{"report_id":"702d6586-8999-4107-ba44-143836a37da4","version":0,"status":"done","tags":[],"date":"2026-08-09T10:06:35Z","url":{"schema":"http","addr":"coinbasesupportdirectmessage.fetliis.sbs/","fqdn":"coinbasesupportdirectmessage.fetliis.sbs","domain":"fetliis.sbs","tld":"sbs"},"ip":{"addr":"86.107.77.210","port":0,"asn":207913,"as":"Next Level Business Srl","country":"Romania","country_code":"RO"},"final":{"url":{"schema":"https","addr":"coinbasesupportdirectmessage.fetliis.sbs/","fqdn":"coinbasesupportdirectmessage.fetliis.sbs","domain":"fetliis.sbs","tld":"sbs"},"title":"Coinbase Support","dom":{"size":38776,"mime_type":"text/html; charset=utf-8","magic":"JavaScript source, Unicode text, UTF-8 text, with very long lines (11407)","md5":"48dd3d4e9ef02bdb9eba384b65aea099","sha1":"797654b662437f6ca1efe8fde67f8c34b66bb414","sha256":"ce4df184276ab4fe7cc65a48102534943e601a08a9457432649d68c86dcdf9dc","sha512":"2e4d6bc153259cebdcb133294f1e45af319f990a98b5f58d633c5141e8e8033508e1db9481fe9398b020596e96bdecdccdb91a6f6bae94038eb50d7e5b18d955","ssdeep":"768:Io1eG2hnzfR9aiRwu1PwysdhdITvz7dIHu:IyeG2hzxRz1PwysBIX7v","tlshash":"3003c55a63f4106f6cc7c5f9b969b729a61ae0c3e9ab85cab1cd0550ef83c96dd03340","dom_hash":"domhash4f3f02e4d3497eb343f5ab144dd7a2e3","first_seen":"2026-08-09T10:06:19.77766Z","last_seen":"2026-08-09T10:06:36.93118Z","times_seen":2,"resource_available":false,"data":null}},"submit":{"url":{"schema":"http","addr":"coinbasesupportdirectmessage.fetliis.sbs/","fqdn":"coinbasesupportdirectmessage.fetliis.sbs","domain":"fetliis.sbs","tld":"sbs"},"ip":{"addr":"86.107.77.210","port":0,"asn":207913,"as":"Next Level Business Srl","country":"Romania","country_code":"RO"},"tags":null,"meta":null},"settings":{"access":"public","device_type":"desktop","expires_at":"2027-09-13T10:06:35Z","useragent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0","referer":"","cookies":null,"exit_node":"qguvgzjxzsgb3vs"},"stats":{"alert_count":{"ids":0,"urlquery":0,"analyzer":1}},"detection":{"ids":null,"analyzer":[{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-08-09","alert":"Sinkholed","trigger":"coinbasesupportdirectmessage.fetliis.sbs","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null}],"urlquery":null},"summary":[{"fqdn":"coinbasesupportdirectmessage.fetliis.sbs","ip":{"addr":"86.107.77.210","port":443,"asn":207913,"as":"Next Level Business Srl","country":"Romania","country_code":"RO"},"domain_registered":"2026-07-24","domain_rank":0,"first_seen":"2026-08-09T10:06:16.958867Z","last_seen":"2026-08-09T10:06:16.958867Z","alert_count":3,"request_count":3,"received_data":41381,"sent_data":1631,"comment":"","tags":null,"fingerprints":[{"name":"LiteSpeed","description":"LiteSpeed is a high-scalability web server.","website":"https://litespeedtech.com","common_platform_enumeration":"cpe:2.3:a:litespeedtech:litespeed_web_server:*:*:*:*:*:*:*:*","icon":"LiteSpeed.svg","categories":["Web servers"]},{"name":"Tailwind CSS","description":"Tailwind is a utility-first CSS framework.","website":"https://tailwindcss.com/","common_platform_enumeration":"","icon":"tailwindcss.svg","categories":["UI frameworks"]}]},{"fqdn":"bootstrap.smartsuppchat.com","ip":{"addr":"63.185.111.202","port":443,"asn":0,"as":"","country":"United States","country_code":"US"},"domain_registered":"2014-02-02","domain_rank":425291,"first_seen":"2018-01-29T06:10:36Z","last_seen":"2026-08-07T16:27:35.868588Z","alert_count":0,"request_count":1,"received_data":370,"sent_data":583,"comment":"","tags":null,"fingerprints":null},{"fqdn":"cdn.tailwindcss.com","ip":{"addr":"104.26.3.143","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"domain_registered":"2017-07-20","domain_rank":117330,"first_seen":"2018-07-09T05:46:13Z","last_seen":"2026-08-03T08:56:14.863554Z","alert_count":0,"request_count":2,"received_data":408701,"sent_data":986,"comment":"","tags":null,"fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"Vercel","description":"Vercel is a cloud platform for static frontends and serverless functions.","website":"https://vercel.com","common_platform_enumeration":"","icon":"vercel.svg","categories":["PaaS"]}]},{"fqdn":"www.smartsuppchat.com","ip":{"addr":"185.76.9.11","port":443,"asn":60068,"as":"Datacamp Limited","country":"Sweden","country_code":"SE"},"domain_registered":"2014-02-02","domain_rank":491650,"first_seen":"2017-01-30T05:24:57Z","last_seen":"2026-08-07T16:27:37.298573Z","alert_count":0,"request_count":1,"received_data":18547,"sent_data":487,"comment":"","tags":null,"fingerprints":[{"name":"CDN77","description":"CDN77 is a content delivery network (CDN).","website":"https://www.cdn77.com","common_platform_enumeration":"","icon":"CDN77.png","categories":["CDN"]}]}],"files":null,"artifacts":{"windows_shortcuts":null,"files":null,"telegram":null,"pdfs":null,"clipboard":null},"sensors":{"ids":null,"analyzer":null,"urlquery":null},"javascript":{"script":[{"url":{"schema":"https","addr":"cdn.tailwindcss.com/","fqdn":"cdn.tailwindcss.com","domain":"tailwindcss.com","tld":"com"},"ip":{"addr":"104.26.3.143","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"scriptElement","is_inline":false,"md5":"7a614b9a197e532c00d09a23b0996b5f","sha1":"1ff1738a40f3716e30e9031b181b0955ae578955","sha256":"176e894661aa9cdc9a5cba6c720044cbbf7b8bd80d1c9a142a7c24b1b6c50d15","sha512":"a67bc26f52d938358471be5671ff4b79e11af4e68b486aaf73a35a4c9bf3777aab51101af81563b4e5b7ba4b04dd8971fcfa9ee2c41fb10a0c1ee5604a99abd6","ssdeep":"12288:fpgrZxSAoNbJb0Wie75aUXGuyQZhK4O0s:RCVoNB0Wie75aUWmnO0s","tlshash":"e8844aa57396702647eb51e850ea1042f2beaa38840c44bcf7edd4da39e5e4440fbf79","size":407279,"data":"","first_seen":"2025-07-28T16:58:08.903462Z","last_seen":"2026-08-18T02:34:50.380888Z","times_seen":49699,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"www.smartsuppchat.com/loader.js?","fqdn":"www.smartsuppchat.com","domain":"smartsuppchat.com","tld":"com"},"ip":{"addr":"185.76.9.11","port":443,"asn":60068,"as":"Datacamp Limited","country":"Sweden","country_code":"SE"},"introduction_type":"scriptElement","is_inline":false,"md5":"218d24439d4e2c0990f35338a7ac220c","sha1":"5a7b913584c1244bf61beab9dc644204d130101c","sha256":"efb497f7159de26ea5e0521d675d909dc063e36d0d23c2ad96fa9109b73ee263","sha512":"17af39bfdc350c9d1f8dd74652641d0c028881ecb3935d2d9fdb763d24136665d135d00219aabac57693112e2314d4fa91b802ba2662a1580aa35c5e0b6e624b","ssdeep":"384:2/xzy2A3wyxNeBWbEgl/EuVaBWbE0rIcvqSI/aQ/UpG:2/xzy2A3wXscuVaAxka05","tlshash":"4182b7cc7691b16543ab61b4843f620ff1376929740d8865b965eae13cb8c8ed037fb8","size":18024,"data":"","first_seen":"2026-03-30T19:01:55.527327Z","last_seen":"2026-08-17T23:41:13.416027Z","times_seen":8491,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"coinbasesupportdirectmessage.fetliis.sbs/","fqdn":"coinbasesupportdirectmessage.fetliis.sbs","domain":"fetliis.sbs","tld":"sbs"},"ip":{"addr":"86.107.77.210","port":443,"asn":207913,"as":"Next Level Business Srl","country":"Romania","country_code":"RO"},"introduction_type":"scriptElement","is_inline":true,"md5":"b01a48bc5fbb35da5eb4a938dd6728a0","sha1":"8da5e03bfa0f521ffcacb79c5822c462e5507abe","sha256":"ef1fd859d627b5293065334408722b835b031e9e5b11c798e3361a549f033d1d","sha512":"864a20fca2f709c8c34f6ae42d6d9ea3f72959030447dfa17de9d992c8fa25227d89550911e1e1f523e4a03ece031bfa74c837c9a4739d4d7477f7a19baae924","ssdeep":"","tlshash":"6ce0617d3c31809557a641b5c1b7f11c3d1d30741455dd07d89a883e1cb2bd9fd14945","size":412,"data":"","first_seen":"2026-08-09T10:06:19.798978Z","last_seen":"2026-08-09T10:06:36.948378Z","times_seen":2,"alerts":{"ids":null,"analyzer":null,"urlquery":null}}],"eval":null,"write":null,"console":[{"level":"warn","text":"cdn.tailwindcss.com should not be used in production. To use Tailwind CSS in production, install it as a PostCSS plugin or use the Tailwind CLI: https://tailwindcss.com/docs/installation","filename":"https://cdn.tailwindcss.com/","line_number":64,"column_number":1711},{"level":"warn","text":"Request failed with status 403","filename":"https://www.smartsuppchat.com/loader.js?","line_number":2,"column_number":17930}]},"http":[{"url":{"schema":"https","addr":"coinbasesupportdirectmessage.fetliis.sbs/favii.png","fqdn":"coinbasesupportdirectmessage.fetliis.sbs","domain":"fetliis.sbs","tld":"sbs"},"ip":{"addr":"86.107.77.210","port":443,"asn":207913,"as":"Next Level Business Srl","country":"Romania","country_code":"RO"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://coinbasesupportdirectmessage.fetliis.sbs/","date":"2026-08-09T10:06:00.855Z","timestamp":1786269960855,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.fetliis.sbs","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Fri, 24 Jul 2026 14:06:38 GMT","end":"Thu, 22 Oct 2026 14:06:37 GMT"},"fingerprint":{"sha1":"C4:58:DE:A1:23:EB:36:34:F7:9D:86:DA:54:A5:DD:5D:08:4F:64:09","sha256":"26:6B:65:30:F4:0B:01:4C:8B:0C:D8:7B:5C:0E:52:BB:65:AC:D9:0A:E6:D9:34:90:FE:7A:97:77:32:76:9D:1D"}}},"request":{"raw":"GET /favii.png HTTP/1.1\r\nHost: coinbasesupportdirectmessage.fetliis.sbs\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://coinbasesupportdirectmessage.fetliis.sbs/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=6\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 404 \r\ncache-control: private, no-cache, no-store, must-revalidate, max-age=0\r\npragma: no-cache\r\ncontent-type: text/html\r\ncontent-length: 1251\r\ndate: Sun, 09 Aug 2026 10:06:00 GMT\r\nserver: LiteSpeed\r\n\r\n","headers":null,"cookies":null,"status_code":"404","status_text":"","fingerprints":[{"name":"LiteSpeed","description":"LiteSpeed is a high-scalability web server.","website":"https://litespeedtech.com","common_platform_enumeration":"cpe:2.3:a:litespeedtech:litespeed_web_server:*:*:*:*:*:*:*:*","icon":"LiteSpeed.svg","categories":["Web servers"]}],"data":{"size":1251,"size_decoded":1459,"mime_type":"text/html","magic":"HTML document, ASCII text, with CRLF, LF line terminators","md5":"8150f458ed6fb9b1db4e5cfa57a1a281","sha1":"6e5726854d28687b560d7fdcb5c782c425c7dfb9","sha256":"4c13d452dd5d49671bd93ca32f2b4f85c78e39b6ab0ad1f38d98ed267f8fd896","sha512":"4cc6a112673aef8bb8bb8a385c26791b805d43bb707b509880e894f1c83bab4e16f13de187036c5f660c3bec1d286258396b7bde65c5d7945c5019665196818c","ssdeep":"","tlshash":"c021353ec1c1560ae0271164fbc1f7a86669825291970f703b9eb176f6cd0bb56a36c8","first_seen":"2024-02-08T16:48:55Z","last_seen":"2026-08-18T02:36:57.205714Z","times_seen":150021,"resource_available":true,"data":null}},"time_used":34,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":33,"receive":1,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-08-09","alert":"Sinkholed","trigger":"coinbasesupportdirectmessage.fetliis.sbs","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"bootstrap.smartsuppchat.com/widget/59e03f3f2fc841cb5d7e245a6d182220dbbb733f.json","fqdn":"bootstrap.smartsuppchat.com","domain":"smartsuppchat.com","tld":"com"},"ip":{"addr":"63.185.111.202","port":443,"asn":0,"as":"","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"https://coinbasesupportdirectmessage.fetliis.sbs/","date":"2026-08-09T10:06:03.738Z","timestamp":1786269963738,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.smartsuppchat.com","organization":""},"issuer":{"commonName":"Amazon RSA 2048 M04","organization":"Amazon"},"validity":{"start":"Tue, 02 Dec 2025 00:00:00 GMT","end":"Wed, 30 Dec 2026 23:59:59 GMT"},"fingerprint":{"sha1":"DC:47:26:FC:2D:4B:14:19:23:BC:B7:70:14:DA:60:A6:21:B0:1E:81","sha256":"0D:5E:FD:70:25:9E:DE:DD:47:CF:0C:58:1C:08:A2:A1:05:AC:A6:7E:0C:43:6F:50:E7:49:E0:A1:60:D0:0E:0F"}}},"request":{"raw":"GET /widget/59e03f3f2fc841cb5d7e245a6d182220dbbb733f.json HTTP/1.1\r\nHost: bootstrap.smartsuppchat.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nContent-Type: text/plain\r\nOrigin: https://coinbasesupportdirectmessage.fetliis.sbs\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://coinbasesupportdirectmessage.fetliis.sbs/\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 403 \r\ndate: Sun, 09 Aug 2026 10:06:03 GMT\r\ncontent-type: application/json; charset=utf-8\r\ncontent-length: 57\r\nx-version: 6cb79abf75047496934c7756b55ec6f26e7d2373\r\nvary: Accept-Encoding\r\naccess-control-allow-origin: *\r\ncache-control: private, max-age=0, must-revalidate\r\nx-hit: redis\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"403","status_text":"","fingerprints":null,"data":{"size":57,"size_decoded":370,"mime_type":"application/json; charset=utf-8","magic":"JSON text data","md5":"471ad8674b65ae0302f71602143789ca","sha1":"8cbb927ffa584a95af053f00149b47d8295719f3","sha256":"1e3f60d29de08e299aa39aadee4c5c47414c0e6108298deb9ec78d14d62ed238","sha512":"717b067945c9b8d6fed624f98c70d1e534d76801934db5975cc13ebd86b1f1b592fb4e7f377e996893b4a7e78cd111044f49990a427bc5c42f2ebce6fa6bf7a9","ssdeep":"","tlshash":"fe90022f05291cba7f3245053c6851cc025404a1518074d6ccec917d064f540c022112","first_seen":"2023-04-19T00:11:12Z","last_seen":"2026-08-16T04:07:31.045518Z","times_seen":3763,"resource_available":false,"data":null}},"time_used":103,"timings":{"blocked":0,"dns":3,"connect":21,"send":0,"wait":32,"receive":0,"ssl":46},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"coinbasesupportdirectmessage.fetliis.sbs/","fqdn":"coinbasesupportdirectmessage.fetliis.sbs","domain":"fetliis.sbs","tld":"sbs"},"ip":{"addr":"86.107.77.210","port":443,"asn":207913,"as":"Next Level Business Srl","country":"Romania","country_code":"RO"},"is_navigation_request":true,"resource_type":"document","requested_by":"","date":"2026-08-09T10:05:59.956Z","timestamp":1786269959956,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.fetliis.sbs","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Fri, 24 Jul 2026 14:06:38 GMT","end":"Thu, 22 Oct 2026 14:06:37 GMT"},"fingerprint":{"sha1":"C4:58:DE:A1:23:EB:36:34:F7:9D:86:DA:54:A5:DD:5D:08:4F:64:09","sha256":"26:6B:65:30:F4:0B:01:4C:8B:0C:D8:7B:5C:0E:52:BB:65:AC:D9:0A:E6:D9:34:90:FE:7A:97:77:32:76:9D:1D"}}},"request":{"raw":"GET / HTTP/1.1\r\nHost: coinbasesupportdirectmessage.fetliis.sbs\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nUpgrade-Insecure-Requests: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: document\r\nSec-Fetch-Mode: navigate\r\nSec-Fetch-Site: none\r\nPriority: u=0, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\ncontent-type: text/html; charset=UTF-8\r\ncontent-length: 5039\r\ncontent-encoding: br\r\nvary: Accept-Encoding\r\ndate: Sun, 09 Aug 2026 10:06:00 GMT\r\nserver: LiteSpeed\r\nalt-svc: h3=\":443\"; ma=2592000, h3-29=\":443\"; ma=2592000, h3-Q050=\":443\"; ma=2592000, h3-Q046=\":443\"; ma=2592000, h3-Q043=\":443\"; ma=2592000, quic=\":443\"; ma=2592000; v=\"43,46\"\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Tailwind CSS","description":"Tailwind is a utility-first CSS framework.","website":"https://tailwindcss.com/","common_platform_enumeration":"","icon":"tailwindcss.svg","categories":["UI frameworks"]},{"name":"LiteSpeed","description":"LiteSpeed is a high-scalability web server.","website":"https://litespeedtech.com","common_platform_enumeration":"cpe:2.3:a:litespeedtech:litespeed_web_server:*:*:*:*:*:*:*:*","icon":"LiteSpeed.svg","categories":["Web servers"]}],"data":{"size":27703,"size_decoded":5415,"mime_type":"text/html; charset=UTF-8","magic":"JavaScript source, Unicode text, UTF-8 text, with very long lines (1382), with CRLF line terminators","md5":"5b0a0f6c0a285766a36cbc2d9beb39af","sha1":"d97fb09ade39d620dfa0236feed3a1f9902ff1d3","sha256":"61bc185b5e8a08abc341bf46df54a91faaf67d67e682fefd5bb692f8859ca4c6","sha512":"1ed73842e3e64043156b99f9ad1abf9ec938a74a131e0773a3450b38110d61652781938828744f13e14826bcb6c5f295b6ef7f538bffbeb06edac818eeca2cbb","ssdeep":"192:4bu5MhxS8cMLlb3DbUGXgxNkIrSSSSQvSSS8NSSSSoOMw+b2wPVtAxhVQTv8K7Zu:CuSFb30Igx2IlO7422RTvz7ZPSMaD","tlshash":"92c2b56612d464af54f7c678ba297738e91ac083e1eb40cdb1dd06ab9f73c85de03690","first_seen":"2026-08-09T10:06:19.794939Z","last_seen":"2026-08-09T10:06:36.937094Z","times_seen":2,"resource_available":false,"data":null}},"time_used":175,"timings":{"blocked":-1,"dns":3,"connect":23,"send":0,"wait":72,"receive":0,"ssl":77},"alerts":{"ids":null,"analyzer":[{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-08-09","alert":"Sinkholed","trigger":"coinbasesupportdirectmessage.fetliis.sbs","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"cdn.tailwindcss.com/","fqdn":"cdn.tailwindcss.com","domain":"tailwindcss.com","tld":"com"},"ip":{"addr":"104.26.3.143","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://coinbasesupportdirectmessage.fetliis.sbs/","date":"2026-08-09T10:06:00.405Z","timestamp":1786269960405,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"tailwindcss.com","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Fri, 17 Jul 2026 20:38:38 GMT","end":"Thu, 15 Oct 2026 21:38:35 GMT"},"fingerprint":{"sha1":"AF:4F:AD:59:FA:ED:77:04:0D:32:56:48:B0:E5:1B:38:67:6D:7D:02","sha256":"E7:FC:CF:2D:6A:CC:F5:3C:4C:1E:9D:CD:21:8A:72:A3:DB:7C:B1:50:0F:83:D1:DC:E4:AD:25:90:8F:98:37:0F"}}},"request":{"raw":"GET / HTTP/1.1\r\nHost: cdn.tailwindcss.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-Fetch-Storage-Access: none\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://coinbasesupportdirectmessage.fetliis.sbs/\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPriority: u=2\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 302 \r\ndate: Sun, 09 Aug 2026 10:06:00 GMT\r\ncache-control: max-age=14400\r\nlocation: /3.4.17\r\nserver: cloudflare\r\nstrict-transport-security: max-age=63072000\r\nx-vercel-cache: MISS\r\nx-vercel-id: fra1::iad1::k85k4-1786269178853-49571fbe1b8b\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nage: 781\r\ncf-cache-status: HIT\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=foRLxUKvsY5w2%2FJyd0pilUHk68WZSEYopXiwrqhJSri62vx9K9P%2FsEQYUqo%2B5mX4oOVLwxiYD8I441LoR6G5O8K3U5d1bfljr2N38utBIkpMP2BQjfGTAPMWewlYdnigm6npws8%3D\"}]}\r\ncf-ray: a285f2149fffb4eb-OSL\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"302","status_text":"","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"Vercel","description":"Vercel is a cloud platform for static frontends and serverless functions.","website":"https://vercel.com","common_platform_enumeration":"","icon":"vercel.svg","categories":["PaaS"]}],"data":{"size":0,"size_decoded":0,"mime_type":"text/javascript","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-08-18T02:37:23.474352Z","times_seen":17948153,"resource_available":true,"data":null}},"time_used":25,"timings":{"blocked":-1,"dns":4,"connect":1,"send":0,"wait":9,"receive":0,"ssl":11},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"www.smartsuppchat.com/loader.js?","fqdn":"www.smartsuppchat.com","domain":"smartsuppchat.com","tld":"com"},"ip":{"addr":"185.76.9.11","port":443,"asn":60068,"as":"Datacamp Limited","country":"Sweden","country_code":"SE"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://coinbasesupportdirectmessage.fetliis.sbs/","date":"2026-08-09T10:06:00.407Z","timestamp":1786269960407,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"1161431244.rsc.cdn77.org","organization":""},"issuer":{"commonName":"YE1","organization":"Let's Encrypt"},"validity":{"start":"Thu, 04 Jun 2026 14:34:49 GMT","end":"Wed, 02 Sep 2026 14:34:48 GMT"},"fingerprint":{"sha1":"77:06:42:CE:73:9F:CA:05:A3:6E:99:99:F2:3F:B7:EE:E4:60:E9:29","sha256":"E7:6E:68:C5:CD:6C:F6:14:84:A0:18:1A:D7:94:77:7A:28:F6:67:8E:90:58:94:AE:3A:65:6A:B7:95:0F:5D:1B"}}},"request":{"raw":"GET /loader.js? HTTP/1.1\r\nHost: www.smartsuppchat.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-Fetch-Storage-Access: none\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://coinbasesupportdirectmessage.fetliis.sbs/\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\ndate: Sun, 09 Aug 2026 10:06:03 GMT\r\ncontent-type: application/javascript\r\ncache-control: max-age=300, public, s-maxage=60\r\netag: W/\"6a2663cd-4668\"\r\nexpires: Mon, 08 Jun 2026 06:46:12 GMT\r\nlast-modified: Mon, 08 Jun 2026 06:40:13 GMT\r\nx-77-nzt: k1k7TmmmJUqpb0ch8QxML9EO7wMaSACSUlwGq3yM1GJIaLtb79m/b1OCgke8UuNiRYo+SM0\r\nx-77-nzt-ray: e2f75420496adf013051786a03157e29\r\nx-77-cache: HIT\r\nx-77-age: 47\r\nvary: Accept-Encoding\r\ncontent-encoding: gzip\r\nserver: CDN77-Turbo\r\nx-77-pop: stockholmSE\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"CDN77","description":"CDN77 is a content delivery network (CDN).","website":"https://www.cdn77.com","common_platform_enumeration":"","icon":"CDN77.png","categories":["CDN"]}],"data":{"size":18024,"size_decoded":6042,"mime_type":"application/javascript","magic":"JavaScript source, ASCII text, with very long lines (17951)","md5":"218d24439d4e2c0990f35338a7ac220c","sha1":"5a7b913584c1244bf61beab9dc644204d130101c","sha256":"efb497f7159de26ea5e0521d675d909dc063e36d0d23c2ad96fa9109b73ee263","sha512":"17af39bfdc350c9d1f8dd74652641d0c028881ecb3935d2d9fdb763d24136665d135d00219aabac57693112e2314d4fa91b802ba2662a1580aa35c5e0b6e624b","ssdeep":"384:2/xzy2A3wyxNeBWbEgl/EuVaBWbE0rIcvqSI/aQ/UpG:2/xzy2A3wXscuVaAxka05","tlshash":"4182b7cc7691b16543ab61b4843f620ff1376929740d8865b965eae13cb8c8ed037fb8","first_seen":"2026-03-30T19:01:55.527327Z","last_seen":"2026-08-17T23:41:13.416027Z","times_seen":8491,"resource_available":true,"data":null}},"time_used":3297,"timings":{"blocked":-1,"dns":34,"connect":8,"send":0,"wait":9,"receive":0,"ssl":3246},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"coinbasesupportdirectmessage.fetliis.sbs/coinbase/coinbas.png","fqdn":"coinbasesupportdirectmessage.fetliis.sbs","domain":"fetliis.sbs","tld":"sbs"},"ip":{"addr":"86.107.77.210","port":443,"asn":207913,"as":"Next Level Business Srl","country":"Romania","country_code":"RO"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://coinbasesupportdirectmessage.fetliis.sbs/","date":"2026-08-09T10:06:00.412Z","timestamp":1786269960412,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.fetliis.sbs","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Fri, 24 Jul 2026 14:06:38 GMT","end":"Thu, 22 Oct 2026 14:06:37 GMT"},"fingerprint":{"sha1":"C4:58:DE:A1:23:EB:36:34:F7:9D:86:DA:54:A5:DD:5D:08:4F:64:09","sha256":"26:6B:65:30:F4:0B:01:4C:8B:0C:D8:7B:5C:0E:52:BB:65:AC:D9:0A:E6:D9:34:90:FE:7A:97:77:32:76:9D:1D"}}},"request":{"raw":"GET /coinbase/coinbas.png HTTP/1.1\r\nHost: coinbasesupportdirectmessage.fetliis.sbs\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://coinbasesupportdirectmessage.fetliis.sbs/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\ncache-control: public, max-age=604800\r\nexpires: Sun, 16 Aug 2026 10:06:00 GMT\r\ncontent-type: image/png\r\nlast-modified: Sat, 02 Aug 2025 10:01:06 GMT\r\naccept-ranges: bytes\r\ncontent-length: 11399\r\ndate: Sun, 09 Aug 2026 10:06:00 GMT\r\nserver: LiteSpeed\r\nalt-svc: h3=\":443\"; ma=2592000, h3-29=\":443\"; ma=2592000, h3-Q050=\":443\"; ma=2592000, h3-Q046=\":443\"; ma=2592000, h3-Q043=\":443\"; ma=2592000, quic=\":443\"; ma=2592000; v=\"43,46\"\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"LiteSpeed","description":"LiteSpeed is a high-scalability web server.","website":"https://litespeedtech.com","common_platform_enumeration":"cpe:2.3:a:litespeedtech:litespeed_web_server:*:*:*:*:*:*:*:*","icon":"LiteSpeed.svg","categories":["Web servers"]}],"data":{"size":11399,"size_decoded":11843,"mime_type":"image/png","magic":"PNG image data, 184 x 50, 8-bit/color RGBA, non-interlaced","md5":"557eacb83c9bed338c180973f5ca13d3","sha1":"7c707e4c039fb4c12835b06ae9ef474294f2ba98","sha256":"5a709c026d92f0e7d3619153f50c57281e3c209c83e7c4c6532e8c309efd36ed","sha512":"dd94c6fecad43088e5a3a53df91287385105dd96c7a488cd366d7f3e02c0c039f78106e19ec18ddee0b74a7b5c7f3a95a0b1cf5ca447e65bcc9e5ef0a37f8caa","ssdeep":"192:MmufY8Q6WLAsm/6VTCF1NlLaMH/Q2Bod5V2tz5nbg4UVdo9AGmNjhX0A:XIjQ6Zsmj1NlL1/BIvwzB+09AGmBhX0A","tlshash":"e032cf8c60d22908eb0bccb81e32b59c67036155794e857f9c063ab73d0b127796b22c","first_seen":"2026-06-27T11:20:13.499647Z","last_seen":"2026-08-09T10:06:36.943699Z","times_seen":5,"resource_available":false,"data":null}},"time_used":27,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":27,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-08-09","alert":"Sinkholed","trigger":"coinbasesupportdirectmessage.fetliis.sbs","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"cdn.tailwindcss.com/3.4.17","fqdn":"cdn.tailwindcss.com","domain":"tailwindcss.com","tld":"com"},"ip":{"addr":"104.26.3.143","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://coinbasesupportdirectmessage.fetliis.sbs/","date":"2026-08-09T10:06:00.438Z","timestamp":1786269960438,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"tailwindcss.com","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Fri, 17 Jul 2026 20:38:38 GMT","end":"Thu, 15 Oct 2026 21:38:35 GMT"},"fingerprint":{"sha1":"AF:4F:AD:59:FA:ED:77:04:0D:32:56:48:B0:E5:1B:38:67:6D:7D:02","sha256":"E7:FC:CF:2D:6A:CC:F5:3C:4C:1E:9D:CD:21:8A:72:A3:DB:7C:B1:50:0F:83:D1:DC:E4:AD:25:90:8F:98:37:0F"}}},"request":{"raw":"GET /3.4.17 HTTP/1.1\r\nHost: cdn.tailwindcss.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://coinbasesupportdirectmessage.fetliis.sbs/\r\nSec-Fetch-Storage-Access: none\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPriority: u=2\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\ndate: Sun, 09 Aug 2026 10:06:00 GMT\r\ncontent-type: text/javascript\r\ncache-control: max-age=31536000\r\ncontent-encoding: br\r\nserver: cloudflare\r\nstrict-transport-security: max-age=63072000\r\nx-vercel-cache: MISS\r\nx-vercel-id: fra1::iad1::kcph7-1785159739950-b8e36432cd95\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nvary: accept-encoding\r\nage: 1110219\r\nlast-modified: Thu, 30 Jul 2026 09:47:27 GMT\r\ncf-cache-status: HIT\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=YX5LoITwCMMd9ZO6lHnvWjAamK9mbzvGbPoHxexMK9Sl754vEe0CpJTauseyPIcsIfIMP1d3%2BxPQ0plkFqPkRv%2Fzv9ogRYoPydgNVB2AicFYg04ejy5vo34qzES%2BsZSpqEMEBLw%3D\"}]}\r\ncf-ray: a285f214b836b4eb-OSL\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Vercel","description":"Vercel is a cloud platform for static frontends and serverless functions.","website":"https://vercel.com","common_platform_enumeration":"","icon":"vercel.svg","categories":["PaaS"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":407279,"size_decoded":127120,"mime_type":"text/javascript","magic":"JavaScript source, ASCII text, with very long lines (52853)","md5":"7a614b9a197e532c00d09a23b0996b5f","sha1":"1ff1738a40f3716e30e9031b181b0955ae578955","sha256":"176e894661aa9cdc9a5cba6c720044cbbf7b8bd80d1c9a142a7c24b1b6c50d15","sha512":"a67bc26f52d938358471be5671ff4b79e11af4e68b486aaf73a35a4c9bf3777aab51101af81563b4e5b7ba4b04dd8971fcfa9ee2c41fb10a0c1ee5604a99abd6","ssdeep":"12288:fpgrZxSAoNbJb0Wie75aUXGuyQZhK4O0s:RCVoNB0Wie75aUWmnO0s","tlshash":"e8844aa57396702647eb51e850ea1042f2beaa38840c44bcf7edd4da39e5e4440fbf79","first_seen":"2025-07-28T16:58:08.903462Z","last_seen":"2026-08-18T02:34:50.380888Z","times_seen":49699,"resource_available":true,"data":null}},"time_used":8,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":8,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}}]}