{"report_id":"5dd1cc2d-5182-49ef-96e1-37207304362a","version":6,"status":"done","tags":[],"date":"2025-02-09T10:28:45Z","url":{"schema":"http","addr":"noble-worldwide.com/wp-content/plugins/super-forms/uploads/php/files/e9e23b3fc2990a49bcbb45f12e8a9d1a/","fqdn":"noble-worldwide.com","domain":"noble-worldwide.com","tld":"com"},"ip":{"addr":"35.197.30.97","port":0,"asn":396982,"as":"GOOGLE-CLOUD-PLATFORM","country":"United States","country_code":"US"},"final":{"url":{"schema":"https","addr":"noble-worldwide.com/wp-content/plugins/super-forms/uploads/php/files/e9e23b3fc2990a49bcbb45f12e8a9d1a/","fqdn":"noble-worldwide.com","domain":"noble-worldwide.com","tld":"com"},"title":"403 Forbidden"},"submit":{"url":{"schema":"","addr":"","fqdn":"","domain":"","tld":""},"ip":{"addr":"","port":0,"asn":0,"as":"","country":"","country_code":""},"tags":null,"meta":null},"settings":{"access":"public","device_type":"","expires_at":"2027-04-20T10:28:45Z","useragent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0","referer":"","cookies":null,"exit_node":"z0yflva4pidy47h"},"stats":{"alert_count":{"ids":0,"urlquery":0,"analyzer":0}},"detection":{"ids":null,"analyzer":null,"urlquery":null},"summary":[{"fqdn":"noble-worldwide.com","ip":{"addr":"35.197.30.97","port":443,"asn":396982,"as":"GOOGLE-CLOUD-PLATFORM","country":"United States","country_code":"US"},"domain_registered":"2018-11-24","domain_rank":0,"first_seen":"2019-09-01T20:23:07Z","last_seen":"2025-02-03T00:42:20.972293Z","alert_count":2,"request_count":2,"received_data":930,"sent_data":1107,"comment":"","tags":null,"fingerprints":null}],"files":null,"artifacts":{"windows_shortcuts":null,"files":null,"telegram":null,"pdfs":null,"clipboard":null},"sensors":{"ids":[{"sensor_name":"suricata","description":"Suricata /w Emerging Threats Pro","alerts":null}],"analyzer":[{"sensor_name":"infosec_yara","type":"yara","description":"Public InfoSec YARA rules","link":"","alerts":null},{"sensor_name":"openphish","type":"url","description":"OpenPhish","link":"","alerts":null},{"sensor_name":"phishtank","type":"url","description":"PhishTank","link":"","alerts":null},{"sensor_name":"quad9","type":"domain","description":"Quad9 DNS","link":"","alerts":[{"sensor_name":"quad9","sensor_type":"domain","title":"","description":"Quad9 DNS","scan_date":"2025-02-08","alert":"Sinkholed","trigger":"noble-worldwide.com","verdict":"malicious","severity":"medium","comment":"Sinkholed","link":"https://www.quad9.net","meta":null},{"sensor_name":"quad9","sensor_type":"domain","title":"","description":"Quad9 DNS","scan_date":"2025-02-08","alert":"Sinkholed","trigger":"noble-worldwide.com","verdict":"malicious","severity":"medium","comment":"Sinkholed","link":"https://www.quad9.net","meta":null}]},{"sensor_name":"threatfox","type":"url","description":"ThreatFox","link":"","alerts":null}],"urlquery":null},"javascript":{"script":null,"eval":null,"write":null,"console":null},"http":[{"url":{"schema":"https","addr":"noble-worldwide.com/wp-content/plugins/super-forms/uploads/php/files/e9e23b3fc2990a49bcbb45f12e8a9d1a/","fqdn":"noble-worldwide.com","domain":"noble-worldwide.com","tld":"com"},"ip":{"addr":"35.197.30.97","port":443,"asn":396982,"as":"GOOGLE-CLOUD-PLATFORM","country":"United States","country_code":"US"},"is_navigation_request":true,"resource_type":"document","requested_by":"","date":"2025-02-09T10:28:16.760Z","timestamp":1739096896760,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"noble-worldwide.com","organization":""},"issuer":{"commonName":"R11","organization":"Let's Encrypt"},"validity":{"start":"Fri, 07 Feb 2025 19:27:22 GMT","end":"Thu, 08 May 2025 19:27:21 GMT"},"fingerprint":{"sha1":"B4:F4:98:80:63:4A:3C:BA:BE:4E:52:BB:FC:F8:DA:B5:9F:2A:C2:09","sha256":"5D:F7:C5:21:04:40:B1:6B:20:2E:73:21:8D:65:07:57:B8:9B:E8:AA:66:8A:B1:87:3A:15:2B:7B:2F:48:C9:82"}}},"request":{"raw":"GET /wp-content/plugins/super-forms/uploads/php/files/e9e23b3fc2990a49bcbb45f12e8a9d1a/ HTTP/1.1\r\nHost: noble-worldwide.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nUpgrade-Insecure-Requests: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: document\r\nSec-Fetch-Mode: navigate\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 403 Forbidden\r\nserver: nginx\r\ndate: Sun, 09 Feb 2025 10:28:16 GMT\r\ncontent-type: text/html; charset=iso-8859-1\r\nvary: Accept-Encoding\r\nx-cacheable: NO:403\r\ncache-control: max-age=0, must-revalidate, private\r\nx-cache: MISS\r\nx-cache-group: normal\r\ncontent-encoding: br\r\nX-Firefox-Spdy: h2\r\n","headers":null,"cookies":null,"status_code":"403","status_text":"Forbidden","fingerprints":null,"data":{"size":317,"size_decoded":199,"mime_type":"text/html; charset=iso-8859-1","magic":"HTML document, ASCII text","md5":"bb8f534fbff5ee61a95af9c4740ae043","sha1":"832e403d42aac1fec93e4f602338544d3fd2e4f1","sha256":"5b13fb5957b84ef7bb9d0b6cd509c947ff6a37d67efdac2b896ddd3b908aad10","sha512":"eb423ca8e0f3e026a367130044b1857a1368097f9ac3c8fcaa523fa5e2785437fbc328397b5c6582fb0c872cff44e70cf0120d874d825472806adc46acdbffdd","ssdeep":"","tlshash":"2ed022afe28f1029562323c02ac316c164111274b88308cc9e0af48391445bd810a55c","first_seen":"2023-04-05T13:40:31Z","last_seen":"2026-09-23T21:21:57.13105Z","times_seen":12786,"resource_available":true,"data":null}},"time_used":156,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":156,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"domain","title":"","description":"Quad9 DNS","scan_date":"2025-02-08","alert":"Sinkholed","trigger":"noble-worldwide.com","verdict":"malicious","severity":"medium","comment":"Sinkholed","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"noble-worldwide.com/favicon.ico","fqdn":"noble-worldwide.com","domain":"noble-worldwide.com","tld":"com"},"ip":{"addr":"35.197.30.97","port":443,"asn":396982,"as":"GOOGLE-CLOUD-PLATFORM","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://noble-worldwide.com/wp-content/plugins/super-forms/uploads/php/files/e9e23b3fc2990a49bcbb45f12e8a9d1a/","date":"2025-02-09T10:28:17.012Z","timestamp":1739096897012,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"noble-worldwide.com","organization":""},"issuer":{"commonName":"R11","organization":"Let's Encrypt"},"validity":{"start":"Fri, 07 Feb 2025 19:27:22 GMT","end":"Thu, 08 May 2025 19:27:21 GMT"},"fingerprint":{"sha1":"B4:F4:98:80:63:4A:3C:BA:BE:4E:52:BB:FC:F8:DA:B5:9F:2A:C2:09","sha256":"5D:F7:C5:21:04:40:B1:6B:20:2E:73:21:8D:65:07:57:B8:9B:E8:AA:66:8A:B1:87:3A:15:2B:7B:2F:48:C9:82"}}},"request":{"raw":"GET /favicon.ico HTTP/1.1\r\nHost: noble-worldwide.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://noble-worldwide.com/wp-content/plugins/super-forms/uploads/php/files/e9e23b3fc2990a49bcbb45f12e8a9d1a/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\nTE: trailers\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Sun, 09 Feb 2025 10:28:17 GMT\r\ncontent-type: image/x-icon\r\ncontent-length: 0\r\nlast-modified: Thu, 09 Jan 2025 22:03:24 GMT\r\netag: \"678047ac-0\"\r\ncache-control: public, max-age=31536000\r\nvary: Accept-Encoding\r\naccess-control-allow-origin: *\r\naccept-ranges: bytes\r\nX-Firefox-Spdy: h2\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":null,"data":{"size":0,"size_decoded":0,"mime_type":"image/x-icon","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-09-23T20:48:39.248821Z","times_seen":18623667,"resource_available":true,"data":null}},"time_used":153,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":153,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"domain","title":"","description":"Quad9 DNS","scan_date":"2025-02-08","alert":"Sinkholed","trigger":"noble-worldwide.com","verdict":"malicious","severity":"medium","comment":"Sinkholed","link":"https://www.quad9.net","meta":null}],"urlquery":null}}]}