{"report_id":"8191912d-cc07-4e48-8d97-c20ca591dd2d","version":0,"status":"done","tags":[],"date":"2026-08-11T11:44:23Z","url":{"schema":"https","addr":"vip-upgrader.cfd/","fqdn":"vip-upgrader.cfd","domain":"vip-upgrader.cfd","tld":"cfd"},"ip":{"addr":"192.162.199.140","port":0,"asn":216271,"as":"Netlabs LLC","country":"Germany","country_code":"DE"},"final":{"url":{"schema":"https","addr":"vip-upgrader.cfd/","fqdn":"vip-upgrader.cfd","domain":"vip-upgrader.cfd","tld":"cfd"},"title":"VIP Club","dom":{"size":46892,"mime_type":"text/html; charset=utf-8","magic":"JavaScript source, ASCII text, with very long lines (46433)","md5":"b43664f635218db9e32134b3a4958653","sha1":"f2f4d04ae12ca5a3698cce643893118ae5790b14","sha256":"8e6b80a17137a904e8e903caaf8d87b68658bc06c6fc1b7561401adee4c68fa9","sha512":"c3c114c769e6606a44f67bcda1ef4ee7a7d2aa11ce83432283e7024e0dc73f63cf34d7193f12f2a1b312d59014bd7d6ef2a6dac5cf3b24dd18dfbc0e255f5137","ssdeep":"768:pdprIn1ifn8nxonU0R7tDfol8Qlcx9ftMQ9OMl2t9kWbSjY99aNNj0:pLrI1kK7cNj0","tlshash":"84234e97a9c2b2d3f191e62cec3712bc955d3891db965409942c35a0b8fcf80f7c2b69","dom_hash":"domhash8add27e923eb93563044c32c080162d1","first_seen":"2026-08-11T11:37:36.811045Z","last_seen":"2026-08-11T11:44:26.070193Z","times_seen":2,"resource_available":false,"data":null}},"submit":{"url":{"schema":"https","addr":"vip-upgrader.cfd/","fqdn":"vip-upgrader.cfd","domain":"vip-upgrader.cfd","tld":"cfd"},"ip":{"addr":"192.162.199.140","port":0,"asn":216271,"as":"Netlabs LLC","country":"Germany","country_code":"DE"},"tags":null,"meta":null},"settings":{"access":"public","device_type":"desktop","expires_at":"2027-09-15T11:44:23Z","useragent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0","referer":"","cookies":null,"exit_node":"qguvgzjxzsgb3vs"},"stats":{"alert_count":{"ids":0,"urlquery":0,"analyzer":3}},"detection":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-08-11","alert":"Sinkholed","trigger":"vip-upgrader.cfd","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-08-11","alert":"Sinkholed","trigger":"s3.upgrader.vip","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-08-11","alert":"Sinkholed","trigger":"s3.upgrader.vip","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null},"summary":[{"fqdn":"vip-upgrader.cfd","ip":{"addr":"192.162.199.140","port":443,"asn":216271,"as":"Netlabs LLC","country":"Germany","country_code":"DE"},"domain_registered":"2026-07-28","domain_rank":0,"first_seen":"2026-08-11T11:37:33.615107Z","last_seen":"2026-08-11T11:37:33.615107Z","alert_count":7,"request_count":7,"received_data":3423237,"sent_data":6762,"comment":"","tags":null,"fingerprints":[{"name":"OpenResty","description":"OpenResty is a web platform based on nginx which can run Lua scripts using its LuaJIT engine.","website":"https://openresty.org","common_platform_enumeration":"","icon":"OpenResty.svg","categories":["Web servers"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}]},{"fqdn":"s3.upgrader.vip","ip":{"addr":"45.199.188.12","port":443,"asn":0,"as":"","country":"United States","country_code":"US"},"domain_registered":"2025-07-02","domain_rank":0,"first_seen":"2026-03-25T03:11:48.719943Z","last_seen":"2026-08-11T11:37:34.217982Z","alert_count":2,"request_count":1,"received_data":1120,"sent_data":523,"comment":"","tags":null,"fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}]}],"files":null,"artifacts":{"windows_shortcuts":null,"files":null,"telegram":null,"pdfs":null,"clipboard":null},"sensors":{"ids":null,"analyzer":null,"urlquery":null},"javascript":{"script":[{"url":{"schema":"https","addr":"vip-upgrader.cfd/224c78567500075d5800554d.js","fqdn":"vip-upgrader.cfd","domain":"vip-upgrader.cfd","tld":"cfd"},"ip":{"addr":"192.162.199.140","port":443,"asn":216271,"as":"Netlabs LLC","country":"Germany","country_code":"DE"},"introduction_type":"scriptElement","is_inline":false,"md5":"ca44472bb63ed5b9536188c1e7250834","sha1":"49f68bde8f9a705cd6a213f99fd1fe9068713f90","sha256":"2d8960006ff583db4bb4dadfe765dc090e723d6ee076ffcdc781fecba2f3ea8b","sha512":"22d5b603744549d96758f401d7e254ef74654ef0a077087a71a6238f076dc8d4c372e10e894b3ebb534f5773e40d8d6fc1fdfadec0182e5592f0ec7c0c99c7a9","ssdeep":"6144:A2dRfP9UYcfQaUqVUNRG1kSlCpqnw4/P9F8JRPaV:9RfP9UYcfQaU+UPsCb4/P9F8JFaV","tlshash":"074484406bd0a86c239b5b7a731fb0e5f46a096f3d88498bd101fc90a6e6217fdf9531","size":260282,"data":"","first_seen":"2026-08-06T00:07:04.322113Z","last_seen":"2026-08-11T11:44:26.076416Z","times_seen":12,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"vip-upgrader.cfd/224c7856750007","fqdn":"vip-upgrader.cfd","domain":"vip-upgrader.cfd","tld":"cfd"},"ip":{"addr":"192.162.199.140","port":443,"asn":216271,"as":"Netlabs LLC","country":"Germany","country_code":"DE"},"introduction_type":"scriptElement","is_inline":true,"md5":"86fac5d307fd236ccb8b6ab822b5ffd0","sha1":"2a7daa54a4fedc6e8c1f9a680ce87db3302aa026","sha256":"1881d7096ced4261ddaa8a0fba43ee5ca16c6ab0a469628d2350e37deb15ebc7","sha512":"feb0bdee3a8cc480bcd6fe47df6c83704172e3cc72f5beb12e7161d9ce066fd1cf506684e69da6f0e765d0ccc53ec34b1096244521075b3549cd3218d9b33dab","ssdeep":"","tlshash":"2980044401575514c73d1114434311003d400054100370505dd441511441c074454c51","size":32,"data":"","first_seen":"2024-08-04T20:33:49Z","last_seen":"2026-08-11T11:44:26.07697Z","times_seen":131,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"vip-upgrader.cfd/224c7856750007","fqdn":"vip-upgrader.cfd","domain":"vip-upgrader.cfd","tld":"cfd"},"ip":{"addr":"192.162.199.140","port":443,"asn":216271,"as":"Netlabs LLC","country":"Germany","country_code":"DE"},"introduction_type":"scriptElement","is_inline":true,"md5":"253e3f41a01287f37dadce32ce402b22","sha1":"60724c7fa32380515d79b61e1634b03c3350d63c","sha256":"d012ad4268069c67535a0c0f0e8b1b271edf1e96b7b405848b6cbd57faa038b6","sha512":"5a80bee64ac5e1083b36d289475b4b0536a6a8a7b57448f40b9fe2ac42467d9d99013f557dcad8fd9a3ef24315bbf3c1d663043dff7e5f993368af39946cbe64","ssdeep":"384:+LiDa6Kxzmwl2GCA/eBPOjTIGzhWLkhnbI0+:I16KxJ2GQPWTIGzhWLkhbI0+","tlshash":"7bd2e86532b710380a17657fc38f378a353550ab7d0aea14393d9b0d1fd2a21c97abe8","size":28902,"data":"","first_seen":"2026-08-11T11:37:36.826335Z","last_seen":"2026-08-11T11:44:26.077491Z","times_seen":2,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"vip-upgrader.cfd/","fqdn":"vip-upgrader.cfd","domain":"vip-upgrader.cfd","tld":"cfd"},"ip":{"addr":"192.162.199.140","port":443,"asn":216271,"as":"Netlabs LLC","country":"Germany","country_code":"DE"},"introduction_type":"scriptElement","is_inline":true,"md5":"ed819f53d69e38f105df8da401a9bf97","sha1":"773f00f276589360f28121c4b4039d123856c8d0","sha256":"4e46127c337e84db58ce5c9bfa8249c3bb9dff237c2f0cbb65582fbbc9848893","sha512":"c8899339342e804abbd2a470915ae8abef93eed5ab23402c9b2ec5a680c3e8a235a08b062cdbb07fb86bf0b9ffa2eae1f9ca7838d825d3eccf73534636825c76","ssdeep":"768:OprIn1ifn8nxonU0R7tDfol8Qlcx9ftMQ9OMl2t9kWbSjY99aNNjT:IrI1kK7cNjT","tlshash":"78234f97a9c2b2d3f191e62cec3712bc955d3991db965409841c35a0b8fcf80f7c2b69","size":46219,"data":"","first_seen":"2026-08-06T00:07:04.345878Z","last_seen":"2026-08-11T11:44:26.078314Z","times_seen":12,"alerts":{"ids":null,"analyzer":null,"urlquery":null}}],"eval":null,"write":null,"console":null},"http":[{"url":{"schema":"https","addr":"vip-upgrader.cfd/api/me","fqdn":"vip-upgrader.cfd","domain":"vip-upgrader.cfd","tld":"cfd"},"ip":{"addr":"192.162.199.140","port":443,"asn":216271,"as":"Netlabs LLC","country":"Germany","country_code":"DE"},"is_navigation_request":false,"resource_type":"fetch","requested_by":"https://vip-upgrader.cfd/224c7856750007","date":"2026-08-11T11:43:52.514Z","timestamp":1786448632514,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"vip-upgrader.cfd","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Tue, 28 Jul 2026 07:23:55 GMT","end":"Mon, 26 Oct 2026 07:23:54 GMT"},"fingerprint":{"sha1":"1A:A5:C7:D9:11:ED:10:56:4F:86:BF:88:BD:71:1B:EF:C7:61:B7:CC","sha256":"4E:E0:E5:84:32:A2:4F:29:80:0D:D9:FD:0A:10:6A:AF:7F:05:BF:3E:22:36:70:A9:C0:2D:41:E9:B6:6E:A5:8C"}}},"request":{"raw":"GET /api/me HTTP/1.1\r\nHost: vip-upgrader.cfd\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nCookie: session=eyJhbGciOiJBMTI4S1ciLCJlbmMiOiJBMTI4R0NNIn0.W0UF9VOfzfOOjT37CbZCFish3RB19BSo.qK-C1e69nDc4kokl.cZE8I-O3f151FCs-8yHwScmTl5Hv3GVP2jVFJb5Jg09On4l1FAdDGD7MHUybFgfztL28p4KcpHKzXA2gIzNQnl2VTyVDcqHje6DAEjQFLI7eP2YRDw1CJtXhEr_7-p0-Nwwnr3yKWXIYOPmUdclep1IkAagFGgj85v_2Wslf4PFAip98JadVkkXSg9quJrSa_lC60HiXw2D-bsNdUBtFJFNrRqXA1icKHSgrZOuAUwYvV1ZMVnFdeYNnPzH4dg96bu-b8tNGA-_2sVhyQA.mAfgALE6kLkv7VXU_CgKxA; token=eyJhbGciOiJIUzI1NiJ9.eyJvd25lciI6Mjg5OCwic2VjcmV0IjoiZjU2NzgxZDQ2ZDA1YzcwYzc5NzVmMGRjNjhjMDY4NGUiLCJzZXJ2aWNlIjoiU3RlYW0ifQ.j7klb20YZF-tF01llj7ZGauL_DOWQIZiTldYc-hH59Q\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=4\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 404 \r\nserver: openresty\r\ndate: Tue, 11 Aug 2026 11:43:52 GMT\r\ncontent-type: application/json; charset=utf-8\r\ncontent-length: 65\r\ncontent-security-policy: frame-ancestors *\r\ncross-origin-opener-policy: same-origin\r\ncross-origin-resource-policy: same-origin\r\netag: W/\"41-0AeMVzV1pApYTMktTMxeiuYqqUg\"\r\norigin-agent-cluster: ?1\r\nreferrer-policy: no-referrer\r\nstrict-transport-security: max-age=15552000; includeSubDomains\r\nx-content-type-options: nosniff\r\nx-dns-prefetch-control: off\r\nx-download-options: noopen\r\nx-frame-options: ALLOWALL\r\nx-permitted-cross-domain-policies: none\r\nx-xss-protection: 0\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"404","status_text":"","fingerprints":[{"name":"OpenResty","description":"OpenResty is a web platform based on nginx which can run Lua scripts using its LuaJIT engine.","website":"https://openresty.org","common_platform_enumeration":"","icon":"OpenResty.svg","categories":["Web servers"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":65,"size_decoded":692,"mime_type":"application/json; charset=utf-8","magic":"JSON text data","md5":"6688d59f1d0b9e116ceca1708a113d0d","sha1":"d0078c573575a40a584cc92d4ccc5e8ae62aa948","sha256":"cacc3c09d432702d237265c156358a0430dd08938afbceaf4a444d26340b25e8","sha512":"116612441c802eae5cdfa4441c5757ee48298f865e1ff4e164ae1ba9ab2a0856c7e2e5c023864eee6963eda1bb89d6edcc7951c4b566eca2aac989a66ef510a4","ssdeep":"","tlshash":"b4a0020c084b7aad4f52c4bd75cd7d3488564ac015a119615189d438825464e8845588","first_seen":"2024-08-02T16:52:12Z","last_seen":"2026-08-11T11:44:26.071285Z","times_seen":1829,"resource_available":true,"data":null}},"time_used":65,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":65,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-08-11","alert":"Sinkholed","trigger":"vip-upgrader.cfd","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"vip-upgrader.cfd/favicon.ico","fqdn":"vip-upgrader.cfd","domain":"vip-upgrader.cfd","tld":"cfd"},"ip":{"addr":"192.162.199.140","port":443,"asn":216271,"as":"Netlabs LLC","country":"Germany","country_code":"DE"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://vip-upgrader.cfd/","date":"2026-08-11T11:43:51.967Z","timestamp":1786448631967,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"vip-upgrader.cfd","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Tue, 28 Jul 2026 07:23:55 GMT","end":"Mon, 26 Oct 2026 07:23:54 GMT"},"fingerprint":{"sha1":"1A:A5:C7:D9:11:ED:10:56:4F:86:BF:88:BD:71:1B:EF:C7:61:B7:CC","sha256":"4E:E0:E5:84:32:A2:4F:29:80:0D:D9:FD:0A:10:6A:AF:7F:05:BF:3E:22:36:70:A9:C0:2D:41:E9:B6:6E:A5:8C"}}},"request":{"raw":"GET /favicon.ico HTTP/1.1\r\nHost: vip-upgrader.cfd\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nCookie: session=eyJhbGciOiJBMTI4S1ciLCJlbmMiOiJBMTI4R0NNIn0.W0UF9VOfzfOOjT37CbZCFish3RB19BSo.qK-C1e69nDc4kokl.cZE8I-O3f151FCs-8yHwScmTl5Hv3GVP2jVFJb5Jg09On4l1FAdDGD7MHUybFgfztL28p4KcpHKzXA2gIzNQnl2VTyVDcqHje6DAEjQFLI7eP2YRDw1CJtXhEr_7-p0-Nwwnr3yKWXIYOPmUdclep1IkAagFGgj85v_2Wslf4PFAip98JadVkkXSg9quJrSa_lC60HiXw2D-bsNdUBtFJFNrRqXA1icKHSgrZOuAUwYvV1ZMVnFdeYNnPzH4dg96bu-b8tNGA-_2sVhyQA.mAfgALE6kLkv7VXU_CgKxA; token=eyJhbGciOiJIUzI1NiJ9.eyJvd25lciI6Mjg5OCwic2VjcmV0IjoiZjU2NzgxZDQ2ZDA1YzcwYzc5NzVmMGRjNjhjMDY4NGUiLCJzZXJ2aWNlIjoiU3RlYW0ifQ.j7klb20YZF-tF01llj7ZGauL_DOWQIZiTldYc-hH59Q\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=6\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 404 \r\nserver: openresty\r\ndate: Tue, 11 Aug 2026 11:43:52 GMT\r\ncontent-type: application/json; charset=utf-8\r\ncontent-length: 65\r\ncontent-security-policy: frame-ancestors *\r\ncross-origin-opener-policy: same-origin\r\ncross-origin-resource-policy: same-origin\r\netag: W/\"41-0AeMVzV1pApYTMktTMxeiuYqqUg\"\r\norigin-agent-cluster: ?1\r\nreferrer-policy: no-referrer\r\nstrict-transport-security: max-age=15552000; includeSubDomains\r\nx-content-type-options: nosniff\r\nx-dns-prefetch-control: off\r\nx-download-options: noopen\r\nx-frame-options: ALLOWALL\r\nx-permitted-cross-domain-policies: none\r\nx-xss-protection: 0\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"404","status_text":"","fingerprints":[{"name":"OpenResty","description":"OpenResty is a web platform based on nginx which can run Lua scripts using its LuaJIT engine.","website":"https://openresty.org","common_platform_enumeration":"","icon":"OpenResty.svg","categories":["Web servers"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":65,"size_decoded":692,"mime_type":"application/json; charset=utf-8","magic":"JSON text data","md5":"6688d59f1d0b9e116ceca1708a113d0d","sha1":"d0078c573575a40a584cc92d4ccc5e8ae62aa948","sha256":"cacc3c09d432702d237265c156358a0430dd08938afbceaf4a444d26340b25e8","sha512":"116612441c802eae5cdfa4441c5757ee48298f865e1ff4e164ae1ba9ab2a0856c7e2e5c023864eee6963eda1bb89d6edcc7951c4b566eca2aac989a66ef510a4","ssdeep":"","tlshash":"b4a0020c084b7aad4f52c4bd75cd7d3488564ac015a119615189d438825464e8845588","first_seen":"2024-08-02T16:52:12Z","last_seen":"2026-08-11T11:44:26.071285Z","times_seen":1829,"resource_available":true,"data":null}},"time_used":133,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":133,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-08-11","alert":"Sinkholed","trigger":"vip-upgrader.cfd","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"vip-upgrader.cfd/224c7856750007535310635c1752730c595f5e52","fqdn":"vip-upgrader.cfd","domain":"vip-upgrader.cfd","tld":"cfd"},"ip":{"addr":"192.162.199.140","port":443,"asn":216271,"as":"Netlabs LLC","country":"Germany","country_code":"DE"},"is_navigation_request":false,"resource_type":"fetch","requested_by":"https://vip-upgrader.cfd/224c7856750007","date":"2026-08-11T11:43:52.494Z","timestamp":1786448632494,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"vip-upgrader.cfd","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Tue, 28 Jul 2026 07:23:55 GMT","end":"Mon, 26 Oct 2026 07:23:54 GMT"},"fingerprint":{"sha1":"1A:A5:C7:D9:11:ED:10:56:4F:86:BF:88:BD:71:1B:EF:C7:61:B7:CC","sha256":"4E:E0:E5:84:32:A2:4F:29:80:0D:D9:FD:0A:10:6A:AF:7F:05:BF:3E:22:36:70:A9:C0:2D:41:E9:B6:6E:A5:8C"}}},"request":{"raw":"GET /224c7856750007535310635c1752730c595f5e52 HTTP/1.1\r\nHost: vip-upgrader.cfd\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nCookie: session=eyJhbGciOiJBMTI4S1ciLCJlbmMiOiJBMTI4R0NNIn0.W0UF9VOfzfOOjT37CbZCFish3RB19BSo.qK-C1e69nDc4kokl.cZE8I-O3f151FCs-8yHwScmTl5Hv3GVP2jVFJb5Jg09On4l1FAdDGD7MHUybFgfztL28p4KcpHKzXA2gIzNQnl2VTyVDcqHje6DAEjQFLI7eP2YRDw1CJtXhEr_7-p0-Nwwnr3yKWXIYOPmUdclep1IkAagFGgj85v_2Wslf4PFAip98JadVkkXSg9quJrSa_lC60HiXw2D-bsNdUBtFJFNrRqXA1icKHSgrZOuAUwYvV1ZMVnFdeYNnPzH4dg96bu-b8tNGA-_2sVhyQA.mAfgALE6kLkv7VXU_CgKxA; token=eyJhbGciOiJIUzI1NiJ9.eyJvd25lciI6Mjg5OCwic2VjcmV0IjoiZjU2NzgxZDQ2ZDA1YzcwYzc5NzVmMGRjNjhjMDY4NGUiLCJzZXJ2aWNlIjoiU3RlYW0ifQ.j7klb20YZF-tF01llj7ZGauL_DOWQIZiTldYc-hH59Q\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=4\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nserver: openresty\r\ndate: Tue, 11 Aug 2026 11:43:52 GMT\r\ncontent-type: application/json; charset=utf-8\r\ncontent-length: 291\r\ncontent-security-policy: frame-ancestors *\r\ncross-origin-opener-policy: same-origin\r\ncross-origin-resource-policy: same-origin\r\netag: W/\"123-Y+TJyH9G68uA+GgovrFLCi9O6SQ\"\r\norigin-agent-cluster: ?1\r\nreferrer-policy: no-referrer\r\nstrict-transport-security: max-age=15552000; includeSubDomains\r\nx-content-type-options: nosniff\r\nx-dns-prefetch-control: off\r\nx-download-options: noopen\r\nx-frame-options: ALLOWALL\r\nx-permitted-cross-domain-policies: none\r\nx-xss-protection: 0\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"OpenResty","description":"OpenResty is a web platform based on nginx which can run Lua scripts using its LuaJIT engine.","website":"https://openresty.org","common_platform_enumeration":"","icon":"OpenResty.svg","categories":["Web servers"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":291,"size_decoded":920,"mime_type":"application/json; charset=utf-8","magic":"JSON text data","md5":"b3d66bdc3c085385865e23d368b79cfc","sha1":"63e4c9c87f46ebcb80f86828beb14b0a2f4ee924","sha256":"a8454fab2325b2777da1592738767969a3ce0b26a441339b30eadf29332cb485","sha512":"fb544fd0094e1140283e4683e84d4e2b2b1eec8d8f59d614aaeea71de045da65d2b57be4534131e9ce455f82fd71fd35ade153c18b4526643a02f2df29ea89c3","ssdeep":"","tlshash":"b3d0c212056ca43ada409204000b3f0a96bd162305c4b91ea5ac8b2299fc6db6455d6f","first_seen":"2026-08-11T11:44:26.072055Z","last_seen":"2026-08-11T11:44:26.072055Z","times_seen":1,"resource_available":false,"data":null}},"time_used":46,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":46,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-08-11","alert":"Sinkholed","trigger":"vip-upgrader.cfd","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"vip-upgrader.cfd/224c785675000744570355630a445917","fqdn":"vip-upgrader.cfd","domain":"vip-upgrader.cfd","tld":"cfd"},"ip":{"addr":"192.162.199.140","port":443,"asn":216271,"as":"Netlabs LLC","country":"Germany","country_code":"DE"},"is_navigation_request":false,"resource_type":"fetch","requested_by":"https://vip-upgrader.cfd/224c7856750007","date":"2026-08-11T11:43:56.596Z","timestamp":1786448636596,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"vip-upgrader.cfd","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Tue, 28 Jul 2026 07:23:55 GMT","end":"Mon, 26 Oct 2026 07:23:54 GMT"},"fingerprint":{"sha1":"1A:A5:C7:D9:11:ED:10:56:4F:86:BF:88:BD:71:1B:EF:C7:61:B7:CC","sha256":"4E:E0:E5:84:32:A2:4F:29:80:0D:D9:FD:0A:10:6A:AF:7F:05:BF:3E:22:36:70:A9:C0:2D:41:E9:B6:6E:A5:8C"}}},"request":{"raw":"POST /224c785675000744570355630a445917 HTTP/1.1\r\nHost: vip-upgrader.cfd\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nOrigin: https://vip-upgrader.cfd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nCookie: session=eyJhbGciOiJBMTI4S1ciLCJlbmMiOiJBMTI4R0NNIn0.W0UF9VOfzfOOjT37CbZCFish3RB19BSo.qK-C1e69nDc4kokl.cZE8I-O3f151FCs-8yHwScmTl5Hv3GVP2jVFJb5Jg09On4l1FAdDGD7MHUybFgfztL28p4KcpHKzXA2gIzNQnl2VTyVDcqHje6DAEjQFLI7eP2YRDw1CJtXhEr_7-p0-Nwwnr3yKWXIYOPmUdclep1IkAagFGgj85v_2Wslf4PFAip98JadVkkXSg9quJrSa_lC60HiXw2D-bsNdUBtFJFNrRqXA1icKHSgrZOuAUwYvV1ZMVnFdeYNnPzH4dg96bu-b8tNGA-_2sVhyQA.mAfgALE6kLkv7VXU_CgKxA; token=eyJhbGciOiJIUzI1NiJ9.eyJvd25lciI6Mjg5OCwic2VjcmV0IjoiZjU2NzgxZDQ2ZDA1YzcwYzc5NzVmMGRjNjhjMDY4NGUiLCJzZXJ2aWNlIjoiU3RlYW0ifQ.j7klb20YZF-tF01llj7ZGauL_DOWQIZiTldYc-hH59Q\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=4\r\nPragma: no-cache\r\nCache-Control: no-cache\r\nContent-Length: 0\r\n\r\n","headers":null,"cookies":null,"method":"POST"},"response":{"raw":"HTTP/2 201 \r\nserver: openresty\r\ndate: Tue, 11 Aug 2026 11:43:56 GMT\r\ncontent-type: application/json; charset=utf-8\r\ncontent-length: 16\r\ncontent-security-policy: frame-ancestors *\r\ncross-origin-opener-policy: same-origin\r\ncross-origin-resource-policy: same-origin\r\netag: W/\"10-oV4hJxRVSENxc/wX8+mA4/Pe4tA\"\r\norigin-agent-cluster: ?1\r\nreferrer-policy: no-referrer\r\nstrict-transport-security: max-age=15552000; includeSubDomains\r\nx-content-type-options: nosniff\r\nx-dns-prefetch-control: off\r\nx-download-options: noopen\r\nx-frame-options: ALLOWALL\r\nx-permitted-cross-domain-policies: none\r\nx-xss-protection: 0\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"201","status_text":"","fingerprints":[{"name":"OpenResty","description":"OpenResty is a web platform based on nginx which can run Lua scripts using its LuaJIT engine.","website":"https://openresty.org","common_platform_enumeration":"","icon":"OpenResty.svg","categories":["Web servers"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":16,"size_decoded":643,"mime_type":"application/json; charset=utf-8","magic":"JSON text data","md5":"7363e85fe9edee6f053a4b319588c086","sha1":"a15e2127145548437173fc17f3e980e3f3dee2d0","sha256":"c955e57777ec0d73639dca6748560d00aa5eb8e12f13ebb2ed9656add3908f97","sha512":"a2fd24056e3ec2f1628f89eb2f1b36a9fc2437ae58d34190630fe065df2bbedaf9bd8aee5f8949a002070052ca68cc6c0167214dd55df289783cff682b808d85","ssdeep":"","tlshash":"f0600003000000a2c000220002382e202080002280000008800c20088a20000208300a","first_seen":"2023-04-05T04:17:27Z","last_seen":"2026-08-11T18:56:41.279753Z","times_seen":181468,"resource_available":false,"data":null}},"time_used":58,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":58,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-08-11","alert":"Sinkholed","trigger":"vip-upgrader.cfd","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"vip-upgrader.cfd/224c7856750007","fqdn":"vip-upgrader.cfd","domain":"vip-upgrader.cfd","tld":"cfd"},"ip":{"addr":"192.162.199.140","port":443,"asn":216271,"as":"Netlabs LLC","country":"Germany","country_code":"DE"},"is_navigation_request":false,"resource_type":"subdocument","requested_by":"https://vip-upgrader.cfd/","date":"2026-08-11T11:43:51.958Z","timestamp":1786448631958,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"vip-upgrader.cfd","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Tue, 28 Jul 2026 07:23:55 GMT","end":"Mon, 26 Oct 2026 07:23:54 GMT"},"fingerprint":{"sha1":"1A:A5:C7:D9:11:ED:10:56:4F:86:BF:88:BD:71:1B:EF:C7:61:B7:CC","sha256":"4E:E0:E5:84:32:A2:4F:29:80:0D:D9:FD:0A:10:6A:AF:7F:05:BF:3E:22:36:70:A9:C0:2D:41:E9:B6:6E:A5:8C"}}},"request":{"raw":"POST /224c7856750007 HTTP/1.1\r\nHost: vip-upgrader.cfd\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nContent-Type: application/x-www-form-urlencoded\r\nContent-Length: 46\r\nOrigin: null\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nCookie: session=eyJhbGciOiJBMTI4S1ciLCJlbmMiOiJBMTI4R0NNIn0.W0UF9VOfzfOOjT37CbZCFish3RB19BSo.qK-C1e69nDc4kokl.cZE8I-O3f151FCs-8yHwScmTl5Hv3GVP2jVFJb5Jg09On4l1FAdDGD7MHUybFgfztL28p4KcpHKzXA2gIzNQnl2VTyVDcqHje6DAEjQFLI7eP2YRDw1CJtXhEr_7-p0-Nwwnr3yKWXIYOPmUdclep1IkAagFGgj85v_2Wslf4PFAip98JadVkkXSg9quJrSa_lC60HiXw2D-bsNdUBtFJFNrRqXA1icKHSgrZOuAUwYvV1ZMVnFdeYNnPzH4dg96bu-b8tNGA-_2sVhyQA.mAfgALE6kLkv7VXU_CgKxA; token=eyJhbGciOiJIUzI1NiJ9.eyJvd25lciI6Mjg5OCwic2VjcmV0IjoiZjU2NzgxZDQ2ZDA1YzcwYzc5NzVmMGRjNjhjMDY4NGUiLCJzZXJ2aWNlIjoiU3RlYW0ifQ.j7klb20YZF-tF01llj7ZGauL_DOWQIZiTldYc-hH59Q\r\nUpgrade-Insecure-Requests: 1\r\nSec-Fetch-Dest: iframe\r\nSec-Fetch-Mode: navigate\r\nSec-Fetch-Site: same-origin\r\nPriority: u=4\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"POST","post_data":{"size":46,"data":"pathname=%2F\u0026search=\u0026hostname=vip-upgrader.cfd"}},"response":{"raw":"HTTP/2 200 \r\nserver: openresty\r\ndate: Tue, 11 Aug 2026 11:43:52 GMT\r\ncontent-type: text/html; charset=utf-8\r\nvary: Accept-Encoding\r\ncache-control: public, max-age=60, s-maxage=0\r\ncontent-security-policy: frame-ancestors *\r\ncross-origin-opener-policy: same-origin\r\ncross-origin-resource-policy: same-origin\r\netag: W/\"2f7639-j/u2YCgV0TBigBTI9hCD/60XUs0\"\r\norigin-agent-cluster: ?1\r\nreferrer-policy: no-referrer\r\nstrict-transport-security: max-age=15552000; includeSubDomains\r\nx-content-type-options: nosniff\r\nx-dns-prefetch-control: off\r\nx-download-options: noopen\r\nx-frame-options: ALLOWALL\r\nx-permitted-cross-domain-policies: none\r\nx-xss-protection: 0\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"OpenResty","description":"OpenResty is a web platform based on nginx which can run Lua scripts using its LuaJIT engine.","website":"https://openresty.org","common_platform_enumeration":"","icon":"OpenResty.svg","categories":["Web servers"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":3110457,"size_decoded":2277594,"mime_type":"text/html; charset=utf-8","magic":"HTML document, ASCII text, with very long lines (34670)","md5":"0c83d590f19f41dfb5b32dbe23af7430","sha1":"6fbcfbe8093309356141342b977034f3c971fdbb","sha256":"7c7cce4934d401088e2254286e7ad1fab343d8cc71a9f799f6b6d74808607453","sha512":"4a5916fa47e30dbda60732fb9c4e502907d1f403419bf1c3a3889413b86c015927c7fe61d41e134989e4a5f2c0b2fe57adf80f258971669bad65168a510fcd4f","ssdeep":"12288:dVyvXOBmreW52fWVW5AwVyvPNB0reWS2fWVW5ATVyv3ABSreWH2fWVW5AOVyvvfB:nAFEeW5A16OEeW5AzkjEeW5AN/","tlshash":"a32522b814ac18af1899cc95d2542f2edf7d3fa3a841c1ee1fd909d267c9c48d912e8d","first_seen":"2026-08-11T11:44:26.074197Z","last_seen":"2026-08-11T11:44:26.074197Z","times_seen":1,"resource_available":false,"data":null}},"time_used":73,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":73,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-08-11","alert":"Sinkholed","trigger":"vip-upgrader.cfd","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"s3.upgrader.vip/cdn/fa/images/header/logo.svg","fqdn":"s3.upgrader.vip","domain":"upgrader.vip","tld":"vip"},"ip":{"addr":"45.199.188.12","port":443,"asn":0,"as":"","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://vip-upgrader.cfd/224c7856750007","date":"2026-08-11T11:43:52.485Z","timestamp":1786448632485,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.2","cert":{"subject":{"commonName":"upgrader.vip","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Sun, 14 Jun 2026 14:33:27 GMT","end":"Sat, 12 Sep 2026 15:33:25 GMT"},"fingerprint":{"sha1":"91:7B:32:A4:36:74:77:3C:DE:2D:CE:AA:B4:E9:A8:E0:0F:65:6A:33","sha256":"0C:4A:03:36:1B:CF:E5:2C:B6:04:0B:84:61:46:D9:D9:86:1B:9F:A5:39:8B:B8:62:0F:23:38:F8:DB:FB:41:2B"}}},"request":{"raw":"GET /cdn/fa/images/header/logo.svg HTTP/1.1\r\nHost: s3.upgrader.vip\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-Fetch-Storage-Access: none\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPriority: u=4, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\ndate: Tue, 11 Aug 2026 11:43:52 GMT\r\ncontent-type: image/svg+xml\r\ncf-ray: a296fc312dc256ca-OSL\r\ncf-cache-status: HIT\r\nx-s3-cache: HIT\r\naccess-control-allow-origin: *\r\nage: 285646\r\ncache-control: public, max-age=2592000, immutable\r\nserver: cloudflare\r\nexpires: Wed, 11 Aug 2027 11:43:52 GMT\r\nlast-modified: Mon, 01 Jun 2026 10:47:34 GMT\r\netag: W/\"4cedd036f0e488318146147f8128e948\"\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":680,"size_decoded":842,"mime_type":"image/svg+xml","magic":"SVG Scalable Vector Graphics image","md5":"4cedd036f0e488318146147f8128e948","sha1":"ea753c11253fb32ed42d56495ea5a152639dd796","sha256":"c447570be6e164d726f79a9924f9ae3eab5a95b2c451db0ada4ab20184056b3a","sha512":"2dbee7ac8d588f8186c81b5cfa986b7920490dc48f8d761d04fa4659b561ce7a77f197d7cf07580dc994cd14b1bff2af69c200718e852a558447c5df26c3f09a","ssdeep":"","tlshash":"8401fe76865d9c27d10a813c8528a8b7300620e5bdc58150d0e8bf2f381d4d6681e6e6","first_seen":"2026-02-21T20:24:00.112213Z","last_seen":"2026-08-11T11:44:26.075206Z","times_seen":28,"resource_available":false,"data":null}},"time_used":40,"timings":{"blocked":-1,"dns":4,"connect":1,"send":0,"wait":21,"receive":0,"ssl":13},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-08-11","alert":"Sinkholed","trigger":"s3.upgrader.vip","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-08-11","alert":"Sinkholed","trigger":"s3.upgrader.vip","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"vip-upgrader.cfd/","fqdn":"vip-upgrader.cfd","domain":"vip-upgrader.cfd","tld":"cfd"},"ip":{"addr":"192.162.199.140","port":443,"asn":216271,"as":"Netlabs LLC","country":"Germany","country_code":"DE"},"is_navigation_request":true,"resource_type":"document","requested_by":"","date":"2026-08-11T11:43:51.523Z","timestamp":1786448631523,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"vip-upgrader.cfd","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Tue, 28 Jul 2026 07:23:55 GMT","end":"Mon, 26 Oct 2026 07:23:54 GMT"},"fingerprint":{"sha1":"1A:A5:C7:D9:11:ED:10:56:4F:86:BF:88:BD:71:1B:EF:C7:61:B7:CC","sha256":"4E:E0:E5:84:32:A2:4F:29:80:0D:D9:FD:0A:10:6A:AF:7F:05:BF:3E:22:36:70:A9:C0:2D:41:E9:B6:6E:A5:8C"}}},"request":{"raw":"GET / HTTP/1.1\r\nHost: vip-upgrader.cfd\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nUpgrade-Insecure-Requests: 1\r\nSec-Fetch-Dest: document\r\nSec-Fetch-Mode: navigate\r\nSec-Fetch-Site: none\r\nPriority: u=0, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nserver: openresty\r\ndate: Tue, 11 Aug 2026 11:43:51 GMT\r\ncontent-type: text/html; charset=utf-8\r\nvary: Accept-Encoding\r\ncache-control: public, max-age=60, s-maxage=60, stale-while-revalidate=30\r\ncontent-security-policy: frame-ancestors *\r\ncross-origin-opener-policy: same-origin\r\ncross-origin-resource-policy: same-origin\r\netag: W/\"b678-Lk7jQGyOw2QS/cuOQjTyPz5gTJU\"\r\norigin-agent-cluster: ?1\r\nreferrer-policy: no-referrer\r\nset-cookie: session=eyJhbGciOiJBMTI4S1ciLCJlbmMiOiJBMTI4R0NNIn0.W0UF9VOfzfOOjT37CbZCFish3RB19BSo.qK-C1e69nDc4kokl.cZE8I-O3f151FCs-8yHwScmTl5Hv3GVP2jVFJb5Jg09On4l1FAdDGD7MHUybFgfztL28p4KcpHKzXA2gIzNQnl2VTyVDcqHje6DAEjQFLI7eP2YRDw1CJtXhEr_7-p0-Nwwnr3yKWXIYOPmUdclep1IkAagFGgj85v_2Wslf4PFAip98JadVkkXSg9quJrSa_lC60HiXw2D-bsNdUBtFJFNrRqXA1icKHSgrZOuAUwYvV1ZMVnFdeYNnPzH4dg96bu-b8tNGA-_2sVhyQA.mAfgALE6kLkv7VXU_CgKxA; Max-Age=21600; Path=/; Expires=Tue, 11 Aug 2026 17:43:51 GMT; SameSite=Lax\ntoken=eyJhbGciOiJIUzI1NiJ9.eyJvd25lciI6Mjg5OCwic2VjcmV0IjoiZjU2NzgxZDQ2ZDA1YzcwYzc5NzVmMGRjNjhjMDY4NGUiLCJzZXJ2aWNlIjoiU3RlYW0ifQ.j7klb20YZF-tF01llj7ZGauL_DOWQIZiTldYc-hH59Q; Max-Age=21600; Path=/; Expires=Tue, 11 Aug 2026 17:43:51 GMT; SameSite=Lax\r\nstrict-transport-security: max-age=15552000; includeSubDomains\r\nx-content-type-options: nosniff\r\nx-dns-prefetch-control: off\r\nx-download-options: noopen\r\nx-frame-options: ALLOWALL\r\nx-permitted-cross-domain-policies: none\r\nx-xss-protection: 0\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"OpenResty","description":"OpenResty is a web platform based on nginx which can run Lua scripts using its LuaJIT engine.","website":"https://openresty.org","common_platform_enumeration":"","icon":"OpenResty.svg","categories":["Web servers"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":46712,"size_decoded":16188,"mime_type":"text/html; charset=utf-8","magic":"HTML document, ASCII text, with very long lines (46236)","md5":"1fa7eac1604df118673d9c9d44a9c016","sha1":"2e4ee3406c8ec36412fdcb8e4234f23f3e604c95","sha256":"db9b9f766223666239af665fcf311764fc37a0da20198932900d6fd6eb897049","sha512":"5fa325205d7bfe37230ce413d99174110f7004a06ddfa4d111d4b89b3062c9c91cde5f460a5f4ff01d4afbd73d1312095ec9093dc0ba7ebbe7edf090ced653d5","ssdeep":"768:sdprIn1ifn8nxonU0R7tDfol8Qlcx9ftMQ9OMl2t9kWbSjY99aNNjK:sLrI1kK7cNjK","tlshash":"fb234e97a9c2b2d3f191e62cec3712bc955d3891db965409942c35a0b8fcf80f7c2b69","first_seen":"2026-08-11T11:37:36.815647Z","last_seen":"2026-08-11T11:44:26.075736Z","times_seen":2,"resource_available":false,"data":null}},"time_used":232,"timings":{"blocked":-1,"dns":90,"connect":34,"send":0,"wait":68,"receive":0,"ssl":39},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-08-11","alert":"Sinkholed","trigger":"vip-upgrader.cfd","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"vip-upgrader.cfd/224c78567500075d5800554d.js","fqdn":"vip-upgrader.cfd","domain":"vip-upgrader.cfd","tld":"cfd"},"ip":{"addr":"192.162.199.140","port":443,"asn":216271,"as":"Netlabs LLC","country":"Germany","country_code":"DE"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://vip-upgrader.cfd/224c7856750007","date":"2026-08-11T11:43:52.049Z","timestamp":1786448632049,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"vip-upgrader.cfd","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Tue, 28 Jul 2026 07:23:55 GMT","end":"Mon, 26 Oct 2026 07:23:54 GMT"},"fingerprint":{"sha1":"1A:A5:C7:D9:11:ED:10:56:4F:86:BF:88:BD:71:1B:EF:C7:61:B7:CC","sha256":"4E:E0:E5:84:32:A2:4F:29:80:0D:D9:FD:0A:10:6A:AF:7F:05:BF:3E:22:36:70:A9:C0:2D:41:E9:B6:6E:A5:8C"}}},"request":{"raw":"GET /224c78567500075d5800554d.js HTTP/1.1\r\nHost: vip-upgrader.cfd\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nCookie: session=eyJhbGciOiJBMTI4S1ciLCJlbmMiOiJBMTI4R0NNIn0.W0UF9VOfzfOOjT37CbZCFish3RB19BSo.qK-C1e69nDc4kokl.cZE8I-O3f151FCs-8yHwScmTl5Hv3GVP2jVFJb5Jg09On4l1FAdDGD7MHUybFgfztL28p4KcpHKzXA2gIzNQnl2VTyVDcqHje6DAEjQFLI7eP2YRDw1CJtXhEr_7-p0-Nwwnr3yKWXIYOPmUdclep1IkAagFGgj85v_2Wslf4PFAip98JadVkkXSg9quJrSa_lC60HiXw2D-bsNdUBtFJFNrRqXA1icKHSgrZOuAUwYvV1ZMVnFdeYNnPzH4dg96bu-b8tNGA-_2sVhyQA.mAfgALE6kLkv7VXU_CgKxA; token=eyJhbGciOiJIUzI1NiJ9.eyJvd25lciI6Mjg5OCwic2VjcmV0IjoiZjU2NzgxZDQ2ZDA1YzcwYzc5NzVmMGRjNjhjMDY4NGUiLCJzZXJ2aWNlIjoiU3RlYW0ifQ.j7klb20YZF-tF01llj7ZGauL_DOWQIZiTldYc-hH59Q\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nserver: openresty\r\ndate: Tue, 11 Aug 2026 11:43:52 GMT\r\ncontent-type: application/javascript\r\nvary: Accept-Encoding\r\ncontent-disposition: inline\r\ncontent-security-policy: frame-ancestors *\r\ncross-origin-opener-policy: same-origin\r\ncross-origin-resource-policy: same-origin\r\nlast-modified: Sun, 02 Aug 2026 16:22:13 GMT\r\norigin-agent-cluster: ?1\r\nreferrer-policy: no-referrer\r\nstrict-transport-security: max-age=15552000; includeSubDomains\r\nx-content-type-options: nosniff\r\nx-dns-prefetch-control: off\r\nx-download-options: noopen\r\nx-frame-options: ALLOWALL\r\nx-permitted-cross-domain-policies: none\r\nx-xss-protection: 0\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"OpenResty","description":"OpenResty is a web platform based on nginx which can run Lua scripts using its LuaJIT engine.","website":"https://openresty.org","common_platform_enumeration":"","icon":"OpenResty.svg","categories":["Web servers"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":260282,"size_decoded":85622,"mime_type":"application/javascript","magic":"JavaScript source, ASCII text, with very long lines (65536), with no line terminators","md5":"ca44472bb63ed5b9536188c1e7250834","sha1":"49f68bde8f9a705cd6a213f99fd1fe9068713f90","sha256":"2d8960006ff583db4bb4dadfe765dc090e723d6ee076ffcdc781fecba2f3ea8b","sha512":"22d5b603744549d96758f401d7e254ef74654ef0a077087a71a6238f076dc8d4c372e10e894b3ebb534f5773e40d8d6fc1fdfadec0182e5592f0ec7c0c99c7a9","ssdeep":"6144:A2dRfP9UYcfQaUqVUNRG1kSlCpqnw4/P9F8JRPaV:9RfP9UYcfQaU+UPsCb4/P9F8JFaV","tlshash":"074484406bd0a86c239b5b7a731fb0e5f46a096f3d88498bd101fc90a6e6217fdf9531","first_seen":"2026-08-06T00:07:04.322113Z","last_seen":"2026-08-11T11:44:26.076416Z","times_seen":12,"resource_available":true,"data":null}},"time_used":121,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":121,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-08-11","alert":"Sinkholed","trigger":"vip-upgrader.cfd","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}}]}