{"report_id":"811ce926-eca4-4847-8c65-49646b6adcdd","version":0,"status":"done","tags":[],"date":"2026-10-14T19:58:25Z","url":{"schema":"http","addr":"vtivision.ca/isafwey/storage/theme/cmd","fqdn":"vtivision.ca","domain":"vtivision.ca","tld":"ca"},"ip":{"addr":"209.182.195.215","port":0,"asn":22611,"as":"InMotion Hosting, Inc.","country":"United States","country_code":"US"},"final":{"url":{"schema":"https","addr":"vtivision.ca/isafwey/storage/theme/cmd/","fqdn":"vtivision.ca","domain":"vtivision.ca","tld":"ca"},"title":"iCloud","dom":{"size":898,"mime_type":"text/html; charset=utf-8","magic":"HTML document, ASCII text","md5":"1f90417a806670fa5b6f07aedf93b0bd","sha1":"2ea27ff5b7078e2bb73e5a05c85895bb7d8da4ab","sha256":"7f15d9ef851b0a21a2270ff0a364b7c52a3136c7d53a1b998a010e2fed83b018","sha512":"b5d09b3a7a09a864902811bc23d40da8c2137b5e9d898117f42939c46f41d47c7abe699058762281788ba08e22adaafb653cd2c6b76f7c75480fad1cd5f332ae","ssdeep":"","tlshash":"b211522794e1990642961de8b9b8f52c18c8cf36ef47094066e4a3dd4bc8fd2dca7789","dom_hash":"domhash029df27971afc552329380cc880386b7","first_seen":"2026-09-24T12:36:06.262779Z","last_seen":"2026-10-14T19:58:30.203641Z","times_seen":5,"resource_available":false,"data":null}},"submit":{"url":{"schema":"http","addr":"vtivision.ca/isafwey/storage/theme/cmd","fqdn":"vtivision.ca","domain":"vtivision.ca","tld":"ca"},"ip":{"addr":"209.182.195.215","port":0,"asn":22611,"as":"InMotion Hosting, Inc.","country":"United States","country_code":"US"},"tags":null,"meta":null},"settings":{"access":"public","device_type":"desktop","expires_at":"2027-11-18T19:58:25Z","useragent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0","referer":"","cookies":null,"exit_node":"qguvgzjxzsgb3vs"},"stats":{"alert_count":{"ids":0,"urlquery":0,"analyzer":6}},"detection":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-10-14","alert":"Sinkholed","trigger":"vtivision.ca","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-10-14","alert":"Phishing Block","trigger":"vtivision.ca","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-10-14","alert":"Sinkholed","trigger":"vtivision.ca","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-10-14","alert":"Sinkholed","trigger":"telegrambotcheck.duckdns.org","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-10-14","alert":"Sinkholed","trigger":"telegrambotcheck.duckdns.org","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-10-14","alert":"Sinkholed","trigger":"telegrambotcheck.duckdns.org","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null},"summary":[{"fqdn":"vtivision.ca","ip":{"addr":"209.182.195.215","port":443,"asn":22611,"as":"INMOTION","country":"United States","country_code":"US"},"domain_registered":"2020-02-22","domain_rank":0,"first_seen":"2026-10-14T12:54:30.811728Z","last_seen":"2026-10-14T12:54:30.811728Z","alert_count":18,"request_count":6,"received_data":405962,"sent_data":3274,"comment":"","tags":null,"fingerprints":[{"name":"Apache HTTP Server","description":"Apache is a free and open-source cross-platform web server software.","website":"https://httpd.apache.org/","common_platform_enumeration":"cpe:2.3:a:apache:http_server:*:*:*:*:*:*:*:*","icon":"Apache.svg","categories":["Web servers"]},{"name":"PHP","description":"PHP is a general-purpose scripting language used for web development.","website":"https://php.net","common_platform_enumeration":"cpe:2.3:a:php:php:*:*:*:*:*:*:*:*","icon":"PHP.svg","categories":["Programming languages"]}]},{"fqdn":"telegrambotcheck.duckdns.org","ip":{"addr":"102.165.14.4","port":5001,"asn":397423,"as":"TIER-NET","country":"United States","country_code":"US"},"domain_registered":"2013-04-12","domain_rank":0,"first_seen":"2024-05-03T19:21:27Z","last_seen":"2026-10-09T18:22:59.628236Z","alert_count":3,"request_count":1,"received_data":177,"sent_data":567,"comment":"","tags":null,"fingerprints":[{"name":"TwistedWeb:26.4.0","description":"","website":"https://twistedmatrix.com/trac/wiki/TwistedWeb","common_platform_enumeration":"","icon":"TwistedWeb.png","categories":["Web servers"]}]}],"files":null,"artifacts":{"windows_shortcuts":null,"files":null,"telegram":null,"pdfs":null,"clipboard":null},"sensors":{"ids":null,"analyzer":null,"urlquery":null},"javascript":{"script":[{"url":{"schema":"https","addr":"vtivision.ca/isafwey/storage/theme/cmd/","fqdn":"vtivision.ca","domain":"vtivision.ca","tld":"ca"},"ip":{"addr":"209.182.195.215","port":443,"asn":22611,"as":"INMOTION","country":"United States","country_code":"US"},"introduction_type":"scriptElement","is_inline":true,"md5":"6543c63a556c9694a4c5cf435793b82e","sha1":"db4b76d50cf756046d9a1d1c17f04cbbee02b188","sha256":"94b852f1e6ac2900589ffd4102cae69ed5d2757338cb6ab7096f2b6109f93b26","sha512":"cbb7f98e8f45bc075aaf1ed3630604ea13a529595adc1396795637890c1a2ccb66bd783165c84a7f081cb68aec0984aaab8be886fe4dc41b238818ada083d07c","ssdeep":"","tlshash":"1660000000f0c000003c0c303000c03300000c03cf00000300003cc30f00003c303cc0","size":15,"data":"","first_seen":"2024-01-26T23:55:17Z","last_seen":"2026-10-14T19:58:30.218665Z","times_seen":467,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"vtivision.ca/isafwey/storage/theme/cmd/res/jq.js","fqdn":"vtivision.ca","domain":"vtivision.ca","tld":"ca"},"ip":{"addr":"209.182.195.215","port":443,"asn":22611,"as":"INMOTION","country":"United States","country_code":"US"},"introduction_type":"scriptElement","is_inline":false,"md5":"da5dde515a49fb9248e84c45d5a63370","sha1":"37825dc4bfb94d3def358d26e6ba0d13840e4045","sha256":"d066c11600369c32eea993e482d74be1bcc76c906f18f2ea7cd995bba6ecc385","sha512":"1c11476adc0d8b856c851a6d27c66f3c8fe9fda7b2ae5255edde524e87ee2f87978b2e5b6b3e26e3c5d4d734ae437070a5bc32651a5a4829b0c9c51e16861163","ssdeep":"3072:IM5LwijORnUkXCvM5LwijORnUkXCvM5LwijOCt1nUkXCvM5LwijORnUkXCs:REiEpCUEiEpCUEiZ1pCUEiEpCs","tlshash":"627483cdf6d2b0a257e37674403f510bf23bae54b45a8090e266e1d16cbd94a807bf39","size":369177,"data":"","first_seen":"2024-05-16T02:47:16Z","last_seen":"2026-10-14T19:58:30.210989Z","times_seen":1633,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"vtivision.ca/isafwey/storage/theme/cmd/","fqdn":"vtivision.ca","domain":"vtivision.ca","tld":"ca"},"ip":{"addr":"209.182.195.215","port":443,"asn":22611,"as":"INMOTION","country":"United States","country_code":"US"},"introduction_type":"Function","is_inline":false,"md5":"f957c88e86e92c7bf2bb53eb18f0971f","sha1":"b7d66c72b9a91ecd028c4d25bc7cbf31806352bf","sha256":"12cf38da03df33d1540f05e342eb443ff92740de80ecc40ee6ec8e7956277e7e","sha512":"2f47fe0d308e5c43d3ce9daa5fa7b509ba9de71c3b92556593760c471ccf03cdb90d916c8de477fbdad29c597c0608a8357a0c068c67b6e3bd0a5ae0fc7fa96c","ssdeep":"","tlshash":"a4119c67175919dd8ae268c30c7f29a30ca9ab210e88d4e48652fc43a5e5f8051faf30","size":916,"data":"","first_seen":"2024-05-16T02:47:16Z","last_seen":"2026-10-14T19:58:30.220423Z","times_seen":1677,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"vtivision.ca/isafwey/storage/theme/cmd/","fqdn":"vtivision.ca","domain":"vtivision.ca","tld":"ca"},"ip":{"addr":"209.182.195.215","port":443,"asn":22611,"as":"INMOTION","country":"United States","country_code":"US"},"introduction_type":"Function","is_inline":false,"md5":"aff49177ae9c77724783cfb192546baa","sha1":"cc7e7afc26962ac345ecb42840891c68754c6722","sha256":"30ed5f646abec0aaec9d0818bf2c05f98081420cd99fcbab3b8653f2542348b9","sha512":"8b3d9123c086fb4f2d9cc5f70d974783652ff3e2189974ae8ffc621b83bc99504a41626ea913c72212f11c7c23669ddd0612b7c0870fc64fc973fce76c25fac7","ssdeep":"","tlshash":"014133092a7c776853d39313205f8c66d2642e20a64fdcb8c553bd902a7121a7b6bcdb","size":1983,"data":"","first_seen":"2024-05-16T02:47:16Z","last_seen":"2026-10-14T19:58:30.221317Z","times_seen":1677,"alerts":{"ids":null,"analyzer":null,"urlquery":null}}],"eval":null,"write":null,"console":[{"level":"error","text":"Error:NetworkError when attempting to fetch resource.","filename":"https://vtivision.ca/isafwey/storage/theme/cmd/res/jq.js line 4 \u003e Function","line_number":3,"column_number":1735}]},"http":[{"url":{"schema":"https","addr":"vtivision.ca/isafwey/storage/theme/cmd/","fqdn":"vtivision.ca","domain":"vtivision.ca","tld":"ca"},"ip":{"addr":"209.182.195.215","port":443,"asn":22611,"as":"INMOTION","country":"United States","country_code":"US"},"is_navigation_request":true,"resource_type":"document","requested_by":"","date":"2026-10-14T19:53:53.462Z","timestamp":1792007633462,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"www.vtivision.ca","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Tue, 06 Oct 2026 03:12:44 GMT","end":"Mon, 04 Jan 2027 03:12:43 GMT"},"fingerprint":{"sha1":"DA:1A:FF:53:AB:87:98:98:F9:29:48:92:BB:A0:17:B3:9D:38:B7:AC","sha256":"FB:C4:2B:78:40:E0:C7:B7:53:44:38:E1:FC:94:2B:9D:7C:B4:7A:6A:24:68:27:E0:8F:E9:55:CA:D5:C6:C6:76"}}},"request":{"raw":"GET /isafwey/storage/theme/cmd/ HTTP/1.1\r\nHost: vtivision.ca\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nUpgrade-Insecure-Requests: 1\r\nSec-Fetch-Dest: document\r\nSec-Fetch-Mode: navigate\r\nSec-Fetch-Site: none\r\nPriority: u=0, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Wed, 14 Oct 2026 19:53:53 GMT\r\nServer: Apache\r\nExpires: Thu, 19 Nov 1981 08:52:00 GMT\r\nCache-Control: no-store, no-cache, must-revalidate\r\nPragma: no-cache\r\nSet-Cookie: PHPSESSID=560f68ede1f37b5e3c26f2829cc989cb; path=/\r\nKeep-Alive: timeout=5, max=99\r\nConnection: Keep-Alive\r\nTransfer-Encoding: chunked\r\nContent-Type: text/html; charset=UTF-8\r\n\r\n","headers":null,"cookies":[{"name":"PHPSESSID","value":"560f68ede1f37b5e3c26f2829cc989cb","quoted":false,"path":"/","secure":false,"http_only":false,"same_site":"","partitioned":false,"raw":"PHPSESSID=560f68ede1f37b5e3c26f2829cc989cb; path=/"}],"status_code":"200","status_text":"OK","fingerprints":[{"name":"Apache HTTP Server","description":"Apache is a free and open-source cross-platform web server software.","website":"https://httpd.apache.org/","common_platform_enumeration":"cpe:2.3:a:apache:http_server:*:*:*:*:*:*:*:*","icon":"Apache.svg","categories":["Web servers"]},{"name":"PHP","description":"PHP is a general-purpose scripting language used for web development.","website":"https://php.net","common_platform_enumeration":"cpe:2.3:a:php:php:*:*:*:*:*:*:*:*","icon":"PHP.svg","categories":["Programming languages"]}],"data":{"size":945,"size_decoded":1314,"mime_type":"text/html; charset=UTF-8","magic":"HTML document, ASCII text, with CRLF line terminators","md5":"6b0ea35a4e26728a2d14473539ea985e","sha1":"459cd9c80578a0c353002cb40b02df90e1877c97","sha256":"834534dfb18527cf079cd3bac0edf2587242db875db2a952c40db71c2903f6a2","sha512":"90dfb3f736560a4680b41dd54a5177cae2cae1de25be89b932acb18422602ce67ecd349af8741cd4589d210dc2df566b8a5cdc34349efaa29dded955c5a786f5","ssdeep":"","tlshash":"1011403294d2ac0941b329b8a4d8b3dce884c321ab835a0071e533879bd8b66ddc7285","first_seen":"2026-09-24T12:36:06.271009Z","last_seen":"2026-10-14T19:58:30.206646Z","times_seen":5,"resource_available":true,"data":null}},"time_used":218,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":201,"receive":17,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-10-14","alert":"Sinkholed","trigger":"vtivision.ca","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-10-14","alert":"Phishing Block","trigger":"vtivision.ca","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-10-14","alert":"Sinkholed","trigger":"vtivision.ca","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"vtivision.ca/isafwey/storage/theme/cmd/res/app.css","fqdn":"vtivision.ca","domain":"vtivision.ca","tld":"ca"},"ip":{"addr":"209.182.195.215","port":443,"asn":22611,"as":"INMOTION","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://vtivision.ca/isafwey/storage/theme/cmd/","date":"2026-10-14T19:53:53.873Z","timestamp":1792007633873,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"www.vtivision.ca","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Tue, 06 Oct 2026 03:12:44 GMT","end":"Mon, 04 Jan 2027 03:12:43 GMT"},"fingerprint":{"sha1":"DA:1A:FF:53:AB:87:98:98:F9:29:48:92:BB:A0:17:B3:9D:38:B7:AC","sha256":"FB:C4:2B:78:40:E0:C7:B7:53:44:38:E1:FC:94:2B:9D:7C:B4:7A:6A:24:68:27:E0:8F:E9:55:CA:D5:C6:C6:76"}}},"request":{"raw":"GET /isafwey/storage/theme/cmd/res/app.css HTTP/1.1\r\nHost: vtivision.ca\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://vtivision.ca/isafwey/storage/theme/cmd/\r\nCookie: PHPSESSID=560f68ede1f37b5e3c26f2829cc989cb\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=2\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":[{"name":"PHPSESSID","value":"560f68ede1f37b5e3c26f2829cc989cb"}],"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Wed, 14 Oct 2026 19:53:53 GMT\r\nServer: Apache\r\nLast-Modified: Wed, 10 Jul 2024 15:03:38 GMT\r\nAccept-Ranges: bytes\r\nContent-Length: 940\r\nKeep-Alive: timeout=5, max=98\r\nConnection: Keep-Alive\r\nContent-Type: text/css\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Apache HTTP Server","description":"Apache is a free and open-source cross-platform web server software.","website":"https://httpd.apache.org/","common_platform_enumeration":"cpe:2.3:a:apache:http_server:*:*:*:*:*:*:*:*","icon":"Apache.svg","categories":["Web servers"]}],"data":{"size":940,"size_decoded":1180,"mime_type":"text/css","magic":"ASCII text, with CRLF line terminators","md5":"3a4c38f68e3ac53f0f7d3fbceb47a8e7","sha1":"0c70c886edd806d52d76cee8c0d3afb9f3716724","sha256":"3a002938cce674e0d424a9476e1e4200de7b74f933fe73970c707f08c738afc7","sha512":"0c2b7c2604b1b35f10e0fb72539a876e57df16cac68b0f7f83d3a37c21ef0e8e71a221f7af96fe0e52b244e057dc7f1ccdd241226e7e3be6f70a43e3a139468b","ssdeep":"","tlshash":"84118c5dc9821146f372cd04a7f501d9fe88081b5a0641aabfd4b3a0efb45798170f9c","first_seen":"2025-07-13T18:08:33.187844Z","last_seen":"2026-10-14T19:58:30.209477Z","times_seen":13,"resource_available":true,"data":null}},"time_used":160,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":160,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-10-14","alert":"Sinkholed","trigger":"vtivision.ca","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-10-14","alert":"Phishing Block","trigger":"vtivision.ca","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-10-14","alert":"Sinkholed","trigger":"vtivision.ca","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"vtivision.ca/isafwey/storage/theme/cmd/res/jq.js","fqdn":"vtivision.ca","domain":"vtivision.ca","tld":"ca"},"ip":{"addr":"209.182.195.215","port":443,"asn":22611,"as":"INMOTION","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://vtivision.ca/isafwey/storage/theme/cmd/","date":"2026-10-14T19:53:53.875Z","timestamp":1792007633875,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"www.vtivision.ca","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Tue, 06 Oct 2026 03:12:44 GMT","end":"Mon, 04 Jan 2027 03:12:43 GMT"},"fingerprint":{"sha1":"DA:1A:FF:53:AB:87:98:98:F9:29:48:92:BB:A0:17:B3:9D:38:B7:AC","sha256":"FB:C4:2B:78:40:E0:C7:B7:53:44:38:E1:FC:94:2B:9D:7C:B4:7A:6A:24:68:27:E0:8F:E9:55:CA:D5:C6:C6:76"}}},"request":{"raw":"GET /isafwey/storage/theme/cmd/res/jq.js HTTP/1.1\r\nHost: vtivision.ca\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://vtivision.ca/isafwey/storage/theme/cmd/\r\nCookie: PHPSESSID=560f68ede1f37b5e3c26f2829cc989cb\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":[{"name":"PHPSESSID","value":"560f68ede1f37b5e3c26f2829cc989cb"}],"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Wed, 14 Oct 2026 19:53:54 GMT\r\nServer: Apache\r\nLast-Modified: Wed, 10 Jul 2024 15:03:38 GMT\r\nAccept-Ranges: bytes\r\nContent-Length: 369177\r\nKeep-Alive: timeout=5, max=97\r\nConnection: Keep-Alive\r\nContent-Type: application/javascript\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Apache HTTP Server","description":"Apache is a free and open-source cross-platform web server software.","website":"https://httpd.apache.org/","common_platform_enumeration":"cpe:2.3:a:apache:http_server:*:*:*:*:*:*:*:*","icon":"Apache.svg","categories":["Web servers"]}],"data":{"size":369177,"size_decoded":369434,"mime_type":"application/javascript","magic":"JavaScript source, Unicode text, UTF-8 text, with very long lines (65434), with no line terminators","md5":"da5dde515a49fb9248e84c45d5a63370","sha1":"37825dc4bfb94d3def358d26e6ba0d13840e4045","sha256":"d066c11600369c32eea993e482d74be1bcc76c906f18f2ea7cd995bba6ecc385","sha512":"1c11476adc0d8b856c851a6d27c66f3c8fe9fda7b2ae5255edde524e87ee2f87978b2e5b6b3e26e3c5d4d734ae437070a5bc32651a5a4829b0c9c51e16861163","ssdeep":"3072:IM5LwijORnUkXCvM5LwijORnUkXCvM5LwijOCt1nUkXCvM5LwijORnUkXCs:REiEpCUEiEpCUEiZ1pCUEiEpCs","tlshash":"627483cdf6d2b0a257e37674403f510bf23bae54b45a8090e266e1d16cbd94a807bf39","first_seen":"2024-05-16T02:47:16Z","last_seen":"2026-10-14T19:58:30.210989Z","times_seen":1633,"resource_available":true,"data":null}},"time_used":951,"timings":{"blocked":-1,"dns":0,"connect":164,"send":0,"wait":159,"receive":633,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-10-14","alert":"Sinkholed","trigger":"vtivision.ca","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-10-14","alert":"Phishing Block","trigger":"vtivision.ca","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-10-14","alert":"Sinkholed","trigger":"vtivision.ca","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"vtivision.ca/isafwey/storage/theme/cmd/res/logo.png","fqdn":"vtivision.ca","domain":"vtivision.ca","tld":"ca"},"ip":{"addr":"209.182.195.215","port":443,"asn":22611,"as":"INMOTION","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://vtivision.ca/isafwey/storage/theme/cmd/","date":"2026-10-14T19:53:53.879Z","timestamp":1792007633879,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"www.vtivision.ca","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Tue, 06 Oct 2026 03:12:44 GMT","end":"Mon, 04 Jan 2027 03:12:43 GMT"},"fingerprint":{"sha1":"DA:1A:FF:53:AB:87:98:98:F9:29:48:92:BB:A0:17:B3:9D:38:B7:AC","sha256":"FB:C4:2B:78:40:E0:C7:B7:53:44:38:E1:FC:94:2B:9D:7C:B4:7A:6A:24:68:27:E0:8F:E9:55:CA:D5:C6:C6:76"}}},"request":{"raw":"GET /isafwey/storage/theme/cmd/res/logo.png HTTP/1.1\r\nHost: vtivision.ca\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://vtivision.ca/isafwey/storage/theme/cmd/\r\nCookie: PHPSESSID=560f68ede1f37b5e3c26f2829cc989cb\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":[{"name":"PHPSESSID","value":"560f68ede1f37b5e3c26f2829cc989cb"}],"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Wed, 14 Oct 2026 19:53:54 GMT\r\nServer: Apache\r\nLast-Modified: Tue, 14 Apr 2026 19:09:06 GMT\r\nAccept-Ranges: bytes\r\nContent-Length: 33344\r\nKeep-Alive: timeout=5, max=100\r\nConnection: Keep-Alive\r\nContent-Type: image/png\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Apache HTTP Server","description":"Apache is a free and open-source cross-platform web server software.","website":"https://httpd.apache.org/","common_platform_enumeration":"cpe:2.3:a:apache:http_server:*:*:*:*:*:*:*:*","icon":"Apache.svg","categories":["Web servers"]}],"data":{"size":33344,"size_decoded":33588,"mime_type":"image/png","magic":"PNG image data, 719 x 226, 8-bit/color RGBA, non-interlaced","md5":"ba0f0a017fc55c33e24818b69649225b","sha1":"61bfa6e9045ea1370aee23f0bce28c3e881a6ea7","sha256":"4042860d543d451e1c2b96efbd78748337e12960721f7182316bd1ee02dc9786","sha512":"b3d49308d0d20a517471ba429f53024c44f54c67116ee4c40a9e064839c690873f5196698c5510275be3591bd4ce5afd3858ba8fdbb99742254098fb45a1f37d","ssdeep":"768:usUvn6kQcgh/BQKXxQ7PPaPWrld+W/6VKobZ9uNbPLf0nBM:uso6wgh/pQrCPWrT+W/2mNrz0nm","tlshash":"8ee2cf9190e0ca516a6ba4994c35ec3758ef9198e0ec1db4dec9f81ccc4bc322999d29","first_seen":"2026-09-24T12:36:06.267444Z","last_seen":"2026-10-14T19:58:30.213651Z","times_seen":4,"resource_available":false,"data":null}},"time_used":803,"timings":{"blocked":150,"dns":0,"connect":150,"send":0,"wait":163,"receive":318,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-10-14","alert":"Sinkholed","trigger":"vtivision.ca","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-10-14","alert":"Phishing Block","trigger":"vtivision.ca","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-10-14","alert":"Sinkholed","trigger":"vtivision.ca","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"telegrambotcheck.duckdns.org:5001/receive_token?referrer=loco","fqdn":"telegrambotcheck.duckdns.org","domain":"telegrambotcheck.duckdns.org","tld":"duckdns.org"},"ip":{"addr":"102.165.14.4","port":5001,"asn":397423,"as":"TIER-NET","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"fetch","requested_by":"https://vtivision.ca/isafwey/storage/theme/cmd/","date":"2026-10-14T19:53:55.069Z","timestamp":1792007635069,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"telegrambotcheck.duckdns.org","organization":""},"issuer":{"commonName":"YE1","organization":"Let's Encrypt"},"validity":{"start":"Mon, 31 Aug 2026 04:40:58 GMT","end":"Sun, 29 Nov 2026 04:40:57 GMT"},"fingerprint":{"sha1":"77:6E:B3:60:26:D6:99:77:6D:90:5A:AE:EA:E2:5B:A3:A3:EF:99:68","sha256":"3A:5D:9C:AC:31:A3:63:8F:EE:1B:A9:BE:CC:09:D5:E9:99:08:E0:8D:0D:98:51:46:80:99:16:2A:E7:9D:1D:C4"}}},"request":{"raw":"POST /receive_token?referrer=loco HTTP/1.1\r\nHost: telegrambotcheck.duckdns.org:5001\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://vtivision.ca/\r\nContent-Type: application/x-www-form-urlencoded\r\nContent-Length: 10\r\nOrigin: https://vtivision.ca\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPriority: u=4\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"POST"},"response":{"raw":"HTTP/1.1 200 OK\r\nServer: TwistedWeb/26.4.0\r\nDate: Wed, 14 Oct 2026 19:53:55 GMT\r\nContent-Type: text/html; charset=utf-8\r\nContent-Length: 34\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"TwistedWeb:26.4.0","description":"","website":"https://twistedmatrix.com/trac/wiki/TwistedWeb","common_platform_enumeration":"","icon":"TwistedWeb.png","categories":["Web servers"]}],"data":{"size":34,"size_decoded":177,"mime_type":"text/html; charset=utf-8","magic":"ASCII text, with no line terminators","md5":"ad9c4044755866ee6ac6a011ceb3c56a","sha1":"07a6fb69c2f069b84acdbb3f43d0200b6a92f5cc","sha256":"a8d8e65e29f25795987dcf392703b5133895dc7d2c831c2cbde30634b3b8d9ed","sha512":"242daba21f73ac8e6ea1ef54315dcbb28f209f737f68c56a03e3955585cfb2f746c7def1c6d02c6f279dbfce2250c7872dcad8cb8130ad310116cf0e169c55ab","ssdeep":"","tlshash":"4e8000a228032b0208b008a8a0b0c32b2ee220088230080e28b0c8e23ce8fc0f022b08","first_seen":"2024-04-12T18:59:54Z","last_seen":"2026-10-14T19:58:30.21561Z","times_seen":198,"resource_available":true,"data":null}},"time_used":1490,"timings":{"blocked":-1,"dns":163,"connect":130,"send":0,"wait":1049,"receive":0,"ssl":147},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-10-14","alert":"Sinkholed","trigger":"telegrambotcheck.duckdns.org","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-10-14","alert":"Sinkholed","trigger":"telegrambotcheck.duckdns.org","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-10-14","alert":"Sinkholed","trigger":"telegrambotcheck.duckdns.org","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"vtivision.ca/favicon.ico","fqdn":"vtivision.ca","domain":"vtivision.ca","tld":"ca"},"ip":{"addr":"209.182.195.215","port":443,"asn":22611,"as":"INMOTION","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://vtivision.ca/isafwey/storage/theme/cmd/","date":"2026-10-14T19:53:55.176Z","timestamp":1792007635176,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"www.vtivision.ca","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Tue, 06 Oct 2026 03:12:44 GMT","end":"Mon, 04 Jan 2027 03:12:43 GMT"},"fingerprint":{"sha1":"DA:1A:FF:53:AB:87:98:98:F9:29:48:92:BB:A0:17:B3:9D:38:B7:AC","sha256":"FB:C4:2B:78:40:E0:C7:B7:53:44:38:E1:FC:94:2B:9D:7C:B4:7A:6A:24:68:27:E0:8F:E9:55:CA:D5:C6:C6:76"}}},"request":{"raw":"GET /favicon.ico HTTP/1.1\r\nHost: vtivision.ca\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://vtivision.ca/isafwey/storage/theme/cmd/\r\nCookie: PHPSESSID=560f68ede1f37b5e3c26f2829cc989cb\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=6\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":[{"name":"PHPSESSID","value":"560f68ede1f37b5e3c26f2829cc989cb"}],"method":"GET"},"response":{"raw":"HTTP/1.1 500 Internal Server Error\r\nDate: Wed, 14 Oct 2026 19:53:55 GMT\r\nServer: Apache\r\nConnection: close\r\nTransfer-Encoding: chunked\r\nContent-Type: text/html; charset=UTF-8\r\n\r\n","headers":null,"cookies":null,"status_code":"500","status_text":"Internal Server Error","fingerprints":[{"name":"Apache HTTP Server","description":"Apache is a free and open-source cross-platform web server software.","website":"https://httpd.apache.org/","common_platform_enumeration":"cpe:2.3:a:apache:http_server:*:*:*:*:*:*:*:*","icon":"Apache.svg","categories":["Web servers"]}],"data":{"size":0,"size_decoded":178,"mime_type":"text/html; charset=UTF-8","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-10-14T21:38:38.165528Z","times_seen":19106563,"resource_available":true,"data":null}},"time_used":222,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":205,"receive":17,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-10-14","alert":"Phishing Block","trigger":"vtivision.ca","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-10-14","alert":"Sinkholed","trigger":"vtivision.ca","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-10-14","alert":"Sinkholed","trigger":"vtivision.ca","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"vtivision.ca/isafwey/storage/theme/cmd","fqdn":"vtivision.ca","domain":"vtivision.ca","tld":"ca"},"ip":{"addr":"209.182.195.215","port":443,"asn":22611,"as":"INMOTION","country":"United States","country_code":"US"},"is_navigation_request":true,"resource_type":"document","requested_by":"","date":"2026-10-14T19:53:52.710Z","timestamp":1792007632710,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"www.vtivision.ca","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Tue, 06 Oct 2026 03:12:44 GMT","end":"Mon, 04 Jan 2027 03:12:43 GMT"},"fingerprint":{"sha1":"DA:1A:FF:53:AB:87:98:98:F9:29:48:92:BB:A0:17:B3:9D:38:B7:AC","sha256":"FB:C4:2B:78:40:E0:C7:B7:53:44:38:E1:FC:94:2B:9D:7C:B4:7A:6A:24:68:27:E0:8F:E9:55:CA:D5:C6:C6:76"}}},"request":{"raw":"GET /isafwey/storage/theme/cmd HTTP/1.1\r\nHost: vtivision.ca\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nUpgrade-Insecure-Requests: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: document\r\nSec-Fetch-Mode: navigate\r\nSec-Fetch-Site: none\r\nPriority: u=0, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 301 Moved Permanently\r\nDate: Wed, 14 Oct 2026 19:53:53 GMT\r\nServer: Apache\r\nLocation: https://vtivision.ca/isafwey/storage/theme/cmd/\r\nContent-Length: 295\r\nKeep-Alive: timeout=5, max=100\r\nConnection: Keep-Alive\r\nContent-Type: text/html; charset=iso-8859-1\r\n\r\n","headers":null,"cookies":null,"status_code":"301","status_text":"Moved Permanently","fingerprints":[{"name":"Apache HTTP Server","description":"Apache is a free and open-source cross-platform web server software.","website":"https://httpd.apache.org/","common_platform_enumeration":"cpe:2.3:a:apache:http_server:*:*:*:*:*:*:*:*","icon":"Apache.svg","categories":["Web servers"]}],"data":{"size":0,"size_decoded":0,"mime_type":"text/html; charset=UTF-8","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-10-14T21:38:38.165528Z","times_seen":19106563,"resource_available":true,"data":null}},"time_used":742,"timings":{"blocked":-1,"dns":106,"connect":157,"send":0,"wait":159,"receive":0,"ssl":319},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-10-14","alert":"Sinkholed","trigger":"vtivision.ca","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-10-14","alert":"Phishing Block","trigger":"vtivision.ca","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-10-14","alert":"Sinkholed","trigger":"vtivision.ca","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}}]}