96bc0142d885aa83f74e8b5558ede44b0668ea953ffe7d3087c4d55b98b8550f776ebce4c989e93d571590ed8aa03789e88bb0","ssdeep":"","tlshash":"b49004403c0d1c17040fd545f44c3540455c315307d4c7300d4c5730415f1753d04570","first_seen":"2024-02-19T23:01:28Z","last_seen":"2026-08-11T08:26:52.955602Z","times_seen":7384,"resource_available":false,"data":null}},"time_used":332,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":332,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2025-12-20","alert":"Sinkholed","trigger":"bluewhaleusen.com","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2025-12-20","alert":"Sinkholed","trigger":"bluewhaleusen.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2025-12-20","alert":"Sinkholed","trigger":"bluewhaleusen.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2025-12-20","alert":"Sinkholed","trigger":"bluewhaleusen.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2025-12-20","alert":"Phishing Block","trigger":"bluewhaleusen.com","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"imgtest1.s3.amazonaws.com/type/2023-03-29/f638f5c6-610e-4035-8a7d-1b49bd18a6ea.jpg","fqdn":"imgtest1.s3.amazonaws.com","domain":"imgtest1.s3.amazonaws.com","tld":"s3.amazonaws.com"},"ip":{"addr":"16.15.207.90","port":443,"asn":14618,"as":"AMAZON-AES","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://bluewhaleusen.com/","date":"2025-12-20T07:01:23.331Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"P256","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.s3.amazonaws.com","organization":""},"issuer":{"commonName":"Amazon RSA 2048 M01","organization":"Amazon"},"validity":{"start":"Fri, 14 Feb 2025 00:00:00 GMT","end":"Sat, 07 Feb 2026 23:59:59 GMT"},"fingerprint":{"sha1":"2E:BA:63:64:95:A8:CE:55:DD:7E:EB:A9:98:83:14:B1:6F:6B:61:69","sha256":"00:D7:0B:CC:1F:82:6B:F6:D9:2E:55:1A:BA:88:38:33:19:09:5B:85:49:41:5E:DA:A1:97:B9:D2:0A:3B:13:52"}}},"request":{"raw":"GET /type/2023-03-29/f638f5c6-610e-4035-8a7d-1b49bd18a6ea.jpg HTTP/1.1\r\nHost: imgtest1.s3.amazonaws.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nx-amz-id-2: o7jsHSNWLYDMbgIeVqVFBYiLl4bCkD0qw6DjC7PtkS7zpAZVhGRrzMyLgl0c4WWcXp3MmW2FI6fAUp2ASI/DiLBdERyCbij6\r\nx-amz-request-id: S19MHNWQRBQ59E53\r\nDate: Sat, 20 Dec 2025 07:01:24 GMT\r\nLast-Modified: Sun, 01 Sep 2024 17:37:19 GMT\r\nETag: \"b367a1a2939abed5721ba1cf5fd272ac\"\r\nx-amz-server-side-encryption: AES256\r\nAccept-Ranges: bytes\r\nContent-Type: image/jpeg\r\nContent-Length: 43151\r\nServer: AmazonS3\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Amazon Web Services","description":"Amazon Web Services (AWS) is a comprehensive cloud services platform offering compute power, database storage, content delivery and other functionality.","website":"https://aws.amazon.com/","common_platform_enumeration":"","icon":"Amazon Web Services.svg","categories":["PaaS"]},{"name":"Amazon S3","description":"Amazon S3 or Amazon Simple Storage Service is a service offered by Amazon Web Services (AWS) that provides object storage through a web service interface.","website":"https://aws.amazon.com/s3/","common_platform_enumeration":"","icon":"Amazon S3.svg","categories":["CDN"]}],"data":{"size":43151,"size_decoded":0,"mime_type":"image/jpeg","magic":"JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, comment: \"CREATOR: gd-jpeg v1.0 (using IJG JPEG v80), quality = 90\", baseline, precision 8, 500x500, components 3","md5":"b367a1a2939abed5721ba1cf5fd272ac","sha1":"14494a7fe1017a29f9fed7421f7d652257490203","sha256":"46d322495677c8a7c5394e265b4ff29491e138ca470aa1ca2d8abf364db9cd21","sha512":"2952940e26d548ef1b5caaff6ed0f6226a5fe3333be792544289621e428353943df8b2c80303329041e0b0308b6fd4961d0805110e5d74bf4bfd3808f3c71117","ssdeep":"768:GAnBvnXpOznCDoX5cNyXgGjFLhpx12yVa6+kZL/4FIpV8xoeKzHMkLFr3:GAnBvZOzCe5cNAgGjFNpb2R+4gixovLF","tlshash":"4b13bf87ad198f936454dbb87f530c396bcc1e1ce8463af910a52ed72f582094caf52a","first_seen":"2023-11-07T02:37:41Z","last_seen":"2026-08-11T08:26:52.953073Z","times_seen":9571,"resource_available":false,"data":null}},"time_used":743,"timings":{"blocked":265,"dns":6,"connect":94,"send":0,"wait":124,"receive":95,"ssl":149},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"bluewhaleusen.com/css/chunk-7c918dfd.8fe95911.css","fqdn":"bluewhaleusen.com","domain":"bluewhaleusen.com","tld":"com"},"ip":{"addr":"118.107.9.252","port":443,"asn":152194,"as":"CTG Server Limited","country":"Singapore","country_code":"SG"},"is_navigation_request":false,"resource_type":"other","requested_by":"https://bluewhaleusen.com/","date":"2025-12-20T07:01:25.309Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"bluewhaleusen.com","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Fri, 19 Dec 2025 05:22:57 GMT","end":"Thu, 19 Mar 2026 05:22:56 GMT"},"fingerprint":{"sha1":"23:4C:94:04:E1:25:E0:EA:D1:85:17:4C:09:FC:E0:DA:D0:01:E6:62","sha256":"AC:EF:45:40:E0:37:3A:BD:B9:C9:32:F5:6B:B1:B8:92:BE:33:89:43:FA:25:17:17:7C:CA:50:4E:0B:CD:25:EB"}}},"request":{"raw":"GET /css/chunk-7c918dfd.8fe95911.css HTTP/1.1\r\nHost: bluewhaleusen.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nX-Moz: prefetch\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Sat, 20 Dec 2025 07:01:25 GMT\r\ncontent-type: text/css\r\nvary: Accept-Encoding\r\netag: W/\"1118-1766123972326\"\r\nlast-modified: Fri, 19 Dec 2025 05:59:32 GMT\r\nstrict-transport-security: max-age=31536000\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":1118,"size_decoded":0,"mime_type":"text/css","magic":"ASCII text, with very long lines (1118), with no line terminators","md5":"51469bb71eb3ad53d091813383d59f9f","sha1":"2dc9da09668fefdab35ccfe6c6a3ec5485ceea3d","sha256":"d9daa1e1faf153cb40d02fe3294adfbf28aeb622797e00cf94c101ccfcf0e073","sha512":"aba105e77a63de395ba92e7d7557d7b7ae209f72dfd735132a2b4d234f8ac75e09d4acbeee7b2cd6e25307285d4d3a4988e9b8b8758761b595c96d20994bfffa","ssdeep":"","tlshash":"d221cef1906510385aabe6b430f0a9b9705df145ea63199c5d6533ad49d378f02e02ce","first_seen":"2024-02-19T23:01:29Z","last_seen":"2026-06-06T14:40:04.435641Z","times_seen":5604,"resource_available":false,"data":null}},"time_used":327,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":327,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2025-12-20","alert":"Sinkholed","trigger":"bluewhaleusen.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2025-12-20","alert":"Phishing Block","trigger":"bluewhaleusen.com","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2025-12-20","alert":"Sinkholed","trigger":"bluewhaleusen.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2025-12-20","alert":"Sinkholed","trigger":"bluewhaleusen.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2025-12-20","alert":"Sinkholed","trigger":"bluewhaleusen.com","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"bluewhaleusen.com/js/chunk-060a6d9e.cf7a5936.js","fqdn":"bluewhaleusen.com","domain":"bluewhaleusen.com","tld":"com"},"ip":{"addr":"118.107.9.252","port":443,"asn":152194,"as":"CTG Server Limited","country":"Singapore","country_code":"SG"},"is_navigation_request":false,"resource_type":"other","requested_by":"https://bluewhaleusen.com/","date":"2025-12-20T07:01:25.988Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"bluewhaleusen.com","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Fri, 19 Dec 2025 05:22:57 GMT","end":"Thu, 19 Mar 2026 05:22:56 GMT"},"fingerprint":{"sha1":"23:4C:94:04:E1:25:E0:EA:D1:85:17:4C:09:FC:E0:DA:D0:01:E6:62","sha256":"AC:EF:45:40:E0:37:3A:BD:B9:C9:32:F5:6B:B1:B8:92:BE:33:89:43:FA:25:17:17:7C:CA:50:4E:0B:CD:25:EB"}}},"request":{"raw":"GET /js/chunk-060a6d9e.cf7a5936.js HTTP/1.1\r\nHost: bluewhaleusen.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nX-Moz: prefetch\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Sat, 20 Dec 2025 07:01:26 GMT\r\ncontent-type: application/javascript\r\nvary: Accept-Encoding\r\netag: W/\"16980-1766123972320\"\r\nlast-modified: Fri, 19 Dec 2025 05:59:32 GMT\r\nstrict-transport-security: max-age=31536000\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":16980,"size_decoded":0,"mime_type":"application/javascript","magic":"JavaScript source, Unicode text, UTF-8 text, with very long lines (16976), with no line terminators","md5":"b88c3084006e9137ddf91c3475dcbeb5","sha1":"76b2fc487b38d5d4ecc04c68bbc022d9a67bb19a","sha256":"11ecf791b47fce02df0d578328172b657ae16615ef25aad3a8a0ec60bc924662","sha512":"7b5237c36f3035864e957f64eea776bce2995b857fd5dcb8e940f4e2191b43dbd670f9fffe922eeb04dd26b64910952f23d863d5cb5ff8ef0524703fc4940bd2","ssdeep":"384:nGcBieJ03vKgXOGBvsFb5Q0ReCw6IJGzg0E5EQfqUUhDBusDJB7WmjX:n7BXG3JXOwD0ReCwPJGzg0wEQfqUUhDP","tlshash":"74721c47d098bc4d9b2b92a2344f30e1b151a52d381654ebf6bd8dfb634cd203a1b779","first_seen":"2025-04-08T11:27:57.673532Z","last_seen":"2026-06-06T14:40:04.30367Z","times_seen":62,"resource_available":false,"data":null}},"time_used":328,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":328,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2025-12-20","alert":"Phishing Block","trigger":"bluewhaleusen.com","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2025-12-20","alert":"Sinkholed","trigger":"bluewhaleusen.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2025-12-20","alert":"Sinkholed","trigger":"bluewhaleusen.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2025-12-20","alert":"Sinkholed","trigger":"bluewhaleusen.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2025-12-20","alert":"Sinkholed","trigger":"bluewhaleusen.com","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"bluewhaleusen.com/js/chunk-17508bb2.6a745edc.js","fqdn":"bluewhaleusen.com","domain":"bluewhaleusen.com","tld":"com"},"ip":{"addr":"118.107.9.252","port":443,"asn":152194,"as":"CTG Server Limited","country":"Singapore","country_code":"SG"},"is_navigation_request":false,"resource_type":"other","requested_by":"https://bluewhaleusen.com/","date":"2025-12-20T07:01:26.262Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"bluewhaleusen.com","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Fri, 19 Dec 2025 05:22:57 GMT","end":"Thu, 19 Mar 2026 05:22:56 GMT"},"fingerprint":{"sha1":"23:4C:94:04:E1:25:E0:EA:D1:85:17:4C:09:FC:E0:DA:D0:01:E6:62","sha256":"AC:EF:45:40:E0:37:3A:BD:B9:C9:32:F5:6B:B1:B8:92:BE:33:89:43:FA:25:17:17:7C:CA:50:4E:0B:CD:25:EB"}}},"request":{"raw":"GET /js/chunk-17508bb2.6a745edc.js HTTP/1.1\r\nHost: bluewhaleusen.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nX-Moz: prefetch\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Sat, 20 Dec 2025 07:01:26 GMT\r\ncontent-type: application/javascript\r\ncontent-length: 828\r\netag: W/\"828-1766123972321\"\r\nlast-modified: Fri, 19 Dec 2025 05:59:32 GMT\r\nstrict-transport-security: max-age=31536000\r\naccept-ranges: bytes\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":828,"size_decoded":0,"mime_type":"application/javascript","magic":"JavaScript source, ASCII text, with very long lines (828), with no line terminators","md5":"cc63af8d654f64e08fcd420dbab2392f","sha1":"283fdf51eb68d372d5781b1894cf1ceb9a4d4646","sha256":"4a555d60677d67f70d34c369fc938f9ed1601a9c90b55ca903617abc26c5bfdc","sha512":"90d5a52ef4cc55039dc03300cdd5afe52b59306d50ac98a31e5d579171d2cfef4c75d086189467abe778d9854a1a5db9ce2fd6836f86c0cbaa7df69d4de59f36","ssdeep":"","tlshash":"3a01af5c79e1f05b090678f4802f95d6612b28bd0deeb813eaf090d41e3086e513ae8c","first_seen":"2025-04-08T11:27:57.661421Z","last_seen":"2026-06-06T14:40:04.506222Z","times_seen":98,"resource_available":false,"data":null}},"time_used":327,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":327,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2025-12-20","alert":"Sinkholed","trigger":"bluewhaleusen.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2025-12-20","alert":"Phishing Block","trigger":"bluewhaleusen.com","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2025-12-20","alert":"Sinkholed","trigger":"bluewhaleusen.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2025-12-20","alert":"Sinkholed","trigger":"bluewhaleusen.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2025-12-20","alert":"Sinkholed","trigger":"bluewhaleusen.com","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"bluewhaleusen.com/js/chunk-5f9dbc55.f745e98b.js","fqdn":"bluewhaleusen.com","domain":"bluewhaleusen.com","tld":"com"},"ip":{"addr":"118.107.9.252","port":443,"asn":152194,"as":"CTG Server Limited","country":"Singapore","country_code":"SG"},"is_navigation_request":false,"resource_type":"other","requested_by":"https://bluewhaleusen.com/","date":"2025-12-20T07:01:26.999Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"bluewhaleusen.com","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Fri, 19 Dec 2025 05:22:57 GMT","end":"Thu, 19 Mar 2026 05:22:56 GMT"},"fingerprint":{"sha1":"23:4C:94:04:E1:25:E0:EA:D1:85:17:4C:09:FC:E0:DA:D0:01:E6:62","sha256":"AC:EF:45:40:E0:37:3A:BD:B9:C9:32:F5:6B:B1:B8:92:BE:33:89:43:FA:25:17:17:7C:CA:50:4E:0B:CD:25:EB"}}},"request":{"raw":"GET /js/chunk-5f9dbc55.f745e98b.js HTTP/1.1\r\nHost: bluewhaleusen.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nX-Moz: prefetch\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Sat, 20 Dec 2025 07:01:27 GMT\r\ncontent-type: application/javascript\r\nvary: Accept-Encoding\r\netag: W/\"3690-1766123972322\"\r\nlast-modified: Fri, 19 Dec 2025 05:59:32 GMT\r\nstrict-transport-security: max-age=31536000\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":3690,"size_decoded":0,"mime_type":"application/javascript","magic":"JavaScript source, Unicode text, UTF-8 text, with very long lines (3686), with no line terminators","md5":"9176aba017e5fbe81d24b18e2da6604b","sha1":"6a0ccb7a2fe025bf5c646d66b3f6b6d2f5d43f35","sha256":"727bb0ecbb4ee487c4d6bdcd0f9c4fe4f15e7c9f0ece2c033997fda7a9239eb5","sha512":"adfd5fb5e1297d7e01c87e619ddb6628d2e8abbbd952f52cf43120603a023e57427698c270b1dc18e9902a873b7d5339b22f310fc403aeb902ad8fb546831684","ssdeep":"","tlshash":"62715546412179ec8bb9155231a96024e1f109d8680dac93edbcdcfa63e483c2b6d3fd","first_seen":"2025-04-08T10:46:39.888305Z","last_seen":"2026-06-06T14:40:04.304787Z","times_seen":153,"resource_available":false,"data":null}},"time_used":327,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":327,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2025-12-20","alert":"Sinkholed","trigger":"bluewhaleusen.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2025-12-20","alert":"Sinkholed","trigger":"bluewhaleusen.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2025-12-20","alert":"Sinkholed","trigger":"bluewhaleusen.com","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2025-12-20","alert":"Sinkholed","trigger":"bluewhaleusen.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2025-12-20","alert":"Phishing Block","trigger":"bluewhaleusen.com","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"mall-test.s3.amazonaws.com/pachong/gaoqing/B083TRDV5R/51n3W0JxmfL._AC_SL1500_.jpg","fqdn":"mall-test.s3.amazonaws.com","domain":"mall-test.s3.amazonaws.com","tld":"s3.amazonaws.com"},"ip":{"addr":"3.5.30.74","port":443,"asn":14618,"as":"AMAZON-AES","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://bluewhaleusen.com/","date":"2025-12-20T07:01:23.467Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_CHACHA20_POLY1305_SHA256","key_group_name":"P256","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"s3.amazonaws.com","organization":""},"issuer":{"commonName":"Amazon RSA 2048 M01","organization":"Amazon"},"validity":{"start":"Fri, 19 Sep 2025 00:00:00 GMT","end":"Sun, 23 Aug 2026 23:59:59 GMT"},"fingerprint":{"sha1":"48:FD:CD:50:85:6A:51:E7:71:E4:CB:E0:03:81:E1:EC:4E:AD:9E:C7","sha256":"D7:11:81:F4:91:03:0D:C6:A5:DE:8A:EF:AA:58:14:BA:AD:33:B5:11:8B:D5:F0:33:53:8B:AF:49:82:E9:4B:A4"}}},"request":{"raw":"GET /pachong/gaoqing/B083TRDV5R/51n3W0JxmfL._AC_SL1500_.jpg HTTP/1.1\r\nHost: mall-test.s3.amazonaws.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nx-amz-id-2: 6XGC3C5avzz95rubQaMbXACtob9F59JPyXNC8HoLBuhtF61y3aNjL8Jvr4TD1ujZsXfrJ34chW5QORIr3pBdBrHqWo1Xb6ex\r\nx-amz-request-id: CRNNRWT6D0V3TKCA\r\nDate: Sat, 20 Dec 2025 07:01:25 GMT\r\nLast-Modified: Tue, 21 May 2024 20:30:08 GMT\r\nETag: \"024f3ba30a6e5258147db3fc66755883\"\r\nx-amz-server-side-encryption: AES256\r\nx-amz-meta-sha256: 25549193484395a6960481470b9eb8284a667b3fa147a766f9e725717aba24f3\r\nx-amz-meta-s3b-last-modified: 20230415T142456Z\r\nAccept-Ranges: bytes\r\nContent-Type: image/jpeg\r\nContent-Length: 60364\r\nServer: AmazonS3\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Amazon S3","description":"Amazon S3 or Amazon Simple Storage Service is a service offered by Amazon Web Services (AWS) that provides object storage through a web service interface.","website":"https://aws.amazon.com/s3/","common_platform_enumeration":"","icon":"Amazon S3.svg","categories":["CDN"]},{"name":"Amazon Web Services","description":"Amazon Web Services (AWS) is a comprehensive cloud services platform offering compute power, database storage, content delivery and other functionality.","website":"https://aws.amazon.com/","common_platform_enumeration":"","icon":"Amazon Web Services.svg","categories":["PaaS"]}],"data":{"size":60364,"size_decoded":0,"mime_type":"image/jpeg","magic":"JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 914x1500, components 3","md5":"024f3ba30a6e5258147db3fc66755883","sha1":"37d404ba13429e44bcba4d4a9a49aba6215e93b9","sha256":"25549193484395a6960481470b9eb8284a667b3fa147a766f9e725717aba24f3","sha512":"b02ed30d00443ac85d31bb467ee41c6efd3d395fd164a84b37ad5d9f4837a2415b2f9d04935d31665231dc776ee72aed285a73d16b0260957b5ef19d3928c905","ssdeep":"768:1R7PirN6neLXjYLRvqhOJdGEN9J+RhC0VRAs7BROG/bQXj9sNNIyMtSp7JN0/hcz:jrQtL4shcdG6JUC0P7rBbUSN6ggY+8","tlshash":"c643f29707a7489ac8f4343a5e12e1d4dd58ee5b259b6fca78f06f4d33060c326b0297","first_seen":"2024-02-19T23:01:28Z","last_seen":"2026-08-09T04:44:19.204556Z","times_seen":7473,"resource_available":false,"data":null}},"time_used":848,"timings":{"blocked":738,"dns":0,"connect":0,"send":0,"wait":108,"receive":2,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"mall-test.s3.amazonaws.com/test/2023-03-28/ba21b1de-1bd6-41cf-993d-cbf59051931d.jpg","fqdn":"mall-test.s3.amazonaws.com","domain":"mall-test.s3.amazonaws.com","tld":"s3.amazonaws.com"},"ip":{"addr":"3.5.30.74","port":443,"asn":14618,"as":"AMAZON-AES","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://bluewhaleusen.com/","date":"2025-12-20T07:01:24.706Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_CHACHA20_POLY1305_SHA256","key_group_name":"P256","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"s3.amazonaws.com","organization":""},"issuer":{"commonName":"Amazon RSA 2048 M01","organization":"Amazon"},"validity":{"start":"Fri, 19 Sep 2025 00:00:00 GMT","end":"Sun, 23 Aug 2026 23:59:59 GMT"},"fingerprint":{"sha1":"48:FD:CD:50:85:6A:51:E7:71:E4:CB:E0:03:81:E1:EC:4E:AD:9E:C7","sha256":"D7:11:81:F4:91:03:0D:C6:A5:DE:8A:EF:AA:58:14:BA:AD:33:B5:11:8B:D5:F0:33:53:8B:AF:49:82:E9:4B:A4"}}},"request":{"raw":"GET /test/2023-03-28/ba21b1de-1bd6-41cf-993d-cbf59051931d.jpg HTTP/1.1\r\nHost: mall-test.s3.amazonaws.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nx-amz-id-2: J1dmOxgOagNDmN7dFmMwgm9cTMWNPhjjSVUhXT+bQwIGktXKuzIdJiMil1Koyv7Ib/zDPie8UlC/bJlHNWckAWtuMdb7Z3rs\r\nx-amz-request-id: CRNNHERXWYFG8SWB\r\nDate: Sat, 20 Dec 2025 07:01:25 GMT\r\nLast-Modified: Wed, 22 May 2024 20:53:12 GMT\r\nETag: \"bb218f576009cd83b9417c5a229c3203\"\r\nx-amz-server-side-encryption: AES256\r\nAccept-Ranges: bytes\r\nContent-Type: image/jpeg\r\nContent-Length: 47710\r\nServer: AmazonS3\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Amazon Web Services","description":"Amazon Web Services (AWS) is a comprehensive cloud services platform offering compute power, database storage, content delivery and other functionality.","website":"https://aws.amazon.com/","common_platform_enumeration":"","icon":"Amazon Web Services.svg","categories":["PaaS"]},{"name":"Amazon S3","description":"Amazon S3 or Amazon Simple Storage Service is a service offered by Amazon Web Services (AWS) that provides object storage through a web service interface.","website":"https://aws.amazon.com/s3/","common_platform_enumeration":"","icon":"Amazon S3.svg","categories":["CDN"]}],"data":{"size":47710,"size_decoded":0,"mime_type":"image/jpeg","magic":"JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 1468x1500, components 3","md5":"bb218f576009cd83b9417c5a229c3203","sha1":"77dff04586788827f80934d71f78f4c88f8356df","sha256":"d0855f819cdc09557f7e383dfbc5e6165e09a50668d15dfd0210949bbdaaa17f","sha512":"7f485bcdf0998dc22d4c9737db92c707975451d3f002fd09c92f23261204700dc22f93182ebb67e07f99d78358027eaf008a78bf02935f590589defab99e918a","ssdeep":"768:1gD/OoEUQEXCRL2xwGC5fTS16JO8Rb5fu5BPqETeaHdQ1DIzwOhLTKh:yEUl+SGGCJTSYJHb4BxTeanxhTa","tlshash":"0923f1d3174348cbff782937b4a153a3677ba5ae219594b3a70078275a423386ec42d7","first_seen":"2024-02-19T23:01:29Z","last_seen":"2026-08-09T04:44:19.256586Z","times_seen":7180,"resource_available":false,"data":null}},"time_used":361,"timings":{"blocked":245,"dns":0,"connect":0,"send":0,"wait":114,"receive":2,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"bluewhaleusen.com/css/chunk-79bc161e.c3acef98.css","fqdn":"bluewhaleusen.com","domain":"bluewhaleusen.com","tld":"com"},"ip":{"addr":"118.107.9.252","port":443,"asn":152194,"as":"CTG Server Limited","country":"Singapore","country_code":"SG"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://bluewhaleusen.com/","date":"2025-12-20T07:01:22.384Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"bluewhaleusen.com","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Fri, 19 Dec 2025 05:22:57 GMT","end":"Thu, 19 Mar 2026 05:22:56 GMT"},"fingerprint":{"sha1":"23:4C:94:04:E1:25:E0:EA:D1:85:17:4C:09:FC:E0:DA:D0:01:E6:62","sha256":"AC:EF:45:40:E0:37:3A:BD:B9:C9:32:F5:6B:B1:B8:92:BE:33:89:43:FA:25:17:17:7C:CA:50:4E:0B:CD:25:EB"}}},"request":{"raw":"GET /css/chunk-79bc161e.c3acef98.css HTTP/1.1\r\nHost: bluewhaleusen.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Sat, 20 Dec 2025 07:01:22 GMT\r\ncontent-type: text/css\r\nvary: Accept-Encoding\r\netag: W/\"6834-1766123972329\"\r\nlast-modified: Fri, 19 Dec 2025 05:59:32 GMT\r\nstrict-transport-security: max-age=31536000\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":6834,"size_decoded":0,"mime_type":"text/css","magic":"ASCII text, with very long lines (6834), with no line terminators","md5":"f7b1de25905c81c373dba149d03c31f9","sha1":"862e37406535632dfb53a15f6a89c16efb3c94df","sha256":"e75dbd8d3fa49fec96c2b893018aed78a616974cb812b015636553d832881751","sha512":"5a2f0034e39196a38ce44b9d9cc46301069bf252b4f092c46db65bcd45a55ed05a6b53bc8241f14a5f5390b530394bcfb0ffea60b21c9262d0b669e07fd1707d","ssdeep":"96:Zsivfdy8lOFD1vq80WV/LPxDmvo6SOwUu50NJj9MC2:Zz33lSD1v30I/LPxDWrhxuuz+","tlshash":"56e10ff2f231112f7426953be18389e8bc86b10dd3ffc656ff84b514daa9182063518e","first_seen":"2024-03-24T18:07:06Z","last_seen":"2026-08-11T08:26:52.961835Z","times_seen":2036,"resource_available":false,"data":null}},"time_used":327,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":327,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2025-12-20","alert":"Sinkholed","trigger":"bluewhaleusen.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2025-12-20","alert":"Phishing Block","trigger":"bluewhaleusen.com","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2025-12-20","alert":"Sinkholed","trigger":"bluewhaleusen.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2025-12-20","alert":"Sinkholed","trigger":"bluewhaleusen.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2025-12-20","alert":"Sinkholed","trigger":"bluewhaleusen.com","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"bluewhaleusen.com/wap/api/syspara!getSyspara.action?code=customer_service_url\u0026lang=en","fqdn":"bluewhaleusen.com","domain":"bluewhaleusen.com","tld":"com"},"ip":{"addr":"118.107.9.252","port":443,"asn":152194,"as":"CTG Server Limited","country":"Singapore","country_code":"SG"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"https://bluewhaleusen.com/","date":"2025-12-20T07:01:22.986Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"bluewhaleusen.com","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Fri, 19 Dec 2025 05:22:57 GMT","end":"Thu, 19 Mar 2026 05:22:56 GMT"},"fingerprint":{"sha1":"23:4C:94:04:E1:25:E0:EA:D1:85:17:4C:09:FC:E0:DA:D0:01:E6:62","sha256":"AC:EF:45:40:E0:37:3A:BD:B9:C9:32:F5:6B:B1:B8:92:BE:33:89:43:FA:25:17:17:7C:CA:50:4E:0B:CD:25:EB"}}},"request":{"raw":"GET /wap/api/syspara!getSyspara.action?code=customer_service_url\u0026lang=en HTTP/1.1\r\nHost: bluewhaleusen.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/json, text/plain, */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Sat, 20 Dec 2025 07:01:23 GMT\r\ncontent-type: application/json;charset=UTF-8\r\nvary: Accept-Encoding, Origin, Access-Control-Request-Method, Access-Control-Request-Headers\r\nstrict-transport-security: max-age=31536000\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":58,"size_decoded":0,"mime_type":"application/json; charset=UTF-8","magic":"JSON text data","md5":"87f201052e0dc6c3b8a4a53b83bf44b5","sha1":"f6b152fa79c655449e9e938e4417a5676a2e06da","sha256":"fb522b0841e80aac3e1cb4fe0f613ae4bfd87fcbe1c03d0137e5c10fbdb86cf4","sha512":"8f854611a22d0fe5ab058bb7ae25c79e995dcc20396f0e64e68aea6662f71cd4144e3378ca1d648d4e3785d96bdb9522864359c14da34c69bbcbceb0bd412777","ssdeep":"","tlshash":"8aa00200146d582b0ca364896c6d39548a5e615348d09f246f99a66440de56d1004429","first_seen":"2023-12-01T19:12:11Z","last_seen":"2026-08-11T08:26:52.926761Z","times_seen":6221,"resource_available":false,"data":null}},"time_used":422,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":422,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2025-12-20","alert":"Sinkholed","trigger":"bluewhaleusen.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2025-12-20","alert":"Sinkholed","trigger":"bluewhaleusen.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2025-12-20","alert":"Sinkholed","trigger":"bluewhaleusen.com","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2025-12-20","alert":"Sinkholed","trigger":"bluewhaleusen.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2025-12-20","alert":"Phishing Block","trigger":"bluewhaleusen.com","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"bluewhaleusen.com/img/right8.5abff5d8.jpeg","fqdn":"bluewhaleusen.com","domain":"bluewhaleusen.com","tld":"com"},"ip":{"addr":"118.107.9.252","port":443,"asn":152194,"as":"CTG Server Limited","country":"Singapore","country_code":"SG"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://bluewhaleusen.com/","date":"2025-12-20T07:01:24.292Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"bluewhaleusen.com","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Fri, 19 Dec 2025 05:22:57 GMT","end":"Thu, 19 Mar 2026 05:22:56 GMT"},"fingerprint":{"sha1":"23:4C:94:04:E1:25:E0:EA:D1:85:17:4C:09:FC:E0:DA:D0:01:E6:62","sha256":"AC:EF:45:40:E0:37:3A:BD:B9:C9:32:F5:6B:B1:B8:92:BE:33:89:43:FA:25:17:17:7C:CA:50:4E:0B:CD:25:EB"}}},"request":{"raw":"GET /img/right8.5abff5d8.jpeg HTTP/1.1\r\nHost: bluewhaleusen.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Sat, 20 Dec 2025 07:01:24 GMT\r\ncontent-type: image/jpeg\r\nvary: Accept-Encoding\r\netag: W/\"4947-1766123972369\"\r\nlast-modified: Fri, 19 Dec 2025 05:59:32 GMT\r\nstrict-transport-security: max-age=31536000\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":4947,"size_decoded":0,"mime_type":"image/jpeg","magic":"JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 242x152, components 3","md5":"5abff5d8ec10911dc3627af31bb816f6","sha1":"78f48e00671ae49cb966becdca71bc72d787958b","sha256":"8a4272a1d4acd3ddbe78a4f4fa3ce3a10b5b2768e06fbee04a70a0597b65eea1","sha512":"7b72c1c7ddf2338a698f0b98ed72712cc83ae066e97339ebe4fa192bc6f60042d07b450547f9945a4b43244622bae0bd4d7b3df1c97686c62c83fa495887e9d1","ssdeep":"96:Wh2/Ha1ZcZNczzMAMmrGxCMpAdWWxzq/SVbFNXJakuuHcPL8z1UlmXexHgvMjH:E2/0ZNMYMpfWZbFNJuu8PYz1LOxHMoH","tlshash":"7aa16dcdbe242d3bef1181b2b946172b1a68093468a8c77d219d3e28691fd710e79c66","first_seen":"2024-02-19T23:01:29Z","last_seen":"2026-08-11T08:26:52.929275Z","times_seen":419,"resource_available":false,"data":null}},"time_used":603,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":603,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2025-12-20","alert":"Sinkholed","trigger":"bluewhaleusen.com","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2025-12-20","alert":"Sinkholed","trigger":"bluewhaleusen.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2025-12-20","alert":"Sinkholed","trigger":"bluewhaleusen.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2025-12-20","alert":"Phishing Block","trigger":"bluewhaleusen.com","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2025-12-20","alert":"Sinkholed","trigger":"bluewhaleusen.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"bluewhaleusen.com/css/chunk-3fe0aac0.bbf1f88d.css","fqdn":"bluewhaleusen.com","domain":"bluewhaleusen.com","tld":"com"},"ip":{"addr":"118.107.9.252","port":443,"asn":152194,"as":"CTG Server Limited","country":"Singapore","country_code":"SG"},"is_navigation_request":false,"resource_type":"other","requested_by":"https://bluewhaleusen.com/","date":"2025-12-20T07:01:24.620Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"bluewhaleusen.com","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Fri, 19 Dec 2025 05:22:57 GMT","end":"Thu, 19 Mar 2026 05:22:56 GMT"},"fingerprint":{"sha1":"23:4C:94:04:E1:25:E0:EA:D1:85:17:4C:09:FC:E0:DA:D0:01:E6:62","sha256":"AC:EF:45:40:E0:37:3A:BD:B9:C9:32:F5:6B:B1:B8:92:BE:33:89:43:FA:25:17:17:7C:CA:50:4E:0B:CD:25:EB"}}},"request":{"raw":"GET /css/chunk-3fe0aac0.bbf1f88d.css HTTP/1.1\r\nHost: bluewhaleusen.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nX-Moz: prefetch\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Sat, 20 Dec 2025 07:01:24 GMT\r\ncontent-type: text/css\r\nvary: Accept-Encoding\r\netag: W/\"2267-1766123972323\"\r\nlast-modified: Fri, 19 Dec 2025 05:59:32 GMT\r\nstrict-transport-security: max-age=31536000\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":2267,"size_decoded":0,"mime_type":"text/css","magic":"ASCII text, with very long lines (2267), with no line terminators","md5":"8c6c2e32d246f43938c015ddcdeb69c0","sha1":"b6c0900796b2f918e95196d1deec6b6bb23de45c","sha256":"2286584045d499c3f6d7e0178051e8cee89b1e36412f7e91b095f677e1b46c73","sha512":"9bb9bf502e8cfe654b271eaa74dfbc90f633cc0ffc25cd2811f89643b603d79584fc1396ad80f23b84cf54beffa20f21ab81a34c3f799d0b7b6cda721418feab","ssdeep":"","tlshash":"5241c0737065617ad9b3e36972419ccc7a81f243e3b352f8fe95e43c89c2aa2193019d","first_seen":"2024-02-11T04:26:49Z","last_seen":"2026-06-06T14:40:04.440992Z","times_seen":6380,"resource_available":false,"data":null}},"time_used":327,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":327,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2025-12-20","alert":"Sinkholed","trigger":"bluewhaleusen.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2025-12-20","alert":"Sinkholed","trigger":"bluewhaleusen.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2025-12-20","alert":"Sinkholed","trigger":"bluewhaleusen.com","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2025-12-20","alert":"Phishing Block","trigger":"bluewhaleusen.com","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2025-12-20","alert":"Sinkholed","trigger":"bluewhaleusen.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"imgtest1.s3.amazonaws.com/test/2023-03-07/c8ec458e-d863-4987-962f-ffcfe4f54175.jpg","fqdn":"imgtest1.s3.amazonaws.com","domain":"imgtest1.s3.amazonaws.com","tld":"s3.amazonaws.com"},"ip":{"addr":"16.15.207.90","port":443,"asn":14618,"as":"AMAZON-AES","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://bluewhaleusen.com/","date":"2025-12-20T07:01:24.715Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"P256","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.s3.amazonaws.com","organization":""},"issuer":{"commonName":"Amazon RSA 2048 M01","organization":"Amazon"},"validity":{"start":"Fri, 14 Feb 2025 00:00:00 GMT","end":"Sat, 07 Feb 2026 23:59:59 GMT"},"fingerprint":{"sha1":"2E:BA:63:64:95:A8:CE:55:DD:7E:EB:A9:98:83:14:B1:6F:6B:61:69","sha256":"00:D7:0B:CC:1F:82:6B:F6:D9:2E:55:1A:BA:88:38:33:19:09:5B:85:49:41:5E:DA:A1:97:B9:D2:0A:3B:13:52"}}},"request":{"raw":"GET /test/2023-03-07/c8ec458e-d863-4987-962f-ffcfe4f54175.jpg HTTP/1.1\r\nHost: imgtest1.s3.amazonaws.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nx-amz-id-2: oKyeTYnS4Tp+POjsVsI47ko4tg1P9UO8f4G46Uu9uBnYnE83OqsrKcXYh++MxzvdEYVvqRG/znIrQNPrcH5mPIfYgvc2ajg9\r\nx-amz-request-id: CRNQGD56VRB0Y6ZG\r\nDate: Sat, 20 Dec 2025 07:01:25 GMT\r\nLast-Modified: Thu, 23 May 2024 01:48:09 GMT\r\nETag: \"f87e7fb1936b7674ce2db3ff1bd51be9\"\r\nx-amz-server-side-encryption: AES256\r\nAccept-Ranges: bytes\r\nContent-Type: image/jpeg\r\nContent-Length: 70050\r\nServer: AmazonS3\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Amazon S3","description":"Amazon S3 or Amazon Simple Storage Service is a service offered by Amazon Web Services (AWS) that provides object storage through a web service interface.","website":"https://aws.amazon.com/s3/","common_platform_enumeration":"","icon":"Amazon S3.svg","categories":["CDN"]},{"name":"Amazon Web Services","description":"Amazon Web Services (AWS) is a comprehensive cloud services platform offering compute power, database storage, content delivery and other functionality.","website":"https://aws.amazon.com/","common_platform_enumeration":"","icon":"Amazon Web Services.svg","categories":["PaaS"]}],"data":{"size":70050,"size_decoded":0,"mime_type":"image/jpeg","magic":"JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 998x1009, components 3","md5":"f87e7fb1936b7674ce2db3ff1bd51be9","sha1":"74046f5896c4ea5701895a0bcad36116deffd811","sha256":"15161b624d29b2f059293432a831953d9dccf18ebf936b3d3c270f12f152a1dc","sha512":"4bf20c3b3d382756dd00487976c63700cabdb9273be6250cec348f8a27604c9fac9a4317cfd7b4225da86e197896aa28ee32b2f53cfb6322ae45a989f2fdf3fa","ssdeep":"1536:xf/qZ8RjuRFR+sLKaSC5PHX+PShIh+jNZZYb:xf/zR8FknaSZSCh+hvG","tlshash":"2e6312c28746312bd3da7733236f4232f0dfa3f6db2248dad208214a52ec6a41d794b5","first_seen":"2024-02-19T23:01:29Z","last_seen":"2026-08-09T04:44:19.216713Z","times_seen":7021,"resource_available":false,"data":null}},"time_used":131,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":129,"receive":2,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"bluewhaleusen.com/css/chunk-758a1bbc.1f2ab8f5.css","fqdn":"bluewhaleusen.com","domain":"bluewhaleusen.com","tld":"com"},"ip":{"addr":"118.107.9.252","port":443,"asn":152194,"as":"CTG Server Limited","country":"Singapore","country_code":"SG"},"is_navigation_request":false,"resource_type":"other","requested_by":"https://bluewhaleusen.com/","date":"2025-12-20T07:01:24.989Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"bluewhaleusen.com","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Fri, 19 Dec 2025 05:22:57 GMT","end":"Thu, 19 Mar 2026 05:22:56 GMT"},"fingerprint":{"sha1":"23:4C:94:04:E1:25:E0:EA:D1:85:17:4C:09:FC:E0:DA:D0:01:E6:62","sha256":"AC:EF:45:40:E0:37:3A:BD:B9:C9:32:F5:6B:B1:B8:92:BE:33:89:43:FA:25:17:17:7C:CA:50:4E:0B:CD:25:EB"}}},"request":{"raw":"GET /css/chunk-758a1bbc.1f2ab8f5.css HTTP/1.1\r\nHost: bluewhaleusen.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nX-Moz: prefetch\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Sat, 20 Dec 2025 07:01:25 GMT\r\ncontent-type: text/css\r\nvary: Accept-Encoding\r\netag: W/\"6183-1766123972325\"\r\nlast-modified: Fri, 19 Dec 2025 05:59:32 GMT\r\nstrict-transport-security: max-age=31536000\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":6183,"size_decoded":0,"mime_type":"text/css","magic":"ASCII text, with very long lines (6183), with no line terminators","md5":"d46ccac8afed41d4fc5c59cdc4df35fe","sha1":"5dd8325163177c847a798e16cc2469681b6ded3a","sha256":"65953a49d49c975458e1b6df9721c7d4487cb8dd24ba0179bf8a0c0803a27bb8","sha512":"02f8980735562cd0cb9f8200963f4c0a614c7d9c2fd1261225add8113efe7bbc968b3c5faccc64418a4a193dfd57eaf18c3134c0895b0ba4362288e0581753ca","ssdeep":"96:V7aBnp0eZAhzD/wFmwxM3Q7BkyJtFoJU6Gfiea2dFyq:VLw+Ifiea2dFR","tlshash":"b6d174132a676520fcbaf01e79647b8e3e5cf643d08606bcf99abe35c4c6873b518141","first_seen":"2024-02-19T23:01:29Z","last_seen":"2026-06-06T14:40:04.524163Z","times_seen":265,"resource_available":false,"data":null}},"time_used":327,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":327,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2025-12-20","alert":"Sinkholed","trigger":"bluewhaleusen.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2025-12-20","alert":"Sinkholed","trigger":"bluewhaleusen.com","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2025-12-20","alert":"Phishing Block","trigger":"bluewhaleusen.com","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2025-12-20","alert":"Sinkholed","trigger":"bluewhaleusen.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2025-12-20","alert":"Sinkholed","trigger":"bluewhaleusen.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"bluewhaleusen.com/js/chunk-3a3912c7.03a92544.js","fqdn":"bluewhaleusen.com","domain":"bluewhaleusen.com","tld":"com"},"ip":{"addr":"118.107.9.252","port":443,"asn":152194,"as":"CTG Server Limited","country":"Singapore","country_code":"SG"},"is_navigation_request":false,"resource_type":"other","requested_by":"https://bluewhaleusen.com/","date":"2025-12-20T07:01:26.953Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"bluewhaleusen.com","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Fri, 19 Dec 2025 05:22:57 GMT","end":"Thu, 19 Mar 2026 05:22:56 GMT"},"fingerprint":{"sha1":"23:4C:94:04:E1:25:E0:EA:D1:85:17:4C:09:FC:E0:DA:D0:01:E6:62","sha256":"AC:EF:45:40:E0:37:3A:BD:B9:C9:32:F5:6B:B1:B8:92:BE:33:89:43:FA:25:17:17:7C:CA:50:4E:0B:CD:25:EB"}}},"request":{"raw":"GET /js/chunk-3a3912c7.03a92544.js HTTP/1.1\r\nHost: bluewhaleusen.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nX-Moz: prefetch\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Sat, 20 Dec 2025 07:01:27 GMT\r\ncontent-type: application/javascript\r\nvary: Accept-Encoding\r\netag: W/\"10213-1766123972304\"\r\nlast-modified: Fri, 19 Dec 2025 05:59:32 GMT\r\nstrict-transport-security: max-age=31536000\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":10213,"size_decoded":0,"mime_type":"application/javascript","magic":"JavaScript source, Unicode text, UTF-8 text, with very long lines (10061), with no line terminators","md5":"7a8dc290452bde6fd47e35490d6d97bb","sha1":"0d2fa734d5402e4481f5080c033888b7f2d7fab2","sha256":"4dc6f918b31c9fb6951bb74e318118f3d61ac3e917509fcd8358a38b7dba7d05","sha512":"1479362816b7b3c9232df4e125238e1aa7ce534d37780d831e3fe2bfd4a39c721776cb72a3296ba15df08db469edd0722dc583ead9f1aa6f837a683626a5c236","ssdeep":"192:XfbfNheZyL9Ks6+F1mW2gK2YG6N28BrFR+2aa2vdozPPfIVYldAN:XfbfNhGyR36212gK2YG6N2GrFR+Y22ze","tlshash":"1e2208c877d0b465565761b2a03f208eb3b719881f0f1c90c264d9e479b1929b37bfac","first_seen":"2025-04-08T10:46:39.849299Z","last_seen":"2026-06-06T14:40:04.415076Z","times_seen":152,"resource_available":false,"data":null}},"time_used":328,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":328,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2025-12-20","alert":"Sinkholed","trigger":"bluewhaleusen.com","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2025-12-20","alert":"Sinkholed","trigger":"bluewhaleusen.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2025-12-20","alert":"Sinkholed","trigger":"bluewhaleusen.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2025-12-20","alert":"Phishing Block","trigger":"bluewhaleusen.com","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2025-12-20","alert":"Sinkholed","trigger":"bluewhaleusen.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"bluewhaleusen.com/js/chunk-c842ca02.5717a26f.js","fqdn":"bluewhaleusen.com","domain":"bluewhaleusen.com","tld":"com"},"ip":{"addr":"118.107.9.252","port":443,"asn":152194,"as":"CTG Server Limited","country":"Singapore","country_code":"SG"},"is_navigation_request":false,"resource_type":"other","requested_by":"https://bluewhaleusen.com/","date":"2025-12-20T07:01:28.032Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"bluewhaleusen.com","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Fri, 19 Dec 2025 05:22:57 GMT","end":"Thu, 19 Mar 2026 05:22:56 GMT"},"fingerprint":{"sha1":"23:4C:94:04:E1:25:E0:EA:D1:85:17:4C:09:FC:E0:DA:D0:01:E6:62","sha256":"AC:EF:45:40:E0:37:3A:BD:B9:C9:32:F5:6B:B1:B8:92:BE:33:89:43:FA:25:17:17:7C:CA:50:4E:0B:CD:25:EB"}}},"request":{"raw":"GET /js/chunk-c842ca02.5717a26f.js HTTP/1.1\r\nHost: bluewhaleusen.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nX-Moz: prefetch\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Sat, 20 Dec 2025 07:01:28 GMT\r\ncontent-type: application/javascript\r\nvary: Accept-Encoding\r\netag: W/\"11287-1766123972322\"\r\nlast-modified: Fri, 19 Dec 2025 05:59:32 GMT\r\nstrict-transport-security: max-age=31536000\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":11287,"size_decoded":0,"mime_type":"application/javascript","magic":"JavaScript source, Unicode text, UTF-8 text, with very long lines (11257), with no line terminators","md5":"5c41f55a31cb3b861cfea3f7e23dc538","sha1":"753f2534faa6318d7a316d5a63676d601151cbbe","sha256":"2d7e17c9f58dad80c145ff80be192c2a347f5da66f5a7a3616180f517a4ffe4b","sha512":"318e4f8ae1778cdba3d4ee951edecf74a30f6b773d4f36bf58e3462da850967f622eb61529494f100863fb6dced8e198f07aa999a273a1efa8266b0cc6ccf93a","ssdeep":"192:jVthRrXBra0UwsE/Vnwk7iw5X6SHEvPXw+s5qtwyO/3aQ5QQY3tO/sC4V/56RXEC:jzXTUws8Vw+ik6YEv/sD/h5Qf3tO/sCn","tlshash":"3c32d68c3991bcc90a17b4f5b06b7456b0868e91540d0941eff488fa7ebbc6b571332b","first_seen":"2025-04-08T11:27:57.652432Z","last_seen":"2026-06-06T14:40:04.442051Z","times_seen":94,"resource_available":false,"data":null}},"time_used":327,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":327,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2025-12-20","alert":"Sinkholed","trigger":"bluewhaleusen.com","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2025-12-20","alert":"Sinkholed","trigger":"bluewhaleusen.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2025-12-20","alert":"Sinkholed","trigger":"bluewhaleusen.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2025-12-20","alert":"Phishing Block","trigger":"bluewhaleusen.com","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2025-12-20","alert":"Sinkholed","trigger":"bluewhaleusen.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"imgtest1.s3.amazonaws.com/type/2023-04-14/fb09769f-95b0-4418-bc5a-8f91952ddf75.png","fqdn":"imgtest1.s3.amazonaws.com","domain":"imgtest1.s3.amazonaws.com","tld":"s3.amazonaws.com"},"ip":{"addr":"16.15.207.90","port":443,"asn":14618,"as":"AMAZON-AES","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://bluewhaleusen.com/","date":"2025-12-20T07:01:23.365Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"P256","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.s3.amazonaws.com","organization":""},"issuer":{"commonName":"Amazon RSA 2048 M01","organization":"Amazon"},"validity":{"start":"Fri, 14 Feb 2025 00:00:00 GMT","end":"Sat, 07 Feb 2026 23:59:59 GMT"},"fingerprint":{"sha1":"2E:BA:63:64:95:A8:CE:55:DD:7E:EB:A9:98:83:14:B1:6F:6B:61:69","sha256":"00:D7:0B:CC:1F:82:6B:F6:D9:2E:55:1A:BA:88:38:33:19:09:5B:85:49:41:5E:DA:A1:97:B9:D2:0A:3B:13:52"}}},"request":{"raw":"GET /type/2023-04-14/fb09769f-95b0-4418-bc5a-8f91952ddf75.png HTTP/1.1\r\nHost: imgtest1.s3.amazonaws.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nx-amz-id-2: iBKv/3eIn4C4LLiHHi6u/5JkqB6qQJuuzg9jTbMa2p2czuYTWYhAgid2vhMLP3GhMq1yF8hMaNPfilKTuaRoDgvweyMIcJ6R\r\nx-amz-request-id: S19HQ4S9563D5XE3\r\nDate: Sat, 20 Dec 2025 07:01:24 GMT\r\nLast-Modified: Thu, 23 May 2024 01:50:35 GMT\r\nETag: \"e1d0a17b2eb5865bccc7dff6330f6562\"\r\nx-amz-server-side-encryption: AES256\r\nAccept-Ranges: bytes\r\nContent-Type: image/png\r\nContent-Length: 147078\r\nServer: AmazonS3\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Amazon Web Services","description":"Amazon Web Services (AWS) is a comprehensive cloud services platform offering compute power, database storage, content delivery and other functionality.","website":"https://aws.amazon.com/","common_platform_enumeration":"","icon":"Amazon Web Services.svg","categories":["PaaS"]},{"name":"Amazon S3","description":"Amazon S3 or Amazon Simple Storage Service is a service offered by Amazon Web Services (AWS) that provides object storage through a web service interface.","website":"https://aws.amazon.com/s3/","common_platform_enumeration":"","icon":"Amazon S3.svg","categories":["CDN"]}],"data":{"size":147078,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 500 x 500, 8-bit/color RGBA, non-interlaced","md5":"e1d0a17b2eb5865bccc7dff6330f6562","sha1":"c956ae8ac7dc2720241d709e92d963ce814550bb","sha256":"9d0495f4e08deab21e64eb8cbe00de00a937aba37d3ff7a3714f30e551f978e0","sha512":"a6c80898e0109f3b6887861ca36e8bcbad9e7091a24eb9d49e55051ebeacbff242ecf0b192cf45d318948b90d660b97dc520cf870d5d651af386a4cec7553456","ssdeep":"3072:0bomG8J7r42I27eo7oPi6T3gKWN4+ogF1Ejq76Cui8MuXK/vDJMKC:0brr425eo6WUgRuC98M7DJMKC","tlshash":"f4e322ddc9c8a380c8003df5fd1699599a347ea34db476461f637adc7b19648ae1bc0c","first_seen":"2024-02-11T04:26:45Z","last_seen":"2026-08-11T08:26:52.923999Z","times_seen":9416,"resource_available":false,"data":null}},"time_used":656,"timings":{"blocked":-1,"dns":1,"connect":99,"send":0,"wait":121,"receive":284,"ssl":147},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"imgtest1.s3.amazonaws.com/type/2023-03-29/d29f0843-33ad-4b3f-8a90-b56fc21b0e77.jpg","fqdn":"imgtest1.s3.amazonaws.com","domain":"imgtest1.s3.amazonaws.com","tld":"s3.amazonaws.com"},"ip":{"addr":"16.15.207.90","port":443,"asn":14618,"as":"AMAZON-AES","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://bluewhaleusen.com/","date":"2025-12-20T07:01:23.385Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"P256","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.s3.amazonaws.com","organization":""},"issuer":{"commonName":"Amazon RSA 2048 M01","organization":"Amazon"},"validity":{"start":"Fri, 14 Feb 2025 00:00:00 GMT","end":"Sat, 07 Feb 2026 23:59:59 GMT"},"fingerprint":{"sha1":"2E:BA:63:64:95:A8:CE:55:DD:7E:EB:A9:98:83:14:B1:6F:6B:61:69","sha256":"00:D7:0B:CC:1F:82:6B:F6:D9:2E:55:1A:BA:88:38:33:19:09:5B:85:49:41:5E:DA:A1:97:B9:D2:0A:3B:13:52"}}},"request":{"raw":"GET /type/2023-03-29/d29f0843-33ad-4b3f-8a90-b56fc21b0e77.jpg HTTP/1.1\r\nHost: imgtest1.s3.amazonaws.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nx-amz-id-2: bh00LD2zWx17laJ6PWUpc6OJecRXUlC4Zgwwr6IyocLDpx+JE0jE/QzaJRO5BD0m+poUUi3W9FctHAsIwqV0kTY8K1eEBESW\r\nx-amz-request-id: S19J08K278V03BAN\r\nDate: Sat, 20 Dec 2025 07:01:24 GMT\r\nLast-Modified: Sun, 01 Sep 2024 17:37:19 GMT\r\nETag: \"6a85f34af56b3c034d5137d4ec807895\"\r\nx-amz-server-side-encryption: AES256\r\nAccept-Ranges: bytes\r\nContent-Type: image/jpeg\r\nContent-Length: 49034\r\nServer: AmazonS3\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Amazon Web Services","description":"Amazon Web Services (AWS) is a comprehensive cloud services platform offering compute power, database storage, content delivery and other functionality.","website":"https://aws.amazon.com/","common_platform_enumeration":"","icon":"Amazon Web Services.svg","categories":["PaaS"]},{"name":"Amazon S3","description":"Amazon S3 or Amazon Simple Storage Service is a service offered by Amazon Web Services (AWS) that provides object storage through a web service interface.","website":"https://aws.amazon.com/s3/","common_platform_enumeration":"","icon":"Amazon S3.svg","categories":["CDN"]}],"data":{"size":49034,"size_decoded":0,"mime_type":"image/jpeg","magic":"JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, comment: \"CREATOR: gd-jpeg v1.0 (using IJG JPEG v80), quality = 90\", baseline, precision 8, 500x500, components 3","md5":"6a85f34af56b3c034d5137d4ec807895","sha1":"75fd4cec7f44e8b8f20655dfdb165720d7223bd6","sha256":"67488643bc9d3ae11bd5cababff694c1f7a131c289d81eb79e25576f78dd4fa8","sha512":"d827fa0cf605ede5b060c72333d4552c1a930b0d8eec8052ba78949ea5e54a58bf0addbef05e024159a196589abbadef866f8c4d5f3c34722ebe1d9757563f9c","ssdeep":"768:G6O88eZQudaEcS6tJCXfvmmxmxwc3ndr/8wP/x49gE3bjt1Txv7ZJ:G6OYAESJCnm2IF3t/8wB49giPdFJ","tlshash":"5523e18725805ee3352fe3f6ff065ae80f088f64d1263edb21e54f98b312a238595428","first_seen":"2023-11-07T02:37:44Z","last_seen":"2026-08-11T08:26:52.949778Z","times_seen":10067,"resource_available":false,"data":null}},"time_used":756,"timings":{"blocked":547,"dns":0,"connect":0,"send":0,"wait":115,"receive":94,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"mall-test.s3.amazonaws.com/test/2023-03-28/50277ee1-dc11-4e3b-948e-f2f37f4858da.jpg","fqdn":"mall-test.s3.amazonaws.com","domain":"mall-test.s3.amazonaws.com","tld":"s3.amazonaws.com"},"ip":{"addr":"3.5.30.74","port":443,"asn":14618,"as":"AMAZON-AES","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://bluewhaleusen.com/","date":"2025-12-20T07:01:23.467Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"P256","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"s3.amazonaws.com","organization":""},"issuer":{"commonName":"Amazon RSA 2048 M01","organization":"Amazon"},"validity":{"start":"Fri, 19 Sep 2025 00:00:00 GMT","end":"Sun, 23 Aug 2026 23:59:59 GMT"},"fingerprint":{"sha1":"48:FD:CD:50:85:6A:51:E7:71:E4:CB:E0:03:81:E1:EC:4E:AD:9E:C7","sha256":"D7:11:81:F4:91:03:0D:C6:A5:DE:8A:EF:AA:58:14:BA:AD:33:B5:11:8B:D5:F0:33:53:8B:AF:49:82:E9:4B:A4"}}},"request":{"raw":"GET /test/2023-03-28/50277ee1-dc11-4e3b-948e-f2f37f4858da.jpg HTTP/1.1\r\nHost: mall-test.s3.amazonaws.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nx-amz-id-2: rej4i+5X/7rvH5dU38wBoKJk0uJYNzajFtb2uilVce3wDEAkXEdlTs5q5vTdyA1NDz3JC5SqA5L5dr+qqxxuumBvCMRKe6vW\r\nx-amz-request-id: S19VXQAA4K7EEY17\r\nDate: Sat, 20 Dec 2025 07:01:24 GMT\r\nLast-Modified: Wed, 22 May 2024 20:49:21 GMT\r\nETag: \"cf0c2ebda19a43267a2348c11f0e9b1a\"\r\nx-amz-server-side-encryption: AES256\r\nAccept-Ranges: bytes\r\nContent-Type: image/jpeg\r\nContent-Length: 104771\r\nServer: AmazonS3\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Amazon S3","description":"Amazon S3 or Amazon Simple Storage Service is a service offered by Amazon Web Services (AWS) that provides object storage through a web service interface.","website":"https://aws.amazon.com/s3/","common_platform_enumeration":"","icon":"Amazon S3.svg","categories":["CDN"]},{"name":"Amazon Web Services","description":"Amazon Web Services (AWS) is a comprehensive cloud services platform offering compute power, database storage, content delivery and other functionality.","website":"https://aws.amazon.com/","common_platform_enumeration":"","icon":"Amazon Web Services.svg","categories":["PaaS"]}],"data":{"size":104771,"size_decoded":0,"mime_type":"image/jpeg","magic":"JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 1500x1166, components 3","md5":"cf0c2ebda19a43267a2348c11f0e9b1a","sha1":"f530278c1954d58bd91d7fd632ec98745670d158","sha256":"f38fad678825212dd76b489f41c44d65f661ffa87f0391f2a1f12823ffa01adb","sha512":"d22c73c72f3979b6d42c25bf33b4dc242900c7923bf2a5fffe6eb262a1c94ec32958594df688404505b92ae99ee8213518bdf76f2a6b4b63c96515899aa48014","ssdeep":"1536:4hPJiIGQfVd8Vw5LuDqpota4IsA1zT05E/igYy8aiPVymyKvgLgwwdmFwXlqfMKi:4hPpVWiLuDqIAkzy8aiPVy0vQ4R","tlshash":"c3a301c3611e5ca3c9381877233286328fb7e7c7c15da49cb458aa29c1e97bd3db9095","first_seen":"2024-02-19T23:01:28Z","last_seen":"2026-08-09T04:44:19.26898Z","times_seen":7032,"resource_available":false,"data":null}},"time_used":647,"timings":{"blocked":428,"dns":0,"connect":0,"send":0,"wait":122,"receive":97,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"mall-test.s3.amazonaws.com/test/2023-03-28/093d9f58-2c6d-425a-b3c9-1898b0aca760.jpg","fqdn":"mall-test.s3.amazonaws.com","domain":"mall-test.s3.amazonaws.com","tld":"s3.amazonaws.com"},"ip":{"addr":"3.5.30.74","port":443,"asn":14618,"as":"AMAZON-AES","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://bluewhaleusen.com/","date":"2025-12-20T07:01:23.606Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_CHACHA20_POLY1305_SHA256","key_group_name":"P256","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"s3.amazonaws.com","organization":""},"issuer":{"commonName":"Amazon RSA 2048 M01","organization":"Amazon"},"validity":{"start":"Fri, 19 Sep 2025 00:00:00 GMT","end":"Sun, 23 Aug 2026 23:59:59 GMT"},"fingerprint":{"sha1":"48:FD:CD:50:85:6A:51:E7:71:E4:CB:E0:03:81:E1:EC:4E:AD:9E:C7","sha256":"D7:11:81:F4:91:03:0D:C6:A5:DE:8A:EF:AA:58:14:BA:AD:33:B5:11:8B:D5:F0:33:53:8B:AF:49:82:E9:4B:A4"}}},"request":{"raw":"GET /test/2023-03-28/093d9f58-2c6d-425a-b3c9-1898b0aca760.jpg HTTP/1.1\r\nHost: mall-test.s3.amazonaws.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nx-amz-id-2: JJyiJAM1TI5+5hXUnpMC8+lBw0GF4pJbJmGBlmG/A64Q/fJNGf7Aa6cUZgAAA9vSkarVA9PyaYkWVqig4stsR1sXEK6IUpJw\r\nx-amz-request-id: CRNH4Q6M4T15Y34A\r\nDate: Sat, 20 Dec 2025 07:01:25 GMT\r\nLast-Modified: Wed, 22 May 2024 20:46:44 GMT\r\nETag: \"cfcc313a94dfb8530acb5ecfe5dc53af\"\r\nx-amz-server-side-encryption: AES256\r\nAccept-Ranges: bytes\r\nContent-Type: image/jpeg\r\nContent-Length: 132447\r\nServer: AmazonS3\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Amazon S3","description":"Amazon S3 or Amazon Simple Storage Service is a service offered by Amazon Web Services (AWS) that provides object storage through a web service interface.","website":"https://aws.amazon.com/s3/","common_platform_enumeration":"","icon":"Amazon S3.svg","categories":["CDN"]},{"name":"Amazon Web Services","description":"Amazon Web Services (AWS) is a comprehensive cloud services platform offering compute power, database storage, content delivery and other functionality.","website":"https://aws.amazon.com/","common_platform_enumeration":"","icon":"Amazon Web Services.svg","categories":["PaaS"]}],"data":{"size":132447,"size_decoded":0,"mime_type":"image/jpeg","magic":"JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 1500x1500, components 3","md5":"cfcc313a94dfb8530acb5ecfe5dc53af","sha1":"4ce68057416501691588568831526f3f621377e1","sha256":"616cefa8fa49014d34e31d96d913620bf5252ad75654db3924f71a05834202c6","sha512":"fc051b5d6e2a87267ee275655fb446499cd4f41eca27a43c7e3666fedcb37364e65086055b0668434a8e8f0c9ca176c4f9570de51dedeb85e37304804be91846","ssdeep":"3072:ErQx7WJnVeTJWMRXz15rKYLbYeZu4G+gqg44O0wZfeN7yC:KQOnVMgeyH+Q4WWfeN7F","tlshash":"28d312c06b111bcbe5c83fb5227a928237e772399493fd323981d26e59d1c78a237d42","first_seen":"2024-03-15T18:45:45Z","last_seen":"2026-08-11T08:26:52.932272Z","times_seen":2396,"resource_available":false,"data":null}},"time_used":599,"timings":{"blocked":482,"dns":0,"connect":0,"send":0,"wait":113,"receive":4,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"bluewhaleusen.com/css/chunk-33a80e61.b6b151df.css","fqdn":"bluewhaleusen.com","domain":"bluewhaleusen.com","tld":"com"},"ip":{"addr":"118.107.9.252","port":443,"asn":152194,"as":"CTG Server Limited","country":"Singapore","country_code":"SG"},"is_navigation_request":false,"resource_type":"other","requested_by":"https://bluewhaleusen.com/","date":"2025-12-20T07:01:24.282Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"bluewhaleusen.com","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Fri, 19 Dec 2025 05:22:57 GMT","end":"Thu, 19 Mar 2026 05:22:56 GMT"},"fingerprint":{"sha1":"23:4C:94:04:E1:25:E0:EA:D1:85:17:4C:09:FC:E0:DA:D0:01:E6:62","sha256":"AC:EF:45:40:E0:37:3A:BD:B9:C9:32:F5:6B:B1:B8:92:BE:33:89:43:FA:25:17:17:7C:CA:50:4E:0B:CD:25:EB"}}},"request":{"raw":"GET /css/chunk-33a80e61.b6b151df.css HTTP/1.1\r\nHost: bluewhaleusen.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nX-Moz: prefetch\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Sat, 20 Dec 2025 07:01:24 GMT\r\ncontent-type: text/css\r\nvary: Accept-Encoding\r\netag: W/\"6025-1766123972324\"\r\nlast-modified: Fri, 19 Dec 2025 05:59:32 GMT\r\nstrict-transport-security: max-age=31536000\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":6025,"size_decoded":0,"mime_type":"text/css","magic":"ASCII text, with very long lines (6025), with no line terminators","md5":"9dbc3890536da05df7626187689522c0","sha1":"41190d802a43a8a1396a981238ad7f907b4a39a7","sha256":"67546016c75035383b17a6d9da587a56dbf6068e1ba53e3cf2c724ee24daf795","sha512":"987a60a2dc3866237901524b293ebb5d95e97f447f3afe8c01dfe27bd93d9ccc9ba38f2cf815f69eca1dbe849973f6f8e706118155c47db3556891b5ff32adfe","ssdeep":"96:VTdRiowyLNQRLCQzpE85mAIJ75iEOOOOOOOOOOOoMSh53zb7DHHnUboUINlSzNDU:VTdoJaQwQzCQIXiDe53zb/UboRyRD5l4","tlshash":"81c1f66920485c354abaf55a98933ec3b007e833c51940e93b41b79dccd7fd66ab83ad","first_seen":"2024-02-19T23:01:30Z","last_seen":"2026-06-06T14:40:04.51612Z","times_seen":177,"resource_available":false,"data":null}},"time_used":327,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":327,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2025-12-20","alert":"Sinkholed","trigger":"bluewhaleusen.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2025-12-20","alert":"Sinkholed","trigger":"bluewhaleusen.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2025-12-20","alert":"Phishing Block","trigger":"bluewhaleusen.com","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2025-12-20","alert":"Sinkholed","trigger":"bluewhaleusen.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2025-12-20","alert":"Sinkholed","trigger":"bluewhaleusen.com","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"bluewhaleusen.com/js/chunk-f0130b90.7688cce6.js","fqdn":"bluewhaleusen.com","domain":"bluewhaleusen.com","tld":"com"},"ip":{"addr":"118.107.9.252","port":443,"asn":152194,"as":"CTG Server Limited","country":"Singapore","country_code":"SG"},"is_navigation_request":false,"resource_type":"other","requested_by":"https://bluewhaleusen.com/","date":"2025-12-20T07:01:28.367Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"bluewhaleusen.com","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Fri, 19 Dec 2025 05:22:57 GMT","end":"Thu, 19 Mar 2026 05:22:56 GMT"},"fingerprint":{"sha1":"23:4C:94:04:E1:25:E0:EA:D1:85:17:4C:09:FC:E0:DA:D0:01:E6:62","sha256":"AC:EF:45:40:E0:37:3A:BD:B9:C9:32:F5:6B:B1:B8:92:BE:33:89:43:FA:25:17:17:7C:CA:50:4E:0B:CD:25:EB"}}},"request":{"raw":"GET /js/chunk-f0130b90.7688cce6.js HTTP/1.1\r\nHost: bluewhaleusen.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nX-Moz: prefetch\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Sat, 20 Dec 2025 07:01:28 GMT\r\ncontent-type: application/javascript\r\nvary: Accept-Encoding\r\netag: W/\"17011-1766123972297\"\r\nlast-modified: Fri, 19 Dec 2025 05:59:32 GMT\r\nstrict-transport-security: max-age=31536000\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":17011,"size_decoded":0,"mime_type":"application/javascript","magic":"JavaScript source, Unicode text, UTF-8 text, with very long lines (16965), with no line terminators","md5":"20c718b5130274faad5b6dfedef63c96","sha1":"d44353cb77d98a98c098b49a9b1c15f0376a1d4a","sha256":"97f0ee74115c7588cd18fda04deef7c89e1facdfb9505dfef981d25634871e55","sha512":"0efd33128bc522156d9c2a5ba4f68f82647a549e0cce7578cb16f5f2cb5987e810cf7893bfe96301a5688a80aacc961959f0a7e4ff2503d98221ec6373f32712","ssdeep":"192:dVthRrXBroFGaEERrSMjye7cAfo8KwRHfnQMsgN8qAV5tQzpV7ocKwRHfnyMs4mP:dzXeM1ERE67HnmqIK7HndqIFs3V","tlshash":"c172e92a50047c9c0e6290ee70273464a09e95105919df5affb8ceedbaced2d261737f","first_seen":"2025-04-08T11:27:57.658084Z","last_seen":"2026-03-24T12:41:05.368514Z","times_seen":56,"resource_available":false,"data":null}},"time_used":328,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":328,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2025-12-20","alert":"Sinkholed","trigger":"bluewhaleusen.com","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2025-12-20","alert":"Sinkholed","trigger":"bluewhaleusen.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2025-12-20","alert":"Sinkholed","trigger":"bluewhaleusen.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2025-12-20","alert":"Sinkholed","trigger":"bluewhaleusen.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2025-12-20","alert":"Phishing Block","trigger":"bluewhaleusen.com","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"bluewhaleusen.com/wap/api/index!download-url.action?lang=en","fqdn":"bluewhaleusen.com","domain":"bluewhaleusen.com","tld":"com"},"ip":{"addr":"118.107.9.252","port":443,"asn":152194,"as":"CTG Server Limited","country":"Singapore","country_code":"SG"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"https://bluewhaleusen.com/","date":"2025-12-20T07:01:22.987Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"bluewhaleusen.com","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Fri, 19 Dec 2025 05:22:57 GMT","end":"Thu, 19 Mar 2026 05:22:56 GMT"},"fingerprint":{"sha1":"23:4C:94:04:E1:25:E0:EA:D1:85:17:4C:09:FC:E0:DA:D0:01:E6:62","sha256":"AC:EF:45:40:E0:37:3A:BD:B9:C9:32:F5:6B:B1:B8:92:BE:33:89:43:FA:25:17:17:7C:CA:50:4E:0B:CD:25:EB"}}},"request":{"raw":"POST /wap/api/index!download-url.action?lang=en HTTP/1.1\r\nHost: bluewhaleusen.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/json, text/plain, */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nContent-Type: application/x-www-form-urlencoded\r\nOrigin: https://bluewhaleusen.com\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\nContent-Length: 0\r\n\r\n","headers":null,"cookies":null,"method":"POST"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Sat, 20 Dec 2025 07:01:23 GMT\r\ncontent-type: application/json;charset=UTF-8\r\nvary: Accept-Encoding, Origin, Access-Control-Request-Method, Access-Control-Request-Headers\r\naccess-control-allow-origin: *\r\nstrict-transport-security: max-age=31536000\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":33,"size_decoded":0,"mime_type":"application/json; charset=UTF-8","magic":"JSON text data","md5":"ee9b70c9443f70379ec2bc27c2ed3e84","sha1":"98f6d951971e74a017b0aeaa15d9645f4b2efb13","sha256":"78519e6fce32195a8ef66068c10588149971771c1ca335b86260786c804f3245","sha512":"162eac4f0326e48dd25c201518b94efad1751cb9b258ca7cb918b760e50c353c3a4fed66c020da9f07b5b1c0e7b298df701e43c64d7bed839df38ce05968c0af","ssdeep":"","tlshash":"5e800000282e2c0b880320c8b88c3a8002ac23a308c0cb200e8cab3080ae2b22000830","first_seen":"2024-09-26T14:29:38Z","last_seen":"2026-08-02T20:19:22.188498Z","times_seen":1924,"resource_available":false,"data":null}},"time_used":421,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":421,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2025-12-20","alert":"Phishing Block","trigger":"bluewhaleusen.com","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2025-12-20","alert":"Sinkholed","trigger":"bluewhaleusen.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2025-12-20","alert":"Sinkholed","trigger":"bluewhaleusen.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2025-12-20","alert":"Sinkholed","trigger":"bluewhaleusen.com","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2025-12-20","alert":"Sinkholed","trigger":"bluewhaleusen.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"shop-shangcheng-shangchuan2.s3.amazonaws.com/type/2024-09-01/8f4c1fa9-df1c-4607-9d6d-992f5b09f703.jpg","fqdn":"shop-shangcheng-shangchuan2.s3.amazonaws.com","domain":"shop-shangcheng-shangchuan2.s3.amazonaws.com","tld":"s3.amazonaws.com"},"ip":{"addr":"3.5.27.242","port":443,"asn":14618,"as":"AMAZON-AES","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://bluewhaleusen.com/","date":"2025-12-20T07:01:23.320Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"P256","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"s3.amazonaws.com","organization":""},"issuer":{"commonName":"Amazon RSA 2048 M01","organization":"Amazon"},"validity":{"start":"Fri, 19 Sep 2025 00:00:00 GMT","end":"Sun, 23 Aug 2026 23:59:59 GMT"},"fingerprint":{"sha1":"48:FD:CD:50:85:6A:51:E7:71:E4:CB:E0:03:81:E1:EC:4E:AD:9E:C7","sha256":"D7:11:81:F4:91:03:0D:C6:A5:DE:8A:EF:AA:58:14:BA:AD:33:B5:11:8B:D5:F0:33:53:8B:AF:49:82:E9:4B:A4"}}},"request":{"raw":"GET /type/2024-09-01/8f4c1fa9-df1c-4607-9d6d-992f5b09f703.jpg HTTP/1.1\r\nHost: shop-shangcheng-shangchuan2.s3.amazonaws.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 403 Forbidden\r\nx-amz-request-id: CRNKVQN6ABADJJJY\r\nx-amz-id-2: KsJgBCO+h3qb0CFdUoLGHw2/pNm0GZZh0b7CGsr3QchLcIsMrF6zhFJ+dbhxKZICHDqcgUlJ0BXcERJYTveI6tNK5a9Z+KXSqDyOJ0Mt+bg=\r\nContent-Type: application/xml\r\nTransfer-Encoding: chunked\r\nDate: Sat, 20 Dec 2025 07:01:24 GMT\r\nServer: AmazonS3\r\n\r\n","headers":null,"cookies":null,"status_code":"403","status_text":"Forbidden","fingerprints":[{"name":"Amazon S3","description":"Amazon S3 or Amazon Simple Storage Service is a service offered by Amazon Web Services (AWS) that provides object storage through a web service interface.","website":"https://aws.amazon.com/s3/","common_platform_enumeration":"","icon":"Amazon S3.svg","categories":["CDN"]},{"name":"Amazon Web Services","description":"Amazon Web Services (AWS) is a comprehensive cloud services platform offering compute power, database storage, content delivery and other functionality.","website":"https://aws.amazon.com/","common_platform_enumeration":"","icon":"Amazon Web Services.svg","categories":["PaaS"]}],"data":{"size":0,"size_decoded":0,"mime_type":"application/xml","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-08-11T16:57:26.648985Z","times_seen":17840002,"resource_available":true,"data":null}},"time_used":1544,"timings":{"blocked":721,"dns":22,"connect":95,"send":0,"wait":101,"receive":1,"ssl":599},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"mall-test.s3.amazonaws.com/pc/gp/B0BBN3YQNK/71JmApgdVAL._AC_SL1500_.jpg","fqdn":"mall-test.s3.amazonaws.com","domain":"mall-test.s3.amazonaws.com","tld":"s3.amazonaws.com"},"ip":{"addr":"3.5.30.74","port":443,"asn":14618,"as":"AMAZON-AES","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://bluewhaleusen.com/","date":"2025-12-20T07:01:23.628Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"P256","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"s3.amazonaws.com","organization":""},"issuer":{"commonName":"Amazon RSA 2048 M01","organization":"Amazon"},"validity":{"start":"Fri, 19 Sep 2025 00:00:00 GMT","end":"Sun, 23 Aug 2026 23:59:59 GMT"},"fingerprint":{"sha1":"48:FD:CD:50:85:6A:51:E7:71:E4:CB:E0:03:81:E1:EC:4E:AD:9E:C7","sha256":"D7:11:81:F4:91:03:0D:C6:A5:DE:8A:EF:AA:58:14:BA:AD:33:B5:11:8B:D5:F0:33:53:8B:AF:49:82:E9:4B:A4"}}},"request":{"raw":"GET /pc/gp/B0BBN3YQNK/71JmApgdVAL._AC_SL1500_.jpg HTTP/1.1\r\nHost: mall-test.s3.amazonaws.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nx-amz-id-2: tXqz8svD9fiHiADkklbhMuSqO89zMZSmaHEdKTYJ2QUXSj30ULWpWrqwQG4hlkhssNvGdlbv1p7G5YtC+/WEMSobnFNIhbsU\r\nx-amz-request-id: CRNN81QJ9K58AYYM\r\nDate: Sat, 20 Dec 2025 07:01:25 GMT\r\nLast-Modified: Wed, 22 May 2024 08:38:38 GMT\r\nETag: \"0f4cce1cc723e9f925010640e9160383\"\r\nx-amz-server-side-encryption: AES256\r\nx-amz-meta-sha256: 9169e20d3f597bd917dcf828b53045e7c31ce2687d137880cdf7aaee623271e5\r\nx-amz-meta-s3b-last-modified: 20230915T060118Z\r\nAccept-Ranges: bytes\r\nContent-Type: image/jpeg\r\nContent-Length: 107843\r\nServer: AmazonS3\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Amazon S3","description":"Amazon S3 or Amazon Simple Storage Service is a service offered by Amazon Web Services (AWS) that provides object storage through a web service interface.","website":"https://aws.amazon.com/s3/","common_platform_enumeration":"","icon":"Amazon S3.svg","categories":["CDN"]},{"name":"Amazon Web Services","description":"Amazon Web Services (AWS) is a comprehensive cloud services platform offering compute power, database storage, content delivery and other functionality.","website":"https://aws.amazon.com/","common_platform_enumeration":"","icon":"Amazon Web Services.svg","categories":["PaaS"]}],"data":{"size":107843,"size_decoded":0,"mime_type":"image/jpeg","magic":"JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 1082x1500, components 3","md5":"0f4cce1cc723e9f925010640e9160383","sha1":"26061d213f8afae16359eae39d295f69758aa915","sha256":"9169e20d3f597bd917dcf828b53045e7c31ce2687d137880cdf7aaee623271e5","sha512":"985da409670855669c845a9f36826cdcf2d6f2762cedfe49f907d6e77fa4e728da769069143411ad59dd98428f8082e391d9c473b50d3efef73adf76c82d1e05","ssdeep":"1536:U2R6KEPTEqfuefyBue/Ja4VCT1AXZyWGOsvv+9TPany3/2pzM1UoR/R0cNRz4mTE:vME5BuqAN4Zlcw/UUx/RRNSmT8rb","tlshash":"53b312f92c292e8bf94ad2fd28f213024245e5b8050f35f84ca45615c6cfebc9f62936","first_seen":"2024-03-15T18:45:45Z","last_seen":"2026-08-11T08:26:52.934455Z","times_seen":2410,"resource_available":false,"data":null}},"time_used":880,"timings":{"blocked":761,"dns":0,"connect":0,"send":0,"wait":116,"receive":3,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"bluewhaleusen.com/css/chunk-708e8450.1837b4a8.css","fqdn":"bluewhaleusen.com","domain":"bluewhaleusen.com","tld":"com"},"ip":{"addr":"118.107.9.252","port":443,"asn":152194,"as":"CTG Server Limited","country":"Singapore","country_code":"SG"},"is_navigation_request":false,"resource_type":"other","requested_by":"https://bluewhaleusen.com/","date":"2025-12-20T07:01:24.983Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"bluewhaleusen.com","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Fri, 19 Dec 2025 05:22:57 GMT","end":"Thu, 19 Mar 2026 05:22:56 GMT"},"fingerprint":{"sha1":"23:4C:94:04:E1:25:E0:EA:D1:85:17:4C:09:FC:E0:DA:D0:01:E6:62","sha256":"AC:EF:45:40:E0:37:3A:BD:B9:C9:32:F5:6B:B1:B8:92:BE:33:89:43:FA:25:17:17:7C:CA:50:4E:0B:CD:25:EB"}}},"request":{"raw":"GET /css/chunk-708e8450.1837b4a8.css HTTP/1.1\r\nHost: bluewhaleusen.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nX-Moz: prefetch\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Sat, 20 Dec 2025 07:01:25 GMT\r\ncontent-type: text/css\r\nvary: Accept-Encoding\r\netag: W/\"21339-1766123972324\"\r\nlast-modified: Fri, 19 Dec 2025 05:59:32 GMT\r\nstrict-transport-security: max-age=31536000\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":21339,"size_decoded":0,"mime_type":"text/css","magic":"ASCII text, with very long lines (21339), with no line terminators","md5":"4999aec05e5d35547b85108739fad5e5","sha1":"543357337951b8dda942cb041d2b0c5d384c375e","sha256":"b5f1bb7367d11a08172a447b50b4bad9304cf13caa87a0b46cf01b78ee4c2e50","sha512":"4dd76776f9e259e22a46f6e05904579ccd709a19dfeeb8822a5cc45e1bcad27149deda542e24d8f2333025b8c7285c4b0cf4676db2b43eeba4b68a53600d20d2","ssdeep":"384:3ZTMfdfzNb6mapzeX/pZ25ZC8CQRDeBzT8lN9lc1gR2iW4YGrSLjhh+P5/e7R0N:6fJNbT2zeX/poFTe2lADtLr+P5/eVy","tlshash":"70a22b70b22d22387837f2691a8155c9b4a4f363d5268396bfdc77168dc36e3bc38256","first_seen":"2024-02-19T23:01:30Z","last_seen":"2026-06-06T14:40:04.388395Z","times_seen":146,"resource_available":false,"data":null}},"time_used":328,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":328,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2025-12-20","alert":"Sinkholed","trigger":"bluewhaleusen.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2025-12-20","alert":"Sinkholed","trigger":"bluewhaleusen.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2025-12-20","alert":"Phishing Block","trigger":"bluewhaleusen.com","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2025-12-20","alert":"Sinkholed","trigger":"bluewhaleusen.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2025-12-20","alert":"Sinkholed","trigger":"bluewhaleusen.com","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"bluewhaleusen.com/js/chunk-058fa281.c1617701.js","fqdn":"bluewhaleusen.com","domain":"bluewhaleusen.com","tld":"com"},"ip":{"addr":"118.107.9.252","port":443,"asn":152194,"as":"CTG Server Limited","country":"Singapore","country_code":"SG"},"is_navigation_request":false,"resource_type":"other","requested_by":"https://bluewhaleusen.com/","date":"2025-12-20T07:01:25.986Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"bluewhaleusen.com","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Fri, 19 Dec 2025 05:22:57 GMT","end":"Thu, 19 Mar 2026 05:22:56 GMT"},"fingerprint":{"sha1":"23:4C:94:04:E1:25:E0:EA:D1:85:17:4C:09:FC:E0:DA:D0:01:E6:62","sha256":"AC:EF:45:40:E0:37:3A:BD:B9:C9:32:F5:6B:B1:B8:92:BE:33:89:43:FA:25:17:17:7C:CA:50:4E:0B:CD:25:EB"}}},"request":{"raw":"GET /js/chunk-058fa281.c1617701.js HTTP/1.1\r\nHost: bluewhaleusen.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nX-Moz: prefetch\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Sat, 20 Dec 2025 07:01:26 GMT\r\ncontent-type: application/javascript\r\nvary: Accept-Encoding\r\netag: W/\"28926-1766123972322\"\r\nlast-modified: Fri, 19 Dec 2025 05:59:32 GMT\r\nstrict-transport-security: max-age=31536000\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":28926,"size_decoded":0,"mime_type":"application/javascript","magic":"JavaScript source, Unicode text, UTF-8 text, with very long lines (28476), with no line terminators","md5":"1c0826de7a913a06ae420440dfdf85d8","sha1":"ce5083431a6b4dbca568f75dc364cee550bb4543","sha256":"78d0ad39e4690232b403e0fbe9149934b43e7b77e5dfd3cd0845aacbb411c603","sha512":"787666cebebdd187ce0286360a7f576f7e05e596595b7cb497a87ac411bf2ac1253ca71177a49c87340ad95e06ba89ff7b7d1e95a25dd9d80dee4e410a26cab0","ssdeep":"384:5Fym4ERqXFcielT32rRv+R1GNw3VrgPnk4d:zym4E1ielT2F2R1GNw3VrqT","tlshash":"41d2c74e71a17c8e130b4261745f2651a22a6125740ea0dbb7bdccfdfa9cd241836ffa","first_seen":"2025-08-14T15:17:48.628014Z","last_seen":"2026-05-27T20:53:28.307131Z","times_seen":13,"resource_available":false,"data":null}},"time_used":328,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":328,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2025-12-20","alert":"Sinkholed","trigger":"bluewhaleusen.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2025-12-20","alert":"Sinkholed","trigger":"bluewhaleusen.com","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2025-12-20","alert":"Sinkholed","trigger":"bluewhaleusen.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2025-12-20","alert":"Phishing Block","trigger":"bluewhaleusen.com","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2025-12-20","alert":"Sinkholed","trigger":"bluewhaleusen.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"bluewhaleusen.com/js/vendors~app.de839525.js","fqdn":"bluewhaleusen.com","domain":"bluewhaleusen.com","tld":"com"},"ip":{"addr":"118.107.9.252","port":443,"asn":152194,"as":"CTG Server Limited","country":"Singapore","country_code":"SG"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://bluewhaleusen.com/","date":"2025-12-20T07:01:19.289Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"bluewhaleusen.com","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Fri, 19 Dec 2025 05:22:57 GMT","end":"Thu, 19 Mar 2026 05:22:56 GMT"},"fingerprint":{"sha1":"23:4C:94:04:E1:25:E0:EA:D1:85:17:4C:09:FC:E0:DA:D0:01:E6:62","sha256":"AC:EF:45:40:E0:37:3A:BD:B9:C9:32:F5:6B:B1:B8:92:BE:33:89:43:FA:25:17:17:7C:CA:50:4E:0B:CD:25:EB"}}},"request":{"raw":"GET /js/vendors~app.de839525.js HTTP/1.1\r\nHost: bluewhaleusen.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Sat, 20 Dec 2025 07:01:19 GMT\r\ncontent-type: application/javascript\r\nvary: Accept-Encoding\r\netag: W/\"3579712-1766123972319\"\r\nlast-modified: Fri, 19 Dec 2025 05:59:32 GMT\r\nstrict-transport-security: max-age=31536000\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":3579712,"size_decoded":0,"mime_type":"application/javascript","magic":"JavaScript source, Unicode text, UTF-8 text, with very long lines (26457)","md5":"7a5edc297ec7708982f091968154f282","sha1":"805500b99fd9d1028cc288afa0f18f4130d4fa22","sha256":"febd75149834dd78869c002fdea9e03acfad28e6126b9f936c18d23ee6c5bde9","sha512":"8f491549adba769b29ccb17a896aecd188db985c37d60aaf5dd78c0c23803ed202ea16c646d5d4d30223b02a1948aa9c89f715900571efe7d2923f1d49cbae63","ssdeep":"6144:lwkguzp5Xgydmac/tDGnij3zp7KeY25LtpHUM2i:qCzp5QydmaOdoijjpEU5p0M2i","tlshash":"ad2548282a5af344e409c0dbea373c84c59de18aa40b64d15f7557b30bb2797ebacd13","first_seen":"2025-08-05T12:35:10.021438Z","last_seen":"2026-08-02T20:19:22.183855Z","times_seen":55,"resource_available":false,"data":null}},"time_used":991,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":991,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2025-12-20","alert":"Sinkholed","trigger":"bluewhaleusen.com","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2025-12-20","alert":"Sinkholed","trigger":"bluewhaleusen.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2025-12-20","alert":"Sinkholed","trigger":"bluewhaleusen.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2025-12-20","alert":"Sinkholed","trigger":"bluewhaleusen.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2025-12-20","alert":"Phishing Block","trigger":"bluewhaleusen.com","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"bluewhaleusen.com/wap/api/sellerGoods!recommend_new.action?type=1\u0026pageSize=24\u0026pageNum=1\u0026lang=en","fqdn":"bluewhaleusen.com","domain":"bluewhaleusen.com","tld":"com"},"ip":{"addr":"118.107.9.252","port":443,"asn":152194,"as":"CTG Server Limited","country":"Singapore","country_code":"SG"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"https://bluewhaleusen.com/","date":"2025-12-20T07:01:22.984Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"bluewhaleusen.com","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Fri, 19 Dec 2025 05:22:57 GMT","end":"Thu, 19 Mar 2026 05:22:56 GMT"},"fingerprint":{"sha1":"23:4C:94:04:E1:25:E0:EA:D1:85:17:4C:09:FC:E0:DA:D0:01:E6:62","sha256":"AC:EF:45:40:E0:37:3A:BD:B9:C9:32:F5:6B:B1:B8:92:BE:33:89:43:FA:25:17:17:7C:CA:50:4E:0B:CD:25:EB"}}},"request":{"raw":"POST /wap/api/sellerGoods!recommend_new.action?type=1\u0026pageSize=24\u0026pageNum=1\u0026lang=en HTTP/1.1\r\nHost: bluewhaleusen.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/json, text/plain, */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nContent-Type: application/x-www-form-urlencoded\r\nOrigin: https://bluewhaleusen.com\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\nContent-Length: 0\r\n\r\n","headers":null,"cookies":null,"method":"POST"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Sat, 20 Dec 2025 07:01:23 GMT\r\ncontent-type: application/json;charset=UTF-8\r\nvary: Accept-Encoding, Origin, Access-Control-Request-Method, Access-Control-Request-Headers\r\naccess-control-allow-origin: *\r\nstrict-transport-security: max-age=31536000\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":153572,"size_decoded":0,"mime_type":"application/json; charset=UTF-8","magic":"JSON text data","md5":"ca42ca850e1b4fa4507d60e606dd77d9","sha1":"c2370547375e29d7af7dcbd1c91872e0a885a7be","sha256":"a293629a403483d3082bb077ae29f786639808d35de4a6d4d1b0888259bce20c","sha512":"d621c885a76a31bb66029438fec72356f3bc916caf2924416732cfe5f0a8e2f8357d8093d4a62efc8dc30379a0cb0339b1170c739d76a8e43ec59794323b89eb","ssdeep":"3072:bOYdnsxPIJewkwXhlTHjzXU4Z/TFyn9Gv/3dZBa+u0dcPZcRaIfldjkC9nVKR:br3hlTDI4W92ZsVYchKtER","tlshash":"eee3d842c398926a1f54019544267beb98fdc1179fb34f98ed2cde34ab98cf6771a08c","first_seen":"2025-12-19T18:50:43.972897Z","last_seen":"2025-12-20T07:02:05.219763Z","times_seen":2,"resource_available":false,"data":null}},"time_used":384,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":384,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2025-12-20","alert":"Sinkholed","trigger":"bluewhaleusen.com","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2025-12-20","alert":"Phishing Block","trigger":"bluewhaleusen.com","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2025-12-20","alert":"Sinkholed","trigger":"bluewhaleusen.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2025-12-20","alert":"Sinkholed","trigger":"bluewhaleusen.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2025-12-20","alert":"Sinkholed","trigger":"bluewhaleusen.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"imgtest1.s3.amazonaws.com/test/2023-03-11/c5a63bc0-28ed-4a64-9e72-b58af5897c43.jpg","fqdn":"imgtest1.s3.amazonaws.com","domain":"imgtest1.s3.amazonaws.com","tld":"s3.amazonaws.com"},"ip":{"addr":"16.15.207.90","port":443,"asn":14618,"as":"AMAZON-AES","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://bluewhaleusen.com/","date":"2025-12-20T07:01:23.454Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"P256","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.s3.amazonaws.com","organization":""},"issuer":{"commonName":"Amazon RSA 2048 M01","organization":"Amazon"},"validity":{"start":"Fri, 14 Feb 2025 00:00:00 GMT","end":"Sat, 07 Feb 2026 23:59:59 GMT"},"fingerprint":{"sha1":"2E:BA:63:64:95:A8:CE:55:DD:7E:EB:A9:98:83:14:B1:6F:6B:61:69","sha256":"00:D7:0B:CC:1F:82:6B:F6:D9:2E:55:1A:BA:88:38:33:19:09:5B:85:49:41:5E:DA:A1:97:B9:D2:0A:3B:13:52"}}},"request":{"raw":"GET /test/2023-03-11/c5a63bc0-28ed-4a64-9e72-b58af5897c43.jpg HTTP/1.1\r\nHost: imgtest1.s3.amazonaws.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nx-amz-id-2: /qfCGr6nA3en9kJmn1pUqmCMwbPeXbTWP7uz8M969UU+zEACvxuB+b1GSkhokUDCdOKfORGL9ahVn3n+VAsIT+jSZfab62GQ\r\nx-amz-request-id: CRNV2FJJ3XCQVBA3\r\nDate: Sat, 20 Dec 2025 07:01:25 GMT\r\nLast-Modified: Thu, 23 May 2024 01:50:10 GMT\r\nETag: \"d85cdd88cbe7726f1f354bedbb0e0705\"\r\nx-amz-server-side-encryption: AES256\r\nAccept-Ranges: bytes\r\nContent-Type: image/jpeg\r\nContent-Length: 113686\r\nServer: AmazonS3\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Amazon S3","description":"Amazon S3 or Amazon Simple Storage Service is a service offered by Amazon Web Services (AWS) that provides object storage through a web service interface.","website":"https://aws.amazon.com/s3/","common_platform_enumeration":"","icon":"Amazon S3.svg","categories":["CDN"]},{"name":"Amazon Web Services","description":"Amazon Web Services (AWS) is a comprehensive cloud services platform offering compute power, database storage, content delivery and other functionality.","website":"https://aws.amazon.com/","common_platform_enumeration":"","icon":"Amazon Web Services.svg","categories":["PaaS"]}],"data":{"size":113686,"size_decoded":0,"mime_type":"image/jpeg","magic":"JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 1258x1333, components 3","md5":"d85cdd88cbe7726f1f354bedbb0e0705","sha1":"99a01bf50cfb668fd087bf30fb597e44f542c8ad","sha256":"0dd206e3bf18b10a0aef408e1f7576894ea0e4b5a37098b3c13df3ca89622975","sha512":"15a88ef4e0751ba42bd64868162e830d7f7b37661438640dd9104ba9589f2595c531d4124d6f0bff37db1b0e44871eb91cc1f28dfd1f27975858bdb5bbb8d92f","ssdeep":"3072:6NE2h6L9TpBzUbO91POsKx/vQzh9wG3+V9BXEJ:6Nitd1PuxnQd9wsQ92J","tlshash":"43b312cadb8f23d1ed8b8179d60146b2735f27ea167863fa0b616d763a352c110cf458","first_seen":"2024-02-19T23:01:28Z","last_seen":"2026-08-09T04:44:19.25899Z","times_seen":7629,"resource_available":false,"data":null}},"time_used":901,"timings":{"blocked":688,"dns":0,"connect":0,"send":0,"wait":117,"receive":96,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"mall-test.s3.amazonaws.com/test/2023-03-28/09f4347f-2277-4985-9f28-668a55470136.jpg","fqdn":"mall-test.s3.amazonaws.com","domain":"mall-test.s3.amazonaws.com","tld":"s3.amazonaws.com"},"ip":{"addr":"3.5.30.74","port":443,"asn":14618,"as":"AMAZON-AES","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://bluewhaleusen.com/","date":"2025-12-20T07:01:23.611Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"P256","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"s3.amazonaws.com","organization":""},"issuer":{"commonName":"Amazon RSA 2048 M01","organization":"Amazon"},"validity":{"start":"Fri, 19 Sep 2025 00:00:00 GMT","end":"Sun, 23 Aug 2026 23:59:59 GMT"},"fingerprint":{"sha1":"48:FD:CD:50:85:6A:51:E7:71:E4:CB:E0:03:81:E1:EC:4E:AD:9E:C7","sha256":"D7:11:81:F4:91:03:0D:C6:A5:DE:8A:EF:AA:58:14:BA:AD:33:B5:11:8B:D5:F0:33:53:8B:AF:49:82:E9:4B:A4"}}},"request":{"raw":"GET /test/2023-03-28/09f4347f-2277-4985-9f28-668a55470136.jpg HTTP/1.1\r\nHost: mall-test.s3.amazonaws.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nx-amz-id-2: lfQONF6NjHNSLYahjVO41zsWebAqVbAJNtLx2QXlt/WvfrbdYWZynFXJNB8VO68bPiiVPM5rMDZMUuyAKKJMoUpXelz7gg01\r\nx-amz-request-id: CRNZECJ9Z9H2M08A\r\nDate: Sat, 20 Dec 2025 07:01:25 GMT\r\nLast-Modified: Wed, 22 May 2024 20:46:46 GMT\r\nETag: \"6c0d8870785f0488d0b7142263a15170\"\r\nx-amz-server-side-encryption: AES256\r\nAccept-Ranges: bytes\r\nContent-Type: image/jpeg\r\nContent-Length: 117525\r\nServer: AmazonS3\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Amazon S3","description":"Amazon S3 or Amazon Simple Storage Service is a service offered by Amazon Web Services (AWS) that provides object storage through a web service interface.","website":"https://aws.amazon.com/s3/","common_platform_enumeration":"","icon":"Amazon S3.svg","categories":["CDN"]},{"name":"Amazon Web Services","description":"Amazon Web Services (AWS) is a comprehensive cloud services platform offering compute power, database storage, content delivery and other functionality.","website":"https://aws.amazon.com/","common_platform_enumeration":"","icon":"Amazon Web Services.svg","categories":["PaaS"]}],"data":{"size":117525,"size_decoded":0,"mime_type":"image/jpeg","magic":"JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 1417x1500, components 3","md5":"6c0d8870785f0488d0b7142263a15170","sha1":"aba57b51e93b5fd1a624f84850eadbaa1c110bad","sha256":"3a90f757acc9d4e5d3088beb21be69f9542bd7e056d6a936d4b920ed7286b665","sha512":"04e4da2f923f15b3c32d6329c9e2f1cbe4ce58f8f09fd03823529da74504d1fedf8317083b1ed370ae9917cb5fade27933d50d4506c1b1e22f373e6d421c7551","ssdeep":"3072:FpBFO7JLZw6p1LoD9WiupE9nfmQXdxt+jm9p033qF:FpBFO7brLoD9WiUEFmELtZp06","tlshash":"f0b312f876a8e373cb7a3e3801d9e95e9c62d16e653ed4524c79144d30100f6c9ce9ae","first_seen":"2024-03-15T18:45:45Z","last_seen":"2026-08-11T08:26:52.987467Z","times_seen":2458,"resource_available":false,"data":null}},"time_used":714,"timings":{"blocked":503,"dns":0,"connect":0,"send":0,"wait":115,"receive":96,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"mall-test.s3.amazonaws.com/test/2023-03-28/38e35767-2052-47cd-8cc7-573464957f89.jpg","fqdn":"mall-test.s3.amazonaws.com","domain":"mall-test.s3.amazonaws.com","tld":"s3.amazonaws.com"},"ip":{"addr":"3.5.30.74","port":443,"asn":14618,"as":"AMAZON-AES","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://bluewhaleusen.com/","date":"2025-12-20T07:01:23.666Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"P256","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"s3.amazonaws.com","organization":""},"issuer":{"commonName":"Amazon RSA 2048 M01","organization":"Amazon"},"validity":{"start":"Fri, 19 Sep 2025 00:00:00 GMT","end":"Sun, 23 Aug 2026 23:59:59 GMT"},"fingerprint":{"sha1":"48:FD:CD:50:85:6A:51:E7:71:E4:CB:E0:03:81:E1:EC:4E:AD:9E:C7","sha256":"D7:11:81:F4:91:03:0D:C6:A5:DE:8A:EF:AA:58:14:BA:AD:33:B5:11:8B:D5:F0:33:53:8B:AF:49:82:E9:4B:A4"}}},"request":{"raw":"GET /test/2023-03-28/38e35767-2052-47cd-8cc7-573464957f89.jpg HTTP/1.1\r\nHost: mall-test.s3.amazonaws.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nx-amz-id-2: zB+rSb4047KY3SgoUKnGuPr+zbXSnknroQzz9BnxTtV/guXm+7t9qCjNAFsancupx4lln0RbjAADIhqx2uzisOR/KuCT7BKh\r\nx-amz-request-id: CRNYH5011B6YRZ7Q\r\nDate: Sat, 20 Dec 2025 07:01:25 GMT\r\nLast-Modified: Wed, 22 May 2024 20:48:30 GMT\r\nETag: \"2e91d081bb998d2dddda0970b892c068\"\r\nx-amz-server-side-encryption: AES256\r\nAccept-Ranges: bytes\r\nContent-Type: image/jpeg\r\nContent-Length: 131190\r\nServer: AmazonS3\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Amazon Web Services","description":"Amazon Web Services (AWS) is a comprehensive cloud services platform offering compute power, database storage, content delivery and other functionality.","website":"https://aws.amazon.com/","common_platform_enumeration":"","icon":"Amazon Web Services.svg","categories":["PaaS"]},{"name":"Amazon S3","description":"Amazon S3 or Amazon Simple Storage Service is a service offered by Amazon Web Services (AWS) that provides object storage through a web service interface.","website":"https://aws.amazon.com/s3/","common_platform_enumeration":"","icon":"Amazon S3.svg","categories":["CDN"]}],"data":{"size":131190,"size_decoded":0,"mime_type":"image/jpeg","magic":"JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 1110x1500, components 3","md5":"2e91d081bb998d2dddda0970b892c068","sha1":"af2243998869e67409f2286640fcaeaee6c70f3b","sha256":"3e4011f81f02eb72f8166c17ffdb60bd2dcb460319f122f87263a28ae7c132d2","sha512":"d974bf72387778c4243d91d1e4f0b7eba43cf7d9daefa2c52ca2dc38f2b463c530654f29fbf5fe239ae51e5ef4a1162e5aec6d917af1a803e62acb2bca3164e4","ssdeep":"3072:nd59GfT6nuj7Nkf062TrHvCFjSYnHL4kjwflZOhhQH8xea:nz9JujHCxr4kj4l4hhQH8xea","tlshash":"0fd31293668555b9e87107fcb8efe87ce11bb8a047dfedd9856008513b88b0f7e49102","first_seen":"2024-02-19T23:01:29Z","last_seen":"2026-08-09T04:44:19.216103Z","times_seen":7146,"resource_available":false,"data":null}},"time_used":1029,"timings":{"blocked":913,"dns":0,"connect":0,"send":0,"wait":112,"receive":4,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"bluewhaleusen.com/css/chunk-3a3912c7.b488a9b3.css","fqdn":"bluewhaleusen.com","domain":"bluewhaleusen.com","tld":"com"},"ip":{"addr":"118.107.9.252","port":443,"asn":152194,"as":"CTG Server Limited","country":"Singapore","country_code":"SG"},"is_navigation_request":false,"resource_type":"other","requested_by":"https://bluewhaleusen.com/","date":"2025-12-20T07:01:24.613Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"bluewhaleusen.com","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Fri, 19 Dec 2025 05:22:57 GMT","end":"Thu, 19 Mar 2026 05:22:56 GMT"},"fingerprint":{"sha1":"23:4C:94:04:E1:25:E0:EA:D1:85:17:4C:09:FC:E0:DA:D0:01:E6:62","sha256":"AC:EF:45:40:E0:37:3A:BD:B9:C9:32:F5:6B:B1:B8:92:BE:33:89:43:FA:25:17:17:7C:CA:50:4E:0B:CD:25:EB"}}},"request":{"raw":"GET /css/chunk-3a3912c7.b488a9b3.css HTTP/1.1\r\nHost: bluewhaleusen.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nX-Moz: prefetch\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Sat, 20 Dec 2025 07:01:24 GMT\r\ncontent-type: text/css\r\ncontent-length: 455\r\netag: W/\"455-1766123972328\"\r\nlast-modified: Fri, 19 Dec 2025 05:59:32 GMT\r\nstrict-transport-security: max-age=31536000\r\naccept-ranges: bytes\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":455,"size_decoded":0,"mime_type":"text/css","magic":"ASCII text, with very long lines (455), with no line terminators","md5":"349139296c5738f2fbacd031343b6bff","sha1":"db2e6346f94985d180c7081db376465748e60841","sha256":"d7ce0fa60daadd138b9d842897feceaba382258f85832df2680ce83f43f0cf4d","sha512":"066cef44f8abb789338e33e9adfa7983344be69f276be860abeac2f458d3993eb3e6180547d19487e037f186631c9477d0cbe3c907371d9facfea31cbbf86fd0","ssdeep":"","tlshash":"ddf05c562b1a61baf8f3c02f20420aeb7117cb4f531bc07957a2e631c947a8b6f71460","first_seen":"2024-02-19T23:01:29Z","last_seen":"2026-06-06T14:40:04.480411Z","times_seen":2110,"resource_available":false,"data":null}},"time_used":328,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":327,"receive":1,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2025-12-20","alert":"Sinkholed","trigger":"bluewhaleusen.com","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2025-12-20","alert":"Sinkholed","trigger":"bluewhaleusen.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2025-12-20","alert":"Sinkholed","trigger":"bluewhaleusen.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2025-12-20","alert":"Phishing Block","trigger":"bluewhaleusen.com","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2025-12-20","alert":"Sinkholed","trigger":"bluewhaleusen.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"mall-test.s3.amazonaws.com/test/2023-03-28/47934c11-34a0-4990-9c8e-834a82f5b701.jpg","fqdn":"mall-test.s3.amazonaws.com","domain":"mall-test.s3.amazonaws.com","tld":"s3.amazonaws.com"},"ip":{"addr":"3.5.30.74","port":443,"asn":14618,"as":"AMAZON-AES","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://bluewhaleusen.com/","date":"2025-12-20T07:01:24.655Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_CHACHA20_POLY1305_SHA256","key_group_name":"P256","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"s3.amazonaws.com","organization":""},"issuer":{"commonName":"Amazon RSA 2048 M01","organization":"Amazon"},"validity":{"start":"Fri, 19 Sep 2025 00:00:00 GMT","end":"Sun, 23 Aug 2026 23:59:59 GMT"},"fingerprint":{"sha1":"48:FD:CD:50:85:6A:51:E7:71:E4:CB:E0:03:81:E1:EC:4E:AD:9E:C7","sha256":"D7:11:81:F4:91:03:0D:C6:A5:DE:8A:EF:AA:58:14:BA:AD:33:B5:11:8B:D5:F0:33:53:8B:AF:49:82:E9:4B:A4"}}},"request":{"raw":"GET /test/2023-03-28/47934c11-34a0-4990-9c8e-834a82f5b701.jpg HTTP/1.1\r\nHost: mall-test.s3.amazonaws.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nx-amz-id-2: 9U8cH7tVKq8NwOxwehLWlj0jnI+KLBr0Xey6/CSCP35myQUogpkTnbWeErkjqAV1bdC/LFqsebqmYAtEe+emRoIn3ubq4L/A\r\nx-amz-request-id: CRNGTDX82ZZ7XA5X\r\nDate: Sat, 20 Dec 2025 07:01:25 GMT\r\nLast-Modified: Wed, 22 May 2024 20:49:02 GMT\r\nETag: \"8c00ff5e70d17f3ad0a9b1b85f0ca0d1\"\r\nx-amz-server-side-encryption: AES256\r\nAccept-Ranges: bytes\r\nContent-Type: image/jpeg\r\nContent-Length: 41631\r\nServer: AmazonS3\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Amazon S3","description":"Amazon S3 or Amazon Simple Storage Service is a service offered by Amazon Web Services (AWS) that provides object storage through a web service interface.","website":"https://aws.amazon.com/s3/","common_platform_enumeration":"","icon":"Amazon S3.svg","categories":["CDN"]},{"name":"Amazon Web Services","description":"Amazon Web Services (AWS) is a comprehensive cloud services platform offering compute power, database storage, content delivery and other functionality.","website":"https://aws.amazon.com/","common_platform_enumeration":"","icon":"Amazon Web Services.svg","categories":["PaaS"]}],"data":{"size":41631,"size_decoded":0,"mime_type":"image/jpeg","magic":"JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 647x1500, components 3","md5":"8c00ff5e70d17f3ad0a9b1b85f0ca0d1","sha1":"821b82e6b725f4a90aa36d51efc1a362e33b53cf","sha256":"41d72946e6b8fde800f2bb6b1ce9f6be2b286f437f1abdd23595a144bd5d1427","sha512":"7bbf0279cc137f96fd2c7a6976af80334de90ceda385bdd26da2215dc52f96f5fee9a68428c5883c7a2bf21755b6c01597c8aa9e40e971de13d550c31027793e","ssdeep":"768:1qE70EERqK41pSmdbAENaZKhNwJ/qdLbSY11ip73BTkEyF06n:770FNGQcbrMZGgCdVip73wB","tlshash":"f813f11b3b62a61ed1dbad36d45b72018ce0fb1b33c1848f6e62346135c6fd40b97695","first_seen":"2024-03-15T18:45:46Z","last_seen":"2026-08-11T08:26:52.951141Z","times_seen":2364,"resource_available":false,"data":null}},"time_used":294,"timings":{"blocked":180,"dns":0,"connect":0,"send":0,"wait":113,"receive":1,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"bluewhaleusen.com/css/chunk-7ad50525.45f75ffc.css","fqdn":"bluewhaleusen.com","domain":"bluewhaleusen.com","tld":"com"},"ip":{"addr":"118.107.9.252","port":443,"asn":152194,"as":"CTG Server Limited","country":"Singapore","country_code":"SG"},"is_navigation_request":false,"resource_type":"other","requested_by":"https://bluewhaleusen.com/","date":"2025-12-20T07:01:25.293Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"bluewhaleusen.com","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Fri, 19 Dec 2025 05:22:57 GMT","end":"Thu, 19 Mar 2026 05:22:56 GMT"},"fingerprint":{"sha1":"23:4C:94:04:E1:25:E0:EA:D1:85:17:4C:09:FC:E0:DA:D0:01:E6:62","sha256":"AC:EF:45:40:E0:37:3A:BD:B9:C9:32:F5:6B:B1:B8:92:BE:33:89:43:FA:25:17:17:7C:CA:50:4E:0B:CD:25:EB"}}},"request":{"raw":"GET /css/chunk-7ad50525.45f75ffc.css HTTP/1.1\r\nHost: bluewhaleusen.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nX-Moz: prefetch\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Sat, 20 Dec 2025 07:01:25 GMT\r\ncontent-type: text/css\r\nvary: Accept-Encoding\r\netag: W/\"4759-1766123972328\"\r\nlast-modified: Fri, 19 Dec 2025 05:59:32 GMT\r\nstrict-transport-security: max-age=31536000\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":4759,"size_decoded":0,"mime_type":"text/css","magic":"ASCII text, with very long lines (4759), with no line terminators","md5":"50b67c1e36297b1843f24dadece451cb","sha1":"aab4395d6d74d3e50d7016a544f7709a601343a2","sha256":"6310619d584f66c72ad89a3e491fcd0100f459bbb6c9d49d92843f464fcf51d5","sha512":"4dfc42a95a7a19d045ca233519f6f1c6fbd5446b344a059b1a5f691e916a5191b0121a7ba61619722cb7989a175982917bdf4e6359cfa4920d9f1e4b3ae2f29b","ssdeep":"96:2oxsUQOwXVcjglPJiA8J+eCkGCaCR4CRjpClCucCOCTpCHC9C3C9CtACbCUCtCcJ:2oxsUQOwXVcjQPJiA80eCkGCaCqCTClX","tlshash":"35a11297311f133d68b7e1571981a86d7878efc2c1322211fc27aa18c8db6977a3724d","first_seen":"2024-02-11T04:26:49Z","last_seen":"2026-06-06T14:40:04.336196Z","times_seen":5412,"resource_available":false,"data":null}},"time_used":327,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":327,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2025-12-20","alert":"Sinkholed","trigger":"bluewhaleusen.com","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2025-12-20","alert":"Sinkholed","trigger":"bluewhaleusen.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2025-12-20","alert":"Sinkholed","trigger":"bluewhaleusen.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2025-12-20","alert":"Phishing Block","trigger":"bluewhaleusen.com","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2025-12-20","alert":"Sinkholed","trigger":"bluewhaleusen.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"bluewhaleusen.com/js/app.cea013d5.js","fqdn":"bluewhaleusen.com","domain":"bluewhaleusen.com","tld":"com"},"ip":{"addr":"118.107.9.252","port":443,"asn":152194,"as":"CTG Server Limited","country":"Singapore","country_code":"SG"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://bluewhaleusen.com/","date":"2025-12-20T07:01:19.285Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"bluewhaleusen.com","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Fri, 19 Dec 2025 05:22:57 GMT","end":"Thu, 19 Mar 2026 05:22:56 GMT"},"fingerprint":{"sha1":"23:4C:94:04:E1:25:E0:EA:D1:85:17:4C:09:FC:E0:DA:D0:01:E6:62","sha256":"AC:EF:45:40:E0:37:3A:BD:B9:C9:32:F5:6B:B1:B8:92:BE:33:89:43:FA:25:17:17:7C:CA:50:4E:0B:CD:25:EB"}}},"request":{"raw":"GET /js/app.cea013d5.js HTTP/1.1\r\nHost: bluewhaleusen.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Sat, 20 Dec 2025 07:01:19 GMT\r\ncontent-type: application/javascript\r\nvary: Accept-Encoding\r\netag: W/\"1442906-1766123972311\"\r\nlast-modified: Fri, 19 Dec 2025 05:59:32 GMT\r\nstrict-transport-security: max-age=31536000\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":1442906,"size_decoded":0,"mime_type":"application/javascript","magic":"JavaScript source, Unicode text, UTF-8 text, with very long lines (64310), with no line terminators","md5":"01e955b2674b25957030b8351e66a35e","sha1":"a3ec01676d0844865318b34c7a62d87cb81ebd19","sha256":"e659f830647f0f82a3725d9340132c8d4d52e7d30870df9a9c1a836fd9a58ba3","sha512":"aef7dc7734127a37a93d997fa2a0a9deb53f02bb977ef2dbe5fa7c7bffac316080e6e81f95a637838195a698cb2471abe85687753969551e744c09080cd6c516","ssdeep":"24576:LOEWKY8JhuWMU9Tra99S3/cPiCDPitLz29HxNUCOE3Nkxp5R+4t69uE9s1B9Lfb3:LOXKY8JhuWMU9d0PZatm9Hb59dWf+837","tlshash":"ac655b7b96c357ac0ef132d1244633e03199489afbeafdef42f8f11421faa419119e65","first_seen":"2025-12-20T07:02:05.225095Z","last_seen":"2025-12-20T07:02:05.225095Z","times_seen":1,"resource_available":false,"data":null}},"time_used":991,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":991,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2025-12-20","alert":"Sinkholed","trigger":"bluewhaleusen.com","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2025-12-20","alert":"Sinkholed","trigger":"bluewhaleusen.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2025-12-20","alert":"Phishing Block","trigger":"bluewhaleusen.com","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2025-12-20","alert":"Sinkholed","trigger":"bluewhaleusen.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2025-12-20","alert":"Sinkholed","trigger":"bluewhaleusen.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"mall-test.s3.amazonaws.com/test/2023-03-28/a7892ec6-7c9a-4017-92d9-5d88ec058706.jpg","fqdn":"mall-test.s3.amazonaws.com","domain":"mall-test.s3.amazonaws.com","tld":"s3.amazonaws.com"},"ip":{"addr":"3.5.30.74","port":443,"asn":14618,"as":"AMAZON-AES","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://bluewhaleusen.com/","date":"2025-12-20T07:01:23.465Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"P256","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"s3.amazonaws.com","organization":""},"issuer":{"commonName":"Amazon RSA 2048 M01","organization":"Amazon"},"validity":{"start":"Fri, 19 Sep 2025 00:00:00 GMT","end":"Sun, 23 Aug 2026 23:59:59 GMT"},"fingerprint":{"sha1":"48:FD:CD:50:85:6A:51:E7:71:E4:CB:E0:03:81:E1:EC:4E:AD:9E:C7","sha256":"D7:11:81:F4:91:03:0D:C6:A5:DE:8A:EF:AA:58:14:BA:AD:33:B5:11:8B:D5:F0:33:53:8B:AF:49:82:E9:4B:A4"}}},"request":{"raw":"GET /test/2023-03-28/a7892ec6-7c9a-4017-92d9-5d88ec058706.jpg HTTP/1.1\r\nHost: mall-test.s3.amazonaws.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nx-amz-id-2: FfEBXTAxHkwl0XpuI8iVvGNO8M8idZ/7CyjM0SL03ZcGgUKrWcR0QH2vLPs0EvFdJ6figlLxAKLDohGJnzZeKhyVZm+U13UU\r\nx-amz-request-id: S19GPF5XV23GPBAB\r\nDate: Sat, 20 Dec 2025 07:01:24 GMT\r\nLast-Modified: Wed, 22 May 2024 20:52:31 GMT\r\nETag: \"4733341abffafac1a80a87d73b929a0e\"\r\nx-amz-server-side-encryption: AES256\r\nAccept-Ranges: bytes\r\nContent-Type: image/jpeg\r\nContent-Length: 46462\r\nServer: AmazonS3\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Amazon S3","description":"Amazon S3 or Amazon Simple Storage Service is a service offered by Amazon Web Services (AWS) that provides object storage through a web service interface.","website":"https://aws.amazon.com/s3/","common_platform_enumeration":"","icon":"Amazon S3.svg","categories":["CDN"]},{"name":"Amazon Web Services","description":"Amazon Web Services (AWS) is a comprehensive cloud services platform offering compute power, database storage, content delivery and other functionality.","website":"https://aws.amazon.com/","common_platform_enumeration":"","icon":"Amazon Web Services.svg","categories":["PaaS"]}],"data":{"size":46462,"size_decoded":0,"mime_type":"image/jpeg","magic":"JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 1500x816, components 3","md5":"4733341abffafac1a80a87d73b929a0e","sha1":"2ed57cdd64866e32ea7315eab53f957943fe7535","sha256":"488b95a8657fe774d74f2c2b03f858888868a277580ae75cd4c45796bccd447c","sha512":"e1db1ff22f5f486ba861cbf7e2e6cd4c701fb2610f9049bae3e4112f7e359d8073e7ada5c955122817689e00b314a5bbd465b325c264c277ce73c2ee61a67c48","ssdeep":"768:1Z94x5KIpQt3/N64yyRimzuVWddwpQairYmoxTWHoJvtBy9ZsdVj9hLvRH/pVexD:n943DuRLyWisu75iRYTLRQsdVj/LJH/G","tlshash":"032301f73328b9a2cbda05741372f6a03265f93716fcb6024450fa70b16c552f598b6e","first_seen":"2024-02-19T23:01:28Z","last_seen":"2026-08-09T04:44:19.251616Z","times_seen":7576,"resource_available":false,"data":null}},"time_used":631,"timings":{"blocked":426,"dns":0,"connect":0,"send":0,"wait":115,"receive":90,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"mall-test.s3.amazonaws.com/test/2023-03-28/0289f107-7fb4-4016-bf41-00405c76db55.jpg","fqdn":"mall-test.s3.amazonaws.com","domain":"mall-test.s3.amazonaws.com","tld":"s3.amazonaws.com"},"ip":{"addr":"3.5.30.74","port":443,"asn":14618,"as":"AMAZON-AES","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://bluewhaleusen.com/","date":"2025-12-20T07:01:24.723Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"P256","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"s3.amazonaws.com","organization":""},"issuer":{"commonName":"Amazon RSA 2048 M01","organization":"Amazon"},"validity":{"start":"Fri, 19 Sep 2025 00:00:00 GMT","end":"Sun, 23 Aug 2026 23:59:59 GMT"},"fingerprint":{"sha1":"48:FD:CD:50:85:6A:51:E7:71:E4:CB:E0:03:81:E1:EC:4E:AD:9E:C7","sha256":"D7:11:81:F4:91:03:0D:C6:A5:DE:8A:EF:AA:58:14:BA:AD:33:B5:11:8B:D5:F0:33:53:8B:AF:49:82:E9:4B:A4"}}},"request":{"raw":"GET /test/2023-03-28/0289f107-7fb4-4016-bf41-00405c76db55.jpg HTTP/1.1\r\nHost: mall-test.s3.amazonaws.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nx-amz-id-2: dI6FN5GKvb5XV99WTR/Zo7V6PM1OzsMJ5yIhlM6M78E6S1H2mdkVoy4jrnpyJzLar01N20Ht3J6dN9DsFul7aKOuRgVebkxl\r\nx-amz-request-id: CRNKJXTBNJ0Y2PKB\r\nDate: Sat, 20 Dec 2025 07:01:25 GMT\r\nLast-Modified: Wed, 22 May 2024 20:46:29 GMT\r\nETag: \"5121c6c654da43d16cb203d4103181c2\"\r\nx-amz-server-side-encryption: AES256\r\nAccept-Ranges: bytes\r\nContent-Type: image/jpeg\r\nContent-Length: 118530\r\nServer: AmazonS3\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Amazon S3","description":"Amazon S3 or Amazon Simple Storage Service is a service offered by Amazon Web Services (AWS) that provides object storage through a web service interface.","website":"https://aws.amazon.com/s3/","common_platform_enumeration":"","icon":"Amazon S3.svg","categories":["CDN"]},{"name":"Amazon Web Services","description":"Amazon Web Services (AWS) is a comprehensive cloud services platform offering compute power, database storage, content delivery and other functionality.","website":"https://aws.amazon.com/","common_platform_enumeration":"","icon":"Amazon Web Services.svg","categories":["PaaS"]}],"data":{"size":118530,"size_decoded":0,"mime_type":"image/jpeg","magic":"JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, baseline, precision 8, 1000x1000, components 3","md5":"5121c6c654da43d16cb203d4103181c2","sha1":"c7ed8e39d4ca57488ff21a40bfc82b068ec54604","sha256":"daf812c394f5200d1785c3f11f06f0ad0b804f44d0dfa5ff22ee173a7876af30","sha512":"f5e5f1138d0fdbf2cec1e2d24cd2db0d7803c6b0ab705f0a6eef97bfd982265aa7539f93849fdb78dd9204b147cb48f39bb9a27f1dd362afc5486d4869080542","ssdeep":"3072:ftP8FyN5Ff0bW6B7+Xzvjb/8sT1sjySOBS4:ft5Bp69A7z8sTKjFOA4","tlshash":"10c39d139906db97a41d86e4be071da82f076319e8c67dee11620e8f3e257339dde02d","first_seen":"2024-02-19T23:01:29Z","last_seen":"2026-08-09T04:44:19.210291Z","times_seen":6966,"resource_available":false,"data":null}},"time_used":356,"timings":{"blocked":232,"dns":0,"connect":0,"send":0,"wait":121,"receive":3,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"bluewhaleusen.com/js/chunk-39678b28.46184998.js","fqdn":"bluewhaleusen.com","domain":"bluewhaleusen.com","tld":"com"},"ip":{"addr":"118.107.9.252","port":443,"asn":152194,"as":"CTG Server Limited","country":"Singapore","country_code":"SG"},"is_navigation_request":false,"resource_type":"other","requested_by":"https://bluewhaleusen.com/","date":"2025-12-20T07:01:26.927Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"bluewhaleusen.com","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Fri, 19 Dec 2025 05:22:57 GMT","end":"Thu, 19 Mar 2026 05:22:56 GMT"},"fingerprint":{"sha1":"23:4C:94:04:E1:25:E0:EA:D1:85:17:4C:09:FC:E0:DA:D0:01:E6:62","sha256":"AC:EF:45:40:E0:37:3A:BD:B9:C9:32:F5:6B:B1:B8:92:BE:33:89:43:FA:25:17:17:7C:CA:50:4E:0B:CD:25:EB"}}},"request":{"raw":"GET /js/chunk-39678b28.46184998.js HTTP/1.1\r\nHost: bluewhaleusen.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nX-Moz: prefetch\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Sat, 20 Dec 2025 07:01:27 GMT\r\ncontent-type: application/javascript\r\nvary: Accept-Encoding\r\netag: W/\"31884-1766123972323\"\r\nlast-modified: Fri, 19 Dec 2025 05:59:32 GMT\r\nstrict-transport-security: max-age=31536000\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":31884,"size_decoded":0,"mime_type":"application/javascript","magic":"JavaScript source, ASCII text, with very long lines (31884), with no line terminators","md5":"6f4bdf05287217e920c92a137e4d38ea","sha1":"4851f1bc3e24af4225e160151595128de6428913","sha256":"738530c82e61b289fc62f0c776df18497e451c080c5468a0c2ae9aecabdf36d0","sha512":"761c2e73b285d1887904f45263657bf54aa9a5864ee0e75ae33a63fc5689dd3d96364a9e7d16b29d817a836dbca0a12262315812b34171d9a7a37d847ac80957","ssdeep":"768:wCCLcjhBoecMY0hL4fFcNLL5guKNUA0Zy+2:wCqMicNgNUpy5","tlshash":"f1e23a5f50a46da8c94e2152302622b97471abd5f00a48c9b7bccefd51c9eb4232f77d","first_seen":"2025-04-08T11:27:57.700531Z","last_seen":"2026-06-06T14:40:04.322499Z","times_seen":60,"resource_available":false,"data":null}},"time_used":330,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":330,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2025-12-20","alert":"Sinkholed","trigger":"bluewhaleusen.com","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2025-12-20","alert":"Sinkholed","trigger":"bluewhaleusen.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2025-12-20","alert":"Phishing Block","trigger":"bluewhaleusen.com","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2025-12-20","alert":"Sinkholed","trigger":"bluewhaleusen.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2025-12-20","alert":"Sinkholed","trigger":"bluewhaleusen.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}}]}