{"report_id":"776997ee-6912-425a-95f6-d70917e18be4","version":6,"status":"done","tags":[],"date":"2025-11-25T01:08:35Z","url":{"schema":"http","addr":"whatsapp-br.cc/","fqdn":"whatsapp-br.cc","domain":"whatsapp-br.cc","tld":"cc"},"ip":{"addr":"27.124.47.164","port":0,"asn":152194,"as":"CTG Server Limited","country":"Singapore","country_code":"SG"},"final":{"url":{"schema":"https","addr":"whatsapp-br.cc/safedetail","fqdn":"whatsapp-br.cc","domain":"whatsapp-br.cc","tld":"cc"},"title":"WhatsApp Security Testing Center","dom":{"size":8786,"mime_type":"text/html; charset=utf-8","magic":"HTML document, Unicode text, UTF-8 text, with very long lines (7289)","md5":"b96fabff371bc2aa118d7782704fd0f1","sha1":"7818adbdd80fa7cae969ef789bb01270e50e4f23","sha256":"620600fddea68760edbffe8de682ab93765079896f99fdeb5ec806626a850238","sha512":"9a61be4726c3f413baff9e5179c13aab7f9bec1ef7f5384860a44e4074aaf14c4e76760a974e1f7e28e964e4eba8387f64b57d7f7cc7d6a6d1e83f8e52e4dc82","ssdeep":"192:Wgm7Jwqk5QZrC32YSW2+/pCt0RDZWJWZdgPZ60/p0zhi4wZq4yfsyj6hepYZfhW:W2Tow2YSWFxCtH2Y4gsYu","tlshash":"6402a63aa298252e75038265ff947b7c746e9207db2fd46cf56d02b49b83ec8ec121d4","dom_hash":"domhashfb5e837342149ad458d10fa30e59f72b","first_seen":"","last_seen":"","times_seen":0,"resource_available":false,"data":null}},"submit":{"url":{"schema":"http","addr":"whatsapp-br.cc/","fqdn":"whatsapp-br.cc","domain":"whatsapp-br.cc","tld":"cc"},"ip":{"addr":"27.124.47.164","port":0,"asn":152194,"as":"CTG Server Limited","country":"Singapore","country_code":"SG"},"tags":["openphish"],"meta":null},"settings":{"access":"public","device_type":"desktop","expires_at":"2026-12-30T01:08:35Z","useragent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0","referer":"","cookies":null,"exit_node":"z0yflva4pidy47h"},"stats":{"alert_count":{"ids":1,"urlquery":0,"analyzer":5}},"detection":{"ids":[{"sensor_name":"suricata","title":"Suricata IDS","description":"Suricata /w Emerging Threats Pro","date":"2025-11-25T01:08:14Z","timestamp":1764032894,"ip_dst":{"addr":"172.18.0.12","port":39898,"asn":0,"as":"","country":"","country_code":"zz"},"ip_src":{"addr":"134.122.187.191","port":443,"asn":152194,"as":"CTG Server Limited","country":"Singapore","country_code":"SG"},"severity":"medium","alert":"ET DROP Spamhaus DROP Listed Traffic Inbound group 25","source":"{\"timestamp\":\"2025-11-25T01:08:14.261462+0000\",\"flow_id\":1656725677344762,\"in_iface\":\"br-31613a7ed13b\",\"event_type\":\"alert\",\"src_ip\":\"134.122.187.191\",\"src_port\":443,\"dest_ip\":\"172.18.0.12\",\"dest_port\":39898,\"proto\":\"TCP\",\"metadata\":{\"flowbits\":[\"ET.Evil\",\"ET.DROPIP\"]},\"alert\":{\"action\":\"allowed\",\"gid\":1,\"signature_id\":2400024,\"rev\":4421,\"signature\":\"ET DROP Spamhaus DROP Listed Traffic Inbound group 25\",\"category\":\"Misc Attack\",\"severity\":2,\"metadata\":{\"affected_product\":[\"Any\"],\"attack_target\":[\"Any\"],\"created_at\":[\"2010_12_30\"],\"deployment\":[\"Perimeter\"],\"signature_severity\":[\"Minor\"],\"tag\":[\"Dshield\"],\"updated_at\":[\"2025_08_01\"]}},\"flow\":{\"pkts_toserver\":1,\"pkts_toclient\":1,\"bytes_toserver\":74,\"bytes_toclient\":74,\"start\":\"2025-11-25T01:08:13.919546+0000\"}}"}],"analyzer":[{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2025-11-25","alert":"Sinkholed","trigger":"whatsapp-br.cc","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2025-11-25","alert":"Phishing Block","trigger":"whatsapp-br.cc","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-11-25","alert":"Sinkholed","trigger":"whatsapp-br.cc","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null},{"sensor_name":"cira_dns","sensor_type":"DNS","title":"CIRA Canadian Shield DNS","description":"CIRA Canadian Shield DNS","scan_date":"2025-11-25","alert":"Sinkholed","trigger":"whatsapp-br.cc","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cira.ca/en/canadian-shield/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2025-11-25","alert":"Sinkholed","trigger":"whatsapp-br.cc","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null},"summary":[{"fqdn":"whatsapp-br.cc","ip":{"addr":"134.122.187.191","port":443,"asn":152194,"as":"CTG Server Limited","country":"Singapore","country_code":"SG"},"domain_registered":"unknown","domain_rank":0,"first_seen":"No data","last_seen":"No data","alert_count":20,"request_count":4,"received_data":454152,"sent_data":1781,"comment":"","tags":null,"fingerprints":null}],"files":null,"artifacts":{"windows_shortcuts":null,"files":null,"telegram":null,"pdfs":null,"clipboard":null},"sensors":{"ids":null,"analyzer":null,"urlquery":null},"javascript":{"script":[{"url":{"schema":"https","addr":"whatsapp-br.cc/assets/index-BuCffO88.js","fqdn":"whatsapp-br.cc","domain":"whatsapp-br.cc","tld":"cc"},"ip":{"addr":"134.122.187.191","port":443,"asn":152194,"as":"CTG Server Limited","country":"Singapore","country_code":"SG"},"introduction_type":"scriptElement","is_inline":false,"md5":"a7234de7337dbd6ae9c8eaf3dc05b75e","sha1":"ce76a6dedad015cfca458ba4bc5c5e0d48078ff0","sha256":"7db78aefadb9bfce96252ed7cf26d7e2e302bd0b154aaac47bec6f4bde4b556f","sha512":"01686c97a82dc80ccb254d4a8b4d0f737dc1a6bee895b3ae16c73c65e2f0fc0be359479cc3995f53cfea422873d2969e70c96008789fc4c8ff558560c0f5f813","ssdeep":"6144:LSvQsjmOYNNKxZtNgMLonVIc4TINNOL4dU:LQzaOYnKTHgMLonSc48vOLn","tlshash":"5f744cdc3169b6262a6346b1509f2107b17c2937a84d88b07068ddaa3bf4449e17bffd","size":370447,"data":"","first_seen":"2025-11-25T01:08:40.328211Z","last_seen":"2025-11-25T01:08:40.328211Z","times_seen":1,"alerts":{"ids":null,"analyzer":null,"urlquery":null}}],"eval":null,"write":null,"console":null},"http":[{"url":{"schema":"https","addr":"whatsapp-br.cc/favicon.ico","fqdn":"whatsapp-br.cc","domain":"whatsapp-br.cc","tld":"cc"},"ip":{"addr":"134.122.187.191","port":443,"asn":152194,"as":"CTG Server Limited","country":"Singapore","country_code":"SG"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://whatsapp-br.cc/","date":"2025-11-25T01:08:16.954Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256","key_group_name":"P256","signature_name":"RSA-PKCS1-SHA512","protocol":"TLSv1.2","cert":{"subject":{"commonName":"www.whatsapp-br.cc","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Fri, 21 Nov 2025 10:03:26 GMT","end":"Thu, 19 Feb 2026 10:03:25 GMT"},"fingerprint":{"sha1":"F4:8F:A0:46:71:03:AB:F3:C5:EE:83:99:E2:BD:A4:09:C4:E3:A1:68","sha256":"56:EB:E6:A9:84:AA:5B:B4:18:C6:29:8B:1A:5E:4A:70:C4:C5:02:5B:86:FF:6B:E4:4C:FC:C3:8E:76:1F:B8:9E"}}},"request":{"raw":"GET /favicon.ico HTTP/1.1\r\nHost: whatsapp-br.cc\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://whatsapp-br.cc/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Tue, 25 Nov 2025 01:08:17 GMT\r\nContent-Type: image/x-icon\r\nContent-Length: 52202\r\nConnection: keep-alive\r\nLast-Modified: Fri, 21 Nov 2025 09:39:00 GMT\r\nETag: \"69203334-cbea\"\r\nServer: cdn\r\nX-Cache-Status: HIT\r\nAccept-Ranges: bytes\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":null,"data":{"size":52202,"size_decoded":0,"mime_type":"image/x-icon","magic":"MS Windows icon resource - 1 icon, 256x256 with PNG image data, 256 x 256, 8-bit/color RGBA, non-interlaced, 32 bits/pixel","md5":"079f3116b70133749a3d162cafdf9906","sha1":"96b1adc5088fdfbeb269bd880cdcecc37a7a336e","sha256":"f59712e51edae60bda860fbe4841f512c288df45b8ff70c748504ae2727a6753","sha512":"35110f4cbe334c2c9c24ca00190af4415484462908944fe2b48481188413908d26a63ea2f9ab613dd1c29f44effcc903ebd4cb63d3c4c91d9b11aebfa83bd45b","ssdeep":"1536:zFSuzNVMNACvRcpN8L/O2hLmevy2VRGrUNCc8:z0uz09vRcpGLTn8","tlshash":"6c33016ef69605f0a7f505a7752bccb400e248a4f0a9f64112f723fe775672c46eb422","first_seen":"2025-11-19T14:03:57.148654Z","last_seen":"2026-02-18T13:07:16.075682Z","times_seen":57,"resource_available":false,"data":null}},"time_used":386,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":353,"receive":33,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2025-11-25","alert":"Sinkholed","trigger":"whatsapp-br.cc","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2025-11-25","alert":"Phishing Block","trigger":"whatsapp-br.cc","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-11-25","alert":"Sinkholed","trigger":"whatsapp-br.cc","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null},{"sensor_name":"cira_dns","sensor_type":"DNS","title":"CIRA Canadian Shield DNS","description":"CIRA Canadian Shield DNS","scan_date":"2025-11-25","alert":"Sinkholed","trigger":"whatsapp-br.cc","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cira.ca/en/canadian-shield/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2025-11-25","alert":"Sinkholed","trigger":"whatsapp-br.cc","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"whatsapp-br.cc/","fqdn":"whatsapp-br.cc","domain":"whatsapp-br.cc","tld":"cc"},"ip":{"addr":"134.122.187.191","port":443,"asn":152194,"as":"CTG Server Limited","country":"Singapore","country_code":"SG"},"is_navigation_request":true,"resource_type":"document","requested_by":"","date":"2025-11-25T01:08:13.338Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256","key_group_name":"P256","signature_name":"RSA-PKCS1-SHA512","protocol":"TLSv1.2","cert":{"subject":{"commonName":"www.whatsapp-br.cc","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Fri, 21 Nov 2025 10:03:26 GMT","end":"Thu, 19 Feb 2026 10:03:25 GMT"},"fingerprint":{"sha1":"F4:8F:A0:46:71:03:AB:F3:C5:EE:83:99:E2:BD:A4:09:C4:E3:A1:68","sha256":"56:EB:E6:A9:84:AA:5B:B4:18:C6:29:8B:1A:5E:4A:70:C4:C5:02:5B:86:FF:6B:E4:4C:FC:C3:8E:76:1F:B8:9E"}}},"request":{"raw":"GET / HTTP/1.1\r\nHost: whatsapp-br.cc\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nUpgrade-Insecure-Requests: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: document\r\nSec-Fetch-Mode: navigate\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Tue, 25 Nov 2025 01:08:15 GMT\r\nContent-Type: text/html\r\nContent-Length: 989\r\nConnection: keep-alive\r\nLast-Modified: Mon, 24 Nov 2025 02:24:46 GMT\r\nETag: \"6923c1ee-3dd\"\r\nAccept-Ranges: bytes\r\nServer: cdn\r\nX-Cache-Status: MISS\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":null,"data":{"size":989,"size_decoded":0,"mime_type":"text/html","magic":"HTML document, Unicode text, UTF-8 text","md5":"def8b120c3fd48c19aa7d03e0dbf3fb2","sha1":"ac2bbd8b62313820b9197eea073971dd0e78cd62","sha256":"4bdd159ec4a54e64257634ffe4241a05ceac4f30091050f4c349bec26cad6880","sha512":"912fef3615a6f9d81659f4b3b9ffe5968483c8fa785943e35a6cc8ac640ac1c76c28eb5e636dc0fa1a2bcc2fbd41ad508f7c3ddb2a3344dc9dee5092374f899c","ssdeep":"","tlshash":"e611ab4699e24444222082741be5b72c7f5bc107034add587a6e70749f857c28cc76a8","first_seen":"2025-11-25T01:08:40.327232Z","last_seen":"2025-11-25T01:08:40.327232Z","times_seen":1,"resource_available":false,"data":null}},"time_used":3582,"timings":{"blocked":1618,"dns":582,"connect":342,"send":0,"wait":346,"receive":0,"ssl":691},"alerts":{"ids":null,"analyzer":[{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2025-11-25","alert":"Phishing Block","trigger":"whatsapp-br.cc","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2025-11-25","alert":"Sinkholed","trigger":"whatsapp-br.cc","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"cira_dns","sensor_type":"DNS","title":"CIRA Canadian Shield DNS","description":"CIRA Canadian Shield DNS","scan_date":"2025-11-25","alert":"Sinkholed","trigger":"whatsapp-br.cc","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cira.ca/en/canadian-shield/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2025-11-25","alert":"Sinkholed","trigger":"whatsapp-br.cc","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-11-25","alert":"Sinkholed","trigger":"whatsapp-br.cc","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"whatsapp-br.cc/assets/index-BuCffO88.js","fqdn":"whatsapp-br.cc","domain":"whatsapp-br.cc","tld":"cc"},"ip":{"addr":"134.122.187.191","port":443,"asn":152194,"as":"CTG Server Limited","country":"Singapore","country_code":"SG"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://whatsapp-br.cc/","date":"2025-11-25T01:08:15.440Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256","key_group_name":"P256","signature_name":"RSA-PKCS1-SHA512","protocol":"TLSv1.2","cert":{"subject":{"commonName":"www.whatsapp-br.cc","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Fri, 21 Nov 2025 10:03:26 GMT","end":"Thu, 19 Feb 2026 10:03:25 GMT"},"fingerprint":{"sha1":"F4:8F:A0:46:71:03:AB:F3:C5:EE:83:99:E2:BD:A4:09:C4:E3:A1:68","sha256":"56:EB:E6:A9:84:AA:5B:B4:18:C6:29:8B:1A:5E:4A:70:C4:C5:02:5B:86:FF:6B:E4:4C:FC:C3:8E:76:1F:B8:9E"}}},"request":{"raw":"GET /assets/index-BuCffO88.js HTTP/1.1\r\nHost: whatsapp-br.cc\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://whatsapp-br.cc/\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Tue, 25 Nov 2025 01:08:15 GMT\r\nContent-Type: application/javascript\r\nTransfer-Encoding: chunked\r\nConnection: keep-alive\r\nLast-Modified: Mon, 24 Nov 2025 02:24:46 GMT\r\nVary: Accept-Encoding, Accept-Encoding\r\nETag: W/\"6923c1ee-5a70f\"\r\nExpires: Tue, 25 Nov 2025 08:22:19 GMT\r\nCache-Control: max-age=43200\r\nServer: cdn\r\nX-Cache-Status: HIT\r\nContent-Encoding: gzip\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":null,"data":{"size":370447,"size_decoded":0,"mime_type":"application/javascript","magic":"JavaScript source, ASCII text, with very long lines (41652)","md5":"a7234de7337dbd6ae9c8eaf3dc05b75e","sha1":"ce76a6dedad015cfca458ba4bc5c5e0d48078ff0","sha256":"7db78aefadb9bfce96252ed7cf26d7e2e302bd0b154aaac47bec6f4bde4b556f","sha512":"01686c97a82dc80ccb254d4a8b4d0f737dc1a6bee895b3ae16c73c65e2f0fc0be359479cc3995f53cfea422873d2969e70c96008789fc4c8ff558560c0f5f813","ssdeep":"6144:LSvQsjmOYNNKxZtNgMLonVIc4TINNOL4dU:LQzaOYnKTHgMLonSc48vOLn","tlshash":"5f744cdc3169b6262a6346b1509f2107b17c2937a84d88b07068ddaa3bf4449e17bffd","first_seen":"2025-11-25T01:08:40.328211Z","last_seen":"2025-11-25T01:08:40.328211Z","times_seen":1,"resource_available":true,"data":null}},"time_used":1409,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":686,"receive":723,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2025-11-25","alert":"Sinkholed","trigger":"whatsapp-br.cc","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"cira_dns","sensor_type":"DNS","title":"CIRA Canadian Shield DNS","description":"CIRA Canadian Shield DNS","scan_date":"2025-11-25","alert":"Sinkholed","trigger":"whatsapp-br.cc","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cira.ca/en/canadian-shield/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2025-11-25","alert":"Sinkholed","trigger":"whatsapp-br.cc","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2025-11-25","alert":"Phishing Block","trigger":"whatsapp-br.cc","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-11-25","alert":"Sinkholed","trigger":"whatsapp-br.cc","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"whatsapp-br.cc/assets/index-Cm4L1pFP.css","fqdn":"whatsapp-br.cc","domain":"whatsapp-br.cc","tld":"cc"},"ip":{"addr":"134.122.187.186","port":443,"asn":152194,"as":"CTG Server Limited","country":"Singapore","country_code":"SG"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://whatsapp-br.cc/","date":"2025-11-25T01:08:15.441Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256","key_group_name":"P256","signature_name":"RSA-PKCS1-SHA512","protocol":"TLSv1.2","cert":{"subject":{"commonName":"www.whatsapp-br.cc","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Fri, 21 Nov 2025 10:03:26 GMT","end":"Thu, 19 Feb 2026 10:03:25 GMT"},"fingerprint":{"sha1":"F4:8F:A0:46:71:03:AB:F3:C5:EE:83:99:E2:BD:A4:09:C4:E3:A1:68","sha256":"56:EB:E6:A9:84:AA:5B:B4:18:C6:29:8B:1A:5E:4A:70:C4:C5:02:5B:86:FF:6B:E4:4C:FC:C3:8E:76:1F:B8:9E"}}},"request":{"raw":"GET /assets/index-Cm4L1pFP.css HTTP/1.1\r\nHost: whatsapp-br.cc\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://whatsapp-br.cc/\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Tue, 25 Nov 2025 01:08:15 GMT\r\nContent-Type: text/css\r\nTransfer-Encoding: chunked\r\nConnection: keep-alive\r\nLast-Modified: Mon, 24 Nov 2025 02:24:46 GMT\r\nVary: Accept-Encoding, Accept-Encoding\r\nETag: W/\"6923c1ee-7242\"\r\nExpires: Tue, 25 Nov 2025 08:22:20 GMT\r\nCache-Control: max-age=43200\r\nServer: cdn\r\nX-Cache-Status: HIT\r\nContent-Encoding: gzip\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":null,"data":{"size":29250,"size_decoded":0,"mime_type":"text/css","magic":"ASCII text, with very long lines (29249)","md5":"2923fe9ff08b7509aca76990f27f548e","sha1":"97160d5bb95c2039bee446d46c952ca727415895","sha256":"4f5c6427d328f094dfc9944e28ea38f6f8d7c45d12f125d4f8134ac5a271e4ab","sha512":"b0e059ace3691dd6822f77775d63ccb0ea0e5f69e4f50b1d700a18edb6de66aeac5ddd6816983db6e9ff155c98fdc95c0ad8737b328744c33b0c36bd7f6c670f","ssdeep":"384:kw5WfER6+GwX/HxrfTlsEKSejLdYiGT/o:nWA6qxrrlsEKSGdYJE","tlshash":"22d2762aa790103f7c63d0e5d5c576bdf62eb0c1df3a4aada982622497d23f70d93604","first_seen":"2025-11-19T14:03:57.15194Z","last_seen":"2026-02-18T13:07:16.077385Z","times_seen":33,"resource_available":false,"data":null}},"time_used":341,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":341,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2025-11-25","alert":"Sinkholed","trigger":"whatsapp-br.cc","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"cira_dns","sensor_type":"DNS","title":"CIRA Canadian Shield DNS","description":"CIRA Canadian Shield DNS","scan_date":"2025-11-25","alert":"Sinkholed","trigger":"whatsapp-br.cc","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cira.ca/en/canadian-shield/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2025-11-25","alert":"Sinkholed","trigger":"whatsapp-br.cc","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2025-11-25","alert":"Phishing Block","trigger":"whatsapp-br.cc","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-11-25","alert":"Sinkholed","trigger":"whatsapp-br.cc","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}}]}