{"report_id":"861f7379-dc75-4e65-a7f4-48a8f75db448","version":6,"status":"done","tags":[],"date":"2026-02-18T15:17:29Z","url":{"schema":"https","addr":"bbonkredeem.icu/","fqdn":"bbonkredeem.icu","domain":"bbonkredeem.icu","tld":"icu"},"ip":{"addr":"216.198.79.1","port":0,"asn":16509,"as":"AMAZON-02","country":"United States","country_code":"US"},"final":{"url":{"schema":"https","addr":"bbonkredeem.icu/","fqdn":"bbonkredeem.icu","domain":"bbonkredeem.icu","tld":"icu"},"title":"Deployment Unavailable","dom":{"size":1636,"mime_type":"text/html; charset=utf-8","magic":"HTML document, ASCII text, with very long lines (1636), with no line terminators","md5":"da08c36924834a9d338d4e0d7aaaa061","sha1":"58c98b2ff790a212f26e6bb532cd7302da407214","sha256":"5c585825e9400a9c00bb9de6d92773753c44988d49a731949c1348267961081b","sha512":"d8b4835b2fff73dae1069ad8117dc103dce456d010fdea6086932efa75bbfca15d2d41a92cab512123e6724257886fe558bd71b5f516ca5fd64c037c0638b140","ssdeep":"","tlshash":"fe3152b745b1702ef23b88fe34e673686244c11bc0920f99b618afb8e2c7ca65123645","dom_hash":"domhashec6cdb565b8b0f77c754672472fa9910","first_seen":"2026-02-18T15:17:29.931994Z","last_seen":"2026-02-18T15:17:29.931994Z","times_seen":1,"resource_available":false,"data":null}},"submit":{"url":{"schema":"https","addr":"bbonkredeem.icu/","fqdn":"bbonkredeem.icu","domain":"bbonkredeem.icu","tld":"icu"},"ip":{"addr":"216.198.79.1","port":0,"asn":16509,"as":"AMAZON-02","country":"United States","country_code":"US"},"tags":null,"meta":null},"settings":{"access":"public","device_type":"desktop","expires_at":"2027-03-25T15:17:29Z","useragent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0","referer":"","cookies":null,"exit_node":"z0yflva4pidy47h"},"stats":{"alert_count":{"ids":1,"urlquery":0,"analyzer":0}},"detection":{"ids":[{"sensor_name":"suricata","title":"Suricata IDS","description":"Suricata /w Emerging Threats Pro","date":"2026-02-18T15:17:06Z","timestamp":1771427826,"ip_dst":{"addr":"216.198.79.1","port":443,"asn":16509,"as":"AMAZON-02","country":"United States","country_code":"US"},"ip_src":{"addr":"Client IP","port":43000,"asn":0,"as":"","country":"","country_code":"zz"},"severity":"medium","alert":"ET INFO Suspicious Domain (*.icu) in TLS SNI","source":"{\"timestamp\":\"2026-02-18T15:17:06.502381+0000\",\"flow_id\":1941831351944372,\"in_iface\":\"br-31613a7ed13b\",\"event_type\":\"alert\",\"src_ip\":\"172.18.0.9\",\"src_port\":43000,\"dest_ip\":\"216.198.79.1\",\"dest_port\":443,\"proto\":\"TCP\",\"tx_id\":0,\"alert\":{\"action\":\"allowed\",\"gid\":1,\"signature_id\":2026889,\"rev\":4,\"signature\":\"ET INFO Suspicious Domain (*.icu) in TLS SNI\",\"category\":\"Potentially Bad Traffic\",\"severity\":2,\"metadata\":{\"attack_target\":[\"Client_Endpoint\"],\"confidence\":[\"High\"],\"created_at\":[\"2019_02_06\"],\"deployment\":[\"Perimeter\"],\"signature_severity\":[\"Informational\"],\"updated_at\":[\"2022_11_21\"]}},\"tls\":{\"sni\":\"bbonkredeem.icu\",\"version\":\"TLS 1.3\",\"ja3\":{\"hash\":\"650c82854aed91a22996035b295a0c3e\",\"string\":\"771,4865-4867-4866-49195-49199-52393-52392-49196-49200-49171-49172-156-157-47-53,0-23-65281-10-11-16-5-34-51-43-13-28-21,29-23-24-25-256-257,0\"},\"ja3s\":{\"hash\":\"f4febc55ea12b31ae17cfb7e614afda8\",\"string\":\"771,4865,43-51\"}},\"app_proto\":\"tls\",\"flow\":{\"pkts_toserver\":4,\"pkts_toclient\":5,\"bytes_toserver\":753,\"bytes_toclient\":3409,\"start\":\"2026-02-18T15:17:06.476340+0000\"}}"}],"analyzer":null,"urlquery":null},"summary":[{"fqdn":"bbonkredeem.icu","ip":{"addr":"216.198.79.1","port":443,"asn":16509,"as":"AMAZON-02","country":"United States","country_code":"US"},"domain_registered":"2025-08-22","domain_rank":0,"first_seen":"2026-02-18T15:02:46.324773Z","last_seen":"2026-02-18T15:02:46.324774Z","alert_count":0,"request_count":2,"received_data":2429,"sent_data":921,"comment":"","tags":null,"fingerprints":[{"name":"Vercel","description":"Vercel is a cloud platform for static frontends and serverless functions.","website":"https://vercel.com","common_platform_enumeration":"","icon":"vercel.svg","categories":["PaaS"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}]}],"files":null,"artifacts":{"windows_shortcuts":null,"files":null,"telegram":null,"pdfs":null,"clipboard":null},"sensors":{"ids":null,"analyzer":null,"urlquery":null},"javascript":{"script":null,"eval":null,"write":null,"console":null},"http":[{"url":{"schema":"https","addr":"bbonkredeem.icu/","fqdn":"bbonkredeem.icu","domain":"bbonkredeem.icu","tld":"icu"},"ip":{"addr":"216.198.79.1","port":443,"asn":16509,"as":"AMAZON-02","country":"United States","country_code":"US"},"is_navigation_request":true,"resource_type":"document","requested_by":"","date":"2026-02-18T15:17:06.425Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"bbonkredeem.icu","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Tue, 23 Dec 2025 11:48:04 GMT","end":"Mon, 23 Mar 2026 11:48:03 GMT"},"fingerprint":{"sha1":"CD:1B:9F:BD:42:78:BD:60:CB:17:7D:A2:86:83:3B:94:C5:7E:79:73","sha256":"7D:97:6D:68:8D:C5:93:C0:6E:A8:45:2F:A8:BE:CE:35:CF:46:EC:A3:72:77:4C:70:8A:8E:F3:B2:AD:DC:02:61"}}},"request":{"raw":"GET / HTTP/1.1\r\nHost: bbonkredeem.icu\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nUpgrade-Insecure-Requests: 1\r\nSec-Fetch-Dest: document\r\nSec-Fetch-Mode: navigate\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 451 Unavailable For Legal Reasons\r\ncache-control: public, max-age=0, must-revalidate\r\ncontent-type: text/html; charset=utf-8\r\ndate: Wed, 18 Feb 2026 15:17:06 GMT\r\nserver: Vercel\r\nstrict-transport-security: max-age=63072000\r\nx-vercel-error: DEPLOYMENT_DISABLED\r\nx-vercel-id: arn1::m4pcv-1771427826514-6f959c9b7935\r\ncontent-length: 1590\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"451","status_text":"Unavailable For Legal Reasons","fingerprints":[{"name":"Vercel","description":"Vercel is a cloud platform for static frontends and serverless functions.","website":"https://vercel.com","common_platform_enumeration":"","icon":"vercel.svg","categories":["PaaS"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":1590,"size_decoded":0,"mime_type":"text/html; charset=utf-8","magic":"HTML document, ASCII text, with very long lines (1590), with no line terminators","md5":"9e2c1089446ebc23a5fb9d50179191c9","sha1":"f05c1a15e770d12d0817c7c5940e77afa7e4aa0d","sha256":"cd90c50793ed34e5164b095f17226e9b780543afbb316a7ab20f63386d6c0b23","sha512":"2ad2b4cda98645a7a0db9ed3754f8c6d448db93fed44bc528b898828d8270afcbae5f2680755db633e5ec2d146a5b926c8a70edd4286770ac2ad293871f0b9d8","ssdeep":"","tlshash":"a73142a705b1702ef23b88fe35d637646208c526c0920f99f618efb8e2c78a65533749","first_seen":"2026-02-18T15:17:29.939974Z","last_seen":"2026-02-18T15:17:29.939974Z","times_seen":1,"resource_available":false,"data":null}},"time_used":191,"timings":{"blocked":82,"dns":56,"connect":1,"send":0,"wait":10,"receive":12,"ssl":28},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"bbonkredeem.icu/favicon.ico","fqdn":"bbonkredeem.icu","domain":"bbonkredeem.icu","tld":"icu"},"ip":{"addr":"216.198.79.1","port":443,"asn":16509,"as":"AMAZON-02","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://bbonkredeem.icu/","date":"2026-02-18T15:17:06.721Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"bbonkredeem.icu","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Tue, 23 Dec 2025 11:48:04 GMT","end":"Mon, 23 Mar 2026 11:48:03 GMT"},"fingerprint":{"sha1":"CD:1B:9F:BD:42:78:BD:60:CB:17:7D:A2:86:83:3B:94:C5:7E:79:73","sha256":"7D:97:6D:68:8D:C5:93:C0:6E:A8:45:2F:A8:BE:CE:35:CF:46:EC:A3:72:77:4C:70:8A:8E:F3:B2:AD:DC:02:61"}}},"request":{"raw":"GET /favicon.ico HTTP/1.1\r\nHost: bbonkredeem.icu\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://bbonkredeem.icu/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 451 Unavailable For Legal Reasons\r\ncache-control: public, max-age=0, must-revalidate\r\ncontent-type: text/plain; charset=utf-8\r\ndate: Wed, 18 Feb 2026 15:17:06 GMT\r\nserver: Vercel\r\nstrict-transport-security: max-age=63072000\r\nx-vercel-error: DEPLOYMENT_DISABLED\r\nx-vercel-id: arn1::7nfpn-1771427826729-009b71e76e2e\r\ncontent-length: 109\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"451","status_text":"Unavailable For Legal Reasons","fingerprints":[{"name":"Vercel","description":"Vercel is a cloud platform for static frontends and serverless functions.","website":"https://vercel.com","common_platform_enumeration":"","icon":"vercel.svg","categories":["PaaS"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":109,"size_decoded":0,"mime_type":"text/plain; charset=utf-8","magic":"ASCII text","md5":"67117e06c94b5f8dc6e1d21cbc62116f","sha1":"81861f9228a1328d6b9d68f339c3e8d94975764c","sha256":"d98930077a3e845e47060fe6c0d68880dd70259610739171d34177225dddb1f6","sha512":"9ba422ac797e21f93f511f7de064f56b8f66a86cfa44f55c6ee70dfd4de915ee9f97b02763f997f6645002f381a57e0aac51f489a436db7f5aadca81825d98d0","ssdeep":"","tlshash":"8eb09275a4a69086b2b8078924102e8868858295ab69861842e18e2e129ea98dbaa160","first_seen":"2026-02-18T15:17:29.944308Z","last_seen":"2026-02-18T15:17:29.944308Z","times_seen":1,"resource_available":false,"data":null}},"time_used":20,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":20,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}}]}