{"report_id":"62fa2a0b-1baa-49c1-be81-86f3ed8c76e3","version":0,"status":"done","tags":[],"date":"2026-10-15T01:29:27Z","url":{"schema":"http","addr":"whatdom.icu/","fqdn":"whatdom.icu","domain":"whatdom.icu","tld":"icu"},"ip":{"addr":"156.251.16.120","port":0,"asn":399077,"as":"Tcloudnet","country":"Hong Kong","country_code":"HK"},"final":{"url":{"schema":"https","addr":"www.whatdom.icu/#/","fqdn":"www.whatdom.icu","domain":"whatdom.icu","tld":"icu"},"title":"WhatsApp","dom":{"size":43252,"mime_type":"text/html; charset=utf-8","magic":"JavaScript source, Unicode text, UTF-8 text, with very long lines (33661)","md5":"e55776948bde52967826f6a93f44f266","sha1":"f077e394d62e30a47555c4f1ec2f4d91e64dacb8","sha256":"4e4e8c71b381f3798ffb76218507650bd4abd0bba3aac337399618abfee9bf81","sha512":"3398d8d1caa363bf889b9734d7880f37b2632a7a4afefdb0f23e8b91c6f1f6e80bd9d8ad8023e9f7e3601f7f96614a1ae9d199118e621a4eea0276fe3f1fd70a","ssdeep":"768:7FzREYHR7FezRgtdgTtdgIaZNYaZNWLg0iLxZYitbW6YEJJS+:ViYTeomZmPZdZsyLxZl5W6YEJJS+","tlshash":"a2133a717c8d342a6133d6c3f49d675d2da3aa13c245960b7b9e37388bc68929c38378","dom_hash":"domhashd90864785ab4bc645d851be70e5827e2","first_seen":"2026-10-02T03:23:24.839894Z","last_seen":"2026-10-15T01:29:32.021684Z","times_seen":3,"resource_available":false,"data":null}},"submit":{"url":{"schema":"http","addr":"whatdom.icu/","fqdn":"whatdom.icu","domain":"whatdom.icu","tld":"icu"},"ip":{"addr":"156.251.16.120","port":0,"asn":399077,"as":"Tcloudnet","country":"Hong Kong","country_code":"HK"},"tags":null,"meta":null},"settings":{"access":"public","device_type":"desktop","expires_at":"2027-11-19T01:29:27Z","useragent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0","referer":"","cookies":null,"exit_node":"qguvgzjxzsgb3vs"},"stats":{"alert_count":{"ids":0,"urlquery":0,"analyzer":18}},"detection":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-10-15","alert":"Sinkholed","trigger":"admin.whatdom.icu","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-10-15","alert":"Phishing Block","trigger":"admin.whatdom.icu","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-10-15","alert":"Sinkholed","trigger":"admin.whatdom.icu","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-10-15","alert":"Sinkholed","trigger":"admin.whatdom.icu","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"cira_dns","sensor_type":"DNS","title":"CIRA Canadian Shield DNS","description":"CIRA Canadian Shield DNS","scan_date":"2026-10-15","alert":"Sinkholed","trigger":"admin.whatdom.icu","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cira.ca/en/canadian-shield/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-10-15","alert":"Sinkholed","trigger":"admin.whatdom.icu","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-10-15","alert":"Sinkholed","trigger":"www.whatdom.icu","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"cira_dns","sensor_type":"DNS","title":"CIRA Canadian Shield DNS","description":"CIRA Canadian Shield DNS","scan_date":"2026-10-15","alert":"Sinkholed","trigger":"www.whatdom.icu","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cira.ca/en/canadian-shield/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-10-15","alert":"Phishing Block","trigger":"www.whatdom.icu","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-10-15","alert":"Sinkholed","trigger":"www.whatdom.icu","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-10-15","alert":"Sinkholed","trigger":"www.whatdom.icu","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-10-15","alert":"Sinkholed","trigger":"www.whatdom.icu","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-10-15","alert":"Sinkholed","trigger":"whatdom.icu","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-10-15","alert":"Sinkholed","trigger":"whatdom.icu","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-10-15","alert":"Sinkholed","trigger":"whatdom.icu","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-10-15","alert":"Phishing Block","trigger":"whatdom.icu","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-10-15","alert":"Sinkholed","trigger":"whatdom.icu","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"cira_dns","sensor_type":"DNS","title":"CIRA Canadian Shield DNS","description":"CIRA Canadian Shield DNS","scan_date":"2026-10-15","alert":"Sinkholed","trigger":"whatdom.icu","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cira.ca/en/canadian-shield/","meta":null}],"urlquery":null},"summary":[{"fqdn":"whatdom.icu","ip":{"addr":"","port":0,"asn":0,"as":"","country":"","country_code":"zz"},"domain_registered":"2026-10-09","domain_rank":0,"first_seen":"2026-10-15T01:07:04.492578Z","last_seen":"2026-10-15T01:07:04.492578Z","alert_count":6,"request_count":1,"received_data":0,"sent_data":480,"comment":"","tags":null,"fingerprints":null},{"fqdn":"admin.whatdom.icu","ip":{"addr":"156.251.16.120","port":443,"asn":399077,"as":"TERAEXCH","country":"Hong Kong","country_code":"HK"},"domain_registered":"2026-10-09","domain_rank":0,"first_seen":"2026-10-15T01:07:04.489257Z","last_seen":"2026-10-15T01:07:04.489257Z","alert_count":12,"request_count":3,"received_data":109134,"sent_data":1726,"comment":"","tags":null,"fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"WebSocket","description":"WebSocket is a communication protocol that provides full-duplex communication channels over a single, long-lived connection, enabling interactive communication between web browsers and servers.","website":"https://en.wikipedia.org/wiki/WebSocket","common_platform_enumeration":"","icon":"WebSocket.svg","categories":["Miscellaneous"]}]},{"fqdn":"www.whatdom.icu","ip":{"addr":"156.251.16.120","port":443,"asn":399077,"as":"TERAEXCH","country":"Hong Kong","country_code":"HK"},"domain_registered":"2026-10-09","domain_rank":0,"first_seen":"2026-10-15T01:07:04.487188Z","last_seen":"2026-10-15T01:07:04.487188Z","alert_count":54,"request_count":9,"received_data":1237185,"sent_data":4316,"comment":"","tags":null,"fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}]},{"fqdn":"cdn.dcloud.net.cn","ip":{"addr":"124.174.94.0","port":443,"asn":0,"as":"","country":"China","country_code":"CN"},"domain_registered":"2013-07-17","domain_rank":296858,"first_seen":"2018-09-15T09:18:08Z","last_seen":"2026-10-10T16:04:14.856558Z","alert_count":0,"request_count":1,"received_data":577,"sent_data":550,"comment":"","tags":null,"fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}]}],"files":null,"artifacts":{"windows_shortcuts":null,"files":null,"telegram":null,"pdfs":null,"clipboard":null},"sensors":{"ids":null,"analyzer":null,"urlquery":null},"javascript":{"script":[{"url":{"schema":"https","addr":"www.whatdom.icu/static/js/pages-kefu-get-code~pages-kefu-index.e554c9ef.js","fqdn":"www.whatdom.icu","domain":"whatdom.icu","tld":"icu"},"ip":{"addr":"156.251.16.120","port":443,"asn":399077,"as":"TERAEXCH","country":"Hong Kong","country_code":"HK"},"introduction_type":"scriptElement","is_inline":false,"md5":"a93b4f157657d6ad14786afcb78654f0","sha1":"0fa94608344a6aabde6d2ce4637c81e9afc9da5d","sha256":"d725a492d058509847245be8e410cbb2d2dd68c3a4f073299f8054ad7bb3fbb7","sha512":"13e0ae24c7080acaf548c809f95ce7dc4f9d732f63c935029d03778b79d5ae378fc5110f07f86bcd71575433fe8c38661ccadbba819e31707c5ec536aa9e434e","ssdeep":"384:7y1V4k+jmnF6S+58pO1aC71Gy3jZC3jeZjXyQZQ7qQJS+5gxkCcndPb8+f1J2H:u1+joF6S+a0sCPj6+wbWkLy","tlshash":"84f22a8d72dbf42d42935270b01f204ae1698c19e90e4922e77ec9e1bca558ed337fb5","size":34586,"data":"","first_seen":"2026-10-02T03:23:24.843233Z","last_seen":"2026-10-15T01:29:32.02624Z","times_seen":3,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"www.whatdom.icu/static/js/pages-kefu-index.5398bf36.js","fqdn":"www.whatdom.icu","domain":"whatdom.icu","tld":"icu"},"ip":{"addr":"156.251.16.120","port":443,"asn":399077,"as":"TERAEXCH","country":"Hong Kong","country_code":"HK"},"introduction_type":"scriptElement","is_inline":false,"md5":"30049d74f10beff21282ac62f600be76","sha1":"05e7ec8e903ff0bc7a5564c661b688920852c697","sha256":"16a9039936bdb0e4b5180380bf105ddf4807f1d2f6127ddc4190dbe1c502f07f","sha512":"ece52c88cbf4b49f3b98c776576e555ead612b0a3dbdd36500f2195ed7e422b5fbd6ba9dc8827cab6c30eab18d56679a0971a5c510e5c8ea8bc254f617dad713","ssdeep":"1536:gpC1r+8ZpmzU8jRkspzaeh0tcKrR/PAAA2rzRiKYRQ9++k3npnys7T1:z1DZpmhaeQR/pvr5U5ny4","tlshash":"94734bb5f4d9b42d499396a2b06f35141d373d63e044a50bfb79e9e887d8d892023b3c","size":78179,"data":"","first_seen":"2026-10-15T01:07:12.268629Z","last_seen":"2026-10-15T01:29:32.030024Z","times_seen":2,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"www.whatdom.icu/","fqdn":"www.whatdom.icu","domain":"whatdom.icu","tld":"icu"},"ip":{"addr":"156.251.16.120","port":443,"asn":399077,"as":"TERAEXCH","country":"Hong Kong","country_code":"HK"},"introduction_type":"scriptElement","is_inline":true,"md5":"93368157fb131b56a45d6f60f8b40342","sha1":"ea2a25edb7b00c3e0a06650f02fded5bd87dfa20","sha256":"c48d4859bc082aa591168f7d7230bef438ecc2b3074e707c83864e11ec1a891f","sha512":"366c90d022f7fd6718d76460de51a154cf6cf8bf8e3aefa2e0e736cbba24ec53506485331abd3c3c2a7e6ae00c9a3b957a9aa675ecdd389afca7863ad8365908","ssdeep":"","tlshash":"c8e068c260a6294c02208016304ac1031bb608729ec149613c4c67a58fb9f4bc46e859","size":352,"data":"","first_seen":"2023-03-07T01:10:06Z","last_seen":"2026-10-15T01:29:32.035888Z","times_seen":7402,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"www.whatdom.icu/static/js/chunk-vendors.20d8cef3.js","fqdn":"www.whatdom.icu","domain":"whatdom.icu","tld":"icu"},"ip":{"addr":"156.251.16.120","port":443,"asn":399077,"as":"TERAEXCH","country":"Hong Kong","country_code":"HK"},"introduction_type":"scriptElement","is_inline":false,"md5":"fa707c11f47f65607197c68bcfdb17b9","sha1":"89ee191a23cafd8e502578dbaacbfc102b4c7dff","sha256":"401f5a3b09bd5434666c0a2cc749bd4ee741b319ef0efc3e642e01f7e4efbd14","sha512":"f6a6be2bec413fc60322a8d493b599811d43bfc815d7aae26389b671fd1b1ae97d692e22093af91e7068e1c82e109aa08d82e9a55ef8128cbafbbd4b935f3fe2","ssdeep":"6144:syP1zjf8dK4H0FhXMwTfmfXb//noHZNTz1Y3vm7Kta/hAq2vxzfep+22Lp3:s+5EIh8wTODnCZtartVvxzn2G","tlshash":"a9f4f78df282b0b60be761b5403f220ba2376959b40ac4d4f675e4d4ad7894e2237f7d","size":794553,"data":"","first_seen":"2024-12-27T15:52:57.829656Z","last_seen":"2026-10-15T01:29:32.035046Z","times_seen":10,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"www.whatdom.icu/static/js/index.d7f6298c.js","fqdn":"www.whatdom.icu","domain":"whatdom.icu","tld":"icu"},"ip":{"addr":"156.251.16.120","port":443,"asn":399077,"as":"TERAEXCH","country":"Hong Kong","country_code":"HK"},"introduction_type":"scriptElement","is_inline":false,"md5":"24ef8f5155ac85f9ac3dd6a56719faf9","sha1":"381bb297fa6e306fa744fb299c1183399f7048ff","sha256":"0d69d8af438bd4ffbc85bb598b2a8d1f043a3ebeb128cc927285d1c5d761e644","sha512":"c6ff6b0efc296325b97c10cb03dc2d345fa83b22f2e920ff93b1cbb3efcb8b6edff6c8a3fb6691a029167664fdd445c6888e4b6032b92c96d4bebb93e4124d3a","ssdeep":"192:i2G3f06wpmecZR8MsYHW34/iHewln3J3ZlT3Q3dSXdUml16Ip:+gpmlZmMsY234/izn3J3HT3Q30Xl1T","tlshash":"0312ca9a35d6fb7d029730788c3f920aa5363fa13c5cf482db59d2a23f2954d9322b54","size":9882,"data":"","first_seen":"2026-10-02T03:23:24.841963Z","last_seen":"2026-10-15T01:29:32.025522Z","times_seen":3,"alerts":{"ids":null,"analyzer":null,"urlquery":null}}],"eval":null,"write":null,"console":null},"http":[{"url":{"schema":"https","addr":"admin.whatdom.icu/assets/addons/kefu/audio/message_prompt.wav","fqdn":"admin.whatdom.icu","domain":"whatdom.icu","tld":"icu"},"ip":{"addr":"156.251.16.120","port":443,"asn":399077,"as":"TERAEXCH","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"media","requested_by":"https://www.whatdom.icu/","date":"2026-10-15T01:28:59.275Z","timestamp":1792027739275,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"admin.whatdom.icu","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Fri, 09 Oct 2026 12:29:08 GMT","end":"Thu, 07 Jan 2027 12:29:07 GMT"},"fingerprint":{"sha1":"DD:5F:60:A3:59:90:E8:BB:61:AA:44:EE:45:F2:5E:D9:F8:E0:38:3A","sha256":"F5:D4:FC:15:96:17:7D:97:3F:88:8B:F0:41:A2:06:84:6B:B7:97:A2:61:18:6D:46:AF:2B:3E:C9:5F:95:18:6B"}}},"request":{"raw":"GET /assets/addons/kefu/audio/message_prompt.wav HTTP/1.1\r\nHost: admin.whatdom.icu\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: audio/webm,audio/ogg,audio/wav,audio/*;q=0.9,application/ogg;q=0.7,video/*;q=0.6,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nRange: bytes=0-\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://www.whatdom.icu/\r\nSec-Fetch-Dest: audio\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-site\r\nAccept-Encoding: identity\r\nPriority: u=4\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 206 \r\nserver: nginx\r\ndate: Thu, 15 Oct 2026 01:28:59 GMT\r\ncontent-type: application/octet-stream\r\ncontent-length: 90044\r\nlast-modified: Sat, 22 Aug 2026 01:37:48 GMT\r\netag: \"6a88fd6c-15fbc\"\r\nstrict-transport-security: max-age=31536000\r\ncontent-range: bytes 0-90043/90044\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"206","status_text":"Partial Content","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":90044,"size_decoded":90345,"mime_type":"audio/x-wav","magic":"RIFF (little-endian) data, WAVE audio, Microsoft PCM, 16 bit, stereo 11025 Hz","md5":"cba79717c1981326caaad3ca2da06527","sha1":"6436164c83b08b6497769e36ad5ed323ad3e8b4c","sha256":"bf7191078dc870fd1691dc1f4a5bc74bd609862903b79320bb35ab69a1141cdd","sha512":"8df464439ea5184c199207323c3d5261033bac3814f3a5dc40ebad0d8cbdcf34c79473fa342a8580ad14466d115decf5bbbfdc97c03b0b6776f8433f239ebf26","ssdeep":"768:omMb4fcpdfBv/ZSXpDPyb1ry8PgcN5dlKsTvNNNS:oXbqcpdfZZSZDPyZr/vbjbS","tlshash":"c593fd537241e802d80d2fb74d56ebe86732bd95bf07a3533480376e6ebb6c28e54690","first_seen":"2023-04-08T10:34:50Z","last_seen":"2026-10-15T01:29:32.023765Z","times_seen":8,"resource_available":false,"data":null}},"time_used":1701,"timings":{"blocked":0,"dns":0,"connect":283,"send":0,"wait":283,"receive":849,"ssl":286},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-10-15","alert":"Sinkholed","trigger":"admin.whatdom.icu","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-10-15","alert":"Phishing Block","trigger":"admin.whatdom.icu","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-10-15","alert":"Sinkholed","trigger":"admin.whatdom.icu","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-10-15","alert":"Sinkholed","trigger":"admin.whatdom.icu","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"cira_dns","sensor_type":"DNS","title":"CIRA Canadian Shield DNS","description":"CIRA Canadian Shield DNS","scan_date":"2026-10-15","alert":"Sinkholed","trigger":"admin.whatdom.icu","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cira.ca/en/canadian-shield/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-10-15","alert":"Sinkholed","trigger":"admin.whatdom.icu","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"www.whatdom.icu/static/wsapp/tips.png","fqdn":"www.whatdom.icu","domain":"whatdom.icu","tld":"icu"},"ip":{"addr":"156.251.16.120","port":443,"asn":399077,"as":"TERAEXCH","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://www.whatdom.icu/","date":"2026-10-15T01:29:00.090Z","timestamp":1792027740090,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"www.whatdom.icu","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Fri, 09 Oct 2026 12:39:03 GMT","end":"Thu, 07 Jan 2027 12:39:02 GMT"},"fingerprint":{"sha1":"31:D7:E1:2D:94:7E:3C:4A:06:B8:91:C1:2E:AC:60:90:5C:1A:EF:ED","sha256":"8A:F3:95:FB:B1:83:24:4E:29:26:08:BB:39:C8:45:AF:E5:0D:A2:EA:78:16:F2:28:05:FD:E2:56:89:C7:7F:7C"}}},"request":{"raw":"GET /static/wsapp/tips.png HTTP/1.1\r\nHost: www.whatdom.icu\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://www.whatdom.icu/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nserver: nginx\r\ndate: Thu, 15 Oct 2026 01:29:00 GMT\r\ncontent-type: image/png\r\ncontent-length: 131145\r\nlast-modified: Tue, 22 Sep 2026 13:40:24 GMT\r\netag: \"6ab28548-20049\"\r\nexpires: Sat, 14 Nov 2026 01:29:00 GMT\r\ncache-control: max-age=2592000\r\nstrict-transport-security: max-age=31536000\r\naccept-ranges: bytes\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":131145,"size_decoded":131490,"mime_type":"image/png","magic":"JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 1644x1100, components 3","md5":"fb17a4af8b6de00542bd3215843d44f9","sha1":"c24a22e82fe3f72671cbf430c250752f0e82b491","sha256":"ed7f06474e7a4280761d8fd1afc0b5111a135f24794828b13129df3da000b86a","sha512":"1eef59a46fdbf84b9145cb887cc716c13f8e81d0af5bf9dff61a12a9f659d78134bf70b1ad33239f19a153da318849503fe69ecfa9a44c23ee621e883334496e","ssdeep":"3072:sRlnO4XEQ+F57VsP7+QokA0ZnA25cxIA3OZ:SntEQ+TGzxozc5ctq","tlshash":"6bd3f1325b61d89bf0d014351cd1cf6289d47a27fea9d3b9ca2b5a0f8875eed9dc0a40","first_seen":"2026-10-02T03:23:24.844397Z","last_seen":"2026-10-15T01:29:32.02468Z","times_seen":3,"resource_available":false,"data":null}},"time_used":274,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":274,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-10-15","alert":"Sinkholed","trigger":"www.whatdom.icu","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"cira_dns","sensor_type":"DNS","title":"CIRA Canadian Shield DNS","description":"CIRA Canadian Shield DNS","scan_date":"2026-10-15","alert":"Sinkholed","trigger":"www.whatdom.icu","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cira.ca/en/canadian-shield/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-10-15","alert":"Phishing Block","trigger":"www.whatdom.icu","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-10-15","alert":"Sinkholed","trigger":"www.whatdom.icu","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-10-15","alert":"Sinkholed","trigger":"www.whatdom.icu","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-10-15","alert":"Sinkholed","trigger":"www.whatdom.icu","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"www.whatdom.icu/static/js/index.d7f6298c.js","fqdn":"www.whatdom.icu","domain":"whatdom.icu","tld":"icu"},"ip":{"addr":"156.251.16.120","port":443,"asn":399077,"as":"TERAEXCH","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://www.whatdom.icu/","date":"2026-10-15T01:28:56.177Z","timestamp":1792027736177,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"www.whatdom.icu","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Fri, 09 Oct 2026 12:39:03 GMT","end":"Thu, 07 Jan 2027 12:39:02 GMT"},"fingerprint":{"sha1":"31:D7:E1:2D:94:7E:3C:4A:06:B8:91:C1:2E:AC:60:90:5C:1A:EF:ED","sha256":"8A:F3:95:FB:B1:83:24:4E:29:26:08:BB:39:C8:45:AF:E5:0D:A2:EA:78:16:F2:28:05:FD:E2:56:89:C7:7F:7C"}}},"request":{"raw":"GET /static/js/index.d7f6298c.js HTTP/1.1\r\nHost: www.whatdom.icu\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://www.whatdom.icu/\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nserver: nginx\r\ndate: Thu, 15 Oct 2026 01:28:56 GMT\r\ncontent-type: application/javascript\r\nlast-modified: Tue, 22 Sep 2026 13:40:38 GMT\r\nvary: Accept-Encoding\r\netag: W/\"6ab28556-269a\"\r\nexpires: Thu, 15 Oct 2026 13:28:56 GMT\r\ncache-control: max-age=43200\r\nstrict-transport-security: max-age=31536000\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":9882,"size_decoded":3662,"mime_type":"application/javascript","magic":"JavaScript source, Unicode text, UTF-8 text, with very long lines (9848), with no line terminators","md5":"24ef8f5155ac85f9ac3dd6a56719faf9","sha1":"381bb297fa6e306fa744fb299c1183399f7048ff","sha256":"0d69d8af438bd4ffbc85bb598b2a8d1f043a3ebeb128cc927285d1c5d761e644","sha512":"c6ff6b0efc296325b97c10cb03dc2d345fa83b22f2e920ff93b1cbb3efcb8b6edff6c8a3fb6691a029167664fdd445c6888e4b6032b92c96d4bebb93e4124d3a","ssdeep":"192:i2G3f06wpmecZR8MsYHW34/iHewln3J3ZlT3Q3dSXdUml16Ip:+gpmlZmMsY234/izn3J3HT3Q30Xl1T","tlshash":"0312ca9a35d6fb7d029730788c3f920aa5363fa13c5cf482db59d2a23f2954d9322b54","first_seen":"2026-10-02T03:23:24.841963Z","last_seen":"2026-10-15T01:29:32.025522Z","times_seen":3,"resource_available":true,"data":null}},"time_used":805,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":805,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-10-15","alert":"Phishing Block","trigger":"www.whatdom.icu","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"cira_dns","sensor_type":"DNS","title":"CIRA Canadian Shield DNS","description":"CIRA Canadian Shield DNS","scan_date":"2026-10-15","alert":"Sinkholed","trigger":"www.whatdom.icu","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cira.ca/en/canadian-shield/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-10-15","alert":"Sinkholed","trigger":"www.whatdom.icu","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-10-15","alert":"Sinkholed","trigger":"www.whatdom.icu","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-10-15","alert":"Sinkholed","trigger":"www.whatdom.icu","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-10-15","alert":"Sinkholed","trigger":"www.whatdom.icu","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"www.whatdom.icu/static/js/pages-kefu-get-code~pages-kefu-index.e554c9ef.js","fqdn":"www.whatdom.icu","domain":"whatdom.icu","tld":"icu"},"ip":{"addr":"156.251.16.120","port":443,"asn":399077,"as":"TERAEXCH","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://www.whatdom.icu/","date":"2026-10-15T01:28:57.698Z","timestamp":1792027737698,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"www.whatdom.icu","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Fri, 09 Oct 2026 12:39:03 GMT","end":"Thu, 07 Jan 2027 12:39:02 GMT"},"fingerprint":{"sha1":"31:D7:E1:2D:94:7E:3C:4A:06:B8:91:C1:2E:AC:60:90:5C:1A:EF:ED","sha256":"8A:F3:95:FB:B1:83:24:4E:29:26:08:BB:39:C8:45:AF:E5:0D:A2:EA:78:16:F2:28:05:FD:E2:56:89:C7:7F:7C"}}},"request":{"raw":"GET /static/js/pages-kefu-get-code~pages-kefu-index.e554c9ef.js HTTP/1.1\r\nHost: www.whatdom.icu\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://www.whatdom.icu/\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nserver: nginx\r\ndate: Thu, 15 Oct 2026 01:28:57 GMT\r\ncontent-type: application/javascript\r\nlast-modified: Tue, 22 Sep 2026 13:40:24 GMT\r\nvary: Accept-Encoding\r\netag: W/\"6ab28548-871a\"\r\nexpires: Thu, 15 Oct 2026 13:28:57 GMT\r\ncache-control: max-age=43200\r\nstrict-transport-security: max-age=31536000\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":34586,"size_decoded":13249,"mime_type":"application/javascript","magic":"JavaScript source, Unicode text, UTF-8 text, with very long lines (29362)","md5":"a93b4f157657d6ad14786afcb78654f0","sha1":"0fa94608344a6aabde6d2ce4637c81e9afc9da5d","sha256":"d725a492d058509847245be8e410cbb2d2dd68c3a4f073299f8054ad7bb3fbb7","sha512":"13e0ae24c7080acaf548c809f95ce7dc4f9d732f63c935029d03778b79d5ae378fc5110f07f86bcd71575433fe8c38661ccadbba819e31707c5ec536aa9e434e","ssdeep":"384:7y1V4k+jmnF6S+58pO1aC71Gy3jZC3jeZjXyQZQ7qQJS+5gxkCcndPb8+f1J2H:u1+joF6S+a0sCPj6+wbWkLy","tlshash":"84f22a8d72dbf42d42935270b01f204ae1698c19e90e4922e77ec9e1bca558ed337fb5","first_seen":"2026-10-02T03:23:24.843233Z","last_seen":"2026-10-15T01:29:32.02624Z","times_seen":3,"resource_available":true,"data":null}},"time_used":270,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":270,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-10-15","alert":"Sinkholed","trigger":"www.whatdom.icu","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-10-15","alert":"Sinkholed","trigger":"www.whatdom.icu","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-10-15","alert":"Sinkholed","trigger":"www.whatdom.icu","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"cira_dns","sensor_type":"DNS","title":"CIRA Canadian Shield DNS","description":"CIRA Canadian Shield DNS","scan_date":"2026-10-15","alert":"Sinkholed","trigger":"www.whatdom.icu","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cira.ca/en/canadian-shield/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-10-15","alert":"Phishing Block","trigger":"www.whatdom.icu","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-10-15","alert":"Sinkholed","trigger":"www.whatdom.icu","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"admin.whatdom.icu/addons/kefu/index/initialize?modulename=index\u0026token=\u0026kefu_tourists_token=","fqdn":"admin.whatdom.icu","domain":"whatdom.icu","tld":"icu"},"ip":{"addr":"156.251.16.120","port":443,"asn":399077,"as":"TERAEXCH","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"https://www.whatdom.icu/","date":"2026-10-15T01:28:57.991Z","timestamp":1792027737991,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"admin.whatdom.icu","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Fri, 09 Oct 2026 12:29:08 GMT","end":"Thu, 07 Jan 2027 12:29:07 GMT"},"fingerprint":{"sha1":"DD:5F:60:A3:59:90:E8:BB:61:AA:44:EE:45:F2:5E:D9:F8:E0:38:3A","sha256":"F5:D4:FC:15:96:17:7D:97:3F:88:8B:F0:41:A2:06:84:6B:B7:97:A2:61:18:6D:46:AF:2B:3E:C9:5F:95:18:6B"}}},"request":{"raw":"GET /addons/kefu/index/initialize?modulename=index\u0026token=\u0026kefu_tourists_token= HTTP/1.1\r\nHost: admin.whatdom.icu\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nOrigin: https://www.whatdom.icu\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://www.whatdom.icu/\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nserver: nginx\r\ndate: Thu, 15 Oct 2026 01:28:58 GMT\r\ncontent-type: application/json; charset=utf-8\r\naccess-control-allow-origin: https://www.whatdom.icu\r\naccess-control-allow-credentials: true\r\naccess-control-max-age: 86400\r\nset-cookie: kefu_user=42733%7C864000%7C1792891738%7Cda3511ae1cd468641dfe24ec133998cb; expires=Sun, 12-Oct-2036 01:28:58 GMT; Max-Age=315360000; path=/\r\nstrict-transport-security: max-age=31536000\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":[{"name":"kefu_user","value":"42733%7C864000%7C1792891738%7Cda3511ae1cd468641dfe24ec133998cb","quoted":false,"path":"/","expires":"2036-10-12T01:28:58Z","raw_expires":"Sun, 12-Oct-2036 01:28:58 GMT","max_age":315360000,"secure":false,"http_only":false,"same_site":"","partitioned":false,"raw":"kefu_user=42733%7C864000%7C1792891738%7Cda3511ae1cd468641dfe24ec133998cb; expires=Sun, 12-Oct-2036 01:28:58 GMT; Max-Age=315360000; path=/"}],"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":18152,"size_decoded":18608,"mime_type":"application/json; charset=utf-8","magic":"JSON text data","md5":"0d23b1c570725f6e67848da484ac2915","sha1":"37da6609a5cc5acddc143c6c537b8d68afc96961","sha256":"3f618fc8cb39b23a0b5a6d846a2c0a5788838033377f3b6115b03ffed13da1b7","sha512":"077c71c31e8feaeff066b2a288778c84028e9892a4e8f6805c7b679d922f588f5bf84371441d613af16a4466ccc8b18bb9ebdb21b1bdf3c52b8ab9c92d9fd877","ssdeep":"192:is/uBhjNZiHYNG7MBXyp0LWdof6EXfcRezQlyC2hsv6N1g1JByg/vGo+eZPTIYbj:A5QKkGMsr+","tlshash":"0d82567338eec5351915a0caeb4b2e5ffc4872129c1cc975bf9e6cf48b48941eaa7421","first_seen":"2026-10-15T01:29:32.027407Z","last_seen":"2026-10-15T01:29:32.027407Z","times_seen":1,"resource_available":true,"data":null}},"time_used":1253,"timings":{"blocked":0,"dns":22,"connect":262,"send":0,"wait":702,"receive":0,"ssl":267},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-10-15","alert":"Sinkholed","trigger":"admin.whatdom.icu","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-10-15","alert":"Phishing Block","trigger":"admin.whatdom.icu","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-10-15","alert":"Sinkholed","trigger":"admin.whatdom.icu","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-10-15","alert":"Sinkholed","trigger":"admin.whatdom.icu","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-10-15","alert":"Sinkholed","trigger":"admin.whatdom.icu","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"cira_dns","sensor_type":"DNS","title":"CIRA Canadian Shield DNS","description":"CIRA Canadian Shield DNS","scan_date":"2026-10-15","alert":"Sinkholed","trigger":"admin.whatdom.icu","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cira.ca/en/canadian-shield/","meta":null}],"urlquery":null}},{"url":{"schema":"wss","addr":"wss://admin.whatdom.icu:1818/?modulename=index\u0026kefu_tourists_token=42733~864000~1792891738~da3511ae1cd468641dfe24ec133998cb","fqdn":"admin.whatdom.icu","domain":"whatdom.icu","tld":"icu"},"ip":{"addr":"156.251.16.120","port":1818,"asn":399077,"as":"TERAEXCH","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"websocket","requested_by":"https://www.whatdom.icu/","date":"2026-10-15T01:28:59.272Z","timestamp":1792027739272,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"admin.whatdom.icu","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Fri, 09 Oct 2026 12:29:08 GMT","end":"Thu, 07 Jan 2027 12:29:07 GMT"},"fingerprint":{"sha1":"DD:5F:60:A3:59:90:E8:BB:61:AA:44:EE:45:F2:5E:D9:F8:E0:38:3A","sha256":"F5:D4:FC:15:96:17:7D:97:3F:88:8B:F0:41:A2:06:84:6B:B7:97:A2:61:18:6D:46:AF:2B:3E:C9:5F:95:18:6B"}}},"request":{"raw":"GET /?modulename=index\u0026kefu_tourists_token=42733~864000~1792891738~da3511ae1cd468641dfe24ec133998cb HTTP/1.1\r\nHost: admin.whatdom.icu:1818\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-WebSocket-Version: 13\r\nOrigin: https://www.whatdom.icu\r\nSec-WebSocket-Extensions: permessage-deflate\r\nSec-WebSocket-Key: MIxF/c4NA9CCYHmV4xsi6A==\r\nSec-GPC: 1\r\nConnection: Upgrade\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: websocket\r\nSec-Fetch-Site: same-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\nUpgrade: websocket\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 101 Switching Protocols\r\nUpgrade: websocket\r\nSec-WebSocket-Version: 13\r\nConnection: Upgrade\r\nSec-WebSocket-Accept: TLBlTfXCX90KzyVzsih/FCz3QEU=\r\nServer: workerman/4.2.1\r\n\r\n","headers":null,"cookies":null,"status_code":"101","status_text":"Switching Protocols","fingerprints":[{"name":"WebSocket","description":"WebSocket is a communication protocol that provides full-duplex communication channels over a single, long-lived connection, enabling interactive communication between web browsers and servers.","website":"https://en.wikipedia.org/wiki/WebSocket","common_platform_enumeration":"","icon":"WebSocket.svg","categories":["Miscellaneous"]}],"data":{"size":0,"size_decoded":181,"mime_type":"text/plain","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-10-15T03:38:33.091252Z","times_seen":19113141,"resource_available":true,"data":null}},"time_used":786,"timings":{"blocked":0,"dns":0,"connect":261,"send":0,"wait":260,"receive":0,"ssl":265},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"www.whatdom.icu/static/js/pages-kefu-index.5398bf36.js","fqdn":"www.whatdom.icu","domain":"whatdom.icu","tld":"icu"},"ip":{"addr":"156.251.16.120","port":443,"asn":399077,"as":"TERAEXCH","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://www.whatdom.icu/","date":"2026-10-15T01:28:57.699Z","timestamp":1792027737699,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"www.whatdom.icu","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Fri, 09 Oct 2026 12:39:03 GMT","end":"Thu, 07 Jan 2027 12:39:02 GMT"},"fingerprint":{"sha1":"31:D7:E1:2D:94:7E:3C:4A:06:B8:91:C1:2E:AC:60:90:5C:1A:EF:ED","sha256":"8A:F3:95:FB:B1:83:24:4E:29:26:08:BB:39:C8:45:AF:E5:0D:A2:EA:78:16:F2:28:05:FD:E2:56:89:C7:7F:7C"}}},"request":{"raw":"GET /static/js/pages-kefu-index.5398bf36.js HTTP/1.1\r\nHost: www.whatdom.icu\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://www.whatdom.icu/\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nserver: nginx\r\ndate: Thu, 15 Oct 2026 01:28:57 GMT\r\ncontent-type: application/javascript\r\nlast-modified: Fri, 09 Oct 2026 13:36:54 GMT\r\nvary: Accept-Encoding\r\netag: W/\"6ac8edf6-13163\"\r\nexpires: Thu, 15 Oct 2026 13:28:57 GMT\r\ncache-control: max-age=43200\r\nstrict-transport-security: max-age=31536000\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":78179,"size_decoded":29892,"mime_type":"application/javascript","magic":"JavaScript source, Unicode text, UTF-8 text, with very long lines (65487), with no line terminators","md5":"30049d74f10beff21282ac62f600be76","sha1":"05e7ec8e903ff0bc7a5564c661b688920852c697","sha256":"16a9039936bdb0e4b5180380bf105ddf4807f1d2f6127ddc4190dbe1c502f07f","sha512":"ece52c88cbf4b49f3b98c776576e555ead612b0a3dbdd36500f2195ed7e422b5fbd6ba9dc8827cab6c30eab18d56679a0971a5c510e5c8ea8bc254f617dad713","ssdeep":"1536:gpC1r+8ZpmzU8jRkspzaeh0tcKrR/PAAA2rzRiKYRQ9++k3npnys7T1:z1DZpmhaeQR/pvr5U5ny4","tlshash":"94734bb5f4d9b42d499396a2b06f35141d373d63e044a50bfb79e9e887d8d892023b3c","first_seen":"2026-10-15T01:07:12.268629Z","last_seen":"2026-10-15T01:29:32.030024Z","times_seen":2,"resource_available":true,"data":null}},"time_used":270,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":270,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-10-15","alert":"Sinkholed","trigger":"www.whatdom.icu","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-10-15","alert":"Phishing Block","trigger":"www.whatdom.icu","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-10-15","alert":"Sinkholed","trigger":"www.whatdom.icu","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-10-15","alert":"Sinkholed","trigger":"www.whatdom.icu","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-10-15","alert":"Sinkholed","trigger":"www.whatdom.icu","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"cira_dns","sensor_type":"DNS","title":"CIRA Canadian Shield DNS","description":"CIRA Canadian Shield DNS","scan_date":"2026-10-15","alert":"Sinkholed","trigger":"www.whatdom.icu","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cira.ca/en/canadian-shield/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"cdn.dcloud.net.cn/img/shadow-grey.png","fqdn":"cdn.dcloud.net.cn","domain":"dcloud.net.cn","tld":"net.cn"},"ip":{"addr":"124.174.94.0","port":443,"asn":0,"as":"","country":"China","country_code":"CN"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://www.whatdom.icu/","date":"2026-10-15T01:28:59.749Z","timestamp":1792027739749,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.dcloud.net.cn","organization":""},"issuer":{"commonName":"RapidSSL TLS RSA CA G1","organization":"DigiCert Inc"},"validity":{"start":"Sun, 20 Sep 2026 00:00:00 GMT","end":"Tue, 06 Apr 2027 23:59:59 GMT"},"fingerprint":{"sha1":"4F:35:3A:96:51:3A:BA:A6:46:B8:B9:BC:97:39:74:7E:49:B4:6F:98","sha256":"F8:18:FA:28:6B:ED:A5:CC:73:11:D3:85:FB:0F:80:CA:B3:EF:76:89:C6:F1:62:90:E2:2C:5A:F5:E2:42:57:56"}}},"request":{"raw":"GET /img/shadow-grey.png HTTP/1.1\r\nHost: cdn.dcloud.net.cn\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-Fetch-Storage-Access: none\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://www.whatdom.icu/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPriority: u=4, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nserver: nginx\r\ndate: Thu, 15 Oct 2026 01:29:00 GMT\r\ncontent-type: image/png\r\ncontent-length: 136\r\nlast-modified: Thu, 06 Jun 2019 06:42:07 GMT\r\netag: \"5cf8b5bf-88\"\r\nexpires: Thu, 15 Oct 2026 15:29:00 GMT\r\ncache-control: max-age=50400\r\nset-cookie: __uni__uid=rBACZWrQLFxeu8cPBCV3Ag==; expires=Thu, 31-Dec-37 23:55:55 GMT; domain=dcloud.net.cn; path=/; secure; httponly; samesite=none\r\naccept-ranges: bytes\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":[{"name":"__uni__uid","value":"rBACZWrQLFxeu8cPBCV3Ag==","quoted":false,"path":"/","domain":"dcloud.net.cn","raw_expires":"Thu, 31-Dec-37 23:55:55 GMT","secure":true,"http_only":true,"same_site":"None","partitioned":false,"raw":"__uni__uid=rBACZWrQLFxeu8cPBCV3Ag==; expires=Thu, 31-Dec-37 23:55:55 GMT; domain=dcloud.net.cn; path=/; secure; httponly; samesite=none"}],"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":136,"size_decoded":577,"mime_type":"image/png","magic":"PNG image data, 1 x 6, 4-bit colormap, non-interlaced","md5":"5a962adf74d92ae702467b3f47976547","sha1":"36f74049375584e3fa69b5ef87e9572336ff9e7a","sha256":"ad4ebea1c3496dd2924789ee009174a2c6289d1200e9811f458fd46f172d1d6f","sha512":"4ace23fe7ec6c7271710030fd423aace13eafac68ac3e76366ce4ce9bdc702caf71c9bdc2fb6a32c8e9791546098617cc0259decd8bb8489afdbce43e1b53a73","ssdeep":"","tlshash":"47c09bf3a615dc754a0d153b42e98271f429511e07046d0e5a13c216741e3448d56793","first_seen":"2023-04-15T10:50:30Z","last_seen":"2026-10-15T01:29:32.031142Z","times_seen":20731,"resource_available":false,"data":null}},"time_used":802,"timings":{"blocked":0,"dns":2,"connect":183,"send":0,"wait":183,"receive":0,"ssl":434},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"www.whatdom.icu/static/wsapp/wx_bg.png","fqdn":"www.whatdom.icu","domain":"whatdom.icu","tld":"icu"},"ip":{"addr":"156.251.16.120","port":443,"asn":399077,"as":"TERAEXCH","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://www.whatdom.icu/","date":"2026-10-15T01:29:00.078Z","timestamp":1792027740078,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"www.whatdom.icu","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Fri, 09 Oct 2026 12:39:03 GMT","end":"Thu, 07 Jan 2027 12:39:02 GMT"},"fingerprint":{"sha1":"31:D7:E1:2D:94:7E:3C:4A:06:B8:91:C1:2E:AC:60:90:5C:1A:EF:ED","sha256":"8A:F3:95:FB:B1:83:24:4E:29:26:08:BB:39:C8:45:AF:E5:0D:A2:EA:78:16:F2:28:05:FD:E2:56:89:C7:7F:7C"}}},"request":{"raw":"GET /static/wsapp/wx_bg.png HTTP/1.1\r\nHost: www.whatdom.icu\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://www.whatdom.icu/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=4, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nserver: nginx\r\ndate: Thu, 15 Oct 2026 01:29:00 GMT\r\ncontent-type: image/png\r\ncontent-length: 88534\r\nlast-modified: Tue, 22 Sep 2026 13:40:24 GMT\r\netag: \"6ab28548-159d6\"\r\nexpires: Sat, 14 Nov 2026 01:29:00 GMT\r\ncache-control: max-age=2592000\r\nstrict-transport-security: max-age=31536000\r\naccept-ranges: bytes\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":88534,"size_decoded":88878,"mime_type":"image/png","magic":"PNG image data, 540 x 981, 4-bit colormap, non-interlaced","md5":"a4be512e7195b6b733d9110b408f075d","sha1":"216772b72be47c45b2b975cc6d2ca591798cd09a","sha256":"b0fa502976056ad9b9613c59d1f264b70da06afe9f3a03321602dfeb1575b158","sha512":"4a304c2c326abf606ae59d5c3733cd9c6db9ceefc4b86bc1c8951b32a88c5b6da58b086aa17c509943ed721ba5d28c491a91446882bdfb84ed6add1e5ec938d2","ssdeep":"1536:xn6OeGkl/sCPGdMXBipwcTiQO3HdQZHm1ZqFnLBosHlrMY/ElUBS0NeEamiV9Krd:x6OAsC9MpwUirQZG1ZqFLyeMY/ElUBSq","tlshash":"1e831239af3564d6d65e07786622774e315c5fc03b2eb313e27e60a21125632ea3f432","first_seen":"2023-05-10T13:36:11Z","last_seen":"2026-10-15T01:29:32.031826Z","times_seen":192,"resource_available":false,"data":null}},"time_used":286,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":286,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-10-15","alert":"Sinkholed","trigger":"www.whatdom.icu","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-10-15","alert":"Sinkholed","trigger":"www.whatdom.icu","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-10-15","alert":"Sinkholed","trigger":"www.whatdom.icu","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-10-15","alert":"Sinkholed","trigger":"www.whatdom.icu","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-10-15","alert":"Phishing Block","trigger":"www.whatdom.icu","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"cira_dns","sensor_type":"DNS","title":"CIRA Canadian Shield DNS","description":"CIRA Canadian Shield DNS","scan_date":"2026-10-15","alert":"Sinkholed","trigger":"www.whatdom.icu","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cira.ca/en/canadian-shield/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"whatdom.icu/","fqdn":"whatdom.icu","domain":"whatdom.icu","tld":"icu"},"ip":{"addr":"","port":0,"asn":0,"as":"","country":"","country_code":"zz"},"is_navigation_request":true,"resource_type":"document","requested_by":"","date":"2026-10-15T01:28:54.258Z","timestamp":1792027734258,"http_version":"","security_state":"broken","security_info":null,"request":{"raw":"GET / HTTP/1.1\r\nHost: whatdom.icu\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nUpgrade-Insecure-Requests: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: document\r\nSec-Fetch-Mode: navigate\r\nSec-Fetch-Site: none\r\nPriority: u=0, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"","headers":null,"cookies":null,"status_code":"","status_text":"","fingerprints":null,"data":{"size":0,"size_decoded":0,"mime_type":"","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-10-15T03:38:33.091252Z","times_seen":19113141,"resource_available":true,"data":null}},"time_used":0,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":0,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-10-15","alert":"Sinkholed","trigger":"whatdom.icu","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-10-15","alert":"Sinkholed","trigger":"whatdom.icu","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-10-15","alert":"Sinkholed","trigger":"whatdom.icu","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-10-15","alert":"Phishing Block","trigger":"whatdom.icu","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-10-15","alert":"Sinkholed","trigger":"whatdom.icu","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"cira_dns","sensor_type":"DNS","title":"CIRA Canadian Shield DNS","description":"CIRA Canadian Shield DNS","scan_date":"2026-10-15","alert":"Sinkholed","trigger":"whatdom.icu","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cira.ca/en/canadian-shield/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"www.whatdom.icu/static/index.2da1efab.css","fqdn":"www.whatdom.icu","domain":"whatdom.icu","tld":"icu"},"ip":{"addr":"156.251.16.120","port":443,"asn":399077,"as":"TERAEXCH","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://www.whatdom.icu/","date":"2026-10-15T01:28:56.175Z","timestamp":1792027736175,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"www.whatdom.icu","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Fri, 09 Oct 2026 12:39:03 GMT","end":"Thu, 07 Jan 2027 12:39:02 GMT"},"fingerprint":{"sha1":"31:D7:E1:2D:94:7E:3C:4A:06:B8:91:C1:2E:AC:60:90:5C:1A:EF:ED","sha256":"8A:F3:95:FB:B1:83:24:4E:29:26:08:BB:39:C8:45:AF:E5:0D:A2:EA:78:16:F2:28:05:FD:E2:56:89:C7:7F:7C"}}},"request":{"raw":"GET /static/index.2da1efab.css HTTP/1.1\r\nHost: www.whatdom.icu\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://www.whatdom.icu/\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=2\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nserver: nginx\r\ndate: Thu, 15 Oct 2026 01:28:56 GMT\r\ncontent-type: text/css\r\nlast-modified: Tue, 22 Sep 2026 13:40:24 GMT\r\nvary: Accept-Encoding\r\netag: W/\"6ab28548-178f9\"\r\nexpires: Thu, 15 Oct 2026 13:28:56 GMT\r\ncache-control: max-age=43200\r\nstrict-transport-security: max-age=31536000\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":96505,"size_decoded":30078,"mime_type":"text/css","magic":"ASCII text, with very long lines (65536), with no line terminators","md5":"73ae6c583d02d78f81e3f18860a2899a","sha1":"07df9233fc11dddc34fbf519b891d40b2ac29c0f","sha256":"e97de9a247807f12d74101e9f736250b2410be4e1ed3d17ed875e4b08cf66c83","sha512":"da54ba9dbe06d8d763f3cfd64cf5babb54e761e3208c7a2f23e845290c48db8c115bb86c24262cd6c9a96ff2e51674c6d86439e1814baf2de7980f5c06349921","ssdeep":"1536:OlIApuK7hmVmb2RS1Wu3xdynGJ7eh/nKhlvbc:VApuK7hmVrS1Wu3iG41nKPI","tlshash":"1893f73719012e39e52bcd26b6c1ab5a1e61c033e15307adfba47628cbcf9c9167b345","first_seen":"2024-01-02T00:07:11Z","last_seen":"2026-10-15T01:29:32.032551Z","times_seen":6543,"resource_available":true,"data":null}},"time_used":539,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":539,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-10-15","alert":"Sinkholed","trigger":"www.whatdom.icu","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-10-15","alert":"Sinkholed","trigger":"www.whatdom.icu","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-10-15","alert":"Sinkholed","trigger":"www.whatdom.icu","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-10-15","alert":"Phishing Block","trigger":"www.whatdom.icu","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-10-15","alert":"Sinkholed","trigger":"www.whatdom.icu","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"cira_dns","sensor_type":"DNS","title":"CIRA Canadian Shield DNS","description":"CIRA Canadian Shield DNS","scan_date":"2026-10-15","alert":"Sinkholed","trigger":"www.whatdom.icu","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cira.ca/en/canadian-shield/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"www.whatdom.icu/favicon.ico","fqdn":"www.whatdom.icu","domain":"whatdom.icu","tld":"icu"},"ip":{"addr":"156.251.16.120","port":443,"asn":399077,"as":"TERAEXCH","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://www.whatdom.icu/","date":"2026-10-15T01:28:57.931Z","timestamp":1792027737931,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"www.whatdom.icu","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Fri, 09 Oct 2026 12:39:03 GMT","end":"Thu, 07 Jan 2027 12:39:02 GMT"},"fingerprint":{"sha1":"31:D7:E1:2D:94:7E:3C:4A:06:B8:91:C1:2E:AC:60:90:5C:1A:EF:ED","sha256":"8A:F3:95:FB:B1:83:24:4E:29:26:08:BB:39:C8:45:AF:E5:0D:A2:EA:78:16:F2:28:05:FD:E2:56:89:C7:7F:7C"}}},"request":{"raw":"GET /favicon.ico HTTP/1.1\r\nHost: www.whatdom.icu\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://www.whatdom.icu/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=6\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 404 \r\nserver: nginx\r\ndate: Thu, 15 Oct 2026 01:28:58 GMT\r\ncontent-type: text/html\r\ncontent-length: 146\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"404","status_text":"Not Found","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":146,"size_decoded":279,"mime_type":"text/html","magic":"HTML document, ASCII text, with CRLF line terminators","md5":"8eec510e57f5f732fd2cce73df7b73ef","sha1":"3c0af39ecb3753c5fee3b53d063c7286019eac3b","sha256":"55f7d9e99b8e2d4e0e193b2f0275501e6d9c1ebd29cadbea6a0da48a8587e3e0","sha512":"73bbf698482132b5fd60a0b58926fddec9055f8095a53bc52714e211e9340c3419736ceafd6b279667810114d306bfccdcfcddf51c0b67fe9e3c73c54583e574","ssdeep":"","tlshash":"b7c02b2d35133c4cc563313423c37140c0d6833b687a41110400c00371cf2998ec3397","first_seen":"2023-03-07T12:05:15Z","last_seen":"2026-10-15T03:33:58.732068Z","times_seen":568054,"resource_available":true,"data":null}},"time_used":269,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":269,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-10-15","alert":"Phishing Block","trigger":"www.whatdom.icu","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-10-15","alert":"Sinkholed","trigger":"www.whatdom.icu","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-10-15","alert":"Sinkholed","trigger":"www.whatdom.icu","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-10-15","alert":"Sinkholed","trigger":"www.whatdom.icu","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"cira_dns","sensor_type":"DNS","title":"CIRA Canadian Shield DNS","description":"CIRA Canadian Shield DNS","scan_date":"2026-10-15","alert":"Sinkholed","trigger":"www.whatdom.icu","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cira.ca/en/canadian-shield/","meta":null},{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-10-15","alert":"Sinkholed","trigger":"www.whatdom.icu","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"www.whatdom.icu/","fqdn":"www.whatdom.icu","domain":"whatdom.icu","tld":"icu"},"ip":{"addr":"156.251.16.120","port":443,"asn":399077,"as":"TERAEXCH","country":"Hong Kong","country_code":"HK"},"is_navigation_request":true,"resource_type":"document","requested_by":"","date":"2026-10-15T01:28:55.178Z","timestamp":1792027735178,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"www.whatdom.icu","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Fri, 09 Oct 2026 12:39:03 GMT","end":"Thu, 07 Jan 2027 12:39:02 GMT"},"fingerprint":{"sha1":"31:D7:E1:2D:94:7E:3C:4A:06:B8:91:C1:2E:AC:60:90:5C:1A:EF:ED","sha256":"8A:F3:95:FB:B1:83:24:4E:29:26:08:BB:39:C8:45:AF:E5:0D:A2:EA:78:16:F2:28:05:FD:E2:56:89:C7:7F:7C"}}},"request":{"raw":"GET / HTTP/1.1\r\nHost: www.whatdom.icu\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nUpgrade-Insecure-Requests: 1\r\nSec-Fetch-Dest: document\r\nSec-Fetch-Mode: navigate\r\nSec-Fetch-Site: none\r\nPriority: u=0, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nserver: nginx\r\ndate: Thu, 15 Oct 2026 01:28:55 GMT\r\ncontent-type: text/html\r\ncontent-length: 786\r\nlast-modified: Tue, 22 Sep 2026 13:42:06 GMT\r\netag: \"6ab285ae-312\"\r\nstrict-transport-security: max-age=31536000\r\naccept-ranges: bytes\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":786,"size_decoded":1054,"mime_type":"text/html","magic":"HTML document, Unicode text, UTF-8 text, with very long lines (500)","md5":"3567cd9245ba65bac2c180c111d5061e","sha1":"0d234cfbcda1b341ff742a6d521d84a495e9007f","sha256":"65fee3604a53755a742ec793f4c45d8bd5d2cbc3e638435d37b2b6ad0aca38be","sha512":"8c05eb0a91402bfa5d3db1ac3ca199cd1ad9b3235f7b65bc30e751e3c1e89e54d6058dcbfc012e9d28d8358eb2dde47bd19c9f84e56dd0b5592da59a41321648","ssdeep":"","tlshash":"8d01b1c21c50e44d0b20855134b6e61e89d649b56991dd603cdc2afc4be078ace3f815","first_seen":"2026-10-02T03:23:24.849024Z","last_seen":"2026-10-15T01:29:32.034097Z","times_seen":3,"resource_available":true,"data":null}},"time_used":831,"timings":{"blocked":-1,"dns":22,"connect":269,"send":0,"wait":268,"receive":0,"ssl":272},"alerts":{"ids":null,"analyzer":[{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-10-15","alert":"Sinkholed","trigger":"www.whatdom.icu","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-10-15","alert":"Sinkholed","trigger":"www.whatdom.icu","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"cira_dns","sensor_type":"DNS","title":"CIRA Canadian Shield DNS","description":"CIRA Canadian Shield DNS","scan_date":"2026-10-15","alert":"Sinkholed","trigger":"www.whatdom.icu","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cira.ca/en/canadian-shield/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-10-15","alert":"Sinkholed","trigger":"www.whatdom.icu","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-10-15","alert":"Phishing Block","trigger":"www.whatdom.icu","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-10-15","alert":"Sinkholed","trigger":"www.whatdom.icu","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"www.whatdom.icu/static/js/chunk-vendors.20d8cef3.js","fqdn":"www.whatdom.icu","domain":"whatdom.icu","tld":"icu"},"ip":{"addr":"156.251.16.120","port":443,"asn":399077,"as":"TERAEXCH","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://www.whatdom.icu/","date":"2026-10-15T01:28:56.176Z","timestamp":1792027736176,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"www.whatdom.icu","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Fri, 09 Oct 2026 12:39:03 GMT","end":"Thu, 07 Jan 2027 12:39:02 GMT"},"fingerprint":{"sha1":"31:D7:E1:2D:94:7E:3C:4A:06:B8:91:C1:2E:AC:60:90:5C:1A:EF:ED","sha256":"8A:F3:95:FB:B1:83:24:4E:29:26:08:BB:39:C8:45:AF:E5:0D:A2:EA:78:16:F2:28:05:FD:E2:56:89:C7:7F:7C"}}},"request":{"raw":"GET /static/js/chunk-vendors.20d8cef3.js HTTP/1.1\r\nHost: www.whatdom.icu\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://www.whatdom.icu/\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nserver: nginx\r\ndate: Thu, 15 Oct 2026 01:28:56 GMT\r\ncontent-type: application/javascript\r\nlast-modified: Tue, 22 Sep 2026 13:40:24 GMT\r\nvary: Accept-Encoding\r\netag: W/\"6ab28548-c1fb9\"\r\nexpires: Thu, 15 Oct 2026 13:28:56 GMT\r\ncache-control: max-age=43200\r\nstrict-transport-security: max-age=31536000\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":794553,"size_decoded":277332,"mime_type":"application/javascript","magic":"JavaScript source, Unicode text, UTF-8 text, with very long lines (65531), with no line terminators","md5":"fa707c11f47f65607197c68bcfdb17b9","sha1":"89ee191a23cafd8e502578dbaacbfc102b4c7dff","sha256":"401f5a3b09bd5434666c0a2cc749bd4ee741b319ef0efc3e642e01f7e4efbd14","sha512":"f6a6be2bec413fc60322a8d493b599811d43bfc815d7aae26389b671fd1b1ae97d692e22093af91e7068e1c82e109aa08d82e9a55ef8128cbafbbd4b935f3fe2","ssdeep":"6144:syP1zjf8dK4H0FhXMwTfmfXb//noHZNTz1Y3vm7Kta/hAq2vxzfep+22Lp3:s+5EIh8wTODnCZtartVvxzn2G","tlshash":"a9f4f78df282b0b60be761b5403f220ba2376959b40ac4d4f675e4d4ad7894e2237f7d","first_seen":"2024-12-27T15:52:57.829656Z","last_seen":"2026-10-15T01:29:32.035046Z","times_seen":10,"resource_available":true,"data":null}},"time_used":806,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":806,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-10-15","alert":"Sinkholed","trigger":"www.whatdom.icu","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-10-15","alert":"Sinkholed","trigger":"www.whatdom.icu","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-10-15","alert":"Sinkholed","trigger":"www.whatdom.icu","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-10-15","alert":"Phishing Block","trigger":"www.whatdom.icu","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-10-15","alert":"Sinkholed","trigger":"www.whatdom.icu","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"cira_dns","sensor_type":"DNS","title":"CIRA Canadian Shield DNS","description":"CIRA Canadian Shield DNS","scan_date":"2026-10-15","alert":"Sinkholed","trigger":"www.whatdom.icu","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cira.ca/en/canadian-shield/","meta":null}],"urlquery":null}}]}