{"report_id":"5510dbe0-deaf-4430-aafe-8160326e1038","version":0,"status":"done","tags":[],"date":"2026-10-07T12:46:21Z","url":{"schema":"https","addr":"1wfbqhhi.sbs/","fqdn":"1wfbqhhi.sbs","domain":"1wfbqhhi.sbs","tld":"sbs"},"ip":{"addr":"194.110.247.238","port":0,"asn":200019,"as":"Alexhost Srl","country":"Moldova","country_code":"MD"},"final":{"url":{"schema":"https","addr":"1wfbqhhi.sbs/","fqdn":"1wfbqhhi.sbs","domain":"1wfbqhhi.sbs","tld":"sbs"},"title":"FilesHub — \u003cspan data-i18n=\"tag\"\u003e\u003c/span\u003e","dom":{"size":11443,"mime_type":"text/html; charset=utf-8","magic":"JavaScript source, Unicode text, UTF-8 text, with very long lines (5991)","md5":"c1decf5cc8fd64d7e16e01989af78983","sha1":"48ec064592142d84ccbbca146dd8d4df5dfafb6b","sha256":"eed9a14da82133c264b9c88b7b463e5772bad2e988be944e4cea90700fd53a7f","sha512":"927f7e5842daadd3542d736d17c5979ad8967114ff067c4d52ed80a83713160e52d71549249cf2a5fa534e1b518ab8f897159324f880e5730cebd6a395e8b544","ssdeep":"192:Ri/0MD03wXhAIalsaRYOx4w6e4/EMWGm+09Btv11:RS0McwOtVGVEMFm+09Tv11","tlshash":"1d320af976b070b41a37b1cef9107e377598863dc70382a5144b626e97d2870de2e1ab","dom_hash":"domhash3d5844d86a719fdc8cac4c776521d079","first_seen":"2026-10-07T12:45:39.632343Z","last_seen":"2026-10-07T12:46:24.450295Z","times_seen":2,"resource_available":false,"data":null}},"submit":{"url":{"schema":"https","addr":"1wfbqhhi.sbs/","fqdn":"1wfbqhhi.sbs","domain":"1wfbqhhi.sbs","tld":"sbs"},"ip":{"addr":"194.110.247.238","port":0,"asn":200019,"as":"Alexhost Srl","country":"Moldova","country_code":"MD"},"tags":null,"meta":null},"settings":{"access":"public","device_type":"desktop","expires_at":"2027-11-11T12:46:21Z","useragent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0","referer":"","cookies":null,"exit_node":"qguvgzjxzsgb3vs"},"stats":{"alert_count":{"ids":0,"urlquery":0,"analyzer":1}},"detection":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-10-07","alert":"Sinkholed","trigger":"1wfbqhhi.sbs","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null},"summary":[{"fqdn":"1wfbqhhi.sbs","ip":{"addr":"194.110.247.238","port":443,"asn":200019,"as":"Alexhost Srl","country":"Moldova","country_code":"MD"},"domain_registered":"2026-09-28","domain_rank":0,"first_seen":"2026-10-07T12:45:35.600485Z","last_seen":"2026-10-07T12:45:35.600485Z","alert_count":2,"request_count":2,"received_data":11600,"sent_data":981,"comment":"","tags":null,"fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}]}],"files":null,"artifacts":{"windows_shortcuts":null,"files":null,"telegram":null,"pdfs":null,"clipboard":null},"sensors":{"ids":null,"analyzer":null,"urlquery":null},"javascript":{"script":[{"url":{"schema":"https","addr":"1wfbqhhi.sbs/","fqdn":"1wfbqhhi.sbs","domain":"1wfbqhhi.sbs","tld":"sbs"},"ip":{"addr":"194.110.247.238","port":443,"asn":200019,"as":"Alexhost Srl","country":"Moldova","country_code":"MD"},"introduction_type":"scriptElement","is_inline":true,"md5":"55228c0e91bc8184f691713129aa4653","sha1":"ed90412076e58ca86f55c2a5562177ad579f906b","sha256":"59f9413375ae2d73a0f050edcedbbc4276dad6cae2e5129b1834a63b2c76e14a","sha512":"b92d78673e49fa8eb499e7e5b7f9e4b76d7c76ceeb926ff15bdb2de26f2622bbf5ab966abeb1ed34e233dea445bc1404bb419e6b1799576fd4173b259954b0b3","ssdeep":"96:SyXRPTN3CsYPGwOx4qoxwdRKl1kT3NeWaBZ9EMjtvj9S/OmMSGQXk96/DC//vxwC:SaRYOx4w6e4/EMWGm+09Btv12","tlshash":"43f195e837b571b90e39728efa147c33baad417cc71381950806666aa7928308d6e5f7","size":7854,"data":"","first_seen":"2026-10-07T12:45:39.637946Z","last_seen":"2026-10-07T12:46:24.459841Z","times_seen":2,"alerts":{"ids":null,"analyzer":null,"urlquery":null}}],"eval":null,"write":null,"console":null},"http":[{"url":{"schema":"https","addr":"1wfbqhhi.sbs/favicon.ico","fqdn":"1wfbqhhi.sbs","domain":"1wfbqhhi.sbs","tld":"sbs"},"ip":{"addr":"194.110.247.238","port":443,"asn":200019,"as":"Alexhost Srl","country":"Moldova","country_code":"MD"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://1wfbqhhi.sbs/","date":"2026-10-07T12:45:52.839Z","timestamp":1791377152839,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"1wfbqhhi.sbs","organization":""},"issuer":{"commonName":"YE1","organization":"Let's Encrypt"},"validity":{"start":"Wed, 30 Sep 2026 11:37:52 GMT","end":"Tue, 29 Dec 2026 11:37:51 GMT"},"fingerprint":{"sha1":"3E:F3:DC:3C:A8:51:CA:69:49:7F:CD:27:90:C5:03:4E:16:1C:48:BF","sha256":"96:49:DA:C9:07:55:0A:C2:82:47:1F:84:0F:44:74:D4:EC:34:EF:34:8D:F1:CE:AF:AC:93:3E:9F:C4:83:A4:32"}}},"request":{"raw":"GET /favicon.ico HTTP/1.1\r\nHost: 1wfbqhhi.sbs\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://1wfbqhhi.sbs/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=6\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 404 Not Found\r\nServer: nginx\r\nDate: Wed, 07 Oct 2026 12:45:52 GMT\r\nContent-Type: text/html\r\nTransfer-Encoding: chunked\r\nConnection: keep-alive\r\nX-Content-Type-Options: nosniff\r\nX-Frame-Options: DENY\r\nContent-Encoding: gzip\r\n\r\n","headers":null,"cookies":null,"status_code":"404","status_text":"Not Found","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":146,"size_decoded":342,"mime_type":"text/html","magic":"HTML document, ASCII text, with CRLF line terminators","md5":"8eec510e57f5f732fd2cce73df7b73ef","sha1":"3c0af39ecb3753c5fee3b53d063c7286019eac3b","sha256":"55f7d9e99b8e2d4e0e193b2f0275501e6d9c1ebd29cadbea6a0da48a8587e3e0","sha512":"73bbf698482132b5fd60a0b58926fddec9055f8095a53bc52714e211e9340c3419736ceafd6b279667810114d306bfccdcfcddf51c0b67fe9e3c73c54583e574","ssdeep":"","tlshash":"b7c02b2d35133c4cc563313423c37140c0d6833b687a41110400c00371cf2998ec3397","first_seen":"2023-03-07T12:05:15Z","last_seen":"2026-10-13T10:42:08.422378Z","times_seen":567729,"resource_available":true,"data":null}},"time_used":54,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":54,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-10-07","alert":"Sinkholed","trigger":"1wfbqhhi.sbs","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"1wfbqhhi.sbs/","fqdn":"1wfbqhhi.sbs","domain":"1wfbqhhi.sbs","tld":"sbs"},"ip":{"addr":"194.110.247.238","port":443,"asn":200019,"as":"Alexhost Srl","country":"Moldova","country_code":"MD"},"is_navigation_request":true,"resource_type":"document","requested_by":"","date":"2026-10-07T12:45:52.359Z","timestamp":1791377152359,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"1wfbqhhi.sbs","organization":""},"issuer":{"commonName":"YE1","organization":"Let's Encrypt"},"validity":{"start":"Wed, 30 Sep 2026 11:37:52 GMT","end":"Tue, 29 Dec 2026 11:37:51 GMT"},"fingerprint":{"sha1":"3E:F3:DC:3C:A8:51:CA:69:49:7F:CD:27:90:C5:03:4E:16:1C:48:BF","sha256":"96:49:DA:C9:07:55:0A:C2:82:47:1F:84:0F:44:74:D4:EC:34:EF:34:8D:F1:CE:AF:AC:93:3E:9F:C4:83:A4:32"}}},"request":{"raw":"GET / HTTP/1.1\r\nHost: 1wfbqhhi.sbs\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nUpgrade-Insecure-Requests: 1\r\nSec-Fetch-Dest: document\r\nSec-Fetch-Mode: navigate\r\nSec-Fetch-Site: none\r\nPriority: u=0, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nServer: nginx\r\nDate: Wed, 07 Oct 2026 12:45:52 GMT\r\nContent-Type: text/html\r\nLast-Modified: Wed, 07 Oct 2026 12:23:02 GMT\r\nTransfer-Encoding: chunked\r\nConnection: keep-alive\r\nETag: W/\"6ac639a6-2aa8\"\r\nX-Content-Type-Options: nosniff\r\nX-Frame-Options: DENY\r\nContent-Encoding: gzip\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":10920,"size_decoded":5370,"mime_type":"text/html","magic":"HTML document, Unicode text, UTF-8 text, with very long lines (5991)","md5":"b2f670fddca386af2c4f8396df90811e","sha1":"42a7370f3a9d1092595cd77c2ee7c61d39f973a6","sha256":"7134af9448ecd24e42e75a825797fd03be286c0ee4eeebd79edccddff4784f25","sha512":"ee450aed1d8ccbbc651e43b8f6ee249f743eca46259baa5068d1b4fbe24db8194c5d242b3b9bed0fd672dfb6c24a5206549ee3278a1727b3182afc6afa52569d","ssdeep":"192:9i/0MD03wXhAytaRYOx4w6e4/EMWGm+09Btv1Z:9S0McwOxGVEMFm+09Tv1Z","tlshash":"2a320af976b070b41a3bb2cef9207d377598853dc60382a5144b726e97c2871cd2e5ab","first_seen":"2026-10-07T12:45:39.635955Z","last_seen":"2026-10-07T12:46:24.457199Z","times_seen":2,"resource_available":true,"data":null}},"time_used":181,"timings":{"blocked":-1,"dns":4,"connect":54,"send":0,"wait":54,"receive":0,"ssl":69},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-10-07","alert":"Sinkholed","trigger":"1wfbqhhi.sbs","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}}]}