{"report_id":"51a807f9-314c-4e5b-9419-367cb52f693a","version":6,"status":"done","tags":[],"date":"2025-11-14T09:13:36Z","url":{"schema":"https","addr":"gentle-george.xyz/.wp-uiopp/pir/pankki/auth-login/login.php","fqdn":"gentle-george.xyz","domain":"gentle-george.xyz","tld":"xyz"},"ip":{"addr":"216.117.151.161","port":0,"asn":10843,"as":"AITNET","country":"United States","country_code":"US"},"final":{"url":{"schema":"https","addr":"gentle-george.xyz/.wp-uiopp/pir/pankki/auth-login/login.php","fqdn":"gentle-george.xyz","domain":"gentle-george.xyz","tld":"xyz"},"title":"Kirjaudu Verkkopankkiin","dom":{"size":17597,"mime_type":"text/html; charset=utf-8","magic":"HTML document, Unicode text, UTF-8 text, with very long lines (330)","md5":"3ca36a8bed368965eb96574dde640b40","sha1":"c79dbfdb688e16887249b1a3d4ce4cd3c480eeb9","sha256":"79be52fc5b6a8d8ab1dbdeb02595688490bfdc7b710fd074f262b4c3f5751c43","sha512":"4c44a1e5fcd31bda4cae978aed736efc3f2c31bf4feaaefcd4e8b8b3c4ba5145b9dc6674e580c1f17fc1fed3a4d92f277ade47d574cede96a100b39acf48f7df","ssdeep":"192:U8k8OjAhtE7mEtLTeyL3sSOpFpB4OtzS4/JTDjevZdfL4Q4JOMl0Ye5wMDMGpM0o:U8k8+Kg9tLnsSOfpBJ9oT41FhDNFb","tlshash":"2f82c519b1b2cab67c63193c27edb2057726a057ca2dcde5bdcd1221dfc13b499c2628","dom_hash":"domhash18ec53b31fa06dec34d35f8a975d5bcb","first_seen":"2025-11-13T18:23:19.92643Z","last_seen":"2025-12-08T03:42:17.494621Z","times_seen":6,"resource_available":false,"data":null}},"submit":{"url":{"schema":"https","addr":"gentle-george.xyz/.wp-uiopp/pir/pankki/auth-login/login.php","fqdn":"gentle-george.xyz","domain":"gentle-george.xyz","tld":"xyz"},"ip":{"addr":"216.117.151.161","port":0,"asn":10843,"as":"AITNET","country":"United States","country_code":"US"},"tags":["openphish"],"meta":null,"user":{"country_code":"zz"}},"settings":{"access":"public","device_type":"desktop","expires_at":"2026-12-19T09:13:36Z","useragent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0","referer":"","cookies":null,"exit_node":"z0yflva4pidy47h"},"stats":{"alert_count":{"ids":0,"urlquery":0,"analyzer":7}},"detection":{"ids":null,"analyzer":[{"sensor_name":"openphish","sensor_type":"Blocklist","title":"OpenPhish","description":"OpenPhish","scan_date":"2025-11-14","alert":"Phishing - Danske Bank A/S","trigger":"gentle-george.xyz","verdict":"phishing","severity":"medium","comment":"Danske Bank A/S","link":"https://openphish.com/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2025-11-14","alert":"Sinkholed","trigger":"gentle-george.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2025-11-14","alert":"Sinkholed","trigger":"gentle-george.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-11-14","alert":"Sinkholed","trigger":"gentle-george.xyz","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2025-11-14","alert":"Phishing Block","trigger":"gentle-george.xyz","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"cira_dns","sensor_type":"DNS","title":"CIRA Canadian Shield DNS","description":"CIRA Canadian Shield DNS","scan_date":"2025-11-14","alert":"Sinkholed","trigger":"gentle-george.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cira.ca/en/canadian-shield/","meta":null},{"sensor_name":"openphish","sensor_type":"url","title":"OpenPhish","description":"OpenPhish","scan_date":"2025-11-14","alert":"Phishing - Danske Bank A/S","trigger":"gentle-george.xyz/.wp-uiopp/pir/pankki/auth-login/login.php","verdict":"phishing","severity":"medium","comment":"Danske Bank A/S","link":"https://openphish.com","meta":null}],"urlquery":null},"summary":[{"fqdn":"cdn.jsdelivr.net","ip":{"addr":"151.101.129.229","port":443,"asn":54113,"as":"FASTLY","country":"United States","country_code":"US"},"domain_registered":"2012-05-16","domain_rank":1678,"first_seen":"2012-09-30T00:15:09Z","last_seen":"2025-11-09T22:18:23.201927Z","alert_count":0,"request_count":1,"received_data":262710,"sent_data":433,"comment":"","tags":null,"fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}]},{"fqdn":"gentle-george.xyz","ip":{"addr":"216.117.151.161","port":443,"asn":10843,"as":"AITNET","country":"United States","country_code":"US"},"domain_registered":"2024-09-17","domain_rank":0,"first_seen":"2025-10-15T14:49:25.992986Z","last_seen":"2025-11-13T18:23:18.80165Z","alert_count":18,"request_count":3,"received_data":49521,"sent_data":1611,"comment":"","tags":null,"fingerprints":[{"name":"Apache HTTP Server","description":"Apache is a free and open-source cross-platform web server software.","website":"https://httpd.apache.org/","common_platform_enumeration":"cpe:2.3:a:apache:http_server:*:*:*:*:*:*:*:*","icon":"Apache.svg","categories":["Web servers"]},{"name":"jsDelivr","description":"JSDelivr is a free public CDN for open-source projects. It can serve web files directly from the npm registry and GitHub repositories without any configuration.","website":"https://www.jsdelivr.com/","common_platform_enumeration":"","icon":"jsdelivr-icon.svg","categories":["CDN"]}]}],"files":null,"artifacts":{"windows_shortcuts":null,"files":null,"telegram":null,"pdfs":null,"clipboard":null},"sensors":{"ids":[{"sensor_name":"suricata","description":"Suricata /w Emerging Threats Pro","alerts":null}],"analyzer":null,"urlquery":null},"javascript":{"script":[{"url":{"schema":"https","addr":"cdn.jsdelivr.net/npm/@tailwindcss/browser@4","fqdn":"cdn.jsdelivr.net","domain":"jsdelivr.net","tld":"net"},"ip":{"addr":"151.101.129.229","port":443,"asn":54113,"as":"FASTLY","country":"United States","country_code":"US"},"introduction_type":"scriptElement","is_inline":false,"md5":"73e36ad6b4577018fa97e50182a89f54","sha1":"aad21c570310cafac244e1db7d14eb9e3c5004f6","sha256":"fe198132cae0c5bc70d34b066726571d905ab97262831934164a7b95d891f6fe","sha512":"5858fc52c2b1b8dec283a7131532c997cfcc2164bde9cca4b4e090f5be647981c3fdb8601c05c699b05a6fbee141d0e400932d129a667d9d98cb72e97fff97b0","ssdeep":"3072:V270V4lZYnKl/LBucygyJKwod0PEzsauR+k0iLNccTo98wMip6oep0EuzT4ZVw70:0wWxj4TXstENUAy2Uuz","tlshash":"11442b317603a03e1fb783da20de6004d63e6b65a65841e9f782d50b15e5af80af7f39","size":261935,"data":"","first_seen":"2025-11-07T05:55:20.050285Z","last_seen":"2026-07-09T21:00:15.019557Z","times_seen":152,"alerts":{"ids":null,"analyzer":null,"urlquery":null}}],"eval":null,"write":null,"console":null},"http":[{"url":{"schema":"https","addr":"cdn.jsdelivr.net/npm/@tailwindcss/browser@4","fqdn":"cdn.jsdelivr.net","domain":"jsdelivr.net","tld":"net"},"ip":{"addr":"151.101.129.229","port":443,"asn":54113,"as":"FASTLY","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://gentle-george.xyz/.wp-uiopp/pir/pankki/auth-login/login.php","date":"2025-11-14T09:13:15.339Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"jsdelivr.net","organization":""},"issuer":{"commonName":"GlobalSign Atlas R3 DV TLS CA 2025 Q2","organization":"GlobalSign nv-sa"},"validity":{"start":"Mon, 02 Jun 2025 15:43:52 GMT","end":"Sat, 04 Jul 2026 15:43:51 GMT"},"fingerprint":{"sha1":"21:17:81:78:41:C6:8F:86:D6:CF:8D:98:CC:74:A8:F1:03:F8:C9:D4","sha256":"D0:E6:8D:08:11:05:7E:0C:2A:0D:C7:E0:ED:AE:9E:18:C8:74:32:12:3D:56:43:98:62:CD:A2:08:6F:64:5B:B0"}}},"request":{"raw":"GET /npm/@tailwindcss/browser@4 HTTP/1.1\r\nHost: cdn.jsdelivr.net\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://gentle-george.xyz/\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\naccess-control-allow-origin: *\r\naccess-control-expose-headers: *\r\ntiming-allow-origin: *\r\ncache-control: public, max-age=604800, s-maxage=43200\r\ncross-origin-resource-policy: cross-origin\r\nx-content-type-options: nosniff\r\nstrict-transport-security: max-age=31536000; includeSubDomains; preload\r\ncontent-type: application/javascript; charset=utf-8\r\nx-jsd-version: 4.1.17\r\nx-jsd-version-type: version\r\netag: W/\"3ff2f-qtIcVwMQyvrCROHbfRTrnjxQBPY\"\r\ncontent-encoding: br\r\naccept-ranges: bytes\r\ndate: Fri, 14 Nov 2025 09:13:15 GMT\r\nage: 41730\r\nx-served-by: cache-fra-eddf8230174-FRA, cache-hel1410032-HEL\r\nx-cache: HIT, HIT\r\nvary: Accept-Encoding\r\nalt-svc: h3=\":443\";ma=86400,h3-29=\":443\";ma=86400,h3-27=\":443\";ma=86400\r\ncontent-length: 64467\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":261935,"size_decoded":0,"mime_type":"application/javascript; charset=utf-8","magic":"JavaScript source, Unicode text, UTF-8 text, with very long lines (65269)","md5":"73e36ad6b4577018fa97e50182a89f54","sha1":"aad21c570310cafac244e1db7d14eb9e3c5004f6","sha256":"fe198132cae0c5bc70d34b066726571d905ab97262831934164a7b95d891f6fe","sha512":"5858fc52c2b1b8dec283a7131532c997cfcc2164bde9cca4b4e090f5be647981c3fdb8601c05c699b05a6fbee141d0e400932d129a667d9d98cb72e97fff97b0","ssdeep":"3072:V270V4lZYnKl/LBucygyJKwod0PEzsauR+k0iLNccTo98wMip6oep0EuzT4ZVw70:0wWxj4TXstENUAy2Uuz","tlshash":"11442b317603a03e1fb783da20de6004d63e6b65a65841e9f782d50b15e5af80af7f39","first_seen":"2025-11-07T05:55:20.050285Z","last_seen":"2026-07-09T21:00:15.019557Z","times_seen":152,"resource_available":true,"data":null}},"time_used":182,"timings":{"blocked":61,"dns":1,"connect":26,"send":0,"wait":27,"receive":32,"ssl":32},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"gentle-george.xyz/.wp-uiopp/pir/pankki/auth-login/images/danske-bank-logo.154c05a78e04009347ecddb918b16561.svg","fqdn":"gentle-george.xyz","domain":"gentle-george.xyz","tld":"xyz"},"ip":{"addr":"216.117.151.161","port":443,"asn":10843,"as":"AITNET","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://gentle-george.xyz/.wp-uiopp/pir/pankki/auth-login/login.php","date":"2025-11-14T09:13:15.341Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"gentle-george.xyz","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Tue, 14 Oct 2025 15:35:02 GMT","end":"Mon, 12 Jan 2026 15:35:01 GMT"},"fingerprint":{"sha1":"83:32:01:1B:92:FD:3D:4E:B0:4F:47:EC:01:A4:9F:1A:D7:C0:FD:C0","sha256":"2F:E4:49:59:3A:43:85:90:ED:3D:7A:C9:CA:CC:94:CA:BF:24:42:D4:97:50:FA:D5:1D:A2:18:57:E1:99:0D:E5"}}},"request":{"raw":"GET /.wp-uiopp/pir/pankki/auth-login/images/danske-bank-logo.154c05a78e04009347ecddb918b16561.svg HTTP/1.1\r\nHost: gentle-george.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://gentle-george.xyz/.wp-uiopp/pir/pankki/auth-login/login.php\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Fri, 14 Nov 2025 09:13:14 GMT\r\nServer: Apache\r\nLast-Modified: Fri, 12 Sep 2025 08:28:25 GMT\r\nAccept-Ranges: bytes\r\nContent-Length: 4322\r\nKeep-Alive: timeout=5, max=99\r\nConnection: Keep-Alive\r\nContent-Type: image/svg+xml\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Apache HTTP Server","description":"Apache is a free and open-source cross-platform web server software.","website":"https://httpd.apache.org/","common_platform_enumeration":"cpe:2.3:a:apache:http_server:*:*:*:*:*:*:*:*","icon":"Apache.svg","categories":["Web servers"]}],"data":{"size":4322,"size_decoded":0,"mime_type":"image/svg+xml","magic":"SVG Scalable Vector Graphics image","md5":"f513e482d1049b6cae46bdab6846e54c","sha1":"0f9cf7e7231569aff4383e540fa0d488229fbd10","sha256":"2566dcb0230f1ae2412d24ade3f940e3e6a6b3b6ee40501711bf53abc19386a7","sha512":"4a9fed77f4f903e0e72c3948dc833f7fac6e698f101d4057d4801d1563f6f826d1df27bae521c93da6b8c4f5c4712b606a59c726e10667cab927e088f29a48f5","ssdeep":"48:ceqb6IJ8yacOJRp+U1ox7x9sbw5HLyduSMfeCHxQ5CyDgo7syF3RzQYjfqCSCCSb:BIJb2JwdxTZLlvQCNyF3yd/SATY4z0Co","tlshash":"5e91a5cb1360c3c9a8cedc5eef3fa444651764eba62688c1879e8701a4d7bc4f904894","first_seen":"2023-05-15T14:38:20Z","last_seen":"2026-08-12T10:09:41.41415Z","times_seen":246,"resource_available":false,"data":null}},"time_used":247,"timings":{"blocked":118,"dns":0,"connect":0,"send":0,"wait":129,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"openphish","sensor_type":"Blocklist","title":"OpenPhish","description":"OpenPhish","scan_date":"2025-11-14","alert":"Phishing - Danske Bank A/S","trigger":"gentle-george.xyz","verdict":"phishing","severity":"medium","comment":"Danske Bank A/S","link":"https://openphish.com/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2025-11-14","alert":"Sinkholed","trigger":"gentle-george.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2025-11-14","alert":"Sinkholed","trigger":"gentle-george.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-11-14","alert":"Sinkholed","trigger":"gentle-george.xyz","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2025-11-14","alert":"Phishing Block","trigger":"gentle-george.xyz","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"cira_dns","sensor_type":"DNS","title":"CIRA Canadian Shield DNS","description":"CIRA Canadian Shield DNS","scan_date":"2025-11-14","alert":"Sinkholed","trigger":"gentle-george.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cira.ca/en/canadian-shield/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"gentle-george.xyz/.wp-uiopp/pir/pankki/auth-login/images/favicon.png","fqdn":"gentle-george.xyz","domain":"gentle-george.xyz","tld":"xyz"},"ip":{"addr":"216.117.151.161","port":443,"asn":10843,"as":"AITNET","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://gentle-george.xyz/.wp-uiopp/pir/pankki/auth-login/login.php","date":"2025-11-14T09:13:15.702Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"gentle-george.xyz","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Tue, 14 Oct 2025 15:35:02 GMT","end":"Mon, 12 Jan 2026 15:35:01 GMT"},"fingerprint":{"sha1":"83:32:01:1B:92:FD:3D:4E:B0:4F:47:EC:01:A4:9F:1A:D7:C0:FD:C0","sha256":"2F:E4:49:59:3A:43:85:90:ED:3D:7A:C9:CA:CC:94:CA:BF:24:42:D4:97:50:FA:D5:1D:A2:18:57:E1:99:0D:E5"}}},"request":{"raw":"GET /.wp-uiopp/pir/pankki/auth-login/images/favicon.png HTTP/1.1\r\nHost: gentle-george.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://gentle-george.xyz/.wp-uiopp/pir/pankki/auth-login/login.php\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Fri, 14 Nov 2025 09:13:14 GMT\r\nServer: Apache\r\nLast-Modified: Fri, 12 Sep 2025 08:51:01 GMT\r\nAccept-Ranges: bytes\r\nContent-Length: 40334\r\nKeep-Alive: timeout=5, max=98\r\nConnection: Keep-Alive\r\nContent-Type: image/png\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Apache HTTP Server","description":"Apache is a free and open-source cross-platform web server software.","website":"https://httpd.apache.org/","common_platform_enumeration":"cpe:2.3:a:apache:http_server:*:*:*:*:*:*:*:*","icon":"Apache.svg","categories":["Web servers"]}],"data":{"size":40334,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 1535 x 1534, 8-bit/color RGBA, non-interlaced","md5":"24e58fa99363d2ba07276778e3aae79c","sha1":"08f418e3b67ecb1b867280ad049cf6d4434ac518","sha256":"3a667a04dde45b199db3289043cf307fab7d269111d0581f2e2dfbe86511f8e0","sha512":"652d812f53ffa12c88c48a9338043aecaf1f40ce1471bbfc9c18355a398ac656f8bfbdec753113bda554f0c3f0f3aed9d918b9d822e9957f1fb713725c8e7dd1","ssdeep":"768:lyjh59CpScwFJou01gEtjXGmqr+genIQta3tKYPDhb:l3ScYCu0Rx2mqrMnPk3oYPDhb","tlshash":"82034c92741ed85cc477e43277a0edfac9e07748e389cf72b7fc422a669b09c1a48194","first_seen":"2025-09-17T11:30:12.294713Z","last_seen":"2025-12-30T14:56:49.034356Z","times_seen":81,"resource_available":false,"data":null}},"time_used":259,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":129,"receive":130,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2025-11-14","alert":"Sinkholed","trigger":"gentle-george.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"cira_dns","sensor_type":"DNS","title":"CIRA Canadian Shield DNS","description":"CIRA Canadian Shield DNS","scan_date":"2025-11-14","alert":"Sinkholed","trigger":"gentle-george.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cira.ca/en/canadian-shield/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2025-11-14","alert":"Phishing Block","trigger":"gentle-george.xyz","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2025-11-14","alert":"Sinkholed","trigger":"gentle-george.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"openphish","sensor_type":"Blocklist","title":"OpenPhish","description":"OpenPhish","scan_date":"2025-11-14","alert":"Phishing - Danske Bank A/S","trigger":"gentle-george.xyz","verdict":"phishing","severity":"medium","comment":"Danske Bank A/S","link":"https://openphish.com/","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-11-14","alert":"Sinkholed","trigger":"gentle-george.xyz","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"gentle-george.xyz/.wp-uiopp/pir/pankki/auth-login/login.php","fqdn":"gentle-george.xyz","domain":"gentle-george.xyz","tld":"xyz"},"ip":{"addr":"216.117.151.161","port":443,"asn":10843,"as":"AITNET","country":"United States","country_code":"US"},"is_navigation_request":true,"resource_type":"document","requested_by":"","date":"2025-11-14T09:13:14.370Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"gentle-george.xyz","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Tue, 14 Oct 2025 15:35:02 GMT","end":"Mon, 12 Jan 2026 15:35:01 GMT"},"fingerprint":{"sha1":"83:32:01:1B:92:FD:3D:4E:B0:4F:47:EC:01:A4:9F:1A:D7:C0:FD:C0","sha256":"2F:E4:49:59:3A:43:85:90:ED:3D:7A:C9:CA:CC:94:CA:BF:24:42:D4:97:50:FA:D5:1D:A2:18:57:E1:99:0D:E5"}}},"request":{"raw":"GET /.wp-uiopp/pir/pankki/auth-login/login.php HTTP/1.1\r\nHost: gentle-george.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nUpgrade-Insecure-Requests: 1\r\nSec-Fetch-Dest: document\r\nSec-Fetch-Mode: navigate\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Fri, 14 Nov 2025 09:13:14 GMT\r\nServer: Apache\r\nKeep-Alive: timeout=5, max=100\r\nConnection: Keep-Alive\r\nTransfer-Encoding: chunked\r\nContent-Type: text/html; charset=UTF-8\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Apache HTTP Server","description":"Apache is a free and open-source cross-platform web server software.","website":"https://httpd.apache.org/","common_platform_enumeration":"cpe:2.3:a:apache:http_server:*:*:*:*:*:*:*:*","icon":"Apache.svg","categories":["Web servers"]},{"name":"jsDelivr","description":"JSDelivr is a free public CDN for open-source projects. It can serve web files directly from the npm registry and GitHub repositories without any configuration.","website":"https://www.jsdelivr.com/","common_platform_enumeration":"","icon":"jsdelivr-icon.svg","categories":["CDN"]}],"data":{"size":4180,"size_decoded":0,"mime_type":"text/html; charset=UTF-8","magic":"HTML document, Unicode text, UTF-8 text","md5":"ed7849e6b4a1884b13d2652a806c1605","sha1":"88fbe7ad2b586808234959a7eb9262c9870db4b8","sha256":"0f76a65125fad312fc638285c98f05659f62a13c7002a099cab2ca73a1f78d3c","sha512":"9118dbd645da1cda7bfde04143c91f8bff02632a4c3eb7d10142ff574b4b72f121a5a352b663d221d3a33eb57c7786735babfef9fa6a3c62df598fb685225ea9","ssdeep":"96:TODe6fA/IaJ+1uJHcDyJKyDWmLJAaeaQB9U709tivfEM:TODe6f8IaJZJHcDyJK3YMRB9K090MM","tlshash":"4681b54650f215b37443913473f5a6016dabd717c76b8ca9b8de4621af86e10c48b6b8","first_seen":"2025-10-15T14:49:28.688263Z","last_seen":"2025-12-08T03:42:17.495833Z","times_seen":27,"resource_available":false,"data":null}},"time_used":1349,"timings":{"blocked":568,"dns":311,"connect":128,"send":0,"wait":196,"receive":8,"ssl":135},"alerts":{"ids":null,"analyzer":[{"sensor_name":"openphish","sensor_type":"url","title":"OpenPhish","description":"OpenPhish","scan_date":"2025-11-14","alert":"Phishing - Danske Bank A/S","trigger":"gentle-george.xyz/.wp-uiopp/pir/pankki/auth-login/login.php","verdict":"phishing","severity":"medium","comment":"Danske Bank A/S","link":"https://openphish.com","meta":null},{"sensor_name":"cira_dns","sensor_type":"DNS","title":"CIRA Canadian Shield DNS","description":"CIRA Canadian Shield DNS","scan_date":"2025-11-14","alert":"Sinkholed","trigger":"gentle-george.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cira.ca/en/canadian-shield/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2025-11-14","alert":"Sinkholed","trigger":"gentle-george.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2025-11-14","alert":"Phishing Block","trigger":"gentle-george.xyz","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2025-11-14","alert":"Sinkholed","trigger":"gentle-george.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-11-14","alert":"Sinkholed","trigger":"gentle-george.xyz","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}}]}