{"report_id":"647f5599-4433-4b2c-b52c-57004dc9eeb1","version":6,"status":"done","tags":["instagram","meta","social","phishing"],"date":"2026-05-22T04:10:10Z","url":{"schema":"https","addr":"zaaex-xxen.github.io/Web-Act/","fqdn":"zaaex-xxen.github.io","domain":"zaaex-xxen.github.io","tld":"github.io"},"ip":{"addr":"185.199.108.153","port":0,"asn":54113,"as":"FASTLY","country":"United States","country_code":"US"},"final":{"url":{"schema":"https","addr":"zaaex-xxen.github.io/Web-Act/","fqdn":"zaaex-xxen.github.io","domain":"zaaex-xxen.github.io","tld":"github.io"},"title":"Instagram","dom":{"size":3891,"mime_type":"text/html; charset=utf-8","magic":"HTML document, Unicode text, UTF-8 text","md5":"3cb9ff028c7dcd00decbf190e6d97137","sha1":"6a2de1e5b7106cd5470cdd9cf82cf9a0a4221728","sha256":"8ec9fffb67835f6b1cf7fad5b337f14be0ff0a273858696598d0f912f375605e","sha512":"0458e42a2f385e8058fc33b741899da1b58832924f0cc41a077c7daa114e9a84a4f4ab542ac8d9b36b04785bdbc3818c449fb574b3bae79bfd9620f9f8714c16","ssdeep":"","tlshash":"d381b02014f4196b52c681a875a19a2b3ed7d503ea46291832fc1ee79fe3e4385271de","dom_hash":"domhash2a61e37377bae6d8ff74a7a9784e2c58","first_seen":"2026-05-22T04:10:14.807988Z","last_seen":"2026-05-22T04:10:14.807988Z","times_seen":1,"resource_available":false,"data":null}},"submit":{"url":{"schema":"https","addr":"zaaex-xxen.github.io/Web-Act/","fqdn":"zaaex-xxen.github.io","domain":"zaaex-xxen.github.io","tld":"github.io"},"ip":{"addr":"185.199.108.153","port":0,"asn":54113,"as":"FASTLY","country":"United States","country_code":"US"},"tags":["openphish"],"meta":null},"settings":{"access":"public","device_type":"desktop","expires_at":"2027-06-26T04:10:10Z","useragent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0","referer":"","cookies":null,"exit_node":"z0yflva4pidy47h"},"stats":{"alert_count":{"ids":0,"urlquery":2,"analyzer":1}},"detection":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-05-22","alert":"Sinkholed","trigger":"zaaex-xxen.github.io","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":[{"sensor_name":"urlquery","alert":"Phishing - Instagram","verdict":"phishing","severity":"medium","comment":"Asset commenly seen with Instagram phishing","tags":["instagram","meta","social","phishing"],"meta":null},{"sensor_name":"urlquery","alert":"Phishing - Instagram","verdict":"phishing","severity":"medium","comment":"Asset commenly seen with Instagram phishing","tags":["instagram","meta","social","phishing"],"meta":null}]},"summary":[{"fqdn":"zaaex-xxen.github.io","ip":{"addr":"185.199.108.153","port":443,"asn":54113,"as":"FASTLY","country":"United States","country_code":"US"},"domain_registered":"2013-03-08","domain_rank":0,"first_seen":"2026-05-21T12:25:24.570763Z","last_seen":"2026-05-21T12:25:24.570763Z","alert_count":12,"request_count":6,"received_data":280734,"sent_data":2770,"comment":"","tags":null,"fingerprints":[{"name":"GitHub Pages","description":"GitHub Pages is a static site hosting service.","website":"https://pages.github.com/","common_platform_enumeration":"","icon":"GitHub.svg","categories":["PaaS"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Varnish","description":"Varnish is a reverse caching proxy.","website":"https://www.varnish-cache.org","common_platform_enumeration":"cpe:2.3:a:varnish-software:varnish_cache:*:*:*:*:*:*:*:*","icon":"Varnish.svg","categories":["Caching"]},{"name":"Fastly","description":"Fastly is a cloud computing services provider. Fastly's cloud platform provides a content delivery network, Internet security services, load balancing, and video \u0026 streaming services.","website":"https://www.fastly.com","common_platform_enumeration":"","icon":"Fastly.svg","categories":["CDN"]}]}],"files":null,"artifacts":{"windows_shortcuts":null,"files":null,"telegram":null,"pdfs":null,"clipboard":null},"sensors":{"ids":null,"analyzer":null,"urlquery":[{"sensor_name":"urlquery","alert":"Phishing - Instagram","verdict":"phishing","severity":"medium","comment":"Asset commenly seen with Instagram phishing","tags":["instagram","meta","social","phishing"],"meta":null}]},"javascript":{"script":[{"url":{"schema":"https","addr":"zaaex-xxen.github.io/Web-Act/script.js","fqdn":"zaaex-xxen.github.io","domain":"zaaex-xxen.github.io","tld":"github.io"},"ip":{"addr":"185.199.108.153","port":443,"asn":54113,"as":"FASTLY","country":"United States","country_code":"US"},"introduction_type":"scriptElement","is_inline":false,"md5":"7d00b19d48167298eb52786adeab6ba8","sha1":"437bee96a640b12fa00c709a87d8dc91622985f2","sha256":"aa80f4e467f70e3cf726c42553894b9698bdf11c8143f5087de23c14c5741f39","sha512":"700d0e6c7e52eb82aff436cb80d8d8b6c96972efcea3328210fc7343ef4bad5a1a251b222a71799cabb4b5c78134b62213f481e4ce3c607b7d4a7b974a967a6f","ssdeep":"","tlshash":"b731de3b367d093087eb99ae228557443a1a10233885dfba7c7d8d014fa0c8916336db","size":1585,"data":"","first_seen":"2026-05-22T04:10:14.823638Z","last_seen":"2026-05-22T04:10:14.823638Z","times_seen":1,"alerts":{"ids":null,"analyzer":null,"urlquery":null}}],"eval":null,"write":null,"console":null},"http":[{"url":{"schema":"https","addr":"zaaex-xxen.github.io/Web-Act/","fqdn":"zaaex-xxen.github.io","domain":"zaaex-xxen.github.io","tld":"github.io"},"ip":{"addr":"185.199.108.153","port":443,"asn":54113,"as":"FASTLY","country":"United States","country_code":"US"},"is_navigation_request":true,"resource_type":"document","requested_by":"","date":"2026-05-22T04:09:45.521Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.github.io","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Mon, 06 Apr 2026 23:32:36 GMT","end":"Sun, 05 Jul 2026 23:32:35 GMT"},"fingerprint":{"sha1":"18:DE:96:E8:3D:99:B2:8A:0C:D1:0C:48:78:BD:6A:14:6A:05:25:60","sha256":"EA:69:BC:71:1C:B9:D4:56:98:D2:FD:AA:48:54:D7:DC:08:6A:CD:3A:9C:35:01:64:90:9B:68:8A:C7:C0:63:1F"}}},"request":{"raw":"GET /Web-Act/ HTTP/1.1\r\nHost: zaaex-xxen.github.io\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nUpgrade-Insecure-Requests: 1\r\nSec-Fetch-Dest: document\r\nSec-Fetch-Mode: navigate\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: GitHub.com\r\ncontent-type: text/html; charset=utf-8\r\nlast-modified: Wed, 20 May 2026 13:46:03 GMT\r\naccess-control-allow-origin: *\r\nstrict-transport-security: max-age=31556952\r\netag: W/\"6a0dbb1b-f5b\"\r\nexpires: Fri, 22 May 2026 04:19:45 GMT\r\ncache-control: max-age=600\r\ncontent-encoding: gzip\r\nx-proxy-cache: MISS\r\nx-github-request-id: 3976:329A9E:ACB1DF:AF151D:6A0FD709\r\naccept-ranges: bytes\r\nage: 0\r\ndate: Fri, 22 May 2026 04:09:45 GMT\r\nvia: 1.1 varnish\r\nx-served-by: cache-hel1410034-HEL\r\nx-cache: MISS\r\nx-cache-hits: 0\r\nx-timer: S1779422986.751641,VS0,VE132\r\nvary: Accept-Encoding\r\nx-fastly-request-id: 91b7b680ed914261b0e8fc2e73d3da3e8a1d8f4b\r\ncontent-length: 1080\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"GitHub Pages","description":"GitHub Pages is a static site hosting service.","website":"https://pages.github.com/","common_platform_enumeration":"","icon":"GitHub.svg","categories":["PaaS"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Varnish","description":"Varnish is a reverse caching proxy.","website":"https://www.varnish-cache.org","common_platform_enumeration":"cpe:2.3:a:varnish-software:varnish_cache:*:*:*:*:*:*:*:*","icon":"Varnish.svg","categories":["Caching"]},{"name":"Fastly","description":"Fastly is a cloud computing services provider. Fastly's cloud platform provides a content delivery network, Internet security services, load balancing, and video \u0026 streaming services.","website":"https://www.fastly.com","common_platform_enumeration":"","icon":"Fastly.svg","categories":["CDN"]}],"data":{"size":3931,"size_decoded":0,"mime_type":"text/html; charset=utf-8","magic":"HTML document, ASCII text","md5":"3a18da2b0dcc0ef504fafbdf21781a73","sha1":"c90264e93d2e505075d75fd4daa92b8fffdeaf24","sha256":"5df4c39892f556722de4694d8a2444ed9f7e2dc4c49f39c95e255cf5dfca91f6","sha512":"86a5f3a700ae44933a66521c2944a3783992ce0ad4b1125d39be055b9f7a348a8c278a66841b6e4b076010030cc36f211fb5c2a0707c7f5e0ddf11d58e49a3bb","ssdeep":"","tlshash":"c481c02014f419ab52c681e875a19a2b3ed6d603eb46291431fc1ee79fe3e8385271df","first_seen":"2026-05-22T04:10:14.813962Z","last_seen":"2026-05-22T04:10:14.813962Z","times_seen":1,"resource_available":false,"data":null}},"time_used":571,"timings":{"blocked":188,"dns":68,"connect":59,"send":0,"wait":190,"receive":0,"ssl":63},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-05-22","alert":"Sinkholed","trigger":"zaaex-xxen.github.io","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":[{"sensor_name":"urlquery","alert":"Phishing - Instagram","verdict":"phishing","severity":"medium","comment":"Asset commenly seen with Instagram phishing","tags":["instagram","meta","social","phishing"],"meta":null}]}},{"url":{"schema":"https","addr":"zaaex-xxen.github.io/Web-Act/style.css","fqdn":"zaaex-xxen.github.io","domain":"zaaex-xxen.github.io","tld":"github.io"},"ip":{"addr":"185.199.108.153","port":443,"asn":54113,"as":"FASTLY","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://zaaex-xxen.github.io/Web-Act/","date":"2026-05-22T04:09:46.071Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.github.io","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Mon, 06 Apr 2026 23:32:36 GMT","end":"Sun, 05 Jul 2026 23:32:35 GMT"},"fingerprint":{"sha1":"18:DE:96:E8:3D:99:B2:8A:0C:D1:0C:48:78:BD:6A:14:6A:05:25:60","sha256":"EA:69:BC:71:1C:B9:D4:56:98:D2:FD:AA:48:54:D7:DC:08:6A:CD:3A:9C:35:01:64:90:9B:68:8A:C7:C0:63:1F"}}},"request":{"raw":"GET /Web-Act/style.css HTTP/1.1\r\nHost: zaaex-xxen.github.io\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://zaaex-xxen.github.io/Web-Act/\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: GitHub.com\r\ncontent-type: text/css; charset=utf-8\r\nlast-modified: Wed, 20 May 2026 13:46:03 GMT\r\naccess-control-allow-origin: *\r\nstrict-transport-security: max-age=31556952\r\netag: W/\"6a0dbb1b-c98\"\r\nexpires: Fri, 22 May 2026 04:19:46 GMT\r\ncache-control: max-age=600\r\ncontent-encoding: gzip\r\nx-proxy-cache: MISS\r\nx-github-request-id: 3976:329A9E:ACB21C:AF155C:6A0FD70A\r\naccept-ranges: bytes\r\nage: 0\r\ndate: Fri, 22 May 2026 04:09:46 GMT\r\nvia: 1.1 varnish\r\nx-served-by: cache-hel1410034-HEL\r\nx-cache: MISS\r\nx-cache-hits: 0\r\nx-timer: S1779422986.099681,VS0,VE428\r\nvary: Accept-Encoding\r\nx-fastly-request-id: 16e285e6130ad99514881a66279ef4d585ed44ab\r\ncontent-length: 952\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"GitHub Pages","description":"GitHub Pages is a static site hosting service.","website":"https://pages.github.com/","common_platform_enumeration":"","icon":"GitHub.svg","categories":["PaaS"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Varnish","description":"Varnish is a reverse caching proxy.","website":"https://www.varnish-cache.org","common_platform_enumeration":"cpe:2.3:a:varnish-software:varnish_cache:*:*:*:*:*:*:*:*","icon":"Varnish.svg","categories":["Caching"]},{"name":"Fastly","description":"Fastly is a cloud computing services provider. Fastly's cloud platform provides a content delivery network, Internet security services, load balancing, and video \u0026 streaming services.","website":"https://www.fastly.com","common_platform_enumeration":"","icon":"Fastly.svg","categories":["CDN"]}],"data":{"size":3224,"size_decoded":0,"mime_type":"text/css; charset=utf-8","magic":"ASCII text","md5":"b59cad811c6d12ef88fccde7132c2cff","sha1":"ed81f734c3211427c9b0268b6c1a910b3c7faffe","sha256":"f995b838bf99470ba8f9a6736e4ae55e7525f2f9dcf28a9f8fce04ee14fbdf21","sha512":"6013d4d99f2591878df8f6126637a9b2f8fc0a7adb3748357d53d852363b72364f14255b98822c6db4d4159aa98e2a939245178718696e848a9a9d040a9bb9f6","ssdeep":"","tlshash":"8661f3827aa71946750fc4287bf2c745633dd083850eda7c3ea1a28c8f4a2c99572fcc","first_seen":"2026-05-22T04:10:14.81639Z","last_seen":"2026-05-22T04:10:14.81639Z","times_seen":1,"resource_available":false,"data":null}},"time_used":482,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":482,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-05-22","alert":"Sinkholed","trigger":"zaaex-xxen.github.io","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":[{"sensor_name":"urlquery","alert":"Phishing - Instagram","verdict":"phishing","severity":"medium","comment":"Asset commenly seen with Instagram phishing","tags":["instagram","meta","social","phishing"],"meta":null}]}},{"url":{"schema":"https","addr":"zaaex-xxen.github.io/Web-Act/facebook.png","fqdn":"zaaex-xxen.github.io","domain":"zaaex-xxen.github.io","tld":"github.io"},"ip":{"addr":"185.199.108.153","port":443,"asn":54113,"as":"FASTLY","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://zaaex-xxen.github.io/Web-Act/","date":"2026-05-22T04:09:46.073Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.github.io","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Mon, 06 Apr 2026 23:32:36 GMT","end":"Sun, 05 Jul 2026 23:32:35 GMT"},"fingerprint":{"sha1":"18:DE:96:E8:3D:99:B2:8A:0C:D1:0C:48:78:BD:6A:14:6A:05:25:60","sha256":"EA:69:BC:71:1C:B9:D4:56:98:D2:FD:AA:48:54:D7:DC:08:6A:CD:3A:9C:35:01:64:90:9B:68:8A:C7:C0:63:1F"}}},"request":{"raw":"GET /Web-Act/facebook.png HTTP/1.1\r\nHost: zaaex-xxen.github.io\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://zaaex-xxen.github.io/Web-Act/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: GitHub.com\r\ncontent-type: image/png\r\nlast-modified: Wed, 20 May 2026 13:46:03 GMT\r\naccess-control-allow-origin: *\r\nstrict-transport-security: max-age=31556952\r\netag: \"6a0dbb1b-d5f3\"\r\nexpires: Fri, 22 May 2026 04:19:46 GMT\r\ncache-control: max-age=600\r\nx-proxy-cache: MISS\r\nx-github-request-id: A00C:18BFD3:AF029D:B16765:6A0FD709\r\naccept-ranges: bytes\r\nage: 0\r\ndate: Fri, 22 May 2026 04:09:46 GMT\r\nvia: 1.1 varnish\r\nx-served-by: cache-hel1410034-HEL\r\nx-cache: MISS\r\nx-cache-hits: 0\r\nx-timer: S1779422986.103006,VS0,VE179\r\nvary: Accept-Encoding\r\nx-fastly-request-id: 5079114f575acdf8a1771b4c958090c1f27275e9\r\ncontent-length: 54771\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Varnish","description":"Varnish is a reverse caching proxy.","website":"https://www.varnish-cache.org","common_platform_enumeration":"cpe:2.3:a:varnish-software:varnish_cache:*:*:*:*:*:*:*:*","icon":"Varnish.svg","categories":["Caching"]},{"name":"Fastly","description":"Fastly is a cloud computing services provider. Fastly's cloud platform provides a content delivery network, Internet security services, load balancing, and video \u0026 streaming services.","website":"https://www.fastly.com","common_platform_enumeration":"","icon":"Fastly.svg","categories":["CDN"]},{"name":"GitHub Pages","description":"GitHub Pages is a static site hosting service.","website":"https://pages.github.com/","common_platform_enumeration":"","icon":"GitHub.svg","categories":["PaaS"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":54771,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 2084 x 2084, 8-bit/color RGBA, non-interlaced","md5":"e4da23704f27c9df07e6c21a13e28bfd","sha1":"af6f06778b34a6b7844168f257fff50611bc7dd9","sha256":"2adfd474d91fd20c51084309ed000c1ae6cc7f5f70af14d375930f5a71301308","sha512":"d42b18c6626354154ebed9ae3c0938e6fbcdb39bc59f1e4b6b2da22e51ea84ec819b30da7784efe53cb6818e6884ad39f868af572710e6b00e9bcdbf09c63f85","ssdeep":"1536:KtEYAEL5KENqJ9jR8Ho6l7tLxoiSyJcI/UgO:uuxEY9jROl7tLxoW9lO","tlshash":"e333be26d8128dd8d93e9f32dd6a2f29337106de804eab074778f2b59fd60390d0702a","first_seen":"2024-01-07T04:22:59Z","last_seen":"2026-08-08T15:59:15.360308Z","times_seen":1287,"resource_available":false,"data":null}},"time_used":375,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":257,"receive":118,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-05-22","alert":"Sinkholed","trigger":"zaaex-xxen.github.io","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":[{"sensor_name":"urlquery","alert":"Phishing - Instagram","verdict":"phishing","severity":"medium","comment":"Asset commenly seen with Instagram phishing","tags":["instagram","meta","social","phishing"],"meta":null}]}},{"url":{"schema":"https","addr":"zaaex-xxen.github.io/Web-Act/meta.png","fqdn":"zaaex-xxen.github.io","domain":"zaaex-xxen.github.io","tld":"github.io"},"ip":{"addr":"185.199.108.153","port":443,"asn":54113,"as":"FASTLY","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://zaaex-xxen.github.io/Web-Act/","date":"2026-05-22T04:09:46.075Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.github.io","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Mon, 06 Apr 2026 23:32:36 GMT","end":"Sun, 05 Jul 2026 23:32:35 GMT"},"fingerprint":{"sha1":"18:DE:96:E8:3D:99:B2:8A:0C:D1:0C:48:78:BD:6A:14:6A:05:25:60","sha256":"EA:69:BC:71:1C:B9:D4:56:98:D2:FD:AA:48:54:D7:DC:08:6A:CD:3A:9C:35:01:64:90:9B:68:8A:C7:C0:63:1F"}}},"request":{"raw":"GET /Web-Act/meta.png HTTP/1.1\r\nHost: zaaex-xxen.github.io\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://zaaex-xxen.github.io/Web-Act/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: GitHub.com\r\ncontent-type: image/png\r\nlast-modified: Wed, 20 May 2026 13:46:03 GMT\r\naccess-control-allow-origin: *\r\nstrict-transport-security: max-age=31556952\r\netag: \"6a0dbb1b-31cd9\"\r\nexpires: Fri, 22 May 2026 04:19:46 GMT\r\ncache-control: max-age=600\r\nx-proxy-cache: MISS\r\nx-github-request-id: AA66:110DE5:AA1D36:AC80DA:6A0FD709\r\naccept-ranges: bytes\r\nage: 0\r\ndate: Fri, 22 May 2026 04:09:46 GMT\r\nvia: 1.1 varnish\r\nx-served-by: cache-hel1410034-HEL\r\nx-cache: MISS\r\nx-cache-hits: 0\r\nx-timer: S1779422986.112428,VS0,VE140\r\nvary: Accept-Encoding\r\nx-fastly-request-id: ac6352748cc00d1c0eafbc222731cd62daa9bd50\r\ncontent-length: 203993\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"GitHub Pages","description":"GitHub Pages is a static site hosting service.","website":"https://pages.github.com/","common_platform_enumeration":"","icon":"GitHub.svg","categories":["PaaS"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Varnish","description":"Varnish is a reverse caching proxy.","website":"https://www.varnish-cache.org","common_platform_enumeration":"cpe:2.3:a:varnish-software:varnish_cache:*:*:*:*:*:*:*:*","icon":"Varnish.svg","categories":["Caching"]},{"name":"Fastly","description":"Fastly is a cloud computing services provider. Fastly's cloud platform provides a content delivery network, Internet security services, load balancing, and video \u0026 streaming services.","website":"https://www.fastly.com","common_platform_enumeration":"","icon":"Fastly.svg","categories":["CDN"]}],"data":{"size":203993,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 3840 x 2551, 8-bit/color RGBA, non-interlaced","md5":"86c918503ea4a568eb844182dcce4024","sha1":"0407ae1f6f581b14f4edea10e03c09ce15a545ca","sha256":"074e0a8146391b480521afbadf10638aa1884fb90c63369dd1abcafdb499c571","sha512":"da4a5523266d57f7955f58bc448638b93a245450536a1b9d5f8dcdf039ced308574da2a53e8038c6b877abb1a72efa374b9c6edfa98c657f06b6ce892b96ad9f","ssdeep":"6144:2VJq4W7BQMhuUtSNvNMaLAvq2YCn5N3z+:2fq4EzSNvN3LcJni","tlshash":"ce1402872953aee2d4e50c3819ef551a7aa649be185d04cf45fcc8fafd38847249ee08","first_seen":"2026-05-22T04:10:14.821139Z","last_seen":"2026-05-22T04:10:14.821139Z","times_seen":1,"resource_available":false,"data":null}},"time_used":431,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":196,"receive":235,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-05-22","alert":"Sinkholed","trigger":"zaaex-xxen.github.io","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":[{"sensor_name":"urlquery","alert":"Phishing - Instagram","verdict":"phishing","severity":"medium","comment":"Asset commenly seen with Instagram phishing","tags":["instagram","meta","social","phishing"],"meta":null}]}},{"url":{"schema":"https","addr":"zaaex-xxen.github.io/Web-Act/script.js","fqdn":"zaaex-xxen.github.io","domain":"zaaex-xxen.github.io","tld":"github.io"},"ip":{"addr":"185.199.108.153","port":443,"asn":54113,"as":"FASTLY","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://zaaex-xxen.github.io/Web-Act/","date":"2026-05-22T04:09:46.076Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.github.io","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Mon, 06 Apr 2026 23:32:36 GMT","end":"Sun, 05 Jul 2026 23:32:35 GMT"},"fingerprint":{"sha1":"18:DE:96:E8:3D:99:B2:8A:0C:D1:0C:48:78:BD:6A:14:6A:05:25:60","sha256":"EA:69:BC:71:1C:B9:D4:56:98:D2:FD:AA:48:54:D7:DC:08:6A:CD:3A:9C:35:01:64:90:9B:68:8A:C7:C0:63:1F"}}},"request":{"raw":"GET /Web-Act/script.js HTTP/1.1\r\nHost: zaaex-xxen.github.io\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://zaaex-xxen.github.io/Web-Act/\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: GitHub.com\r\ncontent-type: application/javascript; charset=utf-8\r\nlast-modified: Wed, 20 May 2026 13:46:03 GMT\r\naccess-control-allow-origin: *\r\nstrict-transport-security: max-age=31556952\r\netag: W/\"6a0dbb1b-631\"\r\nexpires: Fri, 22 May 2026 04:19:46 GMT\r\ncache-control: max-age=600\r\ncontent-encoding: gzip\r\nx-proxy-cache: MISS\r\nx-github-request-id: 1682:174D51:B13647:B39AFD:6A0FD709\r\naccept-ranges: bytes\r\nage: 0\r\ndate: Fri, 22 May 2026 04:09:46 GMT\r\nvia: 1.1 varnish\r\nx-served-by: cache-hel1410034-HEL\r\nx-cache: MISS\r\nx-cache-hits: 0\r\nx-timer: S1779422986.112816,VS0,VE132\r\nvary: Accept-Encoding\r\nx-fastly-request-id: 61f8065c5826d075304dce79f1cc4cc6d51dcaf6\r\ncontent-length: 493\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Fastly","description":"Fastly is a cloud computing services provider. Fastly's cloud platform provides a content delivery network, Internet security services, load balancing, and video \u0026 streaming services.","website":"https://www.fastly.com","common_platform_enumeration":"","icon":"Fastly.svg","categories":["CDN"]},{"name":"GitHub Pages","description":"GitHub Pages is a static site hosting service.","website":"https://pages.github.com/","common_platform_enumeration":"","icon":"GitHub.svg","categories":["PaaS"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Varnish","description":"Varnish is a reverse caching proxy.","website":"https://www.varnish-cache.org","common_platform_enumeration":"cpe:2.3:a:varnish-software:varnish_cache:*:*:*:*:*:*:*:*","icon":"Varnish.svg","categories":["Caching"]}],"data":{"size":1585,"size_decoded":0,"mime_type":"application/javascript; charset=utf-8","magic":"ASCII text","md5":"7d00b19d48167298eb52786adeab6ba8","sha1":"437bee96a640b12fa00c709a87d8dc91622985f2","sha256":"aa80f4e467f70e3cf726c42553894b9698bdf11c8143f5087de23c14c5741f39","sha512":"700d0e6c7e52eb82aff436cb80d8d8b6c96972efcea3328210fc7343ef4bad5a1a251b222a71799cabb4b5c78134b62213f481e4ce3c607b7d4a7b974a967a6f","ssdeep":"","tlshash":"b731de3b367d093087eb99ae228557443a1a10233885dfba7c7d8d014fa0c8916336db","first_seen":"2026-05-22T04:10:14.823638Z","last_seen":"2026-05-22T04:10:14.823638Z","times_seen":1,"resource_available":true,"data":null}},"time_used":188,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":188,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-05-22","alert":"Sinkholed","trigger":"zaaex-xxen.github.io","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":[{"sensor_name":"urlquery","alert":"Phishing - Instagram","verdict":"phishing","severity":"medium","comment":"Asset commenly seen with Instagram phishing","tags":["instagram","meta","social","phishing"],"meta":null}]}},{"url":{"schema":"https","addr":"zaaex-xxen.github.io/favicon.ico","fqdn":"zaaex-xxen.github.io","domain":"zaaex-xxen.github.io","tld":"github.io"},"ip":{"addr":"185.199.108.153","port":443,"asn":54113,"as":"FASTLY","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://zaaex-xxen.github.io/Web-Act/","date":"2026-05-22T04:09:46.559Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.github.io","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Mon, 06 Apr 2026 23:32:36 GMT","end":"Sun, 05 Jul 2026 23:32:35 GMT"},"fingerprint":{"sha1":"18:DE:96:E8:3D:99:B2:8A:0C:D1:0C:48:78:BD:6A:14:6A:05:25:60","sha256":"EA:69:BC:71:1C:B9:D4:56:98:D2:FD:AA:48:54:D7:DC:08:6A:CD:3A:9C:35:01:64:90:9B:68:8A:C7:C0:63:1F"}}},"request":{"raw":"GET /favicon.ico HTTP/1.1\r\nHost: zaaex-xxen.github.io\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://zaaex-xxen.github.io/Web-Act/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 404 Not Found\r\nserver: GitHub.com\r\ncontent-type: text/html; charset=utf-8\r\netag: W/\"69fcc76c-239b\"\r\ncontent-security-policy: default-src 'none'; style-src 'unsafe-inline'; img-src data:; connect-src 'self'\r\ncontent-encoding: gzip\r\nx-github-request-id: 16F8:18BFD3:AF02E3:B167AE:6A0FD70A\r\naccept-ranges: bytes\r\nage: 0\r\ndate: Fri, 22 May 2026 04:09:46 GMT\r\nvia: 1.1 varnish\r\nx-served-by: cache-hel1410034-HEL\r\nx-cache: MISS\r\nx-cache-hits: 0\r\nx-timer: S1779422987.599429,VS0,VE126\r\nvary: Accept-Encoding\r\nx-fastly-request-id: b72a48034dceb2bec600ccc24f9c875a3c78d80b\r\ncontent-length: 5142\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"404","status_text":"Not Found","fingerprints":[{"name":"Fastly","description":"Fastly is a cloud computing services provider. Fastly's cloud platform provides a content delivery network, Internet security services, load balancing, and video \u0026 streaming services.","website":"https://www.fastly.com","common_platform_enumeration":"","icon":"Fastly.svg","categories":["CDN"]},{"name":"GitHub Pages","description":"GitHub Pages is a static site hosting service.","website":"https://pages.github.com/","common_platform_enumeration":"","icon":"GitHub.svg","categories":["PaaS"]},{"name":"Varnish","description":"Varnish is a reverse caching proxy.","website":"https://www.varnish-cache.org","common_platform_enumeration":"cpe:2.3:a:varnish-software:varnish_cache:*:*:*:*:*:*:*:*","icon":"Varnish.svg","categories":["Caching"]}],"data":{"size":9115,"size_decoded":0,"mime_type":"text/html; charset=utf-8","magic":"HTML document, ASCII text, with very long lines (3909)","md5":"1eb970ce5a18bec7165f016df8238566","sha1":"9efd1514af80fe14db4ed28e9bc53975b9ee089c","sha256":"70d613e3acfba24fd2876fcbacaf639e1e111ef4d54baf70761c47673f37d6a3","sha512":"21b4d800cc282ca452f7394e95d5382340ac3481a002c21da681005a44f18ea6cf43959990cd715b4657f180e0e96d6087fe724f3200e909f9fd70ebcd5511bd","ssdeep":"192:Ywnb1iC9OA9XXMa9kukrALQDUnulGVopLAGCALQD6vnglET31iCLL3d:7B8H3DUulGmmv3D6vglETliCfN","tlshash":"e6126d7e19e93308d8028a1539f267993d65880f9e866e6fb5ad0351cf8fe10e1637cc","first_seen":"2023-04-05T03:08:51Z","last_seen":"2026-08-09T16:56:49.421146Z","times_seen":59641,"resource_available":true,"data":null}},"time_used":179,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":177,"receive":2,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-05-22","alert":"Sinkholed","trigger":"zaaex-xxen.github.io","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":[{"sensor_name":"urlquery","alert":"Phishing - Instagram","verdict":"phishing","severity":"medium","comment":"Asset commenly seen with Instagram phishing","tags":["instagram","meta","social","phishing"],"meta":null}]}}]}