{"report_id":"72e405a6-11fb-4efa-837d-8a2bef8c75a4","version":0,"status":"done","tags":[],"date":"2026-07-18T15:49:59Z","url":{"schema":"http","addr":"epavall.ma","fqdn":"epavall.ma","domain":"epavall.ma","tld":"ma"},"ip":{"addr":"149.255.58.87","port":0,"asn":34931,"as":"Awareness Software Limited","country":"United Kingdom","country_code":"GB"},"final":{"url":{"schema":"https","addr":"epavall.ma/","fqdn":"epavall.ma","domain":"epavall.ma","tld":"ma"},"title":"Site en maintenance","dom":{"size":1430,"mime_type":"text/html; charset=utf-8","magic":"HTML document, Unicode text, UTF-8 text","md5":"c485ae17f8d35f3abf5ffbb2ab09c513","sha1":"c047dab8831377d454af7430ccc7dacd45658d81","sha256":"1ccb2dcaf5c17a375bbeb1ed43305cac891d1b40f8d8447d134637fbeb8dd73f","sha512":"7fbb36e24230180e9ff6fa38b42a649f0fe0a2e2494d26196633c0c762d6435a001982efa0c97bfffa0276fced92258d809bcb90c6bd80369022371231456e7e","ssdeep":"","tlshash":"cd21eb5742e300063897a4681bf7a3004a81c80bc68fcd717f8e6298cfc9595d8e778c","dom_hash":"domhash583b9890b4232435af7c15a608cb0861","first_seen":"2026-07-18T15:50:01.12332Z","last_seen":"2026-07-18T15:51:50.820115Z","times_seen":2,"resource_available":false,"data":null}},"submit":{"url":{"schema":"http","addr":"epavall.ma","fqdn":"epavall.ma","domain":"epavall.ma","tld":"ma"},"ip":{"addr":"149.255.58.87","port":0,"asn":34931,"as":"Awareness Software Limited","country":"United Kingdom","country_code":"GB"},"tags":null,"meta":null},"settings":{"access":"public","device_type":"desktop","expires_at":"2027-08-22T15:49:59Z","useragent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0","referer":"","cookies":null,"exit_node":"qguvgzjxzsgb3vs"},"stats":{"alert_count":{"ids":0,"urlquery":0,"analyzer":4}},"detection":{"ids":null,"analyzer":[{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-07-18","alert":"Phishing Block","trigger":"epavall.ma","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-07-18","alert":"Sinkholed","trigger":"epavall.ma","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-07-18","alert":"Sinkholed","trigger":"epavall.ma","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-07-18","alert":"Sinkholed","trigger":"epavall.ma","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null},"summary":[{"fqdn":"epavall.ma","ip":{"addr":"149.255.58.87","port":443,"asn":34931,"as":"Awareness Software Limited","country":"United Kingdom","country_code":"GB"},"domain_registered":"2024-05-20","domain_rank":0,"first_seen":"2026-07-13T20:22:09.219443Z","last_seen":"2026-07-13T20:22:09.219443Z","alert_count":12,"request_count":3,"received_data":47394,"sent_data":1471,"comment":"","tags":null,"fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}]}],"files":null,"artifacts":{"windows_shortcuts":null,"files":null,"telegram":null,"pdfs":null,"clipboard":null},"sensors":{"ids":null,"analyzer":null,"urlquery":null},"javascript":{"script":null,"eval":null,"write":null,"console":null},"http":[{"url":{"schema":"https","addr":"epavall.ma/","fqdn":"epavall.ma","domain":"epavall.ma","tld":"ma"},"ip":{"addr":"149.255.58.87","port":443,"asn":34931,"as":"Awareness Software Limited","country":"United Kingdom","country_code":"GB"},"is_navigation_request":true,"resource_type":"document","requested_by":"","date":"2026-07-18T15:49:32.732Z","timestamp":1784389772732,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.epavall.ma","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Sat, 23 May 2026 06:30:09 GMT","end":"Fri, 21 Aug 2026 06:30:08 GMT"},"fingerprint":{"sha1":"92:CA:CE:B6:63:07:05:AC:40:42:D2:6F:C8:A8:2A:E3:AD:99:DA:62","sha256":"FE:5B:08:38:FD:16:EF:E4:3C:8E:AD:C0:95:B1:BE:B1:F1:55:C2:D6:E2:ED:91:E0:88:93:71:DC:A3:D9:33:4F"}}},"request":{"raw":"GET / HTTP/1.1\r\nHost: epavall.ma\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nUpgrade-Insecure-Requests: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: document\r\nSec-Fetch-Mode: navigate\r\nSec-Fetch-Site: none\r\nPriority: u=0, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nserver: nginx\r\ndate: Sat, 18 Jul 2026 15:49:32 GMT\r\ncontent-type: text/html\r\nlast-modified: Thu, 15 May 2025 15:24:37 GMT\r\nvary: Accept-Encoding, Accept-Encoding\r\nstrict-transport-security: max-age=15768000; includeSubDomains; preload\r\nx-frame-options: SAMEORIGIN\r\nx-content-type-options: nosniff\r\nreferrer-policy: strict-origin-when-cross-origin\r\ncontent-encoding: br\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":1503,"size_decoded":976,"mime_type":"text/html","magic":"HTML document, Unicode text, UTF-8 text, with CRLF line terminators","md5":"0d48b7ce3268fd400f2f0b38c223c08c","sha1":"a2e9cbb6f0ae6192d2153b474ee8fecf7f935907","sha256":"38609cb8b3b1a39b9194f0e686695458c1a1b70431267818a6fdec0b190cf131","sha512":"cd6b01b099cdd4bd1a48cca83bd3652f622b872d299167b47c67652ad1fab7b8798955387064596cb555b98e309822de922e39d794c8781dff91d43246dc87e2","ssdeep":"","tlshash":"3731ce268285040630b7a2785bb3e340dbc24457838b0a717bde6253cff9544c5e7bcc","first_seen":"2026-07-18T15:50:01.130526Z","last_seen":"2026-07-18T15:51:50.828321Z","times_seen":2,"resource_available":true,"data":null}},"time_used":279,"timings":{"blocked":-1,"dns":147,"connect":31,"send":0,"wait":31,"receive":0,"ssl":70},"alerts":{"ids":null,"analyzer":[{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-07-18","alert":"Phishing Block","trigger":"epavall.ma","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-07-18","alert":"Sinkholed","trigger":"epavall.ma","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-07-18","alert":"Sinkholed","trigger":"epavall.ma","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-07-18","alert":"Sinkholed","trigger":"epavall.ma","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"epavall.ma/logo.gif","fqdn":"epavall.ma","domain":"epavall.ma","tld":"ma"},"ip":{"addr":"149.255.58.87","port":443,"asn":34931,"as":"Awareness Software Limited","country":"United Kingdom","country_code":"GB"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://epavall.ma/","date":"2026-07-18T15:49:33.243Z","timestamp":1784389773243,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.epavall.ma","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Sat, 23 May 2026 06:30:09 GMT","end":"Fri, 21 Aug 2026 06:30:08 GMT"},"fingerprint":{"sha1":"92:CA:CE:B6:63:07:05:AC:40:42:D2:6F:C8:A8:2A:E3:AD:99:DA:62","sha256":"FE:5B:08:38:FD:16:EF:E4:3C:8E:AD:C0:95:B1:BE:B1:F1:55:C2:D6:E2:ED:91:E0:88:93:71:DC:A3:D9:33:4F"}}},"request":{"raw":"GET /logo.gif HTTP/1.1\r\nHost: epavall.ma\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://epavall.ma/\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=4, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nserver: nginx\r\ndate: Sat, 18 Jul 2026 15:49:33 GMT\r\ncontent-type: image/gif\r\ncontent-length: 44381\r\nlast-modified: Thu, 15 May 2025 15:23:52 GMT\r\nstrict-transport-security: max-age=15768000; includeSubDomains; preload\r\nx-frame-options: SAMEORIGIN\r\nx-content-type-options: nosniff\r\nreferrer-policy: strict-origin-when-cross-origin\r\naccept-ranges: bytes\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":44381,"size_decoded":44769,"mime_type":"image/gif","magic":"GIF image data, version 89a, 841 x 777","md5":"a98e4a742c0d042430aa61f8f2da4138","sha1":"012e16e5b49347fb8959418b997f2bc49ec5b0b4","sha256":"c347c8ea512a52287c154ed6fbabea62e62cfa66f40d4502433ded45628c5915","sha512":"1469ded1378360be2500de812eba4380c079f9701aa701f6b6f3aad213f4ca4ada8300ee7236b7faa665dfcccec241f94c194aa7785db274a62fc9b086cd67a1","ssdeep":"768:wQR4QNxctgIMarONIMOYR0d/sfe2MhtGCxrzu6lAGb45/A6xeQDJE9JymmbWedz:wy4QfOgVIOaMTCxbhtGWzu6/buzM9U3N","tlshash":"fe13f2b35c2f551ce7819931674bc82860c1b31b9d03ca7132c3cb8a6b2e69f59d9926","first_seen":"2026-07-18T15:50:01.132855Z","last_seen":"2026-07-18T15:51:50.824436Z","times_seen":2,"resource_available":false,"data":null}},"time_used":94,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":63,"receive":31,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-07-18","alert":"Phishing Block","trigger":"epavall.ma","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-07-18","alert":"Sinkholed","trigger":"epavall.ma","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-07-18","alert":"Sinkholed","trigger":"epavall.ma","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-07-18","alert":"Sinkholed","trigger":"epavall.ma","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"epavall.ma/favicon.ico","fqdn":"epavall.ma","domain":"epavall.ma","tld":"ma"},"ip":{"addr":"149.255.58.87","port":443,"asn":34931,"as":"Awareness Software Limited","country":"United Kingdom","country_code":"GB"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://epavall.ma/","date":"2026-07-18T15:49:33.343Z","timestamp":1784389773343,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.epavall.ma","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Sat, 23 May 2026 06:30:09 GMT","end":"Fri, 21 Aug 2026 06:30:08 GMT"},"fingerprint":{"sha1":"92:CA:CE:B6:63:07:05:AC:40:42:D2:6F:C8:A8:2A:E3:AD:99:DA:62","sha256":"FE:5B:08:38:FD:16:EF:E4:3C:8E:AD:C0:95:B1:BE:B1:F1:55:C2:D6:E2:ED:91:E0:88:93:71:DC:A3:D9:33:4F"}}},"request":{"raw":"GET /favicon.ico HTTP/1.1\r\nHost: epavall.ma\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://epavall.ma/\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=6\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 404 \r\nserver: nginx\r\ndate: Sat, 18 Jul 2026 15:49:33 GMT\r\ncontent-type: text/html; charset=iso-8859-1\r\nvary: Accept-Encoding\r\nstrict-transport-security: max-age=15768000; includeSubDomains; preload\r\nx-frame-options: SAMEORIGIN\r\nx-content-type-options: nosniff\r\nreferrer-policy: strict-origin-when-cross-origin\r\ncontent-encoding: br\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"404","status_text":"","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":355,"size_decoded":563,"mime_type":"text/html; charset=iso-8859-1","magic":"HTML document, ASCII text","md5":"4525b2d648f7c457a689fd96421783a5","sha1":"11bfe30ce44585a15a38e86bc094224ddfe2c08e","sha256":"cc0b4e42510d49c6decd464123ecf3b14ae9b47f9b4ed2ee64893e2d6520a264","sha512":"94e3e8246cf38ff7740e51aa115c8c455b14f78e672c2686b782c0ce30b6fa2dbd91a78b29b3964d9c0414aabd4b9391fd5db326665e25b4b8e73dae60ffe979","ssdeep":"","tlshash":"71e0c04f4057b3474011a2907dc01291e505236b38a152f93ac09467500897dc4aa2dd","first_seen":"2025-12-09T03:51:58.5943Z","last_seen":"2026-08-07T11:57:05.400369Z","times_seen":54418,"resource_available":true,"data":null}},"time_used":77,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":77,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-07-18","alert":"Phishing Block","trigger":"epavall.ma","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-07-18","alert":"Sinkholed","trigger":"epavall.ma","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-07-18","alert":"Sinkholed","trigger":"epavall.ma","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-07-18","alert":"Sinkholed","trigger":"epavall.ma","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}}]}