{"report_id":"7786e185-b52a-434e-b4b5-37d9b568c70f","version":6,"status":"done","tags":[],"date":"2026-05-27T00:24:39Z","url":{"schema":"http","addr":"hemmenwellness.com/wp-content/uploads/gawudkx/jrqwgif/ltb1rcx/10001/index.php?uid=aaaa@example.jp","fqdn":"hemmenwellness.com","domain":"hemmenwellness.com","tld":"com"},"ip":{"addr":"180.163.146.7","port":0,"asn":4812,"as":"China Telecom Group","country":"China","country_code":"CN"},"final":{"url":{"schema":"http","addr":"hemmenwellness.com/wp-content/uploads/gawudkx/jrqwgif/ltb1rcx/10001/?uid=aaaa@example.jp","fqdn":"hemmenwellness.com","domain":"hemmenwellness.com","tld":"com"},"title":"未找到页面","dom":{"size":62712,"mime_type":"text/html; charset=utf-8","magic":"JavaScript source, Unicode text, UTF-8 text, with very long lines (16937)","md5":"83519da9a5f80f4f9992216f31c19e4f","sha1":"8b718c20e97cc5b575d47cf1c8fa5006e821b194","sha256":"00c3c8777fe2b3d0124b3b7268dcd78ab4ec1127319ee0f5348b6b00973b1165","sha512":"2a5157d4dff4a861bd11bf5cf1383274e12021a05e862de8605a186e5cba4eadfda201a31ee51dd0957184fb4b58d08bd59081c9f136c985c2ec295d7a91d2b8","ssdeep":"1536:9o/6apMpcC8Kz4dMgjImZtulemlUYuXwPL7d4DVdgVz0dIz7Q:9o/NiWd7jImZtulemlUYugPLIgFKW7Q","tlshash":"4953d8a153b448f5392fc3a99945b319b158e901de0aa2e6f4f5d06865ccdbb08f3b0f","dom_hash":"domhash34ed45cd9b0f644592445f85785e8e50","first_seen":"2026-05-27T00:24:42.325841Z","last_seen":"2026-05-27T00:24:42.325841Z","times_seen":1,"resource_available":false,"data":null}},"submit":{"url":{"schema":"http","addr":"hemmenwellness.com/wp-content/uploads/gawudkx/jrqwgif/ltb1rcx/10001/index.php?uid=aaaa@example.jp","fqdn":"hemmenwellness.com","domain":"hemmenwellness.com","tld":"com"},"ip":{"addr":"180.163.146.7","port":0,"asn":4812,"as":"China Telecom Group","country":"China","country_code":"CN"},"tags":null,"meta":null},"settings":{"access":"public","device_type":"desktop","expires_at":"2027-07-01T00:24:39Z","useragent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0","referer":"","cookies":null,"exit_node":"z0yflva4pidy47h"},"stats":{"alert_count":{"ids":0,"urlquery":0,"analyzer":2}},"detection":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-05-26","alert":"Sinkholed","trigger":"hemmenwellness.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-05-26","alert":"Sinkholed","trigger":"hemmenwellness.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null},"summary":[{"fqdn":"hemmenwellness.com","ip":{"addr":"180.163.146.7","port":80,"asn":4812,"as":"China Telecom Group","country":"China","country_code":"CN"},"domain_registered":"2024-11-20","domain_rank":0,"first_seen":"2026-03-19T12:05:44.959434Z","last_seen":"2026-05-26T17:27:25.050254Z","alert_count":50,"request_count":25,"received_data":1304595,"sent_data":13207,"comment":"","tags":null,"fingerprints":[{"name":"Tengine","description":"Tengine is a web server which is based on the Nginx HTTP server.","website":"https://tengine.taobao.org","common_platform_enumeration":"","icon":"Tengine.png","categories":["Web servers"]},{"name":"WordPress Site Editor","description":"Full Site Editing enables users to design and customize their entire WordPress website with a block-based editor.","website":"https://wordpress.org/documentation/article/site-editor/","common_platform_enumeration":"","icon":"WordPress.svg","categories":["Page builders"]},{"name":"WordPress Block Editor","description":"Sites using the WordPress Block Editor, also known as Gutenberg.","website":"https://wordpress.org/gutenberg/","common_platform_enumeration":"","icon":"WordPress.svg","categories":["Page builders"]},{"name":"jQuery","description":"jQuery is a JavaScript library which is a free, open-source software designed to simplify HTML DOM tree traversal and manipulation, as well as event handling, CSS animation, and Ajax.","website":"https://jquery.com","common_platform_enumeration":"cpe:2.3:a:jquery:jquery:*:*:*:*:*:*:*:*","icon":"jQuery.svg","categories":["JavaScript libraries"]},{"name":"jQuery Migrate:3.4.1","description":"Query Migrate is a javascript library that allows you to preserve the compatibility of your jQuery code developed for versions of jQuery older than 1.9.","website":"https://github.com/jquery/jquery-migrate","common_platform_enumeration":"","icon":"jQuery.svg","categories":["JavaScript libraries"]},{"name":"WordPress:6.7.1","description":"WordPress is a free and open-source content management system written in PHP and paired with a MySQL or MariaDB database. Features include a plugin architecture and a template system.","website":"https://wordpress.org","common_platform_enumeration":"cpe:2.3:a:wordpress:wordpress:*:*:*:*:*:*:*:*","icon":"WordPress.svg","categories":["CMS","Blogs"]},{"name":"MySQL","description":"MySQL is an open-source relational database management system.","website":"https://mysql.com","common_platform_enumeration":"cpe:2.3:a:mysql:mysql:*:*:*:*:*:*:*:*","icon":"MySQL.svg","categories":["Databases"]},{"name":"PHP","description":"PHP is a general-purpose scripting language used for web development.","website":"https://php.net","common_platform_enumeration":"cpe:2.3:a:php:php:*:*:*:*:*:*:*:*","icon":"PHP.svg","categories":["Programming languages"]}]}],"files":null,"artifacts":{"windows_shortcuts":null,"files":null,"telegram":null,"pdfs":null,"clipboard":null},"sensors":{"ids":null,"analyzer":null,"urlquery":null},"javascript":{"script":[{"url":{"schema":"https","addr":"hemmenwellness.com/wp-content/plugins/hm-image-slider/js/slider.js?ver=1.0","fqdn":"hemmenwellness.com","domain":"hemmenwellness.com","tld":"com"},"ip":{"addr":"180.163.146.7","port":443,"asn":4812,"as":"China Telecom Group","country":"China","country_code":"CN"},"introduction_type":"scriptElement","is_inline":false,"md5":"782f8eaf83361b44b9132efda10f7f68","sha1":"8dfd68239a91af10dceaccf8be5c4c7347f7be68","sha256":"1330e79b675ca6188cbabb17e9f44fb5920dc3ca3df6b84caa64e14732e13578","sha512":"502b36273f737e1a9951de791e691189f7790297d773e2fe846208abc757364c337562d4d36a1fa724ea5cdfa8a684506fcaaaba45431d824817e1870c1d51c1","ssdeep":"","tlshash":"42818a1db2675a64d8b7317fb75fd018b5e203033006da48b4dd16844f99a289a50bfb","size":4051,"data":"","first_seen":"2026-03-23T23:15:45.806925Z","last_seen":"2026-05-27T00:24:42.331386Z","times_seen":5,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"hemmenwellness.com/wp-content/plugins/hm-pop-from/js/script.js?ver=1.0","fqdn":"hemmenwellness.com","domain":"hemmenwellness.com","tld":"com"},"ip":{"addr":"180.163.146.7","port":443,"asn":4812,"as":"China Telecom Group","country":"China","country_code":"CN"},"introduction_type":"scriptElement","is_inline":false,"md5":"c8db5398843330e8bf0bd231f8cb7a55","sha1":"720b556387583ba7371b02fa950c44799501fa81","sha256":"149d64a29f53dfdc0aaf06eebe93e14a8c954352e9f1c08c5faf2d70dfffa330","sha512":"5bd31c0e5801a7144241fbc3334e90a0554af6474a13aae691fcc685d426d0e7db0538cf5c64533d4c1b738b99bf6059518ede4c029f0c7fc0653f2ba5e99905","ssdeep":"","tlshash":"c941481a78f676d45a3b306d27fba5063615200bb20cee113a4d1bc14f5cb787992baa","size":2375,"data":"","first_seen":"2026-03-23T23:15:45.787239Z","last_seen":"2026-05-27T00:24:42.356578Z","times_seen":5,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"hemmenwellness.com/wp-includes/js/jquery/jquery-migrate.min.js?ver=3.4.1","fqdn":"hemmenwellness.com","domain":"hemmenwellness.com","tld":"com"},"ip":{"addr":"180.163.146.7","port":443,"asn":4812,"as":"China Telecom Group","country":"China","country_code":"CN"},"introduction_type":"scriptElement","is_inline":false,"md5":"9ffeb32e2d9efbf8f70caabded242267","sha1":"3ad0c10e501ac2a9bfa18f9cd7e700219b378738","sha256":"5274f11e6fb32ae0cf2dfb9f8043272865c397a7c4223b4cfa7d50ea52fbde89","sha512":"8d6be545508a1c38278b8ad780c3758ae48a25e4e12eee443375aa56031d9b356f8c90f22d4f251140fa3f65603af40523165e33cae2e2d62fc78ec106e3d731","ssdeep":"192:5rprDN+sag6ifKIUpQI99P1tLm9kdgyq1+J3aCJQ+h4MPLORq:5rprxaefKI0LP19m4q1WW+h4Mjp","tlshash":"9952c8adb56679724eb721b8f03bd24f71b205de560d8940d19cc4f6282dc6e812bf78","size":13577,"data":"","first_seen":"2023-05-09T19:21:05Z","last_seen":"2026-08-11T00:53:17.905318Z","times_seen":928849,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"http","addr":"hemmenwellness.com/wp-content/uploads/gawudkx/jrqwgif/ltb1rcx/10001/?uid=aaaa@example.jp","fqdn":"hemmenwellness.com","domain":"hemmenwellness.com","tld":"com"},"ip":{"addr":"180.163.146.7","port":80,"asn":4812,"as":"China Telecom Group","country":"China","country_code":"CN"},"introduction_type":"scriptElement","is_inline":true,"md5":"1dfcd30d7141cfc2517a93c0eddbc60b","sha1":"2eddc138027e9fa842b2c90fd79ea0c8cb5efa64","sha256":"542960a90510cd5be7264a82f0ffede5ac93325b3d2f2a44fb8121625fa18efb","sha512":"55afab379c9a6d10377ba67655519e2e28ca5f7c5ee7dfdb38c822d9a86720d420504c858c9b4f4c3e8b21f270e90ff8042af81594a02a503cc7d9fab31a4bea","ssdeep":"","tlshash":"5d61b89a37793887317715d2aa2f0e07eb7658370688d035c9f9b7541cb1463c339d49","size":3216,"data":"","first_seen":"2026-05-26T17:27:29.689095Z","last_seen":"2026-05-27T00:24:42.359348Z","times_seen":4,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"hemmenwellness.com/wp-content/plugins/hm-video-slider/js/frontend.js?ver=1.0.0","fqdn":"hemmenwellness.com","domain":"hemmenwellness.com","tld":"com"},"ip":{"addr":"180.163.146.7","port":443,"asn":4812,"as":"China Telecom Group","country":"China","country_code":"CN"},"introduction_type":"scriptElement","is_inline":false,"md5":"2df0f0215570efab861131b9b51b8314","sha1":"212d478bf26158d739fe5af71551e42643202f46","sha256":"a5adcd2a6b06ea99225c5b6b098a9b360e71d1609258cd2f1daa9ced16ce3651","sha512":"afa69c72362fe48a081d1474dfff5d5e98e51f1f918e59d8ee06c7507474f587e28244232eaf99b8b661eb4dbebb2c5d4f5bcfbab8e028dc903d0c4c3d59d981","ssdeep":"96:PUlS7YEOBxFQ15PgK049zl5wxwpVTjVM9d4mipdbTG0mwxwBD55FB56:PUY7YPzIgK0FmpVTpMb4nDKemBRS","tlshash":"8fc1530922f22878956321b95f4764943a7612875108cc45fdee43888fd1aa19ceffff","size":5953,"data":"","first_seen":"2026-03-23T23:15:45.756792Z","last_seen":"2026-05-27T00:24:42.357377Z","times_seen":5,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"http","addr":"hemmenwellness.com/wp-content/uploads/gawudkx/jrqwgif/ltb1rcx/10001/?uid=aaaa@example.jp","fqdn":"hemmenwellness.com","domain":"hemmenwellness.com","tld":"com"},"ip":{"addr":"180.163.146.7","port":80,"asn":4812,"as":"China Telecom Group","country":"China","country_code":"CN"},"introduction_type":"scriptElement","is_inline":true,"md5":"d3efa723b4c3577a069136fb73198fba","sha1":"070e7082ed3ec0dd37d28f2a453bf7aec8d193e8","sha256":"aa36addba1f33466e516cd92854e52cfeb2a4d2b7623af8b59cb0fdcf205724a","sha512":"cb6b315c1362a6b21c7f5ea05dbaf4e44b75d4cceedbca05bd32b684154311b31421e4093b9320409520049a641848f769b4cc3a585e95d339a9bda203cc6963","ssdeep":"","tlshash":"cd1159c4b21506b800612529d4385bc9e6b9699cb6db2ca7cc0c9c1cf172a1f4576f7e","size":1014,"data":"","first_seen":"2023-11-11T01:28:54Z","last_seen":"2026-06-03T19:59:24.94164Z","times_seen":183,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"hemmenwellness.com/wp-includes/js/jquery/jquery.min.js?ver=3.7.1","fqdn":"hemmenwellness.com","domain":"hemmenwellness.com","tld":"com"},"ip":{"addr":"180.163.146.7","port":443,"asn":4812,"as":"China Telecom Group","country":"China","country_code":"CN"},"introduction_type":"scriptElement","is_inline":false,"md5":"826eb77e86b02ab7724fe3d0141ff87c","sha1":"79cd3587d565afe290076a8d36c31c305a573d18","sha256":"cb6f2d32c49d1c2b25e9ffc9aaafa3f83075346c01bcd4ae6eb187392a4292cf","sha512":"fc79fdb76763025dc39fac045a215ff155ef2f492a0e9640079d6f089fa6218af2b3ab7c6eaf636827dee9294e6939a95ab24554e870c976679c25567ad6374c","ssdeep":"1536:0RUX9uDgwxcy2KVBNwchN6SLaHEk2BSrBESp+a/IEk4aAocVi8SMBQ47GKO:sHNwcv9VBQpLl88SMBQ47GKO","tlshash":"7483f8df77ca702247ab30b9006f550bf276199d684d4400f159d8e9bcb8a4a827bf7e","size":87553,"data":"","first_seen":"2023-11-03T09:26:43Z","last_seen":"2026-08-11T00:53:17.916724Z","times_seen":1013891,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"http","addr":"hemmenwellness.com/wp-content/uploads/gawudkx/jrqwgif/ltb1rcx/10001/?uid=aaaa@example.jp","fqdn":"hemmenwellness.com","domain":"hemmenwellness.com","tld":"com"},"ip":{"addr":"180.163.146.7","port":80,"asn":4812,"as":"China Telecom Group","country":"China","country_code":"CN"},"introduction_type":"scriptElement","is_inline":true,"md5":"0c75e9aa598459a3558a8b85d5272f73","sha1":"4b42617d1ad9613406322602cd78004f266e00b0","sha256":"f58210624e79b160d35a9b115be40e0d0a0b56461f639b7b2881d97eaefe4ca2","sha512":"37ac5d436101e1deb90012549597362c657201bfd74fecefb27449bc9f0e243a4e9237697bbd38b4b9ac94376d45114425adc5dd98257900d31cf3eada3bf701","ssdeep":"","tlshash":"e2b012855b841f46929d16d4782835a7523032257c20dc431bd46c65c658025cc4d226","size":91,"data":"","first_seen":"2026-03-23T23:15:45.820525Z","last_seen":"2026-05-27T00:24:42.361259Z","times_seen":5,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"hemmenwellness.com/wp-includes/js/wp-emoji-release.min.js?ver=6.7.1","fqdn":"hemmenwellness.com","domain":"hemmenwellness.com","tld":"com"},"ip":{"addr":"180.163.146.7","port":443,"asn":4812,"as":"China Telecom Group","country":"China","country_code":"CN"},"introduction_type":"scriptElement","is_inline":false,"md5":"b976b651932bfd25b9ddb5b7693d88a7","sha1":"7fcb7cb5c11227f9213b1e08a07d0212209e1432","sha256":"4e6ce5444c7f396cef0eb1fa3611034151e485dd06fbe5573a5583e1eebc98c3","sha512":"a241ebdcfaf153d5c2a86761145b2575cbe734b4f416acbfac082ae5c6eb7c706bd6ca3bc286b7e1a0f9e326729252dcb95b776750c4a3a0d81f2aa6258ea39f","ssdeep":"384:WTbvzWuPTb9Uh3o//bEPjXgA2k1efAJmpr:WX6U9Uh3o//YrXgAGfACr","tlshash":"7182f99bb33a4e9f343e3bd78e968f4dc5da555321c0f078dbeeb68169a00568274c90","size":18726,"data":"","first_seen":"2024-03-13T16:02:37Z","last_seen":"2026-08-10T23:41:09.172616Z","times_seen":103143,"alerts":{"ids":null,"analyzer":null,"urlquery":null}}],"eval":null,"write":null,"console":null},"http":[{"url":{"schema":"http","addr":"hemmenwellness.com/wp-content/uploads/gawudkx/jrqwgif/ltb1rcx/10001/?uid=aaaa@example.jp","fqdn":"hemmenwellness.com","domain":"hemmenwellness.com","tld":"com"},"ip":{"addr":"180.163.146.7","port":80,"asn":4812,"as":"China Telecom Group","country":"China","country_code":"CN"},"is_navigation_request":true,"resource_type":"document","requested_by":"","date":"2026-05-27T00:24:20.284Z","timestamp":0,"http_version":"","security_state":"insecure","security_info":null,"request":{"raw":"GET /wp-content/uploads/gawudkx/jrqwgif/ltb1rcx/10001/?uid=aaaa@example.jp HTTP/1.1\r\nHost: hemmenwellness.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate\r\nDNT: 1\r\nConnection: keep-alive\r\nCookie: PHPSESSID=qc4im9m4p8q2em39jfja7s8p41\r\nUpgrade-Insecure-Requests: 1\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 404 Not Found\r\nServer: Tengine\r\nContent-Type: text/html; charset=UTF-8\r\nTransfer-Encoding: chunked\r\nConnection: keep-alive\r\nDate: Wed, 27 May 2026 00:24:20 GMT\r\nExpires: Thu, 19 Nov 1981 08:52:00 GMT\r\nCache-Control: no-store, no-cache, must-revalidate\r\nPragma: no-cache\r\nLink: \u003chttps://hemmenwellness.com/wp-json/\u003e; rel=\"https://api.w.org/\"\r\nx-alicdn-da-ups-status: endOs,0,404\r\nVia: ens-cache31.l2eo166-18[179,0], kunlun10.cn7174[187,0]\r\nTiming-Allow-Origin: *\r\nEagleId: b4a3921e17798414605582224e\r\n\r\n","headers":null,"cookies":null,"status_code":"404","status_text":"Not Found","fingerprints":[{"name":"Tengine","description":"Tengine is a web server which is based on the Nginx HTTP server.","website":"https://tengine.taobao.org","common_platform_enumeration":"","icon":"Tengine.png","categories":["Web servers"]},{"name":"WordPress Site Editor","description":"Full Site Editing enables users to design and customize their entire WordPress website with a block-based editor.","website":"https://wordpress.org/documentation/article/site-editor/","common_platform_enumeration":"","icon":"WordPress.svg","categories":["Page builders"]},{"name":"WordPress Block Editor","description":"Sites using the WordPress Block Editor, also known as Gutenberg.","website":"https://wordpress.org/gutenberg/","common_platform_enumeration":"","icon":"WordPress.svg","categories":["Page builders"]},{"name":"jQuery","description":"jQuery is a JavaScript library which is a free, open-source software designed to simplify HTML DOM tree traversal and manipulation, as well as event handling, CSS animation, and Ajax.","website":"https://jquery.com","common_platform_enumeration":"cpe:2.3:a:jquery:jquery:*:*:*:*:*:*:*:*","icon":"jQuery.svg","categories":["JavaScript libraries"]},{"name":"jQuery Migrate:3.4.1","description":"Query Migrate is a javascript library that allows you to preserve the compatibility of your jQuery code developed for versions of jQuery older than 1.9.","website":"https://github.com/jquery/jquery-migrate","common_platform_enumeration":"","icon":"jQuery.svg","categories":["JavaScript libraries"]},{"name":"WordPress:6.7.1","description":"WordPress is a free and open-source content management system written in PHP and paired with a MySQL or MariaDB database. Features include a plugin architecture and a template system.","website":"https://wordpress.org","common_platform_enumeration":"cpe:2.3:a:wordpress:wordpress:*:*:*:*:*:*:*:*","icon":"WordPress.svg","categories":["CMS","Blogs"]},{"name":"MySQL","description":"MySQL is an open-source relational database management system.","website":"https://mysql.com","common_platform_enumeration":"cpe:2.3:a:mysql:mysql:*:*:*:*:*:*:*:*","icon":"MySQL.svg","categories":["Databases"]},{"name":"PHP","description":"PHP is a general-purpose scripting language used for web development.","website":"https://php.net","common_platform_enumeration":"cpe:2.3:a:php:php:*:*:*:*:*:*:*:*","icon":"PHP.svg","categories":["Programming languages"]}],"data":{"size":62561,"size_decoded":0,"mime_type":"text/html; charset=UTF-8","magic":"HTML document, Unicode text, UTF-8 text, with very long lines (16937)","md5":"7d9460890773e4d81d7591bccac17332","sha1":"02a77bec1c8f973db9d308e5fe550df8285de4de","sha256":"d548f1e05eb7dc3be08c83df8c2f7a66ef3a07c302cd8f96d9eba3bcdef5b880","sha512":"57d7fb2cd3c2d425217576639121e44042e5cbb84a4427158678076f6da2b74753209aa5140b39695c48051d6fb774094c4187aea7f7bf46be8eaed7c9e3db6c","ssdeep":"1536:yBY6apMpcC2KzqdP1u1ZpIe4wvSHIXu8KFdjKscgVz0dIz7Q:yBYNiedP1u1ZpIe4wvSHIe8K8gFKW7Q","tlshash":"ef53d7a253b448f9392fc3699945b319b158e901de0aa2e2f4f5d06865ccdb708f7b0f","first_seen":"2026-05-27T00:24:42.328319Z","last_seen":"2026-05-27T00:24:42.328319Z","times_seen":1,"resource_available":false,"data":null}},"time_used":779,"timings":{"blocked":188,"dns":1,"connect":190,"send":0,"wait":381,"receive":19,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-05-26","alert":"Sinkholed","trigger":"hemmenwellness.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-05-26","alert":"Sinkholed","trigger":"hemmenwellness.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"hemmenwellness.com/wp-includes/css/dashicons.min.css?ver=6.7.1","fqdn":"hemmenwellness.com","domain":"hemmenwellness.com","tld":"com"},"ip":{"addr":"180.163.146.7","port":443,"asn":4812,"as":"China Telecom Group","country":"China","country_code":"CN"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"http://hemmenwellness.com/wp-content/uploads/gawudkx/jrqwgif/ltb1rcx/10001/?uid=aaaa@example.jp","date":"2026-05-27T00:24:20.991Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"hemmenwellness.com","organization":""},"issuer":{"commonName":"Encryption Everywhere DV TLS CA - G2","organization":"DigiCert Inc"},"validity":{"start":"Wed, 29 Apr 2026 00:00:00 GMT","end":"Mon, 27 Jul 2026 23:59:59 GMT"},"fingerprint":{"sha1":"68:09:0B:F9:CB:05:86:9A:03:E1:42:FD:F5:AD:32:75:B8:6F:80:CD","sha256":"23:8F:31:84:2E:B5:0E:D1:1C:23:B6:0B:E4:01:48:71:30:4B:A8:C6:C7:65:00:EC:CD:35:86:FE:DE:97:F5:41"}}},"request":{"raw":"GET /wp-includes/css/dashicons.min.css?ver=6.7.1 HTTP/1.1\r\nHost: hemmenwellness.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: http://hemmenwellness.com/\r\nCookie: PHPSESSID=qc4im9m4p8q2em39jfja7s8p41\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nServer: Tengine\r\nContent-Type: text/css\r\nContent-Length: 35730\r\nConnection: keep-alive\r\nDate: Wed, 27 May 2026 00:24:21 GMT\r\nLast-Modified: Thu, 28 Nov 2024 12:42:44 GMT\r\nETag: \"e688-627f86b30d900-gzip\"\r\nAccept-Ranges: bytes\r\nVary: Accept-Encoding\r\nContent-Encoding: gzip\r\nVia: ens-cache61.l2eo166-18[88,0], kunlun6.cn7174[99,0]\r\nTiming-Allow-Origin: *\r\nEagleId: b4a3921a17798414614848572e\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Tengine","description":"Tengine is a web server which is based on the Nginx HTTP server.","website":"https://tengine.taobao.org","common_platform_enumeration":"","icon":"Tengine.png","categories":["Web servers"]}],"data":{"size":59016,"size_decoded":0,"mime_type":"text/css","magic":"ASCII text, with very long lines (58981)","md5":"d68d6bf519169d86e155bad0bed833f8","sha1":"27ba9c67d0e775fc4e6dd62011daf4c3902698fc","sha256":"c21e5a2b32c47bc5f9d9efc97bc0e29fd081946d1d3ebffc5621cfafb1d3960e","sha512":"fd0956d1a7165e61348fda53d859493a094d5a669aa0ba648be3381b02ed170efd776704af6965f1e31143f510172ee941d4f2fc32c4751d9b8763b66301486d","ssdeep":"768:oey/Z24B3P3aXOhUzSv16CAyLquqSfurIdUMbs73KO08QSJ2BQH02CRqxMWs5rJq:ox/ZvB/qPWMiquqioMUXQSJYIMW+rJq","tlshash":"9c43c2b1a74a40d677b0c843af65b26a5582bd7df8409cdef40b821c1af3635069dfb8","first_seen":"2023-04-05T05:16:42Z","last_seen":"2026-08-10T23:18:16.60392Z","times_seen":134258,"resource_available":true,"data":null}},"time_used":1106,"timings":{"blocked":398,"dns":0,"connect":192,"send":0,"wait":290,"receive":6,"ssl":218},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-05-26","alert":"Sinkholed","trigger":"hemmenwellness.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-05-26","alert":"Sinkholed","trigger":"hemmenwellness.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"hemmenwellness.com/wp-content/plugins/hm-pop-from/css/style.css?ver=6.7.1","fqdn":"hemmenwellness.com","domain":"hemmenwellness.com","tld":"com"},"ip":{"addr":"180.163.146.7","port":443,"asn":4812,"as":"China Telecom Group","country":"China","country_code":"CN"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"http://hemmenwellness.com/wp-content/uploads/gawudkx/jrqwgif/ltb1rcx/10001/?uid=aaaa@example.jp","date":"2026-05-27T00:24:20.992Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"hemmenwellness.com","organization":""},"issuer":{"commonName":"Encryption Everywhere DV TLS CA - G2","organization":"DigiCert Inc"},"validity":{"start":"Wed, 29 Apr 2026 00:00:00 GMT","end":"Mon, 27 Jul 2026 23:59:59 GMT"},"fingerprint":{"sha1":"68:09:0B:F9:CB:05:86:9A:03:E1:42:FD:F5:AD:32:75:B8:6F:80:CD","sha256":"23:8F:31:84:2E:B5:0E:D1:1C:23:B6:0B:E4:01:48:71:30:4B:A8:C6:C7:65:00:EC:CD:35:86:FE:DE:97:F5:41"}}},"request":{"raw":"GET /wp-content/plugins/hm-pop-from/css/style.css?ver=6.7.1 HTTP/1.1\r\nHost: hemmenwellness.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: http://hemmenwellness.com/\r\nCookie: PHPSESSID=qc4im9m4p8q2em39jfja7s8p41\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nServer: Tengine\r\nContent-Type: text/css\r\nContent-Length: 640\r\nConnection: keep-alive\r\nDate: Wed, 27 May 2026 00:24:21 GMT\r\nLast-Modified: Thu, 23 Oct 2025 09:34:36 GMT\r\nETag: \"760-641d0242b5614-gzip\"\r\nAccept-Ranges: bytes\r\nVary: Accept-Encoding\r\nContent-Encoding: gzip\r\nVia: ens-cache54.l2eo166-18[67,0], kunlun1.cn7174[72,0]\r\nTiming-Allow-Origin: *\r\nEagleId: b4a3921517798414614908226e\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Tengine","description":"Tengine is a web server which is based on the Nginx HTTP server.","website":"https://tengine.taobao.org","common_platform_enumeration":"","icon":"Tengine.png","categories":["Web servers"]}],"data":{"size":1888,"size_decoded":0,"mime_type":"text/css","magic":"Unicode text, UTF-8 text","md5":"3516e7fab1f84afac29ce4924081fa9f","sha1":"55fd5237189383991bd2a4caba7f4cce8491c29e","sha256":"6e195e05d47a6e1915af3142ebb211ab35142035b208b315c0b8c226c47ca707","sha512":"151ce759b3f61a115238853f630cb11ed73c43083e4c8c6a98084387035f8fa62d8e2a7747f71655e22d31e222ba07cdb95cf1d5f2ec7322a701f6b5c347f846","ssdeep":"","tlshash":"2c418ba3da6b2c46300fd22d77f9c746332a6143a50ace7d3bc021984f497ac95667cc","first_seen":"2026-03-23T23:15:45.769427Z","last_seen":"2026-05-27T00:24:42.330282Z","times_seen":5,"resource_available":false,"data":null}},"time_used":1081,"timings":{"blocked":397,"dns":0,"connect":191,"send":0,"wait":272,"receive":0,"ssl":216},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-05-26","alert":"Sinkholed","trigger":"hemmenwellness.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-05-26","alert":"Sinkholed","trigger":"hemmenwellness.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"hemmenwellness.com/wp-content/themes/twentytwentyfive/assets/images/404-image.webp","fqdn":"hemmenwellness.com","domain":"hemmenwellness.com","tld":"com"},"ip":{"addr":"180.163.146.7","port":443,"asn":4812,"as":"China Telecom Group","country":"China","country_code":"CN"},"is_navigation_request":false,"resource_type":"img","requested_by":"http://hemmenwellness.com/wp-content/uploads/gawudkx/jrqwgif/ltb1rcx/10001/?uid=aaaa@example.jp","date":"2026-05-27T00:24:21.000Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"hemmenwellness.com","organization":""},"issuer":{"commonName":"Encryption Everywhere DV TLS CA - G2","organization":"DigiCert Inc"},"validity":{"start":"Wed, 29 Apr 2026 00:00:00 GMT","end":"Mon, 27 Jul 2026 23:59:59 GMT"},"fingerprint":{"sha1":"68:09:0B:F9:CB:05:86:9A:03:E1:42:FD:F5:AD:32:75:B8:6F:80:CD","sha256":"23:8F:31:84:2E:B5:0E:D1:1C:23:B6:0B:E4:01:48:71:30:4B:A8:C6:C7:65:00:EC:CD:35:86:FE:DE:97:F5:41"}}},"request":{"raw":"GET /wp-content/themes/twentytwentyfive/assets/images/404-image.webp HTTP/1.1\r\nHost: hemmenwellness.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: http://hemmenwellness.com/\r\nCookie: PHPSESSID=qc4im9m4p8q2em39jfja7s8p41\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nServer: Tengine\r\nContent-Type: image/webp\r\nContent-Length: 129970\r\nConnection: keep-alive\r\nDate: Wed, 27 May 2026 00:24:22 GMT\r\nLast-Modified: Thu, 30 Apr 2026 02:47:25 GMT\r\nETag: \"1fbb2-650a47c00eee9\"\r\nAccept-Ranges: bytes\r\nVia: ens-cache34.l2eo166-18[89,0], kunlun8.cn7174[95,0]\r\nTiming-Allow-Origin: *\r\nEagleId: b4a3921c17798414620342158e\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Tengine","description":"Tengine is a web server which is based on the Nginx HTTP server.","website":"https://tengine.taobao.org","common_platform_enumeration":"","icon":"Tengine.png","categories":["Web servers"]}],"data":{"size":129970,"size_decoded":0,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image, VP8 encoding, 1048x1342, Scaling: [none]x[none], YUV color, decoders should clamp","md5":"189ee7f2a40c13d4a2094d2497929e62","sha1":"c116aec61bec386a9cf15e8cf935d673014eb8ef","sha256":"6873efa2823693885dcb88526d155c461d23d785f817249e5721b92025133059","sha512":"f0c29a51877b4c12f2b7d15baa0bfb4b594faba0e4d5befda5bc0be32030a8ab8de087774ce9fb5272fa2c95ad4fbfefca46afbf5b476e992f22f8427257221a","ssdeep":"3072:mxJtcZFKW1VX0Uvj3cb93PYYs0JyD/4w8Wzhy:AfQKW1VkUw6YfyDQdQhy","tlshash":"62c312771a5e797bc15242c4ae86feee33cc2b51ccff2c48d916419685cdb432a488ad","first_seen":"2024-11-18T11:38:41.066984Z","last_seen":"2026-08-10T22:29:31.031664Z","times_seen":1114,"resource_available":false,"data":null}},"time_used":1474,"timings":{"blocked":946,"dns":0,"connect":0,"send":0,"wait":281,"receive":247,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-05-26","alert":"Sinkholed","trigger":"hemmenwellness.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-05-26","alert":"Sinkholed","trigger":"hemmenwellness.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"hemmenwellness.com/wp-content/plugins/hm-image-slider/js/slider.js?ver=1.0","fqdn":"hemmenwellness.com","domain":"hemmenwellness.com","tld":"com"},"ip":{"addr":"180.163.146.7","port":443,"asn":4812,"as":"China Telecom Group","country":"China","country_code":"CN"},"is_navigation_request":false,"resource_type":"script","requested_by":"http://hemmenwellness.com/wp-content/uploads/gawudkx/jrqwgif/ltb1rcx/10001/?uid=aaaa@example.jp","date":"2026-05-27T00:24:21.001Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"hemmenwellness.com","organization":""},"issuer":{"commonName":"Encryption Everywhere DV TLS CA - G2","organization":"DigiCert Inc"},"validity":{"start":"Wed, 29 Apr 2026 00:00:00 GMT","end":"Mon, 27 Jul 2026 23:59:59 GMT"},"fingerprint":{"sha1":"68:09:0B:F9:CB:05:86:9A:03:E1:42:FD:F5:AD:32:75:B8:6F:80:CD","sha256":"23:8F:31:84:2E:B5:0E:D1:1C:23:B6:0B:E4:01:48:71:30:4B:A8:C6:C7:65:00:EC:CD:35:86:FE:DE:97:F5:41"}}},"request":{"raw":"GET /wp-content/plugins/hm-image-slider/js/slider.js?ver=1.0 HTTP/1.1\r\nHost: hemmenwellness.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: http://hemmenwellness.com/\r\nCookie: PHPSESSID=qc4im9m4p8q2em39jfja7s8p41\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nServer: Tengine\r\nContent-Type: text/javascript\r\nContent-Length: 880\r\nConnection: keep-alive\r\nDate: Wed, 27 May 2026 00:24:21 GMT\r\nLast-Modified: Thu, 23 Oct 2025 09:34:36 GMT\r\nETag: \"fd3-641d0242db38e-gzip\"\r\nAccept-Ranges: bytes\r\nVary: Accept-Encoding\r\nContent-Encoding: gzip\r\nVia: ens-cache44.l2eo166-18[66,0], kunlun1.cn7174[74,0]\r\nTiming-Allow-Origin: *\r\nEagleId: b4a3921517798414617621326e\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Tengine","description":"Tengine is a web server which is based on the Nginx HTTP server.","website":"https://tengine.taobao.org","common_platform_enumeration":"","icon":"Tengine.png","categories":["Web servers"]}],"data":{"size":4051,"size_decoded":0,"mime_type":"text/javascript","magic":"JavaScript source, Unicode text, UTF-8 text","md5":"782f8eaf83361b44b9132efda10f7f68","sha1":"8dfd68239a91af10dceaccf8be5c4c7347f7be68","sha256":"1330e79b675ca6188cbabb17e9f44fb5920dc3ca3df6b84caa64e14732e13578","sha512":"502b36273f737e1a9951de791e691189f7790297d773e2fe846208abc757364c337562d4d36a1fa724ea5cdfa8a684506fcaaaba45431d824817e1870c1d51c1","ssdeep":"","tlshash":"42818a1db2675a64d8b7317fb75fd018b5e203033006da48b4dd16844f99a289a50bfb","first_seen":"2026-03-23T23:15:45.806925Z","last_seen":"2026-05-27T00:24:42.331386Z","times_seen":5,"resource_available":true,"data":null}},"time_used":934,"timings":{"blocked":661,"dns":0,"connect":0,"send":0,"wait":273,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-05-26","alert":"Sinkholed","trigger":"hemmenwellness.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-05-26","alert":"Sinkholed","trigger":"hemmenwellness.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"hemmenwellness.com/wp-content/uploads/2025/03/%E5%BE%AE%E4%BF%A1%E5%9B%BE%E7%89%87_20250306085531.png","fqdn":"hemmenwellness.com","domain":"hemmenwellness.com","tld":"com"},"ip":{"addr":"180.163.146.7","port":443,"asn":4812,"as":"China Telecom Group","country":"China","country_code":"CN"},"is_navigation_request":false,"resource_type":"lazy-img","requested_by":"http://hemmenwellness.com/wp-content/uploads/gawudkx/jrqwgif/ltb1rcx/10001/?uid=aaaa@example.jp","date":"2026-05-27T00:24:22.028Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"hemmenwellness.com","organization":""},"issuer":{"commonName":"Encryption Everywhere DV TLS CA - G2","organization":"DigiCert Inc"},"validity":{"start":"Wed, 29 Apr 2026 00:00:00 GMT","end":"Mon, 27 Jul 2026 23:59:59 GMT"},"fingerprint":{"sha1":"68:09:0B:F9:CB:05:86:9A:03:E1:42:FD:F5:AD:32:75:B8:6F:80:CD","sha256":"23:8F:31:84:2E:B5:0E:D1:1C:23:B6:0B:E4:01:48:71:30:4B:A8:C6:C7:65:00:EC:CD:35:86:FE:DE:97:F5:41"}}},"request":{"raw":"GET /wp-content/uploads/2025/03/%E5%BE%AE%E4%BF%A1%E5%9B%BE%E7%89%87_20250306085531.png HTTP/1.1\r\nHost: hemmenwellness.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: http://hemmenwellness.com/\r\nCookie: PHPSESSID=qc4im9m4p8q2em39jfja7s8p41\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nServer: Tengine\r\nContent-Type: image/png\r\nContent-Length: 11143\r\nConnection: keep-alive\r\nDate: Wed, 27 May 2026 00:24:22 GMT\r\nLast-Modified: Thu, 23 Oct 2025 09:34:29 GMT\r\nETag: \"2b87-641d023ce225f\"\r\nAccept-Ranges: bytes\r\nVia: ens-cache61.l2eo166-18[77,0], kunlun6.cn7174[84,0]\r\nTiming-Allow-Origin: *\r\nEagleId: b4a3921a17798414621233041e\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Tengine","description":"Tengine is a web server which is based on the Nginx HTTP server.","website":"https://tengine.taobao.org","common_platform_enumeration":"","icon":"Tengine.png","categories":["Web servers"]}],"data":{"size":11143,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 62 x 67, 8-bit/color RGBA, non-interlaced","md5":"58f55c5c8e4301344d9c5fb4a98075c1","sha1":"4083ac1656e5dbea262aa70aee9ec38a8c0ec51c","sha256":"6189a29f86e1756d1970f4446b9f836642c283c373d312dbddeb42411f1608e6","sha512":"bafec9046afa4b92726d42b7c6a1f6edec2bbf85d76109bd5f6b501c3bd7293e4d221c561746079415850bdc57e56b5911009faa4be36184e68f78723ae36d02","ssdeep":"192:6S5JaknbqFkjXt1gnqUkY/+/ClotWjUf8S9Lw/soRTWqhbgSDlJErYJF:1XpnbqFk7tcqUkY/+/FtOVSCEoRTnhbr","tlshash":"b832af8faf655642e28a44d530f2a03b15be6bd01724f210bde489dbb8214f8c895adf","first_seen":"2023-10-16T03:38:17Z","last_seen":"2026-08-06T10:56:12.470912Z","times_seen":320,"resource_available":false,"data":null}},"time_used":284,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":275,"receive":9,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-05-26","alert":"Sinkholed","trigger":"hemmenwellness.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-05-26","alert":"Sinkholed","trigger":"hemmenwellness.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"hemmenwellness.com/wp-content/uploads/2024/12/%E7%BD%91%E7%AB%99%E5%9B%BE%E6%A0%87-edited-1-300x300.png","fqdn":"hemmenwellness.com","domain":"hemmenwellness.com","tld":"com"},"ip":{"addr":"180.163.146.7","port":443,"asn":4812,"as":"China Telecom Group","country":"China","country_code":"CN"},"is_navigation_request":false,"resource_type":"img","requested_by":"http://hemmenwellness.com/wp-content/uploads/gawudkx/jrqwgif/ltb1rcx/10001/?uid=aaaa@example.jp","date":"2026-05-27T00:24:22.576Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"hemmenwellness.com","organization":""},"issuer":{"commonName":"Encryption Everywhere DV TLS CA - G2","organization":"DigiCert Inc"},"validity":{"start":"Wed, 29 Apr 2026 00:00:00 GMT","end":"Mon, 27 Jul 2026 23:59:59 GMT"},"fingerprint":{"sha1":"68:09:0B:F9:CB:05:86:9A:03:E1:42:FD:F5:AD:32:75:B8:6F:80:CD","sha256":"23:8F:31:84:2E:B5:0E:D1:1C:23:B6:0B:E4:01:48:71:30:4B:A8:C6:C7:65:00:EC:CD:35:86:FE:DE:97:F5:41"}}},"request":{"raw":"GET /wp-content/uploads/2024/12/%E7%BD%91%E7%AB%99%E5%9B%BE%E6%A0%87-edited-1-300x300.png HTTP/1.1\r\nHost: hemmenwellness.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: http://hemmenwellness.com/\r\nCookie: PHPSESSID=qc4im9m4p8q2em39jfja7s8p41\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nServer: Tengine\r\nContent-Type: image/png\r\nContent-Length: 4336\r\nConnection: keep-alive\r\nDate: Wed, 27 May 2026 00:24:22 GMT\r\nLast-Modified: Thu, 23 Oct 2025 09:34:34 GMT\r\nETag: \"10f0-641d024159b80\"\r\nAccept-Ranges: bytes\r\nVia: ens-cache32.l2eo166-18[63,0], kunlun8.cn7174[71,0]\r\nTiming-Allow-Origin: *\r\nEagleId: b4a3921c17798414626714860e\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Tengine","description":"Tengine is a web server which is based on the Nginx HTTP server.","website":"https://tengine.taobao.org","common_platform_enumeration":"","icon":"Tengine.png","categories":["Web servers"]}],"data":{"size":4336,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 300 x 300, 8-bit/color RGBA, non-interlaced","md5":"6b0c18119106014335015778ba9ab91f","sha1":"142d3b255af04f7c6d09119bf5f66397a122a3f2","sha256":"c4c0b3b3843ecca0728c081b4ec2daca8704601367e2e8a036a2be27fda25944","sha512":"5057f7560f2af8e9d42ae69250065178915f367a143213df7af373c94d12809cb7a52bfe314943ba93680f31e1a11283e78b4d779b7f0bfd423900bf9661ce9f","ssdeep":"96:No/N4u1eXfBQ1RqUQzHqP8pJAaNYeoAQn3K7L/wl5:6KnpOqUQuP8pJAKJu8ED","tlshash":"43914ce5e17b7422e27ae3b7946aa6540664cc1ec425f56f3c488c0feb122ad447941c","first_seen":"2026-03-23T23:15:45.814467Z","last_seen":"2026-05-27T00:24:42.340336Z","times_seen":5,"resource_available":false,"data":null}},"time_used":263,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":262,"receive":1,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-05-26","alert":"Sinkholed","trigger":"hemmenwellness.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-05-26","alert":"Sinkholed","trigger":"hemmenwellness.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"hemmenwellness.com/wp-includes/js/dist/script-modules/block-library/navigation/view.min.js?ver=8ff192874fc8910a284c","fqdn":"hemmenwellness.com","domain":"hemmenwellness.com","tld":"com"},"ip":{"addr":"180.163.146.7","port":443,"asn":4812,"as":"China Telecom Group","country":"China","country_code":"CN"},"is_navigation_request":false,"resource_type":"script","requested_by":"http://hemmenwellness.com/wp-content/uploads/gawudkx/jrqwgif/ltb1rcx/10001/?uid=aaaa@example.jp","date":"2026-05-27T00:24:20.997Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"hemmenwellness.com","organization":""},"issuer":{"commonName":"Encryption Everywhere DV TLS CA - G2","organization":"DigiCert Inc"},"validity":{"start":"Wed, 29 Apr 2026 00:00:00 GMT","end":"Mon, 27 Jul 2026 23:59:59 GMT"},"fingerprint":{"sha1":"68:09:0B:F9:CB:05:86:9A:03:E1:42:FD:F5:AD:32:75:B8:6F:80:CD","sha256":"23:8F:31:84:2E:B5:0E:D1:1C:23:B6:0B:E4:01:48:71:30:4B:A8:C6:C7:65:00:EC:CD:35:86:FE:DE:97:F5:41"}}},"request":{"raw":"GET /wp-includes/js/dist/script-modules/block-library/navigation/view.min.js?ver=8ff192874fc8910a284c HTTP/1.1\r\nHost: hemmenwellness.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nOrigin: http://hemmenwellness.com\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: http://hemmenwellness.com/\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nServer: Tengine\r\nContent-Type: text/javascript\r\nContent-Length: 1135\r\nConnection: keep-alive\r\nDate: Wed, 27 May 2026 00:24:21 GMT\r\nLast-Modified: Thu, 28 Nov 2024 12:42:44 GMT\r\nETag: \"ce4-627f86b30d900-gzip\"\r\nAccept-Ranges: bytes\r\nVary: Accept-Encoding\r\nContent-Encoding: gzip\r\nVia: ens-cache8.l2eo166-18[65,0], kunlun9.cn7174[72,0]\r\nTiming-Allow-Origin: *\r\nEagleId: b4a3921d17798414614874682e\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Tengine","description":"Tengine is a web server which is based on the Nginx HTTP server.","website":"https://tengine.taobao.org","common_platform_enumeration":"","icon":"Tengine.png","categories":["Web servers"]}],"data":{"size":3300,"size_decoded":0,"mime_type":"text/javascript","magic":"ASCII text, with very long lines (3300), with no line terminators","md5":"1dd354b759c9108102c93d8bae0573a1","sha1":"b27ba805d3b9118edfd523f01fd6e84229d52ffd","sha256":"cef72ad53596109595c152da16e28c2799d53b4c151274c7b28c0324e7230f24","sha512":"e991ea5ac4eb00dfaf2db40d608ec4face0a75df2199372e4ea03c8d0392d0402257b27fcbe334c17db86ed32da0b6b57f55a1c13f84edbd5dd56fb56e72e798","ssdeep":"","tlshash":"83610234306575b1aafe5be8f3148528a3148581240b78717e1cb9ee58eef53d1f0bea","first_seen":"2024-04-11T09:16:20Z","last_seen":"2026-08-09T18:24:29.31961Z","times_seen":2572,"resource_available":true,"data":null}},"time_used":677,"timings":{"blocked":-1,"dns":1,"connect":191,"send":0,"wait":264,"receive":0,"ssl":221},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-05-26","alert":"Sinkholed","trigger":"hemmenwellness.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-05-26","alert":"Sinkholed","trigger":"hemmenwellness.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"hemmenwellness.com/wp-content/uploads/2025/01/%E7%BD%91%E7%AB%99%E5%9B%BE%E6%A0%872-1024x266.png","fqdn":"hemmenwellness.com","domain":"hemmenwellness.com","tld":"com"},"ip":{"addr":"180.163.146.7","port":443,"asn":4812,"as":"China Telecom Group","country":"China","country_code":"CN"},"is_navigation_request":false,"resource_type":"imageset","requested_by":"http://hemmenwellness.com/wp-content/uploads/gawudkx/jrqwgif/ltb1rcx/10001/?uid=aaaa@example.jp","date":"2026-05-27T00:24:20.998Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"hemmenwellness.com","organization":""},"issuer":{"commonName":"Encryption Everywhere DV TLS CA - G2","organization":"DigiCert Inc"},"validity":{"start":"Wed, 29 Apr 2026 00:00:00 GMT","end":"Mon, 27 Jul 2026 23:59:59 GMT"},"fingerprint":{"sha1":"68:09:0B:F9:CB:05:86:9A:03:E1:42:FD:F5:AD:32:75:B8:6F:80:CD","sha256":"23:8F:31:84:2E:B5:0E:D1:1C:23:B6:0B:E4:01:48:71:30:4B:A8:C6:C7:65:00:EC:CD:35:86:FE:DE:97:F5:41"}}},"request":{"raw":"GET /wp-content/uploads/2025/01/%E7%BD%91%E7%AB%99%E5%9B%BE%E6%A0%872-1024x266.png HTTP/1.1\r\nHost: hemmenwellness.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: http://hemmenwellness.com/\r\nCookie: PHPSESSID=qc4im9m4p8q2em39jfja7s8p41\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nServer: Tengine\r\nContent-Type: image/png\r\nContent-Length: 36023\r\nConnection: keep-alive\r\nDate: Wed, 27 May 2026 00:24:22 GMT\r\nLast-Modified: Thu, 23 Oct 2025 09:34:28 GMT\r\nETag: \"8cb7-641d023b9c375\"\r\nAccept-Ranges: bytes\r\nVia: ens-cache61.l2eo166-18[91,0], kunlun6.cn7174[97,0]\r\nTiming-Allow-Origin: *\r\nEagleId: b4a3921a17798414620322708e\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Tengine","description":"Tengine is a web server which is based on the Nginx HTTP server.","website":"https://tengine.taobao.org","common_platform_enumeration":"","icon":"Tengine.png","categories":["Web servers"]}],"data":{"size":36023,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 1024 x 266, 8-bit/color RGBA, non-interlaced","md5":"cb9f8ab0c0510f3dac05d34bb33b871d","sha1":"ca87a772697d88032b2dc2b0f622d22db56a2e23","sha256":"2c9bdcc494f940b5c4a373b965be6acd50d2813f69934788191c2e0fdd2eaa42","sha512":"c87709668f08e23e10653a0cb52f0627f286b31d3d62b2afa59f5f8707717e26e24197695c752137d8e85eb252a338e776c91afb49f42dda5724424de74c5b56","ssdeep":"768:ofoggtCihD4vtdOON6CZFzkAwqDo99URpsq6/27Txrlm+VE:ogPCiSOONBZ2l99UIr/gT1NVE","tlshash":"0bf2e0aa66f7ec68cd93e270bbe44f2b692f057510e5bb42d40d4c5f6aa4ed483444e0","first_seen":"2026-03-23T23:15:45.741838Z","last_seen":"2026-05-27T00:24:42.341305Z","times_seen":5,"resource_available":false,"data":null}},"time_used":1270,"timings":{"blocked":947,"dns":0,"connect":0,"send":0,"wait":294,"receive":29,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-05-26","alert":"Sinkholed","trigger":"hemmenwellness.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-05-26","alert":"Sinkholed","trigger":"hemmenwellness.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"http","addr":"hemmenwellness.com/?wordfence_syncAttackData=1779841460.7571","fqdn":"hemmenwellness.com","domain":"hemmenwellness.com","tld":"com"},"ip":{"addr":"180.163.146.7","port":80,"asn":4812,"as":"China Telecom Group","country":"China","country_code":"CN"},"is_navigation_request":false,"resource_type":"script","requested_by":"http://hemmenwellness.com/wp-content/uploads/gawudkx/jrqwgif/ltb1rcx/10001/?uid=aaaa@example.jp","date":"2026-05-27T00:24:21.975Z","timestamp":0,"http_version":"","security_state":"insecure","security_info":null,"request":{"raw":"GET /?wordfence_syncAttackData=1779841460.7571 HTTP/1.1\r\nHost: hemmenwellness.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: http://hemmenwellness.com/wp-content/uploads/gawudkx/jrqwgif/ltb1rcx/10001/?uid=aaaa@example.jp\r\nCookie: PHPSESSID=qc4im9m4p8q2em39jfja7s8p41\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nServer: Tengine\r\nContent-Type: text/html; charset=UTF-8\r\nContent-Length: 19772\r\nConnection: keep-alive\r\nDate: Wed, 27 May 2026 00:24:22 GMT\r\nExpires: Thu, 19 Nov 1981 08:52:00 GMT\r\nCache-Control: no-store, no-cache, must-revalidate\r\nPragma: no-cache\r\nLink: \u003chttps://hemmenwellness.com/wp-json/\u003e; rel=\"https://api.w.org/\", \u003chttps://hemmenwellness.com/wp-json/wp/v2/pages/221\u003e; rel=\"alternate\"; title=\"JSON\"; type=\"application/json\", \u003chttps://hemmenwellness.com/\u003e; rel=shortlink\r\nVary: Accept-Encoding\r\nContent-Encoding: gzip\r\nVia: ens-cache31.l2eo166-18[211,0], kunlun10.cn7174[217,0]\r\nTiming-Allow-Origin: *\r\nEagleId: b4a3921e17798414620618341e\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"WordPress Block Editor","description":"Sites using the WordPress Block Editor, also known as Gutenberg.","website":"https://wordpress.org/gutenberg/","common_platform_enumeration":"","icon":"WordPress.svg","categories":["Page builders"]},{"name":"jQuery Migrate:3.4.1","description":"Query Migrate is a javascript library that allows you to preserve the compatibility of your jQuery code developed for versions of jQuery older than 1.9.","website":"https://github.com/jquery/jquery-migrate","common_platform_enumeration":"","icon":"jQuery.svg","categories":["JavaScript libraries"]},{"name":"WordPress:6.7.1","description":"WordPress is a free and open-source content management system written in PHP and paired with a MySQL or MariaDB database. Features include a plugin architecture and a template system.","website":"https://wordpress.org","common_platform_enumeration":"cpe:2.3:a:wordpress:wordpress:*:*:*:*:*:*:*:*","icon":"WordPress.svg","categories":["CMS","Blogs"]},{"name":"MySQL","description":"MySQL is an open-source relational database management system.","website":"https://mysql.com","common_platform_enumeration":"cpe:2.3:a:mysql:mysql:*:*:*:*:*:*:*:*","icon":"MySQL.svg","categories":["Databases"]},{"name":"WordPress Site Editor","description":"Full Site Editing enables users to design and customize their entire WordPress website with a block-based editor.","website":"https://wordpress.org/documentation/article/site-editor/","common_platform_enumeration":"","icon":"WordPress.svg","categories":["Page builders"]},{"name":"jQuery","description":"jQuery is a JavaScript library which is a free, open-source software designed to simplify HTML DOM tree traversal and manipulation, as well as event handling, CSS animation, and Ajax.","website":"https://jquery.com","common_platform_enumeration":"cpe:2.3:a:jquery:jquery:*:*:*:*:*:*:*:*","icon":"jQuery.svg","categories":["JavaScript libraries"]},{"name":"PHP","description":"PHP is a general-purpose scripting language used for web development.","website":"https://php.net","common_platform_enumeration":"cpe:2.3:a:php:php:*:*:*:*:*:*:*:*","icon":"PHP.svg","categories":["Programming languages"]},{"name":"Tengine","description":"Tengine is a web server which is based on the Nginx HTTP server.","website":"https://tengine.taobao.org","common_platform_enumeration":"","icon":"Tengine.png","categories":["Web servers"]}],"data":{"size":96700,"size_decoded":0,"mime_type":"text/html; charset=UTF-8","magic":"HTML document, Unicode text, UTF-8 text, with very long lines (16937)","md5":"772956776dec203dce69974236cd2fc9","sha1":"e5ed0ab2d363bc4eef97d5d51164ad40dce47682","sha256":"85d36a6895a47b4a8560f741a8f898d74b583a7f88f2b67349daa22ecd3ffb14","sha512":"33e16490602b8b9a9486094c042ba20f086c87a70b8f08a9b79921932981bb8f82e0d8fc2ab1b0d1904fc01b56f01d78416999d937bdd586a21261a3bad30ad9","ssdeep":"1536:yOXx6apMpcCb5OF6MCyfQrZaqzRYc/uZAHHTiF5Kz4d4vc1ZpIe4wvSHIXu8K19S:yOhNis5d4vc1ZpIe4wvSHIe8K83HqQJ3","tlshash":"d0930861537408fa396f83add445f7296208f902de4a92d5f4eac158a6ccef744b3b0e","first_seen":"2026-05-27T00:24:42.342434Z","last_seen":"2026-05-27T00:24:42.342434Z","times_seen":1,"resource_available":false,"data":null}},"time_used":422,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":407,"receive":15,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-05-26","alert":"Sinkholed","trigger":"hemmenwellness.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-05-26","alert":"Sinkholed","trigger":"hemmenwellness.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"hemmenwellness.com/wp-content/uploads/gawudkx/jrqwgif/ltb1rcx/10001/?uid=aaaa@example.jp","fqdn":"hemmenwellness.com","domain":"hemmenwellness.com","tld":"com"},"ip":{"addr":"180.163.146.7","port":443,"asn":4812,"as":"China Telecom Group","country":"China","country_code":"CN"},"is_navigation_request":true,"resource_type":"document","requested_by":"","date":"2026-05-27T00:24:19.772Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"hemmenwellness.com","organization":""},"issuer":{"commonName":"Encryption Everywhere DV TLS CA - G2","organization":"DigiCert Inc"},"validity":{"start":"Wed, 29 Apr 2026 00:00:00 GMT","end":"Mon, 27 Jul 2026 23:59:59 GMT"},"fingerprint":{"sha1":"68:09:0B:F9:CB:05:86:9A:03:E1:42:FD:F5:AD:32:75:B8:6F:80:CD","sha256":"23:8F:31:84:2E:B5:0E:D1:1C:23:B6:0B:E4:01:48:71:30:4B:A8:C6:C7:65:00:EC:CD:35:86:FE:DE:97:F5:41"}}},"request":{"raw":"GET /wp-content/uploads/gawudkx/jrqwgif/ltb1rcx/10001/?uid=aaaa@example.jp HTTP/1.1\r\nHost: hemmenwellness.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nCookie: PHPSESSID=qc4im9m4p8q2em39jfja7s8p41\r\nUpgrade-Insecure-Requests: 1\r\nSec-Fetch-Dest: document\r\nSec-Fetch-Mode: navigate\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 404 Not Found\r\nServer: Tengine\r\nContent-Type: text/html; charset=UTF-8\r\nTransfer-Encoding: chunked\r\nConnection: keep-alive\r\nDate: Wed, 27 May 2026 00:24:20 GMT\r\nExpires: Thu, 19 Nov 1981 08:52:00 GMT\r\nCache-Control: no-store, no-cache, must-revalidate\r\nPragma: no-cache\r\nLink: \u003chttps://hemmenwellness.com/wp-json/\u003e; rel=\"https://api.w.org/\"\r\nx-alicdn-da-ups-status: endOs,0,404\r\nVia: ens-cache54.l2eo166-18[188,0], kunlun1.cn7174[195,0]\r\nTiming-Allow-Origin: *\r\nEagleId: b4a3921517798414598652185e\r\n\r\n","headers":null,"cookies":null,"status_code":"404","status_text":"Not Found","fingerprints":[{"name":"WordPress Block Editor","description":"Sites using the WordPress Block Editor, also known as Gutenberg.","website":"https://wordpress.org/gutenberg/","common_platform_enumeration":"","icon":"WordPress.svg","categories":["Page builders"]},{"name":"MySQL","description":"MySQL is an open-source relational database management system.","website":"https://mysql.com","common_platform_enumeration":"cpe:2.3:a:mysql:mysql:*:*:*:*:*:*:*:*","icon":"MySQL.svg","categories":["Databases"]},{"name":"WordPress Site Editor","description":"Full Site Editing enables users to design and customize their entire WordPress website with a block-based editor.","website":"https://wordpress.org/documentation/article/site-editor/","common_platform_enumeration":"","icon":"WordPress.svg","categories":["Page builders"]},{"name":"jQuery","description":"jQuery is a JavaScript library which is a free, open-source software designed to simplify HTML DOM tree traversal and manipulation, as well as event handling, CSS animation, and Ajax.","website":"https://jquery.com","common_platform_enumeration":"cpe:2.3:a:jquery:jquery:*:*:*:*:*:*:*:*","icon":"jQuery.svg","categories":["JavaScript libraries"]},{"name":"jQuery Migrate:3.4.1","description":"Query Migrate is a javascript library that allows you to preserve the compatibility of your jQuery code developed for versions of jQuery older than 1.9.","website":"https://github.com/jquery/jquery-migrate","common_platform_enumeration":"","icon":"jQuery.svg","categories":["JavaScript libraries"]},{"name":"WordPress:6.7.1","description":"WordPress is a free and open-source content management system written in PHP and paired with a MySQL or MariaDB database. Features include a plugin architecture and a template system.","website":"https://wordpress.org","common_platform_enumeration":"cpe:2.3:a:wordpress:wordpress:*:*:*:*:*:*:*:*","icon":"WordPress.svg","categories":["CMS","Blogs"]},{"name":"PHP","description":"PHP is a general-purpose scripting language used for web development.","website":"https://php.net","common_platform_enumeration":"cpe:2.3:a:php:php:*:*:*:*:*:*:*:*","icon":"PHP.svg","categories":["Programming languages"]},{"name":"Tengine","description":"Tengine is a web server which is based on the Nginx HTTP server.","website":"https://tengine.taobao.org","common_platform_enumeration":"","icon":"Tengine.png","categories":["Web servers"]}],"data":{"size":62560,"size_decoded":0,"mime_type":"text/html; charset=UTF-8","magic":"HTML document, Unicode text, UTF-8 text, with very long lines (16937)","md5":"ead207776d12e62fbd2e4e6b321adf4b","sha1":"2bb245088fdfed0e114717ab6fcb758f14fc70ca","sha256":"b5d6acdee8ffde5a9b8ff5dd754ea404e826c583d4288a28f7a2bc77bc49ecc4","sha512":"2e7105980e0ec72dd641a822a9a08e98c4900b180065ad394f9a0cc34b6cecd65fde2d62a81c52a8681291824e8a210d3b7966301215d030aa6d27f14313a0fe","ssdeep":"1536:yBY6apMpcC2KzqdPUu1ZpIe4wvSHIXu8KFdjKscgVz0dIz7Q:yBYNiedPUu1ZpIe4wvSHIe8K8gFKW7Q","tlshash":"a853d7a253b448f9392fc3699945b319b158e901de0aa2e2f4f5d06865ccdb708f7b0f","first_seen":"2026-05-27T00:24:42.34337Z","last_seen":"2026-05-27T00:24:42.34337Z","times_seen":1,"resource_available":false,"data":null}},"time_used":456,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":410,"receive":46,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-05-26","alert":"Sinkholed","trigger":"hemmenwellness.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-05-26","alert":"Sinkholed","trigger":"hemmenwellness.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"hemmenwellness.com/wp-content/plugins/hm-from-gy/assets/style.css?ver=6.7.1","fqdn":"hemmenwellness.com","domain":"hemmenwellness.com","tld":"com"},"ip":{"addr":"180.163.146.7","port":443,"asn":4812,"as":"China Telecom Group","country":"China","country_code":"CN"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"http://hemmenwellness.com/wp-content/uploads/gawudkx/jrqwgif/ltb1rcx/10001/?uid=aaaa@example.jp","date":"2026-05-27T00:24:20.985Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"hemmenwellness.com","organization":""},"issuer":{"commonName":"Encryption Everywhere DV TLS CA - G2","organization":"DigiCert Inc"},"validity":{"start":"Wed, 29 Apr 2026 00:00:00 GMT","end":"Mon, 27 Jul 2026 23:59:59 GMT"},"fingerprint":{"sha1":"68:09:0B:F9:CB:05:86:9A:03:E1:42:FD:F5:AD:32:75:B8:6F:80:CD","sha256":"23:8F:31:84:2E:B5:0E:D1:1C:23:B6:0B:E4:01:48:71:30:4B:A8:C6:C7:65:00:EC:CD:35:86:FE:DE:97:F5:41"}}},"request":{"raw":"GET /wp-content/plugins/hm-from-gy/assets/style.css?ver=6.7.1 HTTP/1.1\r\nHost: hemmenwellness.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: http://hemmenwellness.com/\r\nCookie: PHPSESSID=qc4im9m4p8q2em39jfja7s8p41\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nServer: Tengine\r\nContent-Type: text/css\r\nContent-Length: 817\r\nConnection: keep-alive\r\nDate: Wed, 27 May 2026 00:24:21 GMT\r\nLast-Modified: Thu, 23 Oct 2025 09:34:36 GMT\r\nETag: \"8e3-641d0242a92c3-gzip\"\r\nAccept-Ranges: bytes\r\nVary: Accept-Encoding\r\nContent-Encoding: gzip\r\nVia: ens-cache34.l2eo166-18[65,0], kunlun8.cn7174[72,0]\r\nTiming-Allow-Origin: *\r\nEagleId: b4a3921c17798414614557843e\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Tengine","description":"Tengine is a web server which is based on the Nginx HTTP server.","website":"https://tengine.taobao.org","common_platform_enumeration":"","icon":"Tengine.png","categories":["Web servers"]}],"data":{"size":2275,"size_decoded":0,"mime_type":"text/css","magic":"Unicode text, UTF-8 text","md5":"274eca856a41e3a20ac53f1472884e7c","sha1":"9d6cdc0affb1f2709fd8f4a85d83a342d2ef6fed","sha256":"4052555a559a2e52e2ae3c43aa7832d1ec5285bbdda8fffe8cf46a041747a735","sha512":"49e83f3c0bfe7d4234ec4f2f33eec1b69fba1c8adb5e3f8c82322fb0d20f0f49c69e8dc79fca3fe275ff5bc31f68a01c93c97cdbd71a76f6a0f45a3d8edf7fc1","ssdeep":"","tlshash":"b7415c8659b30e4e730954f81cd697c732cfc64a614dd9b6bdd06468ef4e2c18a7278c","first_seen":"2026-03-23T23:15:45.80161Z","last_seen":"2026-05-27T00:24:42.344251Z","times_seen":5,"resource_available":false,"data":null}},"time_used":1064,"timings":{"blocked":379,"dns":1,"connect":193,"send":0,"wait":256,"receive":1,"ssl":230},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-05-26","alert":"Sinkholed","trigger":"hemmenwellness.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-05-26","alert":"Sinkholed","trigger":"hemmenwellness.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"hemmenwellness.com/wp-includes/blocks/image/style.min.css?ver=6.7.1","fqdn":"hemmenwellness.com","domain":"hemmenwellness.com","tld":"com"},"ip":{"addr":"180.163.146.7","port":443,"asn":4812,"as":"China Telecom Group","country":"China","country_code":"CN"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"http://hemmenwellness.com/wp-content/uploads/gawudkx/jrqwgif/ltb1rcx/10001/?uid=aaaa@example.jp","date":"2026-05-27T00:24:20.987Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"hemmenwellness.com","organization":""},"issuer":{"commonName":"Encryption Everywhere DV TLS CA - G2","organization":"DigiCert Inc"},"validity":{"start":"Wed, 29 Apr 2026 00:00:00 GMT","end":"Mon, 27 Jul 2026 23:59:59 GMT"},"fingerprint":{"sha1":"68:09:0B:F9:CB:05:86:9A:03:E1:42:FD:F5:AD:32:75:B8:6F:80:CD","sha256":"23:8F:31:84:2E:B5:0E:D1:1C:23:B6:0B:E4:01:48:71:30:4B:A8:C6:C7:65:00:EC:CD:35:86:FE:DE:97:F5:41"}}},"request":{"raw":"GET /wp-includes/blocks/image/style.min.css?ver=6.7.1 HTTP/1.1\r\nHost: hemmenwellness.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: http://hemmenwellness.com/\r\nCookie: PHPSESSID=qc4im9m4p8q2em39jfja7s8p41\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nServer: Tengine\r\nContent-Type: text/css\r\nContent-Length: 1599\r\nConnection: keep-alive\r\nDate: Wed, 27 May 2026 00:24:21 GMT\r\nLast-Modified: Thu, 28 Nov 2024 12:42:44 GMT\r\nETag: \"1a34-627f86b30d900-gzip\"\r\nAccept-Ranges: bytes\r\nVary: Accept-Encoding\r\nContent-Encoding: gzip\r\nVia: ens-cache44.l2eo166-18[66,0], kunlun1.cn7174[79,0]\r\nTiming-Allow-Origin: *\r\nEagleId: b4a3921517798414614608142e\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Tengine","description":"Tengine is a web server which is based on the Nginx HTTP server.","website":"https://tengine.taobao.org","common_platform_enumeration":"","icon":"Tengine.png","categories":["Web servers"]}],"data":{"size":6708,"size_decoded":0,"mime_type":"text/css","magic":"ASCII text, with very long lines (6708), with no line terminators","md5":"87f007fadf46d526869d0dd54392dc49","sha1":"3ab2fa86c058d67e8324a0f8ba3eedd5e011b41a","sha256":"16cb27c9b4516ac5fa3b20dd31fa65c200acd87cbb305daed05273367c79047f","sha512":"5d0923305a275547c8e03561fcb74b5b61cb3d6381bfe2b940d5d9f624782bdd9259369b76a18fd8ca09e3ee70cd839549b3855475a9c3604330a7ab92d4c9de","ssdeep":"96:ODXuPynrPhbPGmfsHy8IPLh79ROdAZG6O+ml5yLrAvwZV4D0DXiQpeiX:aXuPO7mS8IP97Cy5mHyKyU0br4C","tlshash":"ded14420435054bb95ab8327388a93a80719efc3eeade7ce7456d30292c72954a67f06","first_seen":"2024-10-22T17:00:10.663818Z","last_seen":"2026-08-08T09:52:16.395863Z","times_seen":482,"resource_available":false,"data":null}},"time_used":1041,"timings":{"blocked":379,"dns":1,"connect":179,"send":0,"wait":272,"receive":0,"ssl":208},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-05-26","alert":"Sinkholed","trigger":"hemmenwellness.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-05-26","alert":"Sinkholed","trigger":"hemmenwellness.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"hemmenwellness.com/wp-includes/js/jquery/jquery-migrate.min.js?ver=3.4.1","fqdn":"hemmenwellness.com","domain":"hemmenwellness.com","tld":"com"},"ip":{"addr":"180.163.146.7","port":443,"asn":4812,"as":"China Telecom Group","country":"China","country_code":"CN"},"is_navigation_request":false,"resource_type":"script","requested_by":"http://hemmenwellness.com/wp-content/uploads/gawudkx/jrqwgif/ltb1rcx/10001/?uid=aaaa@example.jp","date":"2026-05-27T00:24:20.995Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"hemmenwellness.com","organization":""},"issuer":{"commonName":"Encryption Everywhere DV TLS CA - G2","organization":"DigiCert Inc"},"validity":{"start":"Wed, 29 Apr 2026 00:00:00 GMT","end":"Mon, 27 Jul 2026 23:59:59 GMT"},"fingerprint":{"sha1":"68:09:0B:F9:CB:05:86:9A:03:E1:42:FD:F5:AD:32:75:B8:6F:80:CD","sha256":"23:8F:31:84:2E:B5:0E:D1:1C:23:B6:0B:E4:01:48:71:30:4B:A8:C6:C7:65:00:EC:CD:35:86:FE:DE:97:F5:41"}}},"request":{"raw":"GET /wp-includes/js/jquery/jquery-migrate.min.js?ver=3.4.1 HTTP/1.1\r\nHost: hemmenwellness.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: http://hemmenwellness.com/\r\nCookie: PHPSESSID=qc4im9m4p8q2em39jfja7s8p41\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nServer: Tengine\r\nContent-Type: text/javascript\r\nContent-Length: 4872\r\nConnection: keep-alive\r\nDate: Wed, 27 May 2026 00:24:21 GMT\r\nLast-Modified: Thu, 28 Nov 2024 12:42:44 GMT\r\nETag: \"3509-627f86b30d900-gzip\"\r\nAccept-Ranges: bytes\r\nVary: Accept-Encoding\r\nContent-Encoding: gzip\r\nVia: ens-cache19.l2eo166-18[68,0], kunlun6.cn7174[74,0]\r\nTiming-Allow-Origin: *\r\nEagleId: b4a3921a17798414617351563e\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Tengine","description":"Tengine is a web server which is based on the Nginx HTTP server.","website":"https://tengine.taobao.org","common_platform_enumeration":"","icon":"Tengine.png","categories":["Web servers"]}],"data":{"size":13577,"size_decoded":0,"mime_type":"text/javascript","magic":"JavaScript source, ASCII text, with very long lines (13479)","md5":"9ffeb32e2d9efbf8f70caabded242267","sha1":"3ad0c10e501ac2a9bfa18f9cd7e700219b378738","sha256":"5274f11e6fb32ae0cf2dfb9f8043272865c397a7c4223b4cfa7d50ea52fbde89","sha512":"8d6be545508a1c38278b8ad780c3758ae48a25e4e12eee443375aa56031d9b356f8c90f22d4f251140fa3f65603af40523165e33cae2e2d62fc78ec106e3d731","ssdeep":"192:5rprDN+sag6ifKIUpQI99P1tLm9kdgyq1+J3aCJQ+h4MPLORq:5rprxaefKI0LP19m4q1WW+h4Mjp","tlshash":"9952c8adb56679724eb721b8f03bd24f71b205de560d8940d19cc4f6282dc6e812bf78","first_seen":"2023-05-09T19:21:05Z","last_seen":"2026-08-11T00:53:17.905318Z","times_seen":928849,"resource_available":true,"data":null}},"time_used":921,"timings":{"blocked":653,"dns":0,"connect":0,"send":0,"wait":268,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-05-26","alert":"Sinkholed","trigger":"hemmenwellness.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-05-26","alert":"Sinkholed","trigger":"hemmenwellness.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"http","addr":"hemmenwellness.com/wp-content/uploads/fonts/AlimamaShuHeiTi-Bold.woff2","fqdn":"hemmenwellness.com","domain":"hemmenwellness.com","tld":"com"},"ip":{"addr":"180.163.146.7","port":80,"asn":4812,"as":"China Telecom Group","country":"China","country_code":"CN"},"is_navigation_request":false,"resource_type":"font","requested_by":"http://hemmenwellness.com/wp-content/uploads/gawudkx/jrqwgif/ltb1rcx/10001/?uid=aaaa@example.jp","date":"2026-05-27T00:24:21.989Z","timestamp":0,"http_version":"","security_state":"insecure","security_info":null,"request":{"raw":"GET /wp-content/uploads/fonts/AlimamaShuHeiTi-Bold.woff2 HTTP/1.1\r\nHost: hemmenwellness.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: identity\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: http://hemmenwellness.com/wp-content/uploads/gawudkx/jrqwgif/ltb1rcx/10001/?uid=aaaa@example.jp\r\nCookie: PHPSESSID=qc4im9m4p8q2em39jfja7s8p41\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nServer: Tengine\r\nContent-Type: font/woff2\r\nContent-Length: 594404\r\nConnection: keep-alive\r\nDate: Wed, 27 May 2026 00:24:22 GMT\r\nLast-Modified: Thu, 23 Oct 2025 09:34:36 GMT\r\nETag: \"911e4-641d0242a6bb3\"\r\nAccept-Ranges: bytes\r\nVia: ens-cache44.l2eo166-18[88,0], kunlun1.cn7174[96,0]\r\nTiming-Allow-Origin: *\r\nEagleId: b4a3921517798414622593218e\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Tengine","description":"Tengine is a web server which is based on the Nginx HTTP server.","website":"https://tengine.taobao.org","common_platform_enumeration":"","icon":"Tengine.png","categories":["Web servers"]}],"data":{"size":594404,"size_decoded":0,"mime_type":"font/woff2","magic":"Web Open Font Format (Version 2), TrueType, length 594404, version 1.0","md5":"50063921c0cf294b412909abd0f650c2","sha1":"8c078a3478a2a0275ce6f76910f5bb72c58c7275","sha256":"736cfeb978bbdccd0404f0e56a561174cbff078133214254908e29655a9505e6","sha512":"b49c51482269c3b1a54b568c488fdd8ebb4404d850c463dc8edd2462c25de0303a4cd8c3863c9f11a346ca236827978455425631397d5708b12709a4aa0d239a","ssdeep":"12288:rYIOCKMiWu1Mkgl13kwbIhrUTWKBYxFiR5lYhHNtqjWsYfo7P+:r/O3+3pbcITWsKiLlYhtUeoS","tlshash":"8ac42313e1150248a831a603b9e663f0d095897875af8ed57235878bef7cafe74d64f0","first_seen":"2025-09-23T14:29:49.552031Z","last_seen":"2026-05-27T00:24:42.348501Z","times_seen":7,"resource_available":false,"data":null}},"time_used":1311,"timings":{"blocked":183,"dns":1,"connect":182,"send":0,"wait":283,"receive":662,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-05-26","alert":"Sinkholed","trigger":"hemmenwellness.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-05-26","alert":"Sinkholed","trigger":"hemmenwellness.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"hemmenwellness.com/wp-content/uploads/2024/12/%E7%BD%91%E7%AB%99%E5%9B%BE%E6%A0%87-edited-1-150x150.png","fqdn":"hemmenwellness.com","domain":"hemmenwellness.com","tld":"com"},"ip":{"addr":"180.163.146.7","port":443,"asn":4812,"as":"China Telecom Group","country":"China","country_code":"CN"},"is_navigation_request":false,"resource_type":"img","requested_by":"http://hemmenwellness.com/wp-content/uploads/gawudkx/jrqwgif/ltb1rcx/10001/?uid=aaaa@example.jp","date":"2026-05-27T00:24:22.577Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"hemmenwellness.com","organization":""},"issuer":{"commonName":"Encryption Everywhere DV TLS CA - G2","organization":"DigiCert Inc"},"validity":{"start":"Wed, 29 Apr 2026 00:00:00 GMT","end":"Mon, 27 Jul 2026 23:59:59 GMT"},"fingerprint":{"sha1":"68:09:0B:F9:CB:05:86:9A:03:E1:42:FD:F5:AD:32:75:B8:6F:80:CD","sha256":"23:8F:31:84:2E:B5:0E:D1:1C:23:B6:0B:E4:01:48:71:30:4B:A8:C6:C7:65:00:EC:CD:35:86:FE:DE:97:F5:41"}}},"request":{"raw":"GET /wp-content/uploads/2024/12/%E7%BD%91%E7%AB%99%E5%9B%BE%E6%A0%87-edited-1-150x150.png HTTP/1.1\r\nHost: hemmenwellness.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: http://hemmenwellness.com/\r\nCookie: PHPSESSID=qc4im9m4p8q2em39jfja7s8p41\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nServer: Tengine\r\nContent-Type: image/png\r\nContent-Length: 1876\r\nConnection: keep-alive\r\nDate: Wed, 27 May 2026 00:24:22 GMT\r\nLast-Modified: Thu, 23 Oct 2025 09:34:34 GMT\r\nETag: \"754-641d024159f68\"\r\nAccept-Ranges: bytes\r\nVia: ens-cache19.l2eo166-18[82,0], kunlun6.cn7174[90,0]\r\nTiming-Allow-Origin: *\r\nEagleId: b4a3921a17798414626635100e\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Tengine","description":"Tengine is a web server which is based on the Nginx HTTP server.","website":"https://tengine.taobao.org","common_platform_enumeration":"","icon":"Tengine.png","categories":["Web servers"]}],"data":{"size":1876,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 150 x 150, 8-bit/color RGBA, non-interlaced","md5":"f4b5169e996e69266bb9a2cc357c9cc6","sha1":"b2c2775c9fae1d591eaf29ad5553d48b6e0967ef","sha256":"c493d79d7c762379d6ab42b5776b79761edcde528fe28599ce32e5db386e6f50","sha512":"5abf22a456129569b76be78fca04a6498f3cc20428355be9432745f8f03ecc11a135b28dad60dff90220e0b5a0a9a7b1c2e99d3b3df403d1d521036dd5624f2e","ssdeep":"","tlshash":"b2316dc1274aac3ffaa0a3b9092ae8a4fee145e05f8c9202e137ff55ecc7400a05215c","first_seen":"2026-03-23T23:15:45.794458Z","last_seen":"2026-05-27T00:24:42.349649Z","times_seen":5,"resource_available":false,"data":null}},"time_used":283,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":282,"receive":1,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-05-26","alert":"Sinkholed","trigger":"hemmenwellness.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-05-26","alert":"Sinkholed","trigger":"hemmenwellness.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"hemmenwellness.com/wp-includes/blocks/navigation/style.min.css?ver=6.7.1","fqdn":"hemmenwellness.com","domain":"hemmenwellness.com","tld":"com"},"ip":{"addr":"180.163.146.7","port":443,"asn":4812,"as":"China Telecom Group","country":"China","country_code":"CN"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"http://hemmenwellness.com/wp-content/uploads/gawudkx/jrqwgif/ltb1rcx/10001/?uid=aaaa@example.jp","date":"2026-05-27T00:24:20.989Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"hemmenwellness.com","organization":""},"issuer":{"commonName":"Encryption Everywhere DV TLS CA - G2","organization":"DigiCert Inc"},"validity":{"start":"Wed, 29 Apr 2026 00:00:00 GMT","end":"Mon, 27 Jul 2026 23:59:59 GMT"},"fingerprint":{"sha1":"68:09:0B:F9:CB:05:86:9A:03:E1:42:FD:F5:AD:32:75:B8:6F:80:CD","sha256":"23:8F:31:84:2E:B5:0E:D1:1C:23:B6:0B:E4:01:48:71:30:4B:A8:C6:C7:65:00:EC:CD:35:86:FE:DE:97:F5:41"}}},"request":{"raw":"GET /wp-includes/blocks/navigation/style.min.css?ver=6.7.1 HTTP/1.1\r\nHost: hemmenwellness.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: http://hemmenwellness.com/\r\nCookie: PHPSESSID=qc4im9m4p8q2em39jfja7s8p41\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nServer: Tengine\r\nContent-Type: text/css\r\nContent-Length: 2285\r\nConnection: keep-alive\r\nDate: Wed, 27 May 2026 00:24:21 GMT\r\nLast-Modified: Thu, 28 Nov 2024 12:42:44 GMT\r\nETag: \"4000-627f86b30d900-gzip\"\r\nAccept-Ranges: bytes\r\nVary: Accept-Encoding\r\nContent-Encoding: gzip\r\nVia: ens-cache61.l2eo166-18[68,0], kunlun6.cn7174[73,0]\r\nTiming-Allow-Origin: *\r\nEagleId: b4a3921a17798414614678500e\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Tengine","description":"Tengine is a web server which is based on the Nginx HTTP server.","website":"https://tengine.taobao.org","common_platform_enumeration":"","icon":"Tengine.png","categories":["Web servers"]}],"data":{"size":16384,"size_decoded":0,"mime_type":"text/css","magic":"ASCII text, with very long lines (16384), with no line terminators","md5":"248b1933d8fafcd0e9927fba349545c9","sha1":"da66b61dcc5204277eb7846b9dce55b2e7d58a42","sha256":"837b6cb608d918fcd1361fb556d54f0a80d0dd10172790698504b2054535589e","sha512":"5f6e8983cd7c90faac5c5870217075b5d4c96a5e6eb77a10b04b2b8d86711b67eca866c3874ad1d2e0a459d593c17da9473e1047cb0d637393776969091e30c5","ssdeep":"192:qx7il1yFvomVogxLKuUxuOY7bGUg54jyH9iXHuplUYv/m7tm78R3kERn23m9eAL/:CYsFvo7E9bGUg5eyH9iXO/UYv/kLR37/","tlshash":"6672afd04bb49cf4a9bb933b6e4490184633e942c5097bd5a0f3e694b68cb545be3f0b","first_seen":"2024-07-24T04:43:07Z","last_seen":"2026-08-09T18:24:29.317498Z","times_seen":2365,"resource_available":false,"data":null}},"time_used":1070,"timings":{"blocked":393,"dns":0,"connect":191,"send":0,"wait":267,"receive":0,"ssl":216},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-05-26","alert":"Sinkholed","trigger":"hemmenwellness.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-05-26","alert":"Sinkholed","trigger":"hemmenwellness.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"hemmenwellness.com/wp-content/plugins/hm-image-slider/css/slider.css?ver=6.7.1","fqdn":"hemmenwellness.com","domain":"hemmenwellness.com","tld":"com"},"ip":{"addr":"180.163.146.7","port":443,"asn":4812,"as":"China Telecom Group","country":"China","country_code":"CN"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"http://hemmenwellness.com/wp-content/uploads/gawudkx/jrqwgif/ltb1rcx/10001/?uid=aaaa@example.jp","date":"2026-05-27T00:24:20.990Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"hemmenwellness.com","organization":""},"issuer":{"commonName":"Encryption Everywhere DV TLS CA - G2","organization":"DigiCert Inc"},"validity":{"start":"Wed, 29 Apr 2026 00:00:00 GMT","end":"Mon, 27 Jul 2026 23:59:59 GMT"},"fingerprint":{"sha1":"68:09:0B:F9:CB:05:86:9A:03:E1:42:FD:F5:AD:32:75:B8:6F:80:CD","sha256":"23:8F:31:84:2E:B5:0E:D1:1C:23:B6:0B:E4:01:48:71:30:4B:A8:C6:C7:65:00:EC:CD:35:86:FE:DE:97:F5:41"}}},"request":{"raw":"GET /wp-content/plugins/hm-image-slider/css/slider.css?ver=6.7.1 HTTP/1.1\r\nHost: hemmenwellness.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: http://hemmenwellness.com/\r\nCookie: PHPSESSID=qc4im9m4p8q2em39jfja7s8p41\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nServer: Tengine\r\nContent-Type: text/css\r\nContent-Length: 982\r\nConnection: keep-alive\r\nDate: Wed, 27 May 2026 00:24:21 GMT\r\nLast-Modified: Thu, 23 Oct 2025 09:34:36 GMT\r\nETag: \"ca2-641d0242dabbe-gzip\"\r\nAccept-Ranges: bytes\r\nVary: Accept-Encoding\r\nContent-Encoding: gzip\r\nVia: ens-cache25.l2eo166-18[72,0], kunlun5.cn7174[77,0]\r\nTiming-Allow-Origin: *\r\nEagleId: b4a3921917798414614805255e\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Tengine","description":"Tengine is a web server which is based on the Nginx HTTP server.","website":"https://tengine.taobao.org","common_platform_enumeration":"","icon":"Tengine.png","categories":["Web servers"]}],"data":{"size":3234,"size_decoded":0,"mime_type":"text/css","magic":"Unicode text, UTF-8 text","md5":"950fcb24a29ebd4f6c420b2b223c1536","sha1":"110f168fa12aa89ce0c33d978add2cf3232f68ab","sha256":"cf276ffe614fd2f59cc0b4a1e7a59720fe5f4d53f15e9e7819998c29bfb20493","sha512":"628e21821eff2a2239ede22cd2f9260bff4c74dc9789767c3ae6485ea4fe4e5e1e0a5139015e65b3bb4ef08177a6dcc76d905946fdf09ad3712011815a4a06f3","ssdeep":"","tlshash":"b8610e550ae318089c0ae2582ffbcb4c929cd443221ecc6db7c1124ddf452eca8b6fd9","first_seen":"2026-03-23T23:15:45.767862Z","last_seen":"2026-05-27T00:24:42.351039Z","times_seen":5,"resource_available":false,"data":null}},"time_used":1098,"timings":{"blocked":402,"dns":1,"connect":193,"send":0,"wait":276,"receive":0,"ssl":223},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-05-26","alert":"Sinkholed","trigger":"hemmenwellness.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-05-26","alert":"Sinkholed","trigger":"hemmenwellness.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"hemmenwellness.com/wp-content/plugins/hm-video-slider/css/style.css?ver=1.0.0","fqdn":"hemmenwellness.com","domain":"hemmenwellness.com","tld":"com"},"ip":{"addr":"180.163.146.7","port":443,"asn":4812,"as":"China Telecom Group","country":"China","country_code":"CN"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"http://hemmenwellness.com/wp-content/uploads/gawudkx/jrqwgif/ltb1rcx/10001/?uid=aaaa@example.jp","date":"2026-05-27T00:24:20.993Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"hemmenwellness.com","organization":""},"issuer":{"commonName":"Encryption Everywhere DV TLS CA - G2","organization":"DigiCert Inc"},"validity":{"start":"Wed, 29 Apr 2026 00:00:00 GMT","end":"Mon, 27 Jul 2026 23:59:59 GMT"},"fingerprint":{"sha1":"68:09:0B:F9:CB:05:86:9A:03:E1:42:FD:F5:AD:32:75:B8:6F:80:CD","sha256":"23:8F:31:84:2E:B5:0E:D1:1C:23:B6:0B:E4:01:48:71:30:4B:A8:C6:C7:65:00:EC:CD:35:86:FE:DE:97:F5:41"}}},"request":{"raw":"GET /wp-content/plugins/hm-video-slider/css/style.css?ver=1.0.0 HTTP/1.1\r\nHost: hemmenwellness.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: http://hemmenwellness.com/\r\nCookie: PHPSESSID=qc4im9m4p8q2em39jfja7s8p41\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nServer: Tengine\r\nContent-Type: text/css\r\nContent-Length: 1189\r\nConnection: keep-alive\r\nDate: Wed, 27 May 2026 00:24:21 GMT\r\nLast-Modified: Thu, 23 Oct 2025 09:34:36 GMT\r\nETag: \"1023-641d0242b6d84-gzip\"\r\nAccept-Ranges: bytes\r\nVary: Accept-Encoding\r\nContent-Encoding: gzip\r\nVia: ens-cache32.l2eo166-18[67,0], kunlun8.cn7174[73,0]\r\nTiming-Allow-Origin: *\r\nEagleId: b4a3921c17798414617218927e\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Tengine","description":"Tengine is a web server which is based on the Nginx HTTP server.","website":"https://tengine.taobao.org","common_platform_enumeration":"","icon":"Tengine.png","categories":["Web servers"]}],"data":{"size":4131,"size_decoded":0,"mime_type":"text/css","magic":"Unicode text, UTF-8 text","md5":"8a19ebed6fbff50db0dde0215e77ad22","sha1":"6e86ab8fa4b15d6265e085737d52875c5b3153f2","sha256":"b5812712b9d2626b4ffc033d8a21e81f0313ecb29df87398634a67f4050c1d54","sha512":"0dbadd72af483fe6cbc57c6cbbc2316163028ceee41f5a90f40a44707dca75ed0e20c7c6d448ef09e7b46970e621e3b1f85a2f340242fd1ffc39d233fb49591e","ssdeep":"48:mkpHhKRcMFKf477X7LxThI9UmdTNqO06ag+o+JTV8Lr6+MVaES8CMMvIO79LELAX:mGHhZMJ1bmlL06b+JTcrrtESyoh+LAZ1","tlshash":"2981dea25aa31b48650fe1f50fb68758632d908b920ecc6cbbc53658cf851c99473fca","first_seen":"2026-03-23T23:15:45.78362Z","last_seen":"2026-05-27T00:24:42.351542Z","times_seen":5,"resource_available":false,"data":null}},"time_used":894,"timings":{"blocked":629,"dns":0,"connect":0,"send":0,"wait":264,"receive":1,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-05-26","alert":"Sinkholed","trigger":"hemmenwellness.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-05-26","alert":"Sinkholed","trigger":"hemmenwellness.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"hemmenwellness.com/wp-includes/js/jquery/jquery.min.js?ver=3.7.1","fqdn":"hemmenwellness.com","domain":"hemmenwellness.com","tld":"com"},"ip":{"addr":"180.163.146.7","port":443,"asn":4812,"as":"China Telecom Group","country":"China","country_code":"CN"},"is_navigation_request":false,"resource_type":"script","requested_by":"http://hemmenwellness.com/wp-content/uploads/gawudkx/jrqwgif/ltb1rcx/10001/?uid=aaaa@example.jp","date":"2026-05-27T00:24:20.994Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"hemmenwellness.com","organization":""},"issuer":{"commonName":"Encryption Everywhere DV TLS CA - G2","organization":"DigiCert Inc"},"validity":{"start":"Wed, 29 Apr 2026 00:00:00 GMT","end":"Mon, 27 Jul 2026 23:59:59 GMT"},"fingerprint":{"sha1":"68:09:0B:F9:CB:05:86:9A:03:E1:42:FD:F5:AD:32:75:B8:6F:80:CD","sha256":"23:8F:31:84:2E:B5:0E:D1:1C:23:B6:0B:E4:01:48:71:30:4B:A8:C6:C7:65:00:EC:CD:35:86:FE:DE:97:F5:41"}}},"request":{"raw":"GET /wp-includes/js/jquery/jquery.min.js?ver=3.7.1 HTTP/1.1\r\nHost: hemmenwellness.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: http://hemmenwellness.com/\r\nCookie: PHPSESSID=qc4im9m4p8q2em39jfja7s8p41\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nServer: Tengine\r\nContent-Type: text/javascript\r\nContent-Length: 30368\r\nConnection: keep-alive\r\nDate: Wed, 27 May 2026 00:24:21 GMT\r\nLast-Modified: Thu, 28 Nov 2024 12:42:44 GMT\r\nETag: \"15601-627f86b30d900-gzip\"\r\nAccept-Ranges: bytes\r\nVary: Accept-Encoding\r\nContent-Encoding: gzip\r\nVia: ens-cache54.l2eo166-18[92,0], kunlun1.cn7174[98,0]\r\nTiming-Allow-Origin: *\r\nEagleId: b4a3921517798414617201146e\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Tengine","description":"Tengine is a web server which is based on the Nginx HTTP server.","website":"https://tengine.taobao.org","common_platform_enumeration":"","icon":"Tengine.png","categories":["Web servers"]}],"data":{"size":87553,"size_decoded":0,"mime_type":"text/javascript","magic":"JavaScript source, ASCII text, with very long lines (65447)","md5":"826eb77e86b02ab7724fe3d0141ff87c","sha1":"79cd3587d565afe290076a8d36c31c305a573d18","sha256":"cb6f2d32c49d1c2b25e9ffc9aaafa3f83075346c01bcd4ae6eb187392a4292cf","sha512":"fc79fdb76763025dc39fac045a215ff155ef2f492a0e9640079d6f089fa6218af2b3ab7c6eaf636827dee9294e6939a95ab24554e870c976679c25567ad6374c","ssdeep":"1536:0RUX9uDgwxcy2KVBNwchN6SLaHEk2BSrBESp+a/IEk4aAocVi8SMBQ47GKO:sHNwcv9VBQpLl88SMBQ47GKO","tlshash":"7483f8df77ca702247ab30b9006f550bf276199d684d4400f159d8e9bcb8a4a827bf7e","first_seen":"2023-11-03T09:26:43Z","last_seen":"2026-08-11T00:53:17.916724Z","times_seen":1013891,"resource_available":true,"data":null}},"time_used":951,"timings":{"blocked":644,"dns":0,"connect":0,"send":0,"wait":278,"receive":29,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-05-26","alert":"Sinkholed","trigger":"hemmenwellness.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-05-26","alert":"Sinkholed","trigger":"hemmenwellness.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"http","addr":"hemmenwellness.com/?wordfence_syncAttackData=1779841460.7571","fqdn":"hemmenwellness.com","domain":"hemmenwellness.com","tld":"com"},"ip":{"addr":"180.163.146.7","port":80,"asn":4812,"as":"China Telecom Group","country":"China","country_code":"CN"},"is_navigation_request":false,"resource_type":"script","requested_by":"http://hemmenwellness.com/wp-content/uploads/gawudkx/jrqwgif/ltb1rcx/10001/?uid=aaaa@example.jp","date":"2026-05-27T00:24:20.996Z","timestamp":0,"http_version":"","security_state":"insecure","security_info":null,"request":{"raw":"GET /?wordfence_syncAttackData=1779841460.7571 HTTP/1.1\r\nHost: hemmenwellness.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: http://hemmenwellness.com/wp-content/uploads/gawudkx/jrqwgif/ltb1rcx/10001/?uid=aaaa@example.jp\r\nCookie: PHPSESSID=qc4im9m4p8q2em39jfja7s8p41\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 500 Internal Server Error\r\nServer: Tengine\r\nContent-Type: text/html; charset=UTF-8\r\nContent-Length: 2660\r\nConnection: keep-alive\r\nDate: Wed, 27 May 2026 00:24:21 GMT\r\nExpires: Wed, 11 Jan 1984 05:00:00 GMT\r\nCache-Control: no-cache, must-revalidate, max-age=0\r\nx-alicdn-da-ups-status: endOs,0,500\r\nVia: ens-cache57.l2eo166-18[120,0], kunlun10.cn7174[127,0]\r\nTiming-Allow-Origin: *\r\nEagleId: b4a3921e17798414610664151e\r\n\r\n","headers":null,"cookies":null,"status_code":"500","status_text":"Internal Server Error","fingerprints":[{"name":"Tengine","description":"Tengine is a web server which is based on the Nginx HTTP server.","website":"https://tengine.taobao.org","common_platform_enumeration":"","icon":"Tengine.png","categories":["Web servers"]}],"data":{"size":2660,"size_decoded":0,"mime_type":"text/html; charset=UTF-8","magic":"HTML document, Unicode text, UTF-8 text","md5":"17118e16a542217ebf88a73173098139","sha1":"5b5fae836b03503b7bee4ea4a56cf9522dde378f","sha256":"dc5fbf86a0e54bc1ea8be701ecba82799fb99b20e99e2054c63e3429015403cb","sha512":"deccc8bb716d4ce01f31b6a5b7cb5160bbdf833df47728c7d379bb533e410bf4399bcf67481f3929112aec4a49eeb300b4651aa5f0cb034b59f600d3c0d697bd","ssdeep":"","tlshash":"2d511026bb0c100f62168c947935f7e2660f513385080ebfbd649578dfc527c5eb6ba9","first_seen":"2025-08-17T19:50:54.175344Z","last_seen":"2026-05-27T00:24:42.356186Z","times_seen":5,"resource_available":false,"data":null}},"time_used":319,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":317,"receive":2,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-05-26","alert":"Sinkholed","trigger":"hemmenwellness.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-05-26","alert":"Sinkholed","trigger":"hemmenwellness.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"hemmenwellness.com/wp-content/plugins/hm-pop-from/js/script.js?ver=1.0","fqdn":"hemmenwellness.com","domain":"hemmenwellness.com","tld":"com"},"ip":{"addr":"180.163.146.7","port":443,"asn":4812,"as":"China Telecom Group","country":"China","country_code":"CN"},"is_navigation_request":false,"resource_type":"script","requested_by":"http://hemmenwellness.com/wp-content/uploads/gawudkx/jrqwgif/ltb1rcx/10001/?uid=aaaa@example.jp","date":"2026-05-27T00:24:21.002Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"hemmenwellness.com","organization":""},"issuer":{"commonName":"Encryption Everywhere DV TLS CA - G2","organization":"DigiCert Inc"},"validity":{"start":"Wed, 29 Apr 2026 00:00:00 GMT","end":"Mon, 27 Jul 2026 23:59:59 GMT"},"fingerprint":{"sha1":"68:09:0B:F9:CB:05:86:9A:03:E1:42:FD:F5:AD:32:75:B8:6F:80:CD","sha256":"23:8F:31:84:2E:B5:0E:D1:1C:23:B6:0B:E4:01:48:71:30:4B:A8:C6:C7:65:00:EC:CD:35:86:FE:DE:97:F5:41"}}},"request":{"raw":"GET /wp-content/plugins/hm-pop-from/js/script.js?ver=1.0 HTTP/1.1\r\nHost: hemmenwellness.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: http://hemmenwellness.com/\r\nCookie: PHPSESSID=qc4im9m4p8q2em39jfja7s8p41\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nServer: Tengine\r\nContent-Type: text/javascript\r\nContent-Length: 805\r\nConnection: keep-alive\r\nDate: Wed, 27 May 2026 00:24:21 GMT\r\nLast-Modified: Thu, 23 Oct 2025 09:34:36 GMT\r\nETag: \"947-641d0242b59fc-gzip\"\r\nAccept-Ranges: bytes\r\nVary: Accept-Encoding\r\nContent-Encoding: gzip\r\nVia: ens-cache75.l2eo166-18[67,0], kunlun5.cn7174[77,0]\r\nTiming-Allow-Origin: *\r\nEagleId: b4a3921917798414617546495e\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Tengine","description":"Tengine is a web server which is based on the Nginx HTTP server.","website":"https://tengine.taobao.org","common_platform_enumeration":"","icon":"Tengine.png","categories":["Web servers"]}],"data":{"size":2375,"size_decoded":0,"mime_type":"text/javascript","magic":"JavaScript source, Unicode text, UTF-8 text","md5":"c8db5398843330e8bf0bd231f8cb7a55","sha1":"720b556387583ba7371b02fa950c44799501fa81","sha256":"149d64a29f53dfdc0aaf06eebe93e14a8c954352e9f1c08c5faf2d70dfffa330","sha512":"5bd31c0e5801a7144241fbc3334e90a0554af6474a13aae691fcc685d426d0e7db0538cf5c64533d4c1b738b99bf6059518ede4c029f0c7fc0653f2ba5e99905","ssdeep":"","tlshash":"c941481a78f676d45a3b306d27fba5063615200bb20cee113a4d1bc14f5cb787992baa","first_seen":"2026-03-23T23:15:45.787239Z","last_seen":"2026-05-27T00:24:42.356578Z","times_seen":5,"resource_available":true,"data":null}},"time_used":937,"timings":{"blocked":666,"dns":0,"connect":0,"send":0,"wait":271,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-05-26","alert":"Sinkholed","trigger":"hemmenwellness.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-05-26","alert":"Sinkholed","trigger":"hemmenwellness.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"hemmenwellness.com/wp-content/plugins/hm-video-slider/js/frontend.js?ver=1.0.0","fqdn":"hemmenwellness.com","domain":"hemmenwellness.com","tld":"com"},"ip":{"addr":"180.163.146.7","port":443,"asn":4812,"as":"China Telecom Group","country":"China","country_code":"CN"},"is_navigation_request":false,"resource_type":"script","requested_by":"http://hemmenwellness.com/wp-content/uploads/gawudkx/jrqwgif/ltb1rcx/10001/?uid=aaaa@example.jp","date":"2026-05-27T00:24:21.003Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"hemmenwellness.com","organization":""},"issuer":{"commonName":"Encryption Everywhere DV TLS CA - G2","organization":"DigiCert Inc"},"validity":{"start":"Wed, 29 Apr 2026 00:00:00 GMT","end":"Mon, 27 Jul 2026 23:59:59 GMT"},"fingerprint":{"sha1":"68:09:0B:F9:CB:05:86:9A:03:E1:42:FD:F5:AD:32:75:B8:6F:80:CD","sha256":"23:8F:31:84:2E:B5:0E:D1:1C:23:B6:0B:E4:01:48:71:30:4B:A8:C6:C7:65:00:EC:CD:35:86:FE:DE:97:F5:41"}}},"request":{"raw":"GET /wp-content/plugins/hm-video-slider/js/frontend.js?ver=1.0.0 HTTP/1.1\r\nHost: hemmenwellness.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: http://hemmenwellness.com/\r\nCookie: PHPSESSID=qc4im9m4p8q2em39jfja7s8p41\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nServer: Tengine\r\nContent-Type: text/javascript\r\nContent-Length: 1479\r\nConnection: keep-alive\r\nDate: Wed, 27 May 2026 00:24:21 GMT\r\nLast-Modified: Thu, 23 Oct 2025 09:34:36 GMT\r\nETag: \"1741-641d0242b793c-gzip\"\r\nAccept-Ranges: bytes\r\nVary: Accept-Encoding\r\nContent-Encoding: gzip\r\nVia: ens-cache19.l2eo166-18[73,0], kunlun6.cn7174[82,0]\r\nTiming-Allow-Origin: *\r\nEagleId: b4a3921a17798414617811779e\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Tengine","description":"Tengine is a web server which is based on the Nginx HTTP server.","website":"https://tengine.taobao.org","common_platform_enumeration":"","icon":"Tengine.png","categories":["Web servers"]}],"data":{"size":5953,"size_decoded":0,"mime_type":"text/javascript","magic":"Unicode text, UTF-8 text","md5":"2df0f0215570efab861131b9b51b8314","sha1":"212d478bf26158d739fe5af71551e42643202f46","sha256":"a5adcd2a6b06ea99225c5b6b098a9b360e71d1609258cd2f1daa9ced16ce3651","sha512":"afa69c72362fe48a081d1474dfff5d5e98e51f1f918e59d8ee06c7507474f587e28244232eaf99b8b661eb4dbebb2c5d4f5bcfbab8e028dc903d0c4c3d59d981","ssdeep":"96:PUlS7YEOBxFQ15PgK049zl5wxwpVTjVM9d4mipdbTG0mwxwBD55FB56:PUY7YPzIgK0FmpVTpMb4nDKemBRS","tlshash":"8fc1530922f22878956321b95f4764943a7612875108cc45fdee43888fd1aa19ceffff","first_seen":"2026-03-23T23:15:45.756792Z","last_seen":"2026-05-27T00:24:42.357377Z","times_seen":5,"resource_available":true,"data":null}},"time_used":956,"timings":{"blocked":682,"dns":0,"connect":0,"send":0,"wait":274,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-05-26","alert":"Sinkholed","trigger":"hemmenwellness.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-05-26","alert":"Sinkholed","trigger":"hemmenwellness.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"hemmenwellness.com/wp-includes/js/wp-emoji-release.min.js?ver=6.7.1","fqdn":"hemmenwellness.com","domain":"hemmenwellness.com","tld":"com"},"ip":{"addr":"180.163.146.7","port":443,"asn":4812,"as":"China Telecom Group","country":"China","country_code":"CN"},"is_navigation_request":false,"resource_type":"script","requested_by":"http://hemmenwellness.com/wp-content/uploads/gawudkx/jrqwgif/ltb1rcx/10001/?uid=aaaa@example.jp","date":"2026-05-27T00:24:22.030Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"hemmenwellness.com","organization":""},"issuer":{"commonName":"Encryption Everywhere DV TLS CA - G2","organization":"DigiCert Inc"},"validity":{"start":"Wed, 29 Apr 2026 00:00:00 GMT","end":"Mon, 27 Jul 2026 23:59:59 GMT"},"fingerprint":{"sha1":"68:09:0B:F9:CB:05:86:9A:03:E1:42:FD:F5:AD:32:75:B8:6F:80:CD","sha256":"23:8F:31:84:2E:B5:0E:D1:1C:23:B6:0B:E4:01:48:71:30:4B:A8:C6:C7:65:00:EC:CD:35:86:FE:DE:97:F5:41"}}},"request":{"raw":"GET /wp-includes/js/wp-emoji-release.min.js?ver=6.7.1 HTTP/1.1\r\nHost: hemmenwellness.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: http://hemmenwellness.com/\r\nCookie: PHPSESSID=qc4im9m4p8q2em39jfja7s8p41\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nServer: Tengine\r\nContent-Type: text/javascript\r\nContent-Length: 5062\r\nConnection: keep-alive\r\nDate: Wed, 27 May 2026 00:24:22 GMT\r\nLast-Modified: Thu, 28 Nov 2024 12:42:44 GMT\r\nETag: \"4926-627f86b30d900-gzip\"\r\nAccept-Ranges: bytes\r\nVary: Accept-Encoding\r\nContent-Encoding: gzip\r\nVia: ens-cache44.l2eo166-18[69,0], kunlun1.cn7174[75,0]\r\nTiming-Allow-Origin: *\r\nEagleId: b4a3921517798414621282698e\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Tengine","description":"Tengine is a web server which is based on the Nginx HTTP server.","website":"https://tengine.taobao.org","common_platform_enumeration":"","icon":"Tengine.png","categories":["Web servers"]}],"data":{"size":18726,"size_decoded":0,"mime_type":"text/javascript","magic":"JavaScript source, ASCII text, with very long lines (15752)","md5":"b976b651932bfd25b9ddb5b7693d88a7","sha1":"7fcb7cb5c11227f9213b1e08a07d0212209e1432","sha256":"4e6ce5444c7f396cef0eb1fa3611034151e485dd06fbe5573a5583e1eebc98c3","sha512":"a241ebdcfaf153d5c2a86761145b2575cbe734b4f416acbfac082ae5c6eb7c706bd6ca3bc286b7e1a0f9e326729252dcb95b776750c4a3a0d81f2aa6258ea39f","ssdeep":"384:WTbvzWuPTb9Uh3o//bEPjXgA2k1efAJmpr:WX6U9Uh3o//YrXgAGfACr","tlshash":"7182f99bb33a4e9f343e3bd78e968f4dc5da555321c0f078dbeeb68169a00568274c90","first_seen":"2024-03-13T16:02:37Z","last_seen":"2026-08-10T23:41:09.172616Z","times_seen":103143,"resource_available":true,"data":null}},"time_used":273,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":273,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-05-26","alert":"Sinkholed","trigger":"hemmenwellness.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-05-26","alert":"Sinkholed","trigger":"hemmenwellness.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"hemmenwellness.com/wp-content/uploads/gawudkx/jrqwgif/ltb1rcx/10001/index.php?uid=aaaa@example.jp","fqdn":"hemmenwellness.com","domain":"hemmenwellness.com","tld":"com"},"ip":{"addr":"180.163.146.7","port":443,"asn":4812,"as":"China Telecom Group","country":"China","country_code":"CN"},"is_navigation_request":true,"resource_type":"document","requested_by":"","date":"2026-05-27T00:24:17.511Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"hemmenwellness.com","organization":""},"issuer":{"commonName":"Encryption Everywhere DV TLS CA - G2","organization":"DigiCert Inc"},"validity":{"start":"Wed, 29 Apr 2026 00:00:00 GMT","end":"Mon, 27 Jul 2026 23:59:59 GMT"},"fingerprint":{"sha1":"68:09:0B:F9:CB:05:86:9A:03:E1:42:FD:F5:AD:32:75:B8:6F:80:CD","sha256":"23:8F:31:84:2E:B5:0E:D1:1C:23:B6:0B:E4:01:48:71:30:4B:A8:C6:C7:65:00:EC:CD:35:86:FE:DE:97:F5:41"}}},"request":{"raw":"GET /wp-content/uploads/gawudkx/jrqwgif/ltb1rcx/10001/index.php?uid=aaaa@example.jp HTTP/1.1\r\nHost: hemmenwellness.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nUpgrade-Insecure-Requests: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: document\r\nSec-Fetch-Mode: navigate\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 301 Moved Permanently\r\nServer: Tengine\r\nContent-Type: text/html; charset=UTF-8\r\nContent-Length: 0\r\nConnection: keep-alive\r\nDate: Wed, 27 May 2026 00:24:19 GMT\r\nExpires: Thu, 19 Nov 1981 08:52:00 GMT\r\nCache-Control: no-store, no-cache, must-revalidate\r\nSet-Cookie: PHPSESSID=qc4im9m4p8q2em39jfja7s8p41; path=/\r\nPragma: no-cache\r\nX-Redirect-By: WordPress\r\nLocation: https://hemmenwellness.com/wp-content/uploads/gawudkx/jrqwgif/ltb1rcx/10001/?uid=aaaa@example.jp\r\nVia: ens-cache44.l2eo166-18[349,0], kunlun1.cn7174[356,0]\r\nTiming-Allow-Origin: *\r\nEagleId: b4a3921517798414592998274e\r\n\r\n","headers":null,"cookies":null,"status_code":"301","status_text":"Moved Permanently","fingerprints":[{"name":"Tengine","description":"Tengine is a web server which is based on the Nginx HTTP server.","website":"https://tengine.taobao.org","common_platform_enumeration":"","icon":"Tengine.png","categories":["Web servers"]},{"name":"PHP","description":"PHP is a general-purpose scripting language used for web development.","website":"https://php.net","common_platform_enumeration":"cpe:2.3:a:php:php:*:*:*:*:*:*:*:*","icon":"PHP.svg","categories":["Programming languages"]}],"data":{"size":62560,"size_decoded":0,"mime_type":"text/html; charset=UTF-8","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-08-11T00:57:15.584388Z","times_seen":17827927,"resource_available":true,"data":null}},"time_used":3951,"timings":{"blocked":1696,"dns":991,"connect":200,"send":0,"wait":559,"receive":0,"ssl":501},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-05-26","alert":"Sinkholed","trigger":"hemmenwellness.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-05-26","alert":"Sinkholed","trigger":"hemmenwellness.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}}]}