{"report_id":"7af63e85-e829-418a-b16b-e3e704b61bc2","version":0,"status":"done","tags":["phishing","suspicious","telegram_bot"],"date":"2026-08-22T12:36:03Z","url":{"schema":"http","addr":"benedettibigpond.com/","fqdn":"benedettibigpond.com","domain":"benedettibigpond.com","tld":"com"},"ip":{"addr":"45.14.224.93","port":0,"asn":62068,"as":"SpectraIP B.V.","country":"The Netherlands","country_code":"NL"},"final":{"url":{"schema":"https","addr":"allsaintconveyancing.net/voiceaccess/","fqdn":"allsaintconveyancing.net","domain":"allsaintconveyancing.net","tld":"net"},"title":"Webmail Login","dom":{"size":14723,"mime_type":"text/html; charset=utf-8","magic":"JavaScript source, Unicode text, UTF-8 text","md5":"06174d987964d790daf4bd12a60d74af","sha1":"d58febf844cbac95317611952f8aa9b7816d0f54","sha256":"c86c5dda94c44a1151f5eba0159738b93a62da394399a993882891149836f027","sha512":"b9c649d850ad271c429af519f14061af7c8626337b1abd07e73861486c3953f244726e6eecc20c51973642e1bac7d3197f82b3b8f51942a7de5f430496927c03","ssdeep":"192:hvf9DWoINl+mdnLzyJ8igI3lhHPJE7f6hq968o/R/wyrjfc:J9DlyrQ3l5Pvq","tlshash":"cd62644ba5f301827573e0b42bfb774a7595440b8648de647e4d23888f49ea6b9b33cc","dom_hash":"domhash392e2d73e130057c815563b48c8cf134","first_seen":"2026-08-22T12:36:07.883147Z","last_seen":"2026-08-22T15:25:19.15929Z","times_seen":2,"resource_available":false,"data":null}},"submit":{"url":{"schema":"http","addr":"benedettibigpond.com/","fqdn":"benedettibigpond.com","domain":"benedettibigpond.com","tld":"com"},"ip":{"addr":"45.14.224.93","port":0,"asn":62068,"as":"SpectraIP B.V.","country":"The Netherlands","country_code":"NL"},"tags":null,"meta":null},"settings":{"access":"public","device_type":"desktop","expires_at":"2027-09-26T12:36:03Z","useragent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0","referer":"","cookies":null,"exit_node":"qguvgzjxzsgb3vs"},"stats":{"alert_count":{"ids":0,"urlquery":3,"analyzer":4}},"detection":{"ids":null,"analyzer":[{"sensor_name":"infosec_yara","sensor_type":"yara","title":"YARAhub by abuse.ch","description":"YARAhub by abuse.ch","scan_date":"2026-08-22","alert":"Detects file containing Telegram Bot API","trigger":"allsaintconveyancing.net/voiceaccess/","verdict":"malware","severity":"medium","comment":"","link":"https://yaraify.abuse.ch/yarahub/","meta":{"author":"rectifyq","date":"2024-09-07","description":"Detects file containing Telegram Bot API","rule":"telegram_bot_api","yarahub_author_twitter":"@_rectifyq","yarahub_license":"CC0 1.0","yarahub_reference_md5":"9DA48D34DC999B4E05E0C6716A3B3B83","yarahub_rule_matching_tlp":"TLP:WHITE","yarahub_rule_sharing_tlp":"TLP:WHITE","yarahub_uuid":"58c9e4fe-d1e9-46ed-913c-dba943ac16d6"}},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-08-22","alert":"Sinkholed","trigger":"benedettibigpond.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-08-22","alert":"Phishing Block","trigger":"benedettibigpond.com","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"cira_dns","sensor_type":"DNS","title":"CIRA Canadian Shield DNS","description":"CIRA Canadian Shield DNS","scan_date":"2026-08-22","alert":"Sinkholed","trigger":"benedettibigpond.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cira.ca/en/canadian-shield/","meta":null}],"urlquery":[{"sensor_name":"urlquery","alert":"Phishing - Generic phishing","verdict":"phishing","severity":"medium","comment":"","tags":["phishing"],"meta":null},{"sensor_name":"urlquery","alert":"Suspicious - Suspicious Javascript code","verdict":"suspicious","severity":"medium","comment":"","tags":["suspicious"],"meta":null},{"sensor_name":"urlquery","alert":"Suspicious - Suspicious Javascript code","verdict":"suspicious","severity":"medium","comment":"","tags":["suspicious"],"meta":null}]},"summary":[{"fqdn":"allsaintconveyancing.net","ip":{"addr":"45.14.224.93","port":443,"asn":62068,"as":"SpectraIP B.V.","country":"The Netherlands","country_code":"NL"},"domain_registered":"unknown","domain_rank":0,"first_seen":"No data","last_seen":"No data","alert_count":3,"request_count":2,"received_data":15234,"sent_data":1009,"comment":"","tags":null,"fingerprints":[{"name":"jQuery CDN","description":"jQuery CDN is a way to include jQuery in your website without actually downloading and keeping it your website's folder.","website":"https://code.jquery.com/","common_platform_enumeration":"","icon":"jQuery.svg","categories":["CDN"]},{"name":"jQuery:3.3.1","description":"jQuery is a JavaScript library which is a free, open-source software designed to simplify HTML DOM tree traversal and manipulation, as well as event handling, CSS animation, and Ajax.","website":"https://jquery.com","common_platform_enumeration":"cpe:2.3:a:jquery:jquery:*:*:*:*:*:*:*:*","icon":"jQuery.svg","categories":["JavaScript libraries"]},{"name":"LiteSpeed","description":"LiteSpeed is a high-scalability web server.","website":"https://litespeedtech.com","common_platform_enumeration":"cpe:2.3:a:litespeedtech:litespeed_web_server:*:*:*:*:*:*:*:*","icon":"LiteSpeed.svg","categories":["Web servers"]}]},{"fqdn":"code.jquery.com","ip":{"addr":"151.101.193.155","port":443,"asn":54113,"as":"FASTLY","country":"United States","country_code":"US"},"domain_registered":"2005-12-10","domain_rank":4915,"first_seen":"2012-05-21T17:28:02Z","last_seen":"2026-08-17T00:17:20.947423Z","alert_count":0,"request_count":1,"received_data":87567,"sent_data":474,"comment":"","tags":null,"fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"Varnish","description":"Varnish is a reverse caching proxy.","website":"https://www.varnish-cache.org","common_platform_enumeration":"cpe:2.3:a:varnish-software:varnish_cache:*:*:*:*:*:*:*:*","icon":"Varnish.svg","categories":["Caching"]}]},{"fqdn":"benedettibigpond.com","ip":{"addr":"45.14.224.93","port":443,"asn":62068,"as":"SpectraIP B.V.","country":"The Netherlands","country_code":"NL"},"domain_registered":"2026-04-05","domain_rank":0,"first_seen":"2026-08-22T12:36:03.458957Z","last_seen":"2026-08-22T12:36:03.458957Z","alert_count":3,"request_count":1,"received_data":371,"sent_data":489,"comment":"","tags":null,"fingerprints":[{"name":"LiteSpeed","description":"LiteSpeed is a high-scalability web server.","website":"https://litespeedtech.com","common_platform_enumeration":"cpe:2.3:a:litespeedtech:litespeed_web_server:*:*:*:*:*:*:*:*","icon":"LiteSpeed.svg","categories":["Web servers"]}]}],"files":null,"artifacts":{"windows_shortcuts":null,"files":null,"telegram":[{"url":{"schema":"https","addr":"allsaintconveyancing.net/voiceaccess/","fqdn":"allsaintconveyancing.net","domain":"allsaintconveyancing.net","tld":"net"},"ip":{"addr":"45.14.224.93","port":443,"asn":62068,"as":"SpectraIP B.V.","country":"The Netherlands","country_code":"NL"},"md5":"548e5ea165be6b4b947f26972c6a7a6a","sha1":"6938db05f3ea2926c36f77128a6068322fb5a54e","sha256":"7a96f7d4011e21a166a35b5660a5bc10719085291d07bc40fb959bc58a340bfb","sha512":"d14f61f412cd78b729527f7b7002a19f696a0610d49ea950d4d53bb12896659fc98c76b60b7266d0bd7b1e7bfee73d48aadb4ad359290b95c5fd6fe86048beaa","size":7742,"token":"8332718312:AAGD1mcyfJLZtAVGuFi-kdUiGj6amWnq7wI","is_revoked":false,"bot":{"token":"8332718312:AAGD1mcyfJLZtAVGuFi-kdUiGj6amWnq7wI","user_id":"8332718312","username":"DOCUSIGNIPS_bot","first_name":"DOCUSIGNIPS","last_name":"","chat":{"chat_id":"8094719889","title":"","type":"private","bot_is":"member","total_users":2,"active_members":null,"admins":null},"pending_messages":0}}],"pdfs":null,"clipboard":null},"sensors":{"ids":null,"analyzer":null,"urlquery":[{"sensor_name":"urlquery","alert":"Phishing - Generic phishing","verdict":"phishing","severity":"medium","comment":"","tags":["phishing"],"meta":null},{"sensor_name":"urlquery","alert":"Suspicious - Suspicious Javascript code","verdict":"suspicious","severity":"medium","comment":"","tags":["suspicious"],"meta":null}]},"javascript":{"script":[{"url":{"schema":"https","addr":"code.jquery.com/jquery-3.3.1.min.js","fqdn":"code.jquery.com","domain":"jquery.com","tld":"com"},"ip":{"addr":"151.101.193.155","port":443,"asn":54113,"as":"FASTLY","country":"United States","country_code":"US"},"introduction_type":"scriptElement","is_inline":false,"md5":"a09e13ee94d51c524b7e2a728c7d4039","sha1":"0dc32db4aa9c5f03f3b38c47d883dbd4fed13aae","sha256":"160a426ff2894252cd7cebbdd6d6b7da8fcd319c65b70468f10b6690c45d02ef","sha512":"f8da8f95b6ed33542a88af19028e18ae3d9ce25350a06bfc3fbf433ed2b38fefa5e639cddfdac703fc6caa7f3313d974b92a3168276b3a016ceb28f27db0714a","ssdeep":"1536:jLiBdiaWLOczCmZx6+VWuGzQNOzdn6x2RZd9SEnk9HB96c9Yo/NWLbVj3kC6t3:5kn6x2xe9NK6nC69","tlshash":"748319dd72c6b06247ab71ba00bf550bf2361999684d4410f129e4eabc74b4e823bf7d","size":86927,"data":"","first_seen":"2023-03-07T01:02:02Z","last_seen":"2026-08-22T16:24:33.868034Z","times_seen":143512,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"allsaintconveyancing.net/voiceaccess/","fqdn":"allsaintconveyancing.net","domain":"allsaintconveyancing.net","tld":"net"},"ip":{"addr":"45.14.224.93","port":443,"asn":62068,"as":"SpectraIP B.V.","country":"The Netherlands","country_code":"NL"},"introduction_type":"scriptElement","is_inline":true,"md5":"548e5ea165be6b4b947f26972c6a7a6a","sha1":"6938db05f3ea2926c36f77128a6068322fb5a54e","sha256":"7a96f7d4011e21a166a35b5660a5bc10719085291d07bc40fb959bc58a340bfb","sha512":"d14f61f412cd78b729527f7b7002a19f696a0610d49ea950d4d53bb12896659fc98c76b60b7266d0bd7b1e7bfee73d48aadb4ad359290b95c5fd6fe86048beaa","ssdeep":"96:Ab53SiEx15V9YhZLYqLYNL0Lskum0jVoL1/R/wyrVsrIfV:QJE7f6hq968o/R/wyrjfV","tlshash":"4bf1004af4a306d22273f0b82fefb14da595044f0a84df94bc5d2ac85f1ce66b5b26c5","size":7742,"data":"","first_seen":"2026-08-22T12:36:07.891545Z","last_seen":"2026-08-22T15:25:19.172134Z","times_seen":2,"alerts":{"ids":null,"analyzer":[{"sensor_name":"infosec_yara","sensor_type":"yara","title":"YARAhub by abuse.ch","description":"YARAhub by abuse.ch","scan_date":"2026-08-22","alert":"Detects file containing Telegram Bot API","trigger":"allsaintconveyancing.net/voiceaccess/","verdict":"malware","severity":"medium","comment":"","link":"https://yaraify.abuse.ch/yarahub/","meta":{"author":"rectifyq","date":"2024-09-07","description":"Detects file containing Telegram Bot API","rule":"telegram_bot_api","yarahub_author_twitter":"@_rectifyq","yarahub_license":"CC0 1.0","yarahub_reference_md5":"9DA48D34DC999B4E05E0C6716A3B3B83","yarahub_rule_matching_tlp":"TLP:WHITE","yarahub_rule_sharing_tlp":"TLP:WHITE","yarahub_uuid":"58c9e4fe-d1e9-46ed-913c-dba943ac16d6"}}],"urlquery":null}}],"eval":null,"write":null,"console":null},"http":[{"url":{"schema":"https","addr":"allsaintconveyancing.net/voiceaccess/","fqdn":"allsaintconveyancing.net","domain":"allsaintconveyancing.net","tld":"net"},"ip":{"addr":"45.14.224.93","port":443,"asn":62068,"as":"SpectraIP B.V.","country":"The Netherlands","country_code":"NL"},"is_navigation_request":true,"resource_type":"document","requested_by":"","date":"2026-08-22T12:35:36.359Z","timestamp":1787402136359,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"allsaintconveyancing.net","organization":""},"issuer":{"commonName":"YR1","organization":"Let's Encrypt"},"validity":{"start":"Sat, 08 Aug 2026 19:40:23 GMT","end":"Fri, 06 Nov 2026 19:40:22 GMT"},"fingerprint":{"sha1":"04:0F:B3:9B:48:32:71:34:1D:92:46:16:F1:3A:BA:5B:3C:A4:87:58","sha256":"48:BC:15:9C:CC:F3:E9:12:35:A0:4C:BE:13:E7:EA:8F:72:11:73:3A:2B:EA:FF:41:92:22:B9:F2:FE:93:57:0F"}}},"request":{"raw":"GET /voiceaccess/ HTTP/1.1\r\nHost: allsaintconveyancing.net\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nUpgrade-Insecure-Requests: 1\r\nSec-Fetch-Dest: document\r\nSec-Fetch-Mode: navigate\r\nSec-Fetch-Site: none\r\nPriority: u=0, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\ncontent-type: text/html\r\nlast-modified: Thu, 20 Aug 2026 23:41:35 GMT\r\naccept-ranges: bytes\r\ncontent-encoding: br\r\nvary: Accept-Encoding\r\ncontent-length: 3153\r\ndate: Sat, 22 Aug 2026 12:35:36 GMT\r\nserver: LiteSpeed\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"jQuery CDN","description":"jQuery CDN is a way to include jQuery in your website without actually downloading and keeping it your website's folder.","website":"https://code.jquery.com/","common_platform_enumeration":"","icon":"jQuery.svg","categories":["CDN"]},{"name":"jQuery:3.3.1","description":"jQuery is a JavaScript library which is a free, open-source software designed to simplify HTML DOM tree traversal and manipulation, as well as event handling, CSS animation, and Ajax.","website":"https://jquery.com","common_platform_enumeration":"cpe:2.3:a:jquery:jquery:*:*:*:*:*:*:*:*","icon":"jQuery.svg","categories":["JavaScript libraries"]},{"name":"LiteSpeed","description":"LiteSpeed is a high-scalability web server.","website":"https://litespeedtech.com","common_platform_enumeration":"cpe:2.3:a:litespeedtech:litespeed_web_server:*:*:*:*:*:*:*:*","icon":"LiteSpeed.svg","categories":["Web servers"]}],"data":{"size":14611,"size_decoded":3404,"mime_type":"text/html","magic":"HTML document, Unicode text, UTF-8 text","md5":"d29e265df4329904ba1d013cba7c3ef1","sha1":"4b5058905a554949516e108de5a6abcadfb9a5ff","sha256":"a8ac9686209905b293161586194f1abf98bf3294073e191ae44d046065ca06df","sha512":"5702a5fd9fc5b8a34a10e758f523222b44f8e7cdb52aff32a83e97f4fe805a90d9831a7c9ff75cbeea25cd60ad5430089605632c3f9a6d0ad3a10fd0264b893a","ssdeep":"192:Pvf9DWoINl+mdnLzyJsKHNCylAWPJE7f6hq968o/R/wyrjfOAM:/9DlyrEblVPvlM","tlshash":"1262744ba5f305827573e0b43fef660a7594440b8948de647e4c23888f49ea6b9b33cc","first_seen":"2026-08-22T12:36:07.887088Z","last_seen":"2026-08-22T15:25:19.167752Z","times_seen":2,"resource_available":false,"data":null}},"time_used":19,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":19,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"infosec_yara","sensor_type":"yara","title":"YARAhub by abuse.ch","description":"YARAhub by abuse.ch","scan_date":"2026-08-22","alert":"Detects file containing Telegram Bot API","trigger":"allsaintconveyancing.net/voiceaccess/","verdict":"malware","severity":"medium","comment":"","link":"https://yaraify.abuse.ch/yarahub/","meta":{"author":"rectifyq","date":"2024-09-07","description":"Detects file containing Telegram Bot API","rule":"telegram_bot_api","yarahub_author_twitter":"@_rectifyq","yarahub_license":"CC0 1.0","yarahub_reference_md5":"9DA48D34DC999B4E05E0C6716A3B3B83","yarahub_rule_matching_tlp":"TLP:WHITE","yarahub_rule_sharing_tlp":"TLP:WHITE","yarahub_uuid":"58c9e4fe-d1e9-46ed-913c-dba943ac16d6"}}],"urlquery":[{"sensor_name":"urlquery","alert":"Phishing - Generic phishing","verdict":"phishing","severity":"medium","comment":"","tags":["phishing"],"meta":null},{"sensor_name":"urlquery","alert":"Suspicious - Suspicious Javascript code","verdict":"suspicious","severity":"medium","comment":"","tags":["suspicious"],"meta":null}]}},{"url":{"schema":"https","addr":"code.jquery.com/jquery-3.3.1.min.js","fqdn":"code.jquery.com","domain":"jquery.com","tld":"com"},"ip":{"addr":"151.101.193.155","port":443,"asn":54113,"as":"FASTLY","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://allsaintconveyancing.net/voiceaccess/","date":"2026-08-22T12:35:36.830Z","timestamp":1787402136830,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.jquery.com","organization":""},"issuer":{"commonName":"Sectigo Public Server Authentication CA DV E36","organization":"Sectigo Limited"},"validity":{"start":"Wed, 20 May 2026 00:00:00 GMT","end":"Fri, 04 Dec 2026 23:59:59 GMT"},"fingerprint":{"sha1":"DE:F8:0F:C4:8F:BC:F5:01:B1:66:91:CC:15:DC:D8:6E:5D:2F:45:4E","sha256":"05:8E:2E:14:85:E2:41:28:F5:18:A4:37:49:31:2B:0E:24:53:64:3F:02:15:BE:63:EF:F4:B8:53:5A:8B:6D:29"}}},"request":{"raw":"GET /jquery-3.3.1.min.js HTTP/1.1\r\nHost: code.jquery.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-Fetch-Storage-Access: none\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://allsaintconveyancing.net/\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nserver: nginx\r\ncontent-type: application/javascript; charset=utf-8\r\nlast-modified: Fri, 18 Oct 1991 12:00:00 GMT\r\netag: W/\"28feccc0-1538f\"\r\ncache-control: public, max-age=31536000, stale-while-revalidate=604800\r\naccess-control-allow-origin: *\r\ncross-origin-resource-policy: cross-origin\r\ncontent-encoding: gzip\r\nvia: 1.1 varnish, 1.1 varnish\r\naccept-ranges: bytes\r\ndate: Sat, 22 Aug 2026 12:35:36 GMT\r\nage: 875098\r\nx-served-by: cache-lga21927-LGA, cache-bma-essb1270043-BMA\r\nx-cache: HIT, HIT\r\nx-cache-hits: 95822, 28799\r\nx-timer: S1787402137.885366,VS0,VE0\r\nvary: Accept-Encoding\r\ncontent-length: 30288\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"Varnish","description":"Varnish is a reverse caching proxy.","website":"https://www.varnish-cache.org","common_platform_enumeration":"cpe:2.3:a:varnish-software:varnish_cache:*:*:*:*:*:*:*:*","icon":"Varnish.svg","categories":["Caching"]}],"data":{"size":86927,"size_decoded":30928,"mime_type":"application/javascript; charset=utf-8","magic":"JavaScript source, ASCII text, with very long lines (65451)","md5":"a09e13ee94d51c524b7e2a728c7d4039","sha1":"0dc32db4aa9c5f03f3b38c47d883dbd4fed13aae","sha256":"160a426ff2894252cd7cebbdd6d6b7da8fcd319c65b70468f10b6690c45d02ef","sha512":"f8da8f95b6ed33542a88af19028e18ae3d9ce25350a06bfc3fbf433ed2b38fefa5e639cddfdac703fc6caa7f3313d974b92a3168276b3a016ceb28f27db0714a","ssdeep":"1536:jLiBdiaWLOczCmZx6+VWuGzQNOzdn6x2RZd9SEnk9HB96c9Yo/NWLbVj3kC6t3:5kn6x2xe9NK6nC69","tlshash":"748319dd72c6b06247ab71ba00bf550bf2361999684d4410f129e4eabc74b4e823bf7d","first_seen":"2023-03-07T01:02:02Z","last_seen":"2026-08-22T16:24:33.868034Z","times_seen":143512,"resource_available":true,"data":null}},"time_used":66,"timings":{"blocked":-1,"dns":28,"connect":9,"send":0,"wait":9,"receive":3,"ssl":17},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"benedettibigpond.com/","fqdn":"benedettibigpond.com","domain":"benedettibigpond.com","tld":"com"},"ip":{"addr":"45.14.224.93","port":443,"asn":62068,"as":"SpectraIP B.V.","country":"The Netherlands","country_code":"NL"},"is_navigation_request":true,"resource_type":"document","requested_by":"","date":"2026-08-22T12:35:35.841Z","timestamp":1787402135841,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"benedettibigpond.com","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Sat, 08 Aug 2026 17:20:56 GMT","end":"Fri, 06 Nov 2026 17:20:55 GMT"},"fingerprint":{"sha1":"BA:8F:F6:57:BF:14:E9:C3:EA:0E:0F:CD:AF:81:1D:A5:EC:7C:6D:D6","sha256":"32:69:10:CD:2C:5E:F9:94:95:73:95:FC:56:1F:22:A5:46:18:8F:94:28:2F:1E:CF:AB:93:57:C1:0D:AF:95:FB"}}},"request":{"raw":"GET / HTTP/1.1\r\nHost: benedettibigpond.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nUpgrade-Insecure-Requests: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: document\r\nSec-Fetch-Mode: navigate\r\nSec-Fetch-Site: none\r\nPriority: u=0, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 301 \r\ncontent-type: text/html\r\ncontent-length: 795\r\ndate: Sat, 22 Aug 2026 12:35:36 GMT\r\nserver: LiteSpeed\r\nlocation: https://allsaintconveyancing.net/voiceaccess\r\nalt-svc: h3=\":443\"; ma=2592000, h3-29=\":443\"; ma=2592000, h3-Q050=\":443\"; ma=2592000, h3-Q046=\":443\"; ma=2592000, h3-Q043=\":443\"; ma=2592000, quic=\":443\"; ma=2592000; v=\"43,46\"\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"301","status_text":"Moved Permanently","fingerprints":[{"name":"LiteSpeed","description":"LiteSpeed is a high-scalability web server.","website":"https://litespeedtech.com","common_platform_enumeration":"cpe:2.3:a:litespeedtech:litespeed_web_server:*:*:*:*:*:*:*:*","icon":"LiteSpeed.svg","categories":["Web servers"]}],"data":{"size":0,"size_decoded":0,"mime_type":"text/html","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-08-22T16:26:50.255427Z","times_seen":18038150,"resource_available":true,"data":null}},"time_used":299,"timings":{"blocked":-1,"dns":153,"connect":75,"send":0,"wait":20,"receive":0,"ssl":50},"alerts":{"ids":null,"analyzer":[{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-08-22","alert":"Sinkholed","trigger":"benedettibigpond.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-08-22","alert":"Phishing Block","trigger":"benedettibigpond.com","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"cira_dns","sensor_type":"DNS","title":"CIRA Canadian Shield DNS","description":"CIRA Canadian Shield DNS","scan_date":"2026-08-22","alert":"Sinkholed","trigger":"benedettibigpond.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cira.ca/en/canadian-shield/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"allsaintconveyancing.net/voiceaccess","fqdn":"allsaintconveyancing.net","domain":"allsaintconveyancing.net","tld":"net"},"ip":{"addr":"45.14.224.93","port":443,"asn":62068,"as":"SpectraIP B.V.","country":"The Netherlands","country_code":"NL"},"is_navigation_request":true,"resource_type":"document","requested_by":"","date":"2026-08-22T12:35:36.150Z","timestamp":1787402136150,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"allsaintconveyancing.net","organization":""},"issuer":{"commonName":"YR1","organization":"Let's Encrypt"},"validity":{"start":"Sat, 08 Aug 2026 19:40:23 GMT","end":"Fri, 06 Nov 2026 19:40:22 GMT"},"fingerprint":{"sha1":"04:0F:B3:9B:48:32:71:34:1D:92:46:16:F1:3A:BA:5B:3C:A4:87:58","sha256":"48:BC:15:9C:CC:F3:E9:12:35:A0:4C:BE:13:E7:EA:8F:72:11:73:3A:2B:EA:FF:41:92:22:B9:F2:FE:93:57:0F"}}},"request":{"raw":"GET /voiceaccess HTTP/1.1\r\nHost: allsaintconveyancing.net\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nUpgrade-Insecure-Requests: 1\r\nSec-Fetch-Dest: document\r\nSec-Fetch-Mode: navigate\r\nSec-Fetch-Site: none\r\nPriority: u=0, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 301 \r\ncontent-type: text/html\r\ncontent-length: 795\r\ndate: Sat, 22 Aug 2026 12:35:36 GMT\r\nserver: LiteSpeed\r\nlocation: https://allsaintconveyancing.net/voiceaccess/\r\nalt-svc: h3=\":443\"; ma=2592000, h3-29=\":443\"; ma=2592000, h3-Q050=\":443\"; ma=2592000, h3-Q046=\":443\"; ma=2592000, h3-Q043=\":443\"; ma=2592000, quic=\":443\"; ma=2592000; v=\"43,46\"\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"301","status_text":"Moved Permanently","fingerprints":[{"name":"LiteSpeed","description":"LiteSpeed is a high-scalability web server.","website":"https://litespeedtech.com","common_platform_enumeration":"cpe:2.3:a:litespeedtech:litespeed_web_server:*:*:*:*:*:*:*:*","icon":"LiteSpeed.svg","categories":["Web servers"]}],"data":{"size":0,"size_decoded":0,"mime_type":"text/html","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-08-22T16:26:50.255427Z","times_seen":18038150,"resource_available":true,"data":null}},"time_used":204,"timings":{"blocked":-1,"dns":143,"connect":18,"send":0,"wait":18,"receive":0,"ssl":25},"alerts":{"ids":null,"analyzer":null,"urlquery":null}}]}