{"report_id":"5f039f62-70f3-4741-ab57-4adca1d790ce","version":0,"status":"done","tags":[],"date":"2026-10-02T18:06:23Z","url":{"schema":"https","addr":"wswhats.cyou/","fqdn":"wswhats.cyou","domain":"wswhats.cyou","tld":"cyou"},"ip":{"addr":"94.154.43.128","port":0,"asn":219502,"as":"Storm Industries LLC","country":"The Netherlands","country_code":"NL"},"final":{"url":{"schema":"https","addr":"wswhats.cyou/","fqdn":"wswhats.cyou","domain":"wswhats.cyou","tld":"cyou"},"title":"ws","dom":{"size":56271,"mime_type":"text/html; charset=utf-8","magic":"HTML document, Unicode text, UTF-8 text, with very long lines (54121)","md5":"acfd7b3896c1dc97b55d3e924e71b53f","sha1":"855ac5028c71185032c15db5db65137757a84dff","sha256":"fcabd9621f51e57004c3b7a856b445e5a10ab7304429f9193b72fbaa2589810c","sha512":"209273ae3e537dd2c42b193f2a3d80ff2486a72c515c2f7fbfb3b471f40ba4ddfc438e79696017dc70a2e8614952e4ff45e3debe5a926bffeac6938a8cde1a21","ssdeep":"1536:rmJdHoGH1NgSKpfnSVcJSE22+p1HF63In8sla7aAq5:r6VfVcJS/jPH7n8slH","tlshash":"02437ca0766471e18fa3c7d5e932be23325731fb7349818065ea4a7055c73a9f9884fc","dom_hash":"domhash9f32b8f3f88c380a63d97a69f1004e51","first_seen":"2026-10-02T18:06:25.90519Z","last_seen":"2026-10-02T18:06:25.90519Z","times_seen":1,"resource_available":false,"data":null}},"submit":{"url":{"schema":"https","addr":"wswhats.cyou/","fqdn":"wswhats.cyou","domain":"wswhats.cyou","tld":"cyou"},"ip":{"addr":"94.154.43.128","port":0,"asn":219502,"as":"Storm Industries LLC","country":"The Netherlands","country_code":"NL"},"tags":["openphish"],"meta":null},"settings":{"access":"public","device_type":"desktop","expires_at":"2027-11-06T18:06:23Z","useragent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0","referer":"","cookies":null,"exit_node":"qguvgzjxzsgb3vs"},"stats":{"alert_count":{"ids":0,"urlquery":0,"analyzer":6}},"detection":{"ids":null,"analyzer":[{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-10-02","alert":"Sinkholed","trigger":"wswhats.cyou","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-10-02","alert":"Phishing Block","trigger":"wswhats.cyou","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-10-02","alert":"Sinkholed","trigger":"wswhats.cyou","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-10-02","alert":"Sinkholed","trigger":"wswhats.cyou","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-10-02","alert":"Sinkholed","trigger":"wswhats.cyou","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"cira_dns","sensor_type":"DNS","title":"CIRA Canadian Shield DNS","description":"CIRA Canadian Shield DNS","scan_date":"2026-10-02","alert":"Sinkholed","trigger":"wswhats.cyou","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cira.ca/en/canadian-shield/","meta":null}],"urlquery":null},"summary":[{"fqdn":"wswhats.cyou","ip":{"addr":"94.154.43.128","port":443,"asn":208485,"as":"Moon Dc","country":"United Kingdom","country_code":"GB"},"domain_registered":"2026-10-01","domain_rank":0,"first_seen":"2026-10-02T02:24:46.194309Z","last_seen":"2026-10-02T02:24:46.194309Z","alert_count":48,"request_count":9,"received_data":752417,"sent_data":4275,"comment":"","tags":null,"fingerprints":[{"name":"WebSocket","description":"WebSocket is a communication protocol that provides full-duplex communication channels over a single, long-lived connection, enabling interactive communication between web browsers and servers.","website":"https://en.wikipedia.org/wiki/WebSocket","common_platform_enumeration":"","icon":"WebSocket.svg","categories":["Miscellaneous"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}]}],"files":null,"artifacts":{"windows_shortcuts":null,"files":null,"telegram":null,"pdfs":null,"clipboard":null},"sensors":{"ids":null,"analyzer":null,"urlquery":null},"javascript":{"script":[{"url":{"schema":"https","addr":"wswhats.cyou/","fqdn":"wswhats.cyou","domain":"wswhats.cyou","tld":"cyou"},"ip":{"addr":"94.154.43.128","port":443,"asn":208485,"as":"Moon Dc","country":"United Kingdom","country_code":"GB"},"introduction_type":"scriptElement","is_inline":true,"md5":"0d2de310110ab1bdbd381b9c02e1ceeb","sha1":"220c6cb20b0f7dfefedaa7ff4625274a94d9135c","sha256":"d60b3f803c3df16fdbe8c56d0ac432691edb2146544c10f1ce06e533e9644cbb","sha512":"1ab7b82a3d007db343fa4cb0f0605ac6ce8994098da50af5810dbb4b913c2e827e4cc55143129180733473cd9d9fafc9aae6fc5c1223add201db5015a0df3562","ssdeep":"","tlshash":"83a002b955519401ad312010891d3100340306634cc4a81174dc0c447f1950a10601c7","size":64,"data":"","first_seen":"2025-09-25T09:42:12.605655Z","last_seen":"2026-10-02T18:06:25.922702Z","times_seen":5,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"wswhats.cyou/","fqdn":"wswhats.cyou","domain":"wswhats.cyou","tld":"cyou"},"ip":{"addr":"94.154.43.128","port":443,"asn":208485,"as":"Moon Dc","country":"United Kingdom","country_code":"GB"},"introduction_type":"scriptElement","is_inline":true,"md5":"2a434c47ff24c27c5a55f35cf1812066","sha1":"2b98da4e95a348734ddd357c3ad6cfa603002fe0","sha256":"3c5f3e26771df8a9657d43eb4a943c1876338e01ff06da7225b6c8e223bd1239","sha512":"f0bb28f5abe6adb0d7f272987eed5a316fb470c044f0ff8b83e34ea36db090e57de69b5121ce5e95da8c08fe81ccb4377feff886156c9d224b0b3a8dda7719c4","ssdeep":"","tlshash":"7cd0a7794ea6c06089056447217dd614a64160a55a62f0cebccdec5d6f00fcf4d45c20","size":248,"data":"","first_seen":"2023-03-10T16:03:22Z","last_seen":"2026-10-02T18:06:25.923853Z","times_seen":91,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"wswhats.cyou/static/js/VXOmf3Wrc6.js","fqdn":"wswhats.cyou","domain":"wswhats.cyou","tld":"cyou"},"ip":{"addr":"94.154.43.128","port":443,"asn":208485,"as":"Moon Dc","country":"United Kingdom","country_code":"GB"},"introduction_type":"scriptElement","is_inline":false,"md5":"b88122cdcfa8f9c3e8b08bf466d4a38b","sha1":"91047b010c3bd957e30dc1bc788b2996b6a39571","sha256":"db2e7bc86cd435d02687f7ca3313ddf5bfd759034272275a90ea7d84adbb06dc","sha512":"70888b1eb4ae301739b266c4d48bf733fe18eaa5edc465d98f9a07ca1c3e45ef20bb5e781ea683928796faea8f565b151665e49de830ad421b6b649ffdce12f8","ssdeep":"3072:Eq6XkZvM4oDqQ2Ruyg5P/GrfBGoPrIutK:ZM4ZtBGcIuK","tlshash":"8cf3d48df6c5b0b113e720b4416f660bf27b6858b84ec1d0e266e4d56c7988e912bf3d","size":169211,"data":"","first_seen":"2026-10-01T02:41:29.701501Z","last_seen":"2026-10-02T18:06:25.910976Z","times_seen":4,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"wswhats.cyou/static/js/rmEhbO2u.js","fqdn":"wswhats.cyou","domain":"wswhats.cyou","tld":"cyou"},"ip":{"addr":"94.154.43.128","port":443,"asn":208485,"as":"Moon Dc","country":"United Kingdom","country_code":"GB"},"introduction_type":"scriptElement","is_inline":false,"md5":"310cc7176b4a04d7afc1432fb93fdee9","sha1":"f378d1753af054bcfddd0c139f4f162416031405","sha256":"845e68683677951b282b63f76b147422796daea20ab1ad8720bc9e805d57d010","sha512":"bcf04ac1da33464db13dadb54edc768ede8860588c3f35f0a918ab05a83c2ae6379706e63c51728237d658d9a113e641f8ce77bc0ce3bfe28fdf867076a12717","ssdeep":"96:EoHLlMJH/HB4TF2+WLiX/kCsZ1zl0NhNtry0euEHY3LkNDNS:rWvKTF2+WqJszmbFMiLGxS","tlshash":"80b1e8ee72e5b86e07532472813fb287f17728b2542f80555369d8f5be78d880227f94","size":5543,"data":"","first_seen":"2026-10-01T02:41:29.693096Z","last_seen":"2026-10-02T18:06:25.919898Z","times_seen":4,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"wswhats.cyou/static/js/VXOm82Wrc6.js","fqdn":"wswhats.cyou","domain":"wswhats.cyou","tld":"cyou"},"ip":{"addr":"94.154.43.128","port":443,"asn":208485,"as":"Moon Dc","country":"United Kingdom","country_code":"GB"},"introduction_type":"scriptElement","is_inline":false,"md5":"5fac9c0ebef535e420ec1d9ee7940577","sha1":"3c5db78ef2aa4a254ad299b47fc72f565fe7f4af","sha256":"58087a116f3e2a14d604c08b91963464620e293634ff5ea4fe34e5611c223d02","sha512":"64f19a433b41bfceed3642c0452aef0b4c0b223abd7779ce547eeb3d07ddbec8961b4778693e583dc42bd2b783b6e4899c9fd7837619fa7b5a0a61eccb99ec37","ssdeep":"1536:mUAydHYRhpgITo6Qn7aEiC9FpTWlMA+/jEGhyU:CRMIToz/FpDEGhj","tlshash":"8a533ae5e7a062f4c01ac7b5952b5431716a18f539158088fbf8c9f4a4b4be4df0eaf8","size":62669,"data":"","first_seen":"2026-10-01T02:41:29.696069Z","last_seen":"2026-10-02T18:06:25.915027Z","times_seen":4,"alerts":{"ids":null,"analyzer":null,"urlquery":null}}],"eval":null,"write":null,"console":null},"http":[{"url":{"schema":"wss","addr":"wss://wswhats.cyou/ws/chat/0qedxbxh5gab833jrev3vn300228ac","fqdn":"wswhats.cyou","domain":"wswhats.cyou","tld":"cyou"},"ip":{"addr":"94.154.43.128","port":443,"asn":208485,"as":"Moon Dc","country":"United Kingdom","country_code":"GB"},"is_navigation_request":false,"resource_type":"websocket","requested_by":"https://wswhats.cyou/","date":"2026-10-02T18:05:55.847Z","timestamp":1790964355847,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"mlkem768x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"wswhats.cyou","organization":""},"issuer":{"commonName":"YR1","organization":"Let's Encrypt"},"validity":{"start":"Thu, 01 Oct 2026 05:50:09 GMT","end":"Wed, 30 Dec 2026 05:50:08 GMT"},"fingerprint":{"sha1":"99:33:2E:76:02:E0:85:95:DA:6D:9A:7B:C9:4F:EC:16:56:25:F1:EA","sha256":"21:00:DA:A9:E9:28:B4:E9:B8:FF:17:EA:A3:35:82:1E:9D:9D:52:BC:53:FF:84:B1:8C:89:B2:DE:6B:04:5C:24"}}},"request":{"raw":"GET /ws/chat/0qedxbxh5gab833jrev3vn300228ac HTTP/1.1\r\nHost: wswhats.cyou\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-WebSocket-Version: 13\r\nOrigin: https://wswhats.cyou\r\nSec-WebSocket-Extensions: permessage-deflate\r\nSec-WebSocket-Key: +K+bcmVq1es7S3bTzQv8cw==\r\nSec-GPC: 1\r\nConnection: Upgrade\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: websocket\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\nUpgrade: websocket\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 101 Switching Protocols\r\nDate: Fri, 02 Oct 2026 18:05:56 GMT\r\nConnection: upgrade\r\nUpgrade: websocket\r\nSec-WebSocket-Accept: q2WgtWyyhUw9hn7omCvHcuLDh7M=\r\nSec-WebSocket-Extensions: permessage-deflate\r\nServer: nginx\r\n\r\n","headers":null,"cookies":null,"status_code":"101","status_text":"Switching Protocols","fingerprints":[{"name":"WebSocket","description":"WebSocket is a communication protocol that provides full-duplex communication channels over a single, long-lived connection, enabling interactive communication between web browsers and servers.","website":"https://en.wikipedia.org/wiki/WebSocket","common_platform_enumeration":"","icon":"WebSocket.svg","categories":["Miscellaneous"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":0,"size_decoded":227,"mime_type":"text/plain","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-10-02T23:01:47.570629Z","times_seen":18782439,"resource_available":true,"data":null}},"time_used":453,"timings":{"blocked":0,"dns":0,"connect":23,"send":0,"wait":402,"receive":0,"ssl":28},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"wswhats.cyou/","fqdn":"wswhats.cyou","domain":"wswhats.cyou","tld":"cyou"},"ip":{"addr":"94.154.43.128","port":443,"asn":208485,"as":"Moon Dc","country":"United Kingdom","country_code":"GB"},"is_navigation_request":true,"resource_type":"document","requested_by":"","date":"2026-10-02T18:05:54.235Z","timestamp":1790964354235,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"mlkem768x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"wswhats.cyou","organization":""},"issuer":{"commonName":"YR1","organization":"Let's Encrypt"},"validity":{"start":"Thu, 01 Oct 2026 05:50:09 GMT","end":"Wed, 30 Dec 2026 05:50:08 GMT"},"fingerprint":{"sha1":"99:33:2E:76:02:E0:85:95:DA:6D:9A:7B:C9:4F:EC:16:56:25:F1:EA","sha256":"21:00:DA:A9:E9:28:B4:E9:B8:FF:17:EA:A3:35:82:1E:9D:9D:52:BC:53:FF:84:B1:8C:89:B2:DE:6B:04:5C:24"}}},"request":{"raw":"GET / HTTP/1.1\r\nHost: wswhats.cyou\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nUpgrade-Insecure-Requests: 1\r\nSec-Fetch-Dest: document\r\nSec-Fetch-Mode: navigate\r\nSec-Fetch-Site: none\r\nPriority: u=0, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Fri, 02 Oct 2026 18:05:55 GMT\r\nContent-Type: text/html\r\nTransfer-Encoding: chunked\r\nConnection: keep-alive\r\nLast-Modified: Wed, 28 May 2025 16:36:23 GMT\r\nVary: Accept-Encoding\r\nETag: W/\"68373b87-806\"\r\nContent-Encoding: gzip\r\nServer: nginx\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":2054,"size_decoded":1164,"mime_type":"text/html","magic":"HTML document, ASCII text, with very long lines (743)","md5":"9c0b5c24dffbf85bb9201fd3b4828ed9","sha1":"794d7d3da0f04342a76e57f6261588b014649409","sha256":"97b8703cfc0c2f17ee8f5ff6bbaa3c1e98d4e941ccaeefffb413677801c02f9e","sha512":"80471807688cf1c8a73f3d9cb3466da6c81ec6493a3caaa5c66e747a6ecc9deb695acf7eddec870af7e34f936c05722d7867a8d7fd1799e07b9697d84e31cfa6","ssdeep":"","tlshash":"854132a9cc01d12e6e759643e6f8b22fc4d4885e8971f895f89c4a3de714fc88a22c13","first_seen":"2026-10-01T02:41:29.698742Z","last_seen":"2026-10-02T18:06:25.908092Z","times_seen":4,"resource_available":true,"data":null}},"time_used":946,"timings":{"blocked":-1,"dns":469,"connect":23,"send":0,"wait":403,"receive":0,"ssl":51},"alerts":{"ids":null,"analyzer":[{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-10-02","alert":"Sinkholed","trigger":"wswhats.cyou","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-10-02","alert":"Phishing Block","trigger":"wswhats.cyou","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-10-02","alert":"Sinkholed","trigger":"wswhats.cyou","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-10-02","alert":"Sinkholed","trigger":"wswhats.cyou","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-10-02","alert":"Sinkholed","trigger":"wswhats.cyou","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"cira_dns","sensor_type":"DNS","title":"CIRA Canadian Shield DNS","description":"CIRA Canadian Shield DNS","scan_date":"2026-10-02","alert":"Sinkholed","trigger":"wswhats.cyou","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cira.ca/en/canadian-shield/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"wswhats.cyou/static/css/z8Mxd2M0Fd.css","fqdn":"wswhats.cyou","domain":"wswhats.cyou","tld":"cyou"},"ip":{"addr":"94.154.43.128","port":443,"asn":208485,"as":"Moon Dc","country":"United Kingdom","country_code":"GB"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://wswhats.cyou/","date":"2026-10-02T18:05:55.365Z","timestamp":1790964355365,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"mlkem768x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"wswhats.cyou","organization":""},"issuer":{"commonName":"YR1","organization":"Let's Encrypt"},"validity":{"start":"Thu, 01 Oct 2026 05:50:09 GMT","end":"Wed, 30 Dec 2026 05:50:08 GMT"},"fingerprint":{"sha1":"99:33:2E:76:02:E0:85:95:DA:6D:9A:7B:C9:4F:EC:16:56:25:F1:EA","sha256":"21:00:DA:A9:E9:28:B4:E9:B8:FF:17:EA:A3:35:82:1E:9D:9D:52:BC:53:FF:84:B1:8C:89:B2:DE:6B:04:5C:24"}}},"request":{"raw":"GET /static/css/z8Mxd2M0Fd.css HTTP/1.1\r\nHost: wswhats.cyou\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://wswhats.cyou/\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=0\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Fri, 02 Oct 2026 18:05:55 GMT\r\nContent-Type: text/css\r\nTransfer-Encoding: chunked\r\nConnection: keep-alive\r\nLast-Modified: Wed, 28 May 2025 16:36:23 GMT\r\nVary: Accept-Encoding\r\nETag: W/\"68373b87-7b302\"\r\nContent-Encoding: gzip\r\nServer: nginx\r\nX-Cache-Status: HIT from L1:1118\r\nVia: L1:1118\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":504578,"size_decoded":143460,"mime_type":"text/css","magic":"ASCII text, with very long lines (65536), with no line terminators","md5":"00ed03fad1cb8dc6bd09557c973248cc","sha1":"ee4a2c2433fc1c889f0845c08030e9e931667fc7","sha256":"50a6c123acd5b25233a8dc26077409b7e191e265f4e42328b691153545c9372c","sha512":"d3c57758f64ddfb14dc5f1f6c3d1a84a63711d8f5815e246d3a4c2e64b9f2164aec53baf1f5217f4aa934320e88fba3b7e555562fa79d6d3a2913c7461b5556d","ssdeep":"3072:X9cAy7+X6RkkmhmnwsD+eUvleu38cpaS9e9K7VihOrmAMsKypIFtdT48v/zo:XQI6RZmhCUyFFOrzoT5o","tlshash":"9bb4faf7d672523c7c27862b42dc7668d32c9dc6fa021fe9f191f028a6c2be91263515","first_seen":"2026-10-01T02:41:29.699903Z","last_seen":"2026-10-02T18:06:25.90993Z","times_seen":4,"resource_available":true,"data":null}},"time_used":115,"timings":{"blocked":-1,"dns":0,"connect":24,"send":0,"wait":30,"receive":61,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-10-02","alert":"Phishing Block","trigger":"wswhats.cyou","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-10-02","alert":"Sinkholed","trigger":"wswhats.cyou","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-10-02","alert":"Sinkholed","trigger":"wswhats.cyou","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-10-02","alert":"Sinkholed","trigger":"wswhats.cyou","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"cira_dns","sensor_type":"DNS","title":"CIRA Canadian Shield DNS","description":"CIRA Canadian Shield DNS","scan_date":"2026-10-02","alert":"Sinkholed","trigger":"wswhats.cyou","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cira.ca/en/canadian-shield/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-10-02","alert":"Sinkholed","trigger":"wswhats.cyou","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"wswhats.cyou/static/js/VXOmf3Wrc6.js","fqdn":"wswhats.cyou","domain":"wswhats.cyou","tld":"cyou"},"ip":{"addr":"94.154.43.128","port":443,"asn":208485,"as":"Moon Dc","country":"United Kingdom","country_code":"GB"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://wswhats.cyou/","date":"2026-10-02T18:05:55.366Z","timestamp":1790964355366,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"mlkem768x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"wswhats.cyou","organization":""},"issuer":{"commonName":"YR1","organization":"Let's Encrypt"},"validity":{"start":"Thu, 01 Oct 2026 05:50:09 GMT","end":"Wed, 30 Dec 2026 05:50:08 GMT"},"fingerprint":{"sha1":"99:33:2E:76:02:E0:85:95:DA:6D:9A:7B:C9:4F:EC:16:56:25:F1:EA","sha256":"21:00:DA:A9:E9:28:B4:E9:B8:FF:17:EA:A3:35:82:1E:9D:9D:52:BC:53:FF:84:B1:8C:89:B2:DE:6B:04:5C:24"}}},"request":{"raw":"GET /static/js/VXOmf3Wrc6.js HTTP/1.1\r\nHost: wswhats.cyou\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://wswhats.cyou/\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=1\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Fri, 02 Oct 2026 18:05:55 GMT\r\nContent-Type: application/javascript\r\nTransfer-Encoding: chunked\r\nConnection: keep-alive\r\nLast-Modified: Wed, 28 May 2025 16:36:23 GMT\r\nVary: Accept-Encoding\r\nETag: W/\"68373b87-294fb\"\r\nContent-Encoding: gzip\r\nServer: nginx\r\nX-Cache-Status: HIT from L1:1118\r\nVia: L1:1118\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":169211,"size_decoded":66597,"mime_type":"application/javascript","magic":"JavaScript source, ASCII text, with very long lines (55754)","md5":"b88122cdcfa8f9c3e8b08bf466d4a38b","sha1":"91047b010c3bd957e30dc1bc788b2996b6a39571","sha256":"db2e7bc86cd435d02687f7ca3313ddf5bfd759034272275a90ea7d84adbb06dc","sha512":"70888b1eb4ae301739b266c4d48bf733fe18eaa5edc465d98f9a07ca1c3e45ef20bb5e781ea683928796faea8f565b151665e49de830ad421b6b649ffdce12f8","ssdeep":"3072:Eq6XkZvM4oDqQ2Ruyg5P/GrfBGoPrIutK:ZM4ZtBGcIuK","tlshash":"8cf3d48df6c5b0b113e720b4416f660bf27b6858b84ec1d0e266e4d56c7988e912bf3d","first_seen":"2026-10-01T02:41:29.701501Z","last_seen":"2026-10-02T18:06:25.910976Z","times_seen":4,"resource_available":true,"data":null}},"time_used":91,"timings":{"blocked":-1,"dns":0,"connect":17,"send":0,"wait":23,"receive":29,"ssl":21},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-10-02","alert":"Sinkholed","trigger":"wswhats.cyou","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-10-02","alert":"Sinkholed","trigger":"wswhats.cyou","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-10-02","alert":"Sinkholed","trigger":"wswhats.cyou","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-10-02","alert":"Phishing Block","trigger":"wswhats.cyou","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-10-02","alert":"Sinkholed","trigger":"wswhats.cyou","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"cira_dns","sensor_type":"DNS","title":"CIRA Canadian Shield DNS","description":"CIRA Canadian Shield DNS","scan_date":"2026-10-02","alert":"Sinkholed","trigger":"wswhats.cyou","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cira.ca/en/canadian-shield/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"wswhats.cyou/static/css/wwan9fAyhO.css","fqdn":"wswhats.cyou","domain":"wswhats.cyou","tld":"cyou"},"ip":{"addr":"94.154.43.128","port":443,"asn":208485,"as":"Moon Dc","country":"United Kingdom","country_code":"GB"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://wswhats.cyou/","date":"2026-10-02T18:05:55.792Z","timestamp":1790964355792,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"mlkem768x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"wswhats.cyou","organization":""},"issuer":{"commonName":"YR1","organization":"Let's Encrypt"},"validity":{"start":"Thu, 01 Oct 2026 05:50:09 GMT","end":"Wed, 30 Dec 2026 05:50:08 GMT"},"fingerprint":{"sha1":"99:33:2E:76:02:E0:85:95:DA:6D:9A:7B:C9:4F:EC:16:56:25:F1:EA","sha256":"21:00:DA:A9:E9:28:B4:E9:B8:FF:17:EA:A3:35:82:1E:9D:9D:52:BC:53:FF:84:B1:8C:89:B2:DE:6B:04:5C:24"}}},"request":{"raw":"GET /static/css/wwan9fAyhO.css HTTP/1.1\r\nHost: wswhats.cyou\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://wswhats.cyou/\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=2\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Fri, 02 Oct 2026 18:05:55 GMT\r\nContent-Type: text/css\r\nTransfer-Encoding: chunked\r\nConnection: keep-alive\r\nLast-Modified: Wed, 28 May 2025 16:36:23 GMT\r\nVary: Accept-Encoding\r\nETag: W/\"68373b87-e93\"\r\nContent-Encoding: gzip\r\nServer: nginx\r\nX-Cache-Status: HIT from L1:1118\r\nVia: L1:1118\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":3731,"size_decoded":1358,"mime_type":"text/css","magic":"ASCII text, with very long lines (3731), with no line terminators","md5":"d04961ce5c49351be2b565d678d8e646","sha1":"24454f79f63be585bcf337dd94dd122baf728694","sha256":"97676fc03086bd0940eed0c755603d0fc306b43339ffcabc31dffd8bf921e3a8","sha512":"c2dc3ce59943a21a2f7e10b616eb916dccd66adfe2f04bae4e19f43e8f18d7c8b632ae4aecd8a4f41495bc2f5ad7c157b5e702dd861a3da5b091c283aa43edb2","ssdeep":"","tlshash":"0b71ed1421aa0536fc77dd2596bc2309035dad039a1246eb641ba6bfcbc379f30225af","first_seen":"2026-10-01T02:41:29.694695Z","last_seen":"2026-10-02T18:06:25.913249Z","times_seen":4,"resource_available":true,"data":null}},"time_used":23,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":23,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-10-02","alert":"Sinkholed","trigger":"wswhats.cyou","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-10-02","alert":"Sinkholed","trigger":"wswhats.cyou","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-10-02","alert":"Sinkholed","trigger":"wswhats.cyou","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-10-02","alert":"Sinkholed","trigger":"wswhats.cyou","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"cira_dns","sensor_type":"DNS","title":"CIRA Canadian Shield DNS","description":"CIRA Canadian Shield DNS","scan_date":"2026-10-02","alert":"Sinkholed","trigger":"wswhats.cyou","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cira.ca/en/canadian-shield/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-10-02","alert":"Phishing Block","trigger":"wswhats.cyou","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"wswhats.cyou/static/js/VXOm82Wrc6.js","fqdn":"wswhats.cyou","domain":"wswhats.cyou","tld":"cyou"},"ip":{"addr":"94.154.43.128","port":443,"asn":208485,"as":"Moon Dc","country":"United Kingdom","country_code":"GB"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://wswhats.cyou/","date":"2026-10-02T18:05:55.793Z","timestamp":1790964355793,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"mlkem768x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"wswhats.cyou","organization":""},"issuer":{"commonName":"YR1","organization":"Let's Encrypt"},"validity":{"start":"Thu, 01 Oct 2026 05:50:09 GMT","end":"Wed, 30 Dec 2026 05:50:08 GMT"},"fingerprint":{"sha1":"99:33:2E:76:02:E0:85:95:DA:6D:9A:7B:C9:4F:EC:16:56:25:F1:EA","sha256":"21:00:DA:A9:E9:28:B4:E9:B8:FF:17:EA:A3:35:82:1E:9D:9D:52:BC:53:FF:84:B1:8C:89:B2:DE:6B:04:5C:24"}}},"request":{"raw":"GET /static/js/VXOm82Wrc6.js HTTP/1.1\r\nHost: wswhats.cyou\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://wswhats.cyou/\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Fri, 02 Oct 2026 18:05:55 GMT\r\nContent-Type: application/javascript\r\nTransfer-Encoding: chunked\r\nConnection: keep-alive\r\nLast-Modified: Wed, 28 May 2025 16:36:23 GMT\r\nVary: Accept-Encoding\r\nETag: W/\"68373b87-f4cd\"\r\nContent-Encoding: gzip\r\nServer: nginx\r\nX-Cache-Status: HIT from L1:1118\r\nVia: L1:1118\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":62669,"size_decoded":25877,"mime_type":"application/javascript","magic":"JavaScript source, Unicode text, UTF-8 text, with very long lines (62302), with no line terminators","md5":"5fac9c0ebef535e420ec1d9ee7940577","sha1":"3c5db78ef2aa4a254ad299b47fc72f565fe7f4af","sha256":"58087a116f3e2a14d604c08b91963464620e293634ff5ea4fe34e5611c223d02","sha512":"64f19a433b41bfceed3642c0452aef0b4c0b223abd7779ce547eeb3d07ddbec8961b4778693e583dc42bd2b783b6e4899c9fd7837619fa7b5a0a61eccb99ec37","ssdeep":"1536:mUAydHYRhpgITo6Qn7aEiC9FpTWlMA+/jEGhyU:CRMIToz/FpDEGhj","tlshash":"8a533ae5e7a062f4c01ac7b5952b5431716a18f539158088fbf8c9f4a4b4be4df0eaf8","first_seen":"2026-10-01T02:41:29.696069Z","last_seen":"2026-10-02T18:06:25.915027Z","times_seen":4,"resource_available":true,"data":null}},"time_used":20,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":18,"receive":2,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-10-02","alert":"Sinkholed","trigger":"wswhats.cyou","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-10-02","alert":"Sinkholed","trigger":"wswhats.cyou","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"cira_dns","sensor_type":"DNS","title":"CIRA Canadian Shield DNS","description":"CIRA Canadian Shield DNS","scan_date":"2026-10-02","alert":"Sinkholed","trigger":"wswhats.cyou","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cira.ca/en/canadian-shield/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-10-02","alert":"Sinkholed","trigger":"wswhats.cyou","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-10-02","alert":"Phishing Block","trigger":"wswhats.cyou","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-10-02","alert":"Sinkholed","trigger":"wswhats.cyou","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"wswhats.cyou/favicon.ico","fqdn":"wswhats.cyou","domain":"wswhats.cyou","tld":"cyou"},"ip":{"addr":"94.154.43.128","port":443,"asn":208485,"as":"Moon Dc","country":"United Kingdom","country_code":"GB"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://wswhats.cyou/","date":"2026-10-02T18:05:55.819Z","timestamp":1790964355819,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"mlkem768x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"wswhats.cyou","organization":""},"issuer":{"commonName":"YR1","organization":"Let's Encrypt"},"validity":{"start":"Thu, 01 Oct 2026 05:50:09 GMT","end":"Wed, 30 Dec 2026 05:50:08 GMT"},"fingerprint":{"sha1":"99:33:2E:76:02:E0:85:95:DA:6D:9A:7B:C9:4F:EC:16:56:25:F1:EA","sha256":"21:00:DA:A9:E9:28:B4:E9:B8:FF:17:EA:A3:35:82:1E:9D:9D:52:BC:53:FF:84:B1:8C:89:B2:DE:6B:04:5C:24"}}},"request":{"raw":"GET /favicon.ico HTTP/1.1\r\nHost: wswhats.cyou\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://wswhats.cyou/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=6\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Fri, 02 Oct 2026 18:05:55 GMT\r\nContent-Type: image/x-icon\r\nContent-Length: 787\r\nConnection: keep-alive\r\nLast-Modified: Wed, 28 May 2025 16:36:23 GMT\r\nETag: \"68373b87-313\"\r\nServer: nginx\r\nX-Cache-Status: HIT from L1:1118\r\nVia: L1:1118\r\nAccept-Ranges: bytes\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":787,"size_decoded":1069,"mime_type":"image/x-icon","magic":"PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced","md5":"c5088e888c97ad440a61d247596f88e5","sha1":"865a0d1bb7e1245e046c5e1bae988cce53330280","sha256":"d0cadf240e89340b93df35240e7809039c1c574be05fbe2cf3243e2f487bc9ec","sha512":"ae2a039fc7c2ec70ad33eec78b3392d96d7899fb8bfffce45808c5d9e1ae6b3a73607b85d04433de16da43a8c007cb158e5d461302845edd15cba387d4b7e946","ssdeep":"","tlshash":"3101c530a610efb8c39b8eaaa6a0c2741219119d967aa63a080de03fce608c042d003c","first_seen":"2023-05-03T14:02:32Z","last_seen":"2026-10-02T18:06:25.917065Z","times_seen":1572,"resource_available":false,"data":null}},"time_used":23,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":23,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-10-02","alert":"Sinkholed","trigger":"wswhats.cyou","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-10-02","alert":"Sinkholed","trigger":"wswhats.cyou","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-10-02","alert":"Sinkholed","trigger":"wswhats.cyou","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-10-02","alert":"Phishing Block","trigger":"wswhats.cyou","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"cira_dns","sensor_type":"DNS","title":"CIRA Canadian Shield DNS","description":"CIRA Canadian Shield DNS","scan_date":"2026-10-02","alert":"Sinkholed","trigger":"wswhats.cyou","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cira.ca/en/canadian-shield/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-10-02","alert":"Sinkholed","trigger":"wswhats.cyou","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"wswhats.cyou/static/css/wwanb8AyhO.css","fqdn":"wswhats.cyou","domain":"wswhats.cyou","tld":"cyou"},"ip":{"addr":"94.154.43.128","port":443,"asn":208485,"as":"Moon Dc","country":"United Kingdom","country_code":"GB"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://wswhats.cyou/","date":"2026-10-02T18:05:55.363Z","timestamp":1790964355363,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"mlkem768x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"wswhats.cyou","organization":""},"issuer":{"commonName":"YR1","organization":"Let's Encrypt"},"validity":{"start":"Thu, 01 Oct 2026 05:50:09 GMT","end":"Wed, 30 Dec 2026 05:50:08 GMT"},"fingerprint":{"sha1":"99:33:2E:76:02:E0:85:95:DA:6D:9A:7B:C9:4F:EC:16:56:25:F1:EA","sha256":"21:00:DA:A9:E9:28:B4:E9:B8:FF:17:EA:A3:35:82:1E:9D:9D:52:BC:53:FF:84:B1:8C:89:B2:DE:6B:04:5C:24"}}},"request":{"raw":"GET /static/css/wwanb8AyhO.css HTTP/1.1\r\nHost: wswhats.cyou\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://wswhats.cyou/\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=0\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Fri, 02 Oct 2026 18:05:55 GMT\r\nContent-Type: text/css\r\nTransfer-Encoding: chunked\r\nConnection: keep-alive\r\nLast-Modified: Wed, 28 May 2025 16:36:23 GMT\r\nVary: Accept-Encoding\r\nETag: W/\"68373b87-47e\"\r\nContent-Encoding: gzip\r\nServer: nginx\r\nX-Cache-Status: HIT from L1:1118\r\nVia: L1:1118\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":1150,"size_decoded":753,"mime_type":"text/css","magic":"ASCII text, with very long lines (1150), with no line terminators","md5":"02c770f9e4a5eb4864805df48640dad5","sha1":"e3f9bb7916e0f62d78d2a4213c3ddd9b13bf66c5","sha256":"759dc14a647618bcae5099437c89998c28a2828fd56784bf1ce88edea1c037fa","sha512":"bf639d5882d032ad3cfc31fdcdd4bc4006e974edcccfc5796c33cd1de3b4ad152f286590ab19e8ceec5a25ca375479efa16780c2dc60c96684cb74ee82e02f84","ssdeep":"","tlshash":"0a21d932cca01067a1276d07b7cf0a99037ac602863bc6cd7b543419c786b6c1c9ef9b","first_seen":"2023-10-29T02:31:40Z","last_seen":"2026-10-02T18:06:25.918137Z","times_seen":38,"resource_available":true,"data":null}},"time_used":24,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":24,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-10-02","alert":"Sinkholed","trigger":"wswhats.cyou","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-10-02","alert":"Sinkholed","trigger":"wswhats.cyou","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-10-02","alert":"Sinkholed","trigger":"wswhats.cyou","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-10-02","alert":"Sinkholed","trigger":"wswhats.cyou","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"cira_dns","sensor_type":"DNS","title":"CIRA Canadian Shield DNS","description":"CIRA Canadian Shield DNS","scan_date":"2026-10-02","alert":"Sinkholed","trigger":"wswhats.cyou","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cira.ca/en/canadian-shield/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-10-02","alert":"Phishing Block","trigger":"wswhats.cyou","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"wswhats.cyou/static/js/rmEhbO2u.js","fqdn":"wswhats.cyou","domain":"wswhats.cyou","tld":"cyou"},"ip":{"addr":"94.154.43.128","port":443,"asn":208485,"as":"Moon Dc","country":"United Kingdom","country_code":"GB"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://wswhats.cyou/","date":"2026-10-02T18:05:55.367Z","timestamp":1790964355367,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"mlkem768x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"wswhats.cyou","organization":""},"issuer":{"commonName":"YR1","organization":"Let's Encrypt"},"validity":{"start":"Thu, 01 Oct 2026 05:50:09 GMT","end":"Wed, 30 Dec 2026 05:50:08 GMT"},"fingerprint":{"sha1":"99:33:2E:76:02:E0:85:95:DA:6D:9A:7B:C9:4F:EC:16:56:25:F1:EA","sha256":"21:00:DA:A9:E9:28:B4:E9:B8:FF:17:EA:A3:35:82:1E:9D:9D:52:BC:53:FF:84:B1:8C:89:B2:DE:6B:04:5C:24"}}},"request":{"raw":"GET /static/js/rmEhbO2u.js HTTP/1.1\r\nHost: wswhats.cyou\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://wswhats.cyou/\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=1\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Fri, 02 Oct 2026 18:05:55 GMT\r\nContent-Type: application/javascript\r\nTransfer-Encoding: chunked\r\nConnection: keep-alive\r\nLast-Modified: Wed, 28 May 2025 16:36:23 GMT\r\nVary: Accept-Encoding\r\nETag: W/\"68373b87-15a7\"\r\nContent-Encoding: gzip\r\nServer: nginx\r\nX-Cache-Status: HIT from L1:1118\r\nVia: L1:1118\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":5543,"size_decoded":2817,"mime_type":"application/javascript","magic":"JavaScript source, ASCII text, with very long lines (5543), with no line terminators","md5":"310cc7176b4a04d7afc1432fb93fdee9","sha1":"f378d1753af054bcfddd0c139f4f162416031405","sha256":"845e68683677951b282b63f76b147422796daea20ab1ad8720bc9e805d57d010","sha512":"bcf04ac1da33464db13dadb54edc768ede8860588c3f35f0a918ab05a83c2ae6379706e63c51728237d658d9a113e641f8ce77bc0ce3bfe28fdf867076a12717","ssdeep":"96:EoHLlMJH/HB4TF2+WLiX/kCsZ1zl0NhNtry0euEHY3LkNDNS:rWvKTF2+WqJszmbFMiLGxS","tlshash":"80b1e8ee72e5b86e07532472813fb287f17728b2542f80555369d8f5be78d880227f94","first_seen":"2026-10-01T02:41:29.693096Z","last_seen":"2026-10-02T18:06:25.919898Z","times_seen":4,"resource_available":true,"data":null}},"time_used":65,"timings":{"blocked":-1,"dns":0,"connect":20,"send":0,"wait":21,"receive":0,"ssl":24},"alerts":{"ids":null,"analyzer":[{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-10-02","alert":"Sinkholed","trigger":"wswhats.cyou","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-10-02","alert":"Phishing Block","trigger":"wswhats.cyou","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-10-02","alert":"Sinkholed","trigger":"wswhats.cyou","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"cira_dns","sensor_type":"DNS","title":"CIRA Canadian Shield DNS","description":"CIRA Canadian Shield DNS","scan_date":"2026-10-02","alert":"Sinkholed","trigger":"wswhats.cyou","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cira.ca/en/canadian-shield/","meta":null},{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-10-02","alert":"Sinkholed","trigger":"wswhats.cyou","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-10-02","alert":"Sinkholed","trigger":"wswhats.cyou","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}}]}