{"report_id":"7b245dc5-e7ea-40b0-8f1c-b64320004cf9","version":6,"status":"done","tags":["botpanel","malware"],"date":"2025-10-18T15:23:59Z","url":{"schema":"http","addr":"base-recovery.com","fqdn":"base-recovery.com","domain":"base-recovery.com","tld":"com"},"ip":{"addr":"34.111.179.208","port":0,"asn":396982,"as":"GOOGLE-CLOUD-PLATFORM","country":"United States","country_code":"US"},"final":{"url":{"schema":"https","addr":"base-recovery.com/","fqdn":"base-recovery.com","domain":"base-recovery.com","tld":"com"},"title":"CBWALLET"},"submit":{"url":{"schema":"http","addr":"base-recovery.com","fqdn":"base-recovery.com","domain":"base-recovery.com","tld":"com"},"ip":{"addr":"34.111.179.208","port":0,"asn":396982,"as":"GOOGLE-CLOUD-PLATFORM","country":"United States","country_code":"US"},"tags":null,"meta":null,"user":{"user_id":"akbkyowd9geqr98"}},"settings":{"access":"public","device_type":"desktop","expires_at":"2026-11-22T15:23:59Z","useragent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0","referer":"","cookies":null,"exit_node":"z0yflva4pidy47h"},"stats":{"alert_count":{"ids":0,"urlquery":2,"analyzer":2}},"detection":{"ids":null,"analyzer":[{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-10-18","alert":"Sinkholed","trigger":"base-recovery.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2025-10-18","alert":"Sinkholed","trigger":"base-recovery.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":[{"sensor_name":"urlquery","alert":"Malware - Botnet panel","verdict":"malware","severity":"medium","comment":"Associated with Botnet webpanel","tags":["botpanel","malware"],"meta":null},{"sensor_name":"urlquery","alert":"Malware - Botnet panel","verdict":"malware","severity":"medium","comment":"Associated with Botnet webpanel","tags":["botpanel","malware"],"meta":null}]},"summary":[{"fqdn":"base-recovery.com","ip":{"addr":"34.111.179.208","port":443,"asn":396982,"as":"GOOGLE-CLOUD-PLATFORM","country":"United States","country_code":"US"},"domain_registered":"2025-10-17","domain_rank":0,"first_seen":"2025-10-18T15:23:59.99037Z","last_seen":"2025-10-18T15:23:59.99037Z","alert_count":9,"request_count":4,"received_data":79971,"sent_data":1992,"comment":"","tags":null,"fingerprints":[{"name":"Google Cloud CDN","description":"Cloud CDN uses Google's global edge network to serve content closer to users.","website":"https://cloud.google.com/cdn","common_platform_enumeration":"","icon":"google-cloud-cdn.svg","categories":["CDN"]},{"name":"Google Cloud","description":"Google Cloud is a suite of cloud computing services.","website":"https://cloud.google.com","common_platform_enumeration":"cpe:2.3:a:google:cloud_platform:*:*:*:*:*:*:*:*","icon":"Google Cloud.svg","categories":["IaaS"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Google Cloud Trace","description":"Google Cloud Trace is a distributed tracing system that collects latency data from applications and displays it in the Google Cloud Console.","website":"https://cloud.google.com/trace","common_platform_enumeration":"","icon":"google-cloud-trace.svg","categories":["Performance"]}]}],"files":null,"artifacts":{"windows_shortcuts":null,"files":null,"telegram":null,"pdfs":null,"clipboard":null},"sensors":{"ids":[{"sensor_name":"suricata","description":"Suricata /w Emerging Threats Pro","alerts":null}],"analyzer":null,"urlquery":[{"sensor_name":"urlquery","alert":"Malware - Botnet panel","verdict":"malware","severity":"medium","comment":"Associated with Botnet webpanel","tags":["botpanel","malware"],"meta":null}]},"javascript":{"script":[{"url":{"schema":"https","addr":"base-recovery.com/","fqdn":"base-recovery.com","domain":"base-recovery.com","tld":"com"},"ip":{"addr":"34.111.179.208","port":443,"asn":396982,"as":"GOOGLE-CLOUD-PLATFORM","country":"United States","country_code":"US"},"introduction_type":"scriptElement","is_inline":true,"md5":"841a136a9286c2e2ff77d1e65c22fa9c","sha1":"76762d8aa56cc1761c84fdecfc3bb233fecdcbfc","sha256":"c2bfbb5797018929b0cd0217c0d797a8c5a649426ccca99df2fe52f9659618c8","sha512":"365041e882411f49358b962d0b86f262962eaaaeecf0cf966d0fd2d82d743c2281a521b0ade1bfa57703909690335c6a818ec0b88efa8217de3d4976465011b9","ssdeep":"","tlshash":"3c11d63ab6f324708ab7f62a7f6fa244353b92032005da413e1e86c94f91b455867bc9","size":897,"data":"","first_seen":"2025-10-18T15:24:03.948917Z","last_seen":"2025-11-17T15:48:41.238797Z","times_seen":2,"alerts":{"ids":null,"analyzer":null,"urlquery":null}}],"eval":null,"write":null,"console":null},"http":[{"url":{"schema":"https","addr":"base-recovery.com/favicon.ico","fqdn":"base-recovery.com","domain":"base-recovery.com","tld":"com"},"ip":{"addr":"34.111.179.208","port":443,"asn":396982,"as":"GOOGLE-CLOUD-PLATFORM","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://base-recovery.com/","date":"2025-10-18T15:23:39.390Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"base-recovery.com","organization":""},"issuer":{"commonName":"E8","organization":"Let's Encrypt"},"validity":{"start":"Fri, 17 Oct 2025 17:44:51 GMT","end":"Thu, 15 Jan 2026 17:44:50 GMT"},"fingerprint":{"sha1":"6F:D9:F2:9B:CD:DD:35:A3:8C:84:47:97:2A:B7:6F:2C:49:99:95:0C","sha256":"BA:88:CE:A2:88:33:6C:23:C7:EB:01:35:65:4D:EF:AA:3D:A3:D9:73:B7:88:FC:80:19:68:88:84:F5:E8:0A:94"}}},"request":{"raw":"GET /favicon.ico HTTP/1.1\r\nHost: base-recovery.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://base-recovery.com/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 404 Not Found\r\naccess-control-allow-origin: *\r\ncontent-length: 207\r\ncontent-type: text/html; charset=utf-8\r\ndate: Sat, 18 Oct 2025 15:23:39 GMT\r\nserver: Google Frontend\r\nstrict-transport-security: max-age=63072000; includeSubDomains\r\nx-cloud-trace-context: 7cdeaf3a33801c86301d85f81aa0861e\r\nvia: 1.1 google\r\nalt-svc: h3=\":443\"; ma=2592000,h3-29=\":443\"; ma=2592000\r\n\r\n","headers":null,"cookies":null,"status_code":"404","status_text":"Not Found","fingerprints":[{"name":"Google Cloud CDN","description":"Cloud CDN uses Google's global edge network to serve content closer to users.","website":"https://cloud.google.com/cdn","common_platform_enumeration":"","icon":"google-cloud-cdn.svg","categories":["CDN"]},{"name":"Google Cloud","description":"Google Cloud is a suite of cloud computing services.","website":"https://cloud.google.com","common_platform_enumeration":"cpe:2.3:a:google:cloud_platform:*:*:*:*:*:*:*:*","icon":"Google Cloud.svg","categories":["IaaS"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Google Cloud Trace","description":"Google Cloud Trace is a distributed tracing system that collects latency data from applications and displays it in the Google Cloud Console.","website":"https://cloud.google.com/trace","common_platform_enumeration":"","icon":"google-cloud-trace.svg","categories":["Performance"]}],"data":{"size":207,"size_decoded":0,"mime_type":"text/html; charset=utf-8","magic":"HTML document, ASCII text","md5":"e46c4e5e1fbc64b1bae9ebd9bcef7fcf","sha1":"d767b3cb0ad66544c649e4165fc4b37e3c17e370","sha256":"e9639e3c4681ce85f852fbac48e2eeee5ba51296dbfec57c200d59b76237ab80","sha512":"d82048fdcff225197a7e9f0b7f22d470518420a4b10ea3327d604804d04d0d97efadafc84a0aaa23650146f59d94373438dc18bb822e26fd60283c384940ddb9","ssdeep":"","tlshash":"dad0224ed30a032b0a20071035c11beb998f1322757612398f42583e6185b2d81e23c8","first_seen":"2023-04-05T03:09:50Z","last_seen":"2026-08-07T19:28:36.711734Z","times_seen":17251,"resource_available":true,"data":null}},"time_used":193,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":193,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-10-18","alert":"Sinkholed","trigger":"base-recovery.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2025-10-18","alert":"Sinkholed","trigger":"base-recovery.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":[{"sensor_name":"urlquery","alert":"Malware - Botnet panel","verdict":"malware","severity":"medium","comment":"Associated with Botnet webpanel","tags":["botpanel","malware"],"meta":null}]}},{"url":{"schema":"https","addr":"base-recovery.com/youcut/YouCut_20251017_040657332.mp4","fqdn":"base-recovery.com","domain":"base-recovery.com","tld":"com"},"ip":{"addr":"34.111.179.208","port":443,"asn":396982,"as":"GOOGLE-CLOUD-PLATFORM","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"media","requested_by":"https://base-recovery.com/","date":"2025-10-18T15:23:39.593Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"base-recovery.com","organization":""},"issuer":{"commonName":"E8","organization":"Let's Encrypt"},"validity":{"start":"Fri, 17 Oct 2025 17:44:51 GMT","end":"Thu, 15 Jan 2026 17:44:50 GMT"},"fingerprint":{"sha1":"6F:D9:F2:9B:CD:DD:35:A3:8C:84:47:97:2A:B7:6F:2C:49:99:95:0C","sha256":"BA:88:CE:A2:88:33:6C:23:C7:EB:01:35:65:4D:EF:AA:3D:A3:D9:73:B7:88:FC:80:19:68:88:84:F5:E8:0A:94"}}},"request":{"raw":"GET /youcut/YouCut_20251017_040657332.mp4 HTTP/1.1\r\nHost: base-recovery.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: video/webm,video/ogg,video/*;q=0.9,application/ogg;q=0.7,audio/*;q=0.6,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.5\r\nRange: bytes=16711680-\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://base-recovery.com/\r\nSec-Fetch-Dest: video\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nAccept-Encoding: identity\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 206 Partial Content\r\naccept-ranges: bytes\r\naccess-control-allow-origin: *\r\ncache-control: no-cache\r\ncontent-disposition: inline; filename=YouCut_20251017_040657332.mp4\r\ncontent-length: 35556\r\ncontent-range: bytes 16711680-16747235/16747236\r\ncontent-type: video/mp4\r\ndate: Sat, 18 Oct 2025 15:23:39 GMT\r\netag: \"1760722373.0-16747236-2715816906\"\r\nlast-modified: Fri, 17 Oct 2025 17:32:53 GMT\r\nserver: Google Frontend\r\nstrict-transport-security: max-age=63072000; includeSubDomains\r\nx-cloud-trace-context: e5ed1cfbe791bd28301d85f81aa08075\r\nvia: 1.1 google\r\nalt-svc: h3=\":443\"; ma=2592000,h3-29=\":443\"; ma=2592000\r\n\r\n","headers":null,"cookies":null,"status_code":"206","status_text":"Partial Content","fingerprints":[{"name":"Google Cloud Trace","description":"Google Cloud Trace is a distributed tracing system that collects latency data from applications and displays it in the Google Cloud Console.","website":"https://cloud.google.com/trace","common_platform_enumeration":"","icon":"google-cloud-trace.svg","categories":["Performance"]},{"name":"Google Cloud CDN","description":"Cloud CDN uses Google's global edge network to serve content closer to users.","website":"https://cloud.google.com/cdn","common_platform_enumeration":"","icon":"google-cloud-cdn.svg","categories":["CDN"]},{"name":"Google Cloud","description":"Google Cloud is a suite of cloud computing services.","website":"https://cloud.google.com","common_platform_enumeration":"cpe:2.3:a:google:cloud_platform:*:*:*:*:*:*:*:*","icon":"Google Cloud.svg","categories":["IaaS"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":35556,"size_decoded":0,"mime_type":"video/mp4","magic":"data","md5":"fd65c02f7951bfc32131e3bc75168c42","sha1":"6211684c2d6d64e3e032093584d416d8e57ec808","sha256":"f4f21462d2170dc2ccee102e064503fb7522f66c6f5b57c6a5ed5f5cecb2f79d","sha512":"b3619be272b7ec1b4d3d23e5ffa5d241235ef07069c370b201b78f2a88f3e89ce9a1abc22c5ba8e4fb60c10800634c7603db560a5113601ae76dc718f297aaf0","ssdeep":"384:XTP7NnP2+TNdYv/vaY+LeVyeKpH5XxVOG58pfa0h5t8VlW4JZ5v+gxGeRx3d72:XZPHNi3vn+aV1Kx6pfClCWx3dq","tlshash":"12f29ca6279c411afbe7327d5aa1330227e0de26d346decb83d0063b1eb5670059f6c6","first_seen":"2025-10-18T15:24:03.913835Z","last_seen":"2025-11-17T15:48:41.235872Z","times_seen":2,"resource_available":false,"data":null}},"time_used":224,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":203,"receive":21,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2025-10-18","alert":"Sinkholed","trigger":"base-recovery.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-10-18","alert":"Sinkholed","trigger":"base-recovery.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"base-recovery.com/","fqdn":"base-recovery.com","domain":"base-recovery.com","tld":"com"},"ip":{"addr":"34.111.179.208","port":443,"asn":396982,"as":"GOOGLE-CLOUD-PLATFORM","country":"United States","country_code":"US"},"is_navigation_request":true,"resource_type":"document","requested_by":"","date":"2025-10-18T15:23:38.753Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"base-recovery.com","organization":""},"issuer":{"commonName":"E8","organization":"Let's Encrypt"},"validity":{"start":"Fri, 17 Oct 2025 17:44:51 GMT","end":"Thu, 15 Jan 2026 17:44:50 GMT"},"fingerprint":{"sha1":"6F:D9:F2:9B:CD:DD:35:A3:8C:84:47:97:2A:B7:6F:2C:49:99:95:0C","sha256":"BA:88:CE:A2:88:33:6C:23:C7:EB:01:35:65:4D:EF:AA:3D:A3:D9:73:B7:88:FC:80:19:68:88:84:F5:E8:0A:94"}}},"request":{"raw":"GET / HTTP/1.1\r\nHost: base-recovery.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nUpgrade-Insecure-Requests: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: document\r\nSec-Fetch-Mode: navigate\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\naccess-control-allow-origin: *\r\ncache-control: no-cache\r\ncontent-disposition: inline; filename=index.html\r\ncontent-length: 5111\r\ncontent-type: text/html; charset=utf-8\r\ndate: Sat, 18 Oct 2025 15:23:38 GMT\r\netag: \"1760722288.0-5111-3972533543\"\r\nlast-modified: Fri, 17 Oct 2025 17:31:28 GMT\r\nserver: Google Frontend\r\nstrict-transport-security: max-age=63072000; includeSubDomains\r\nx-cloud-trace-context: ff0ca69b70e75605e081f039e794252b;o=1\r\nvia: 1.1 google\r\nalt-svc: h3=\":443\"; ma=2592000,h3-29=\":443\"; ma=2592000\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Google Cloud","description":"Google Cloud is a suite of cloud computing services.","website":"https://cloud.google.com","common_platform_enumeration":"cpe:2.3:a:google:cloud_platform:*:*:*:*:*:*:*:*","icon":"Google Cloud.svg","categories":["IaaS"]},{"name":"Google Cloud CDN","description":"Cloud CDN uses Google's global edge network to serve content closer to users.","website":"https://cloud.google.com/cdn","common_platform_enumeration":"","icon":"google-cloud-cdn.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Google Cloud Trace","description":"Google Cloud Trace is a distributed tracing system that collects latency data from applications and displays it in the Google Cloud Console.","website":"https://cloud.google.com/trace","common_platform_enumeration":"","icon":"google-cloud-trace.svg","categories":["Performance"]}],"data":{"size":5111,"size_decoded":0,"mime_type":"text/html; charset=utf-8","magic":"HTML document, ASCII text","md5":"83fd2b8f3755bbb78ea312edf20ed9c8","sha1":"68fdb632a8f0805e8b43f1f0c1ee125a6858e4ad","sha256":"bea7c69ea15ef2483836a0dfe4bc92c04bef3d44240ed69f2bf7a2755d1469be","sha512":"22eef67d53c1ae10cb782579601d2eb30f91fc1d1b2479320a6c2fde54a66be6bed49ba1f59565e394f25cd3009c1fd972ef340cfca0845b7ea85f446a1a4d7d","ssdeep":"96:wCdAGqyOpqXEQHUzNerdGWze/J3OYM2hmjR1f+NFNim:wCqG+qXRHU0rdTcJekiW","tlshash":"26b1035a6ba32055d913d2683ffba6082775e113d60acda87ecd9388cfc674498527c8","first_seen":"2025-10-18T15:24:03.927551Z","last_seen":"2025-11-17T15:48:41.22819Z","times_seen":2,"resource_available":false,"data":null}},"time_used":397,"timings":{"blocked":96,"dns":15,"connect":26,"send":0,"wait":204,"receive":1,"ssl":52},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2025-10-18","alert":"Sinkholed","trigger":"base-recovery.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-10-18","alert":"Sinkholed","trigger":"base-recovery.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"base-recovery.com/youcut/YouCut_20251017_040657332.mp4","fqdn":"base-recovery.com","domain":"base-recovery.com","tld":"com"},"ip":{"addr":"34.111.179.208","port":443,"asn":396982,"as":"GOOGLE-CLOUD-PLATFORM","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"media","requested_by":"https://base-recovery.com/","date":"2025-10-18T15:23:39.292Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"base-recovery.com","organization":""},"issuer":{"commonName":"E8","organization":"Let's Encrypt"},"validity":{"start":"Fri, 17 Oct 2025 17:44:51 GMT","end":"Thu, 15 Jan 2026 17:44:50 GMT"},"fingerprint":{"sha1":"6F:D9:F2:9B:CD:DD:35:A3:8C:84:47:97:2A:B7:6F:2C:49:99:95:0C","sha256":"BA:88:CE:A2:88:33:6C:23:C7:EB:01:35:65:4D:EF:AA:3D:A3:D9:73:B7:88:FC:80:19:68:88:84:F5:E8:0A:94"}}},"request":{"raw":"GET /youcut/YouCut_20251017_040657332.mp4 HTTP/1.1\r\nHost: base-recovery.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: video/webm,video/ogg,video/*;q=0.9,application/ogg;q=0.7,audio/*;q=0.6,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.5\r\nRange: bytes=0-\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://base-recovery.com/\r\nSec-Fetch-Dest: video\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nAccept-Encoding: identity\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 206 Partial Content\r\naccept-ranges: bytes\r\naccess-control-allow-origin: *\r\ncache-control: no-cache\r\ncontent-disposition: inline; filename=YouCut_20251017_040657332.mp4\r\ncontent-length: 16747236\r\ncontent-range: bytes 0-16747235/16747236\r\ncontent-type: video/mp4\r\ndate: Sat, 18 Oct 2025 15:23:39 GMT\r\netag: \"1760722373.0-16747236-2715816906\"\r\nlast-modified: Fri, 17 Oct 2025 17:32:53 GMT\r\nserver: Google Frontend\r\nstrict-transport-security: max-age=63072000; includeSubDomains\r\nx-cloud-trace-context: da916254441f0416301d85f81aa08b13\r\nvia: 1.1 google\r\nalt-svc: h3=\":443\"; ma=2592000,h3-29=\":443\"; ma=2592000\r\n\r\n","headers":null,"cookies":null,"status_code":"206","status_text":"Partial Content","fingerprints":[{"name":"Google Cloud CDN","description":"Cloud CDN uses Google's global edge network to serve content closer to users.","website":"https://cloud.google.com/cdn","common_platform_enumeration":"","icon":"google-cloud-cdn.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Google Cloud Trace","description":"Google Cloud Trace is a distributed tracing system that collects latency data from applications and displays it in the Google Cloud Console.","website":"https://cloud.google.com/trace","common_platform_enumeration":"","icon":"google-cloud-trace.svg","categories":["Performance"]},{"name":"Google Cloud","description":"Google Cloud is a suite of cloud computing services.","website":"https://cloud.google.com","common_platform_enumeration":"cpe:2.3:a:google:cloud_platform:*:*:*:*:*:*:*:*","icon":"Google Cloud.svg","categories":["IaaS"]}],"data":{"size":36936,"size_decoded":0,"mime_type":"video/mp4","magic":"ISO Media, MP4 Base Media v1 [ISO 14496-12:2003]","md5":"16510252ed034d9842834896a0643af8","sha1":"851fb7ebc2759fd9202dc8b771e8aa46d3209f1b","sha256":"84d80487b52a107a7e135df049cc8c17ce81c525ef97fc23dc4e4d4976eba292","sha512":"55ca38bd6f98c9e87da49f4ea6c940dd7de937f027aeaeac6014585a313428b6dbbbd7d7af0b0665f90e566fb5cb123268b03c3d018e73fbad3d76ee6e773635","ssdeep":"768:QkDMjg9FU3ES0BxN1sHruDrPunI5szyWbu86nHdeq:PDMkPUS3DsHobuecd6Qq","tlshash":"3ff2e1ae92c2be1adffa06bd8748935a54c91ee1c878f3dbf41e47f65174641071320a","first_seen":"2025-10-18T15:24:03.940582Z","last_seen":"2025-10-18T15:24:03.940582Z","times_seen":1,"resource_available":false,"data":null}},"time_used":298,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":282,"receive":16,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2025-10-18","alert":"Sinkholed","trigger":"base-recovery.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-10-18","alert":"Sinkholed","trigger":"base-recovery.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}}]}