{"report_id":"82a20969-7d03-4a10-9f92-0d3dad0f263c","version":0,"status":"done","tags":[],"date":"2026-10-05T00:38:55Z","url":{"schema":"http","addr":"johnclaim.com/","fqdn":"johnclaim.com","domain":"johnclaim.com","tld":"com"},"ip":{"addr":"185.66.143.30","port":0,"asn":200514,"as":"KnownSRV Ltd.","country":"Croatia","country_code":"HR"},"final":{"url":{"schema":"https","addr":"johnclaim.com/","fqdn":"johnclaim.com","domain":"johnclaim.com","tld":"com"},"title":"John Lewis Gift Card - Claim Your £750 Reward","dom":{"size":5136,"mime_type":"text/html; charset=utf-8","magic":"HTML document, Unicode text, UTF-8 text","md5":"e06008419db4c8f652d7fa53399dae64","sha1":"7109cd245f5784ec4dae1fdef605bd239d69272d","sha256":"21e076b3bce0246c02faa6b349e07f78c408a79e8defdb2fefde8b3af6ba236c","sha512":"e5d24da98754fa8bd6d8050eeb65efac8f2f93a23cc435e9794f53651ee5d3955dad530a7b1ee6a24fee51e6181a2ba570b3786fc5108a263433fc0a953befbb","ssdeep":"96:svHoMdupa4kRZep3mTmTmTmiZfavbO8m3v:svHoWupa4kRdDr","tlshash":"e2b1e078d4f9163b019783c1aa9267a72ff1940fdb8a411572bc07a41fe6ecad853168","dom_hash":"domhash2d6b16bcc1ec633db0d4e87e07546518","first_seen":"2026-10-05T00:37:29.10464Z","last_seen":"2026-10-05T00:38:56.292364Z","times_seen":2,"resource_available":false,"data":null}},"submit":{"url":{"schema":"http","addr":"johnclaim.com/","fqdn":"johnclaim.com","domain":"johnclaim.com","tld":"com"},"ip":{"addr":"185.66.143.30","port":0,"asn":200514,"as":"KnownSRV Ltd.","country":"Croatia","country_code":"HR"},"tags":null,"meta":null},"settings":{"access":"public","device_type":"desktop","expires_at":"2027-11-09T00:38:55Z","useragent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0","referer":"","cookies":null,"exit_node":"qguvgzjxzsgb3vs"},"stats":{"alert_count":{"ids":0,"urlquery":0,"analyzer":1}},"detection":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-10-05","alert":"Sinkholed","trigger":"johnclaim.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null},"summary":[{"fqdn":"johnclaim.com","ip":{"addr":"185.66.143.30","port":443,"asn":200514,"as":"KnownSRV Ltd.","country":"Belize","country_code":"BZ"},"domain_registered":"2026-03-10","domain_rank":0,"first_seen":"2026-10-05T00:37:25.296088Z","last_seen":"2026-10-05T00:37:25.296088Z","alert_count":4,"request_count":4,"received_data":14515,"sent_data":1852,"comment":"","tags":null,"fingerprints":[{"name":"LiteSpeed","description":"LiteSpeed is a high-scalability web server.","website":"https://litespeedtech.com","common_platform_enumeration":"cpe:2.3:a:litespeedtech:litespeed_web_server:*:*:*:*:*:*:*:*","icon":"LiteSpeed.svg","categories":["Web servers"]}]}],"files":null,"artifacts":{"windows_shortcuts":null,"files":null,"telegram":null,"pdfs":null,"clipboard":null},"sensors":{"ids":null,"analyzer":null,"urlquery":null},"javascript":{"script":[{"url":{"schema":"https","addr":"johnclaim.com/main.js","fqdn":"johnclaim.com","domain":"johnclaim.com","tld":"com"},"ip":{"addr":"185.66.143.30","port":443,"asn":200514,"as":"KnownSRV Ltd.","country":"Belize","country_code":"BZ"},"introduction_type":"scriptElement","is_inline":false,"md5":"2b1d6ed1f03b994ee0845db311dcc2ba","sha1":"be82cbca4e9e6832348c71089b0002385a7ab060","sha256":"112082f22843e2037782ffdd8a93cde153d1dfbea752c665a90b0f13c2f62c73","sha512":"1a9ef8d52942eaa9d2e7fdbade5e1f9ef98bbbf25a976031a8c13fa5bedf53249a53a8f81732e8debb4d5a556949df5bdddcad46a0b74846262b907944a4e613","ssdeep":"","tlshash":"8721027407f81130002b922f32f9d7c63a7d815fb2916a0e732e498c1a94cb467e98f3","size":1221,"data":"","first_seen":"2026-04-05T11:19:39.331882Z","last_seen":"2026-10-05T00:38:56.295999Z","times_seen":3,"alerts":{"ids":null,"analyzer":null,"urlquery":null}}],"eval":null,"write":null,"console":null},"http":[{"url":{"schema":"https","addr":"johnclaim.com/favicon.ico","fqdn":"johnclaim.com","domain":"johnclaim.com","tld":"com"},"ip":{"addr":"185.66.143.30","port":443,"asn":200514,"as":"KnownSRV Ltd.","country":"Belize","country_code":"BZ"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://johnclaim.com/","date":"2026-10-05T00:38:26.718Z","timestamp":1791160706718,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"johnclaim.com","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Sat, 12 Sep 2026 15:06:08 GMT","end":"Fri, 11 Dec 2026 15:06:07 GMT"},"fingerprint":{"sha1":"2E:0C:D9:42:53:2C:D2:BA:28:F0:AB:E3:D5:95:54:7E:88:CA:84:55","sha256":"17:15:FE:D1:5E:A7:AD:D5:AC:A0:C8:BC:72:62:5C:EA:D1:A3:22:2E:0B:A2:75:EE:39:AB:66:A1:9D:03:0B:41"}}},"request":{"raw":"GET /favicon.ico HTTP/1.1\r\nHost: johnclaim.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://johnclaim.com/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=6\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 404 \r\ncache-control: private, no-cache, no-store, must-revalidate, max-age=0\r\npragma: no-cache\r\ncontent-type: text/html\r\ncontent-length: 1251\r\ndate: Mon, 05 Oct 2026 00:38:26 GMT\r\nserver: LiteSpeed\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"404","status_text":"Not Found","fingerprints":[{"name":"LiteSpeed","description":"LiteSpeed is a high-scalability web server.","website":"https://litespeedtech.com","common_platform_enumeration":"cpe:2.3:a:litespeedtech:litespeed_web_server:*:*:*:*:*:*:*:*","icon":"LiteSpeed.svg","categories":["Web servers"]}],"data":{"size":1251,"size_decoded":1479,"mime_type":"text/html","magic":"HTML document, ASCII text, with CRLF, LF line terminators","md5":"8150f458ed6fb9b1db4e5cfa57a1a281","sha1":"6e5726854d28687b560d7fdcb5c782c425c7dfb9","sha256":"4c13d452dd5d49671bd93ca32f2b4f85c78e39b6ab0ad1f38d98ed267f8fd896","sha512":"4cc6a112673aef8bb8bb8a385c26791b805d43bb707b509880e894f1c83bab4e16f13de187036c5f660c3bec1d286258396b7bde65c5d7945c5019665196818c","ssdeep":"","tlshash":"c021353ec1c1560ae0271164fbc1f7a86669825291970f703b9eb176f6cd0bb56a36c8","first_seen":"2024-02-08T16:48:55Z","last_seen":"2026-10-05T02:35:01.415Z","times_seen":157717,"resource_available":true,"data":null}},"time_used":22,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":22,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-10-05","alert":"Sinkholed","trigger":"johnclaim.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"johnclaim.com/","fqdn":"johnclaim.com","domain":"johnclaim.com","tld":"com"},"ip":{"addr":"185.66.143.30","port":443,"asn":200514,"as":"KnownSRV Ltd.","country":"Belize","country_code":"BZ"},"is_navigation_request":true,"resource_type":"document","requested_by":"","date":"2026-10-05T00:38:26.336Z","timestamp":1791160706336,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"johnclaim.com","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Sat, 12 Sep 2026 15:06:08 GMT","end":"Fri, 11 Dec 2026 15:06:07 GMT"},"fingerprint":{"sha1":"2E:0C:D9:42:53:2C:D2:BA:28:F0:AB:E3:D5:95:54:7E:88:CA:84:55","sha256":"17:15:FE:D1:5E:A7:AD:D5:AC:A0:C8:BC:72:62:5C:EA:D1:A3:22:2E:0B:A2:75:EE:39:AB:66:A1:9D:03:0B:41"}}},"request":{"raw":"GET / HTTP/1.1\r\nHost: johnclaim.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nUpgrade-Insecure-Requests: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: document\r\nSec-Fetch-Mode: navigate\r\nSec-Fetch-Site: none\r\nPriority: u=0, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\ncontent-type: text/html\r\nlast-modified: Fri, 13 Mar 2026 10:54:05 GMT\r\naccept-ranges: bytes\r\ncontent-encoding: br\r\nvary: Accept-Encoding\r\ncontent-length: 1289\r\ndate: Mon, 05 Oct 2026 00:38:26 GMT\r\nserver: LiteSpeed\r\nalt-svc: h3=\":443\"; ma=2592000, h3-29=\":443\"; ma=2592000\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"LiteSpeed","description":"LiteSpeed is a high-scalability web server.","website":"https://litespeedtech.com","common_platform_enumeration":"cpe:2.3:a:litespeedtech:litespeed_web_server:*:*:*:*:*:*:*:*","icon":"LiteSpeed.svg","categories":["Web servers"]}],"data":{"size":5007,"size_decoded":1598,"mime_type":"text/html","magic":"HTML document, Unicode text, UTF-8 text","md5":"048449e0bee9cb41bdb0afcc71615bd2","sha1":"c5c8c9cb09bb45eba4a04e9d7393c3adb0723dc4","sha256":"97b1bad2353c7e1a02a315a81039c80369e102d650271c5069b7059fa1d70d02","sha512":"4f01d37705adbd61c5863559b8d56765f2f4552fb328e63697129576d04932dc1f200c42f48051f1043fbccbe913a0b65674c22d8843821847988b9efd510cc7","ssdeep":"48:vvHozJ0VpatuFS5/X8uLJ6/ypJpswIJqKmlqKmlqKmlqKmlqnZBxaBXFL/OwqKmD:vvHoopaakRZep3mTmTmTmiZfavbO8m3T","tlshash":"f6a1ffb8d4f9163b019783c1af5267a72ef1940fdb8a511172bc07a41fe6ecad85316c","first_seen":"2026-10-05T00:37:29.107328Z","last_seen":"2026-10-05T00:38:56.294232Z","times_seen":2,"resource_available":true,"data":null}},"time_used":130,"timings":{"blocked":-1,"dns":57,"connect":21,"send":0,"wait":23,"receive":0,"ssl":29},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-10-05","alert":"Sinkholed","trigger":"johnclaim.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"johnclaim.com/styles.css","fqdn":"johnclaim.com","domain":"johnclaim.com","tld":"com"},"ip":{"addr":"185.66.143.30","port":443,"asn":200514,"as":"KnownSRV Ltd.","country":"Belize","country_code":"BZ"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://johnclaim.com/","date":"2026-10-05T00:38:26.662Z","timestamp":1791160706662,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"johnclaim.com","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Sat, 12 Sep 2026 15:06:08 GMT","end":"Fri, 11 Dec 2026 15:06:07 GMT"},"fingerprint":{"sha1":"2E:0C:D9:42:53:2C:D2:BA:28:F0:AB:E3:D5:95:54:7E:88:CA:84:55","sha256":"17:15:FE:D1:5E:A7:AD:D5:AC:A0:C8:BC:72:62:5C:EA:D1:A3:22:2E:0B:A2:75:EE:39:AB:66:A1:9D:03:0B:41"}}},"request":{"raw":"GET /styles.css HTTP/1.1\r\nHost: johnclaim.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://johnclaim.com/\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=2\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\ncache-control: public, max-age=604800\r\nexpires: Mon, 12 Oct 2026 00:38:26 GMT\r\ncontent-type: text/css\r\nlast-modified: Fri, 13 Mar 2026 10:54:05 GMT\r\naccept-ranges: bytes\r\ncontent-encoding: br\r\nvary: Accept-Encoding\r\ncontent-length: 1418\r\ndate: Mon, 05 Oct 2026 00:38:26 GMT\r\nserver: LiteSpeed\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"LiteSpeed","description":"LiteSpeed is a high-scalability web server.","website":"https://litespeedtech.com","common_platform_enumeration":"cpe:2.3:a:litespeedtech:litespeed_web_server:*:*:*:*:*:*:*:*","icon":"LiteSpeed.svg","categories":["Web servers"]}],"data":{"size":5828,"size_decoded":1747,"mime_type":"text/css","magic":"ASCII text","md5":"763e82c452b060512be14a5ffcad982b","sha1":"1875f679d9679c26f8d6d15668919637620f115f","sha256":"43d7fc789fa884d71c7fa09169072671d37dc9c97d9b3172dce6dded41e82210","sha512":"0980149ba5f3592ea01e563f6b080bf083c1210ea93f943de104fb80018cc3a4b48a8e6a02e8817a47d40a1f09bda4b1bee796b630482cacf8f721500784c927","ssdeep":"96:7ZI+p+KZ0C9CpcCpcXBhC0XvCyIMxMd+efyxMmzoW+s9FGXWspLOfReL7eL14Ze1:dI+p+KpgZpcXBU0XayI+roXWxX/n9wu","tlshash":"a1c1638d6be8240af53bd80420538b9466e88419d60fd93d77dbd5acfdc52c42aa27ce","first_seen":"2026-10-05T00:37:29.109132Z","last_seen":"2026-10-05T00:38:56.295331Z","times_seen":2,"resource_available":true,"data":null}},"time_used":22,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":22,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-10-05","alert":"Sinkholed","trigger":"johnclaim.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"johnclaim.com/main.js","fqdn":"johnclaim.com","domain":"johnclaim.com","tld":"com"},"ip":{"addr":"185.66.143.30","port":443,"asn":200514,"as":"KnownSRV Ltd.","country":"Belize","country_code":"BZ"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://johnclaim.com/","date":"2026-10-05T00:38:26.663Z","timestamp":1791160706663,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"johnclaim.com","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Sat, 12 Sep 2026 15:06:08 GMT","end":"Fri, 11 Dec 2026 15:06:07 GMT"},"fingerprint":{"sha1":"2E:0C:D9:42:53:2C:D2:BA:28:F0:AB:E3:D5:95:54:7E:88:CA:84:55","sha256":"17:15:FE:D1:5E:A7:AD:D5:AC:A0:C8:BC:72:62:5C:EA:D1:A3:22:2E:0B:A2:75:EE:39:AB:66:A1:9D:03:0B:41"}}},"request":{"raw":"GET /main.js HTTP/1.1\r\nHost: johnclaim.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://johnclaim.com/\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\ncache-control: public, max-age=604800\r\nexpires: Mon, 12 Oct 2026 00:38:26 GMT\r\ncontent-type: application/javascript\r\nlast-modified: Fri, 13 Mar 2026 10:54:05 GMT\r\naccept-ranges: bytes\r\ncontent-encoding: br\r\nvary: Accept-Encoding\r\ncontent-length: 458\r\ndate: Mon, 05 Oct 2026 00:38:26 GMT\r\nserver: LiteSpeed\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"LiteSpeed","description":"LiteSpeed is a high-scalability web server.","website":"https://litespeedtech.com","common_platform_enumeration":"cpe:2.3:a:litespeedtech:litespeed_web_server:*:*:*:*:*:*:*:*","icon":"LiteSpeed.svg","categories":["Web servers"]}],"data":{"size":1221,"size_decoded":800,"mime_type":"application/javascript","magic":"ASCII text","md5":"2b1d6ed1f03b994ee0845db311dcc2ba","sha1":"be82cbca4e9e6832348c71089b0002385a7ab060","sha256":"112082f22843e2037782ffdd8a93cde153d1dfbea752c665a90b0f13c2f62c73","sha512":"1a9ef8d52942eaa9d2e7fdbade5e1f9ef98bbbf25a976031a8c13fa5bedf53249a53a8f81732e8debb4d5a556949df5bdddcad46a0b74846262b907944a4e613","ssdeep":"","tlshash":"8721027407f81130002b922f32f9d7c63a7d815fb2916a0e732e498c1a94cb467e98f3","first_seen":"2026-04-05T11:19:39.331882Z","last_seen":"2026-10-05T00:38:56.295999Z","times_seen":3,"resource_available":true,"data":null}},"time_used":21,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":21,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-10-05","alert":"Sinkholed","trigger":"johnclaim.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}}]}