{"report_id":"868ea8c7-71a8-43ff-a7e5-d906d33d6b45","version":6,"status":"done","tags":[],"date":"2026-01-12T23:29:59Z","url":{"schema":"https","addr":"security-amlcheck.help","fqdn":"security-amlcheck.help","domain":"security-amlcheck.help","tld":"help"},"ip":{"addr":"104.21.7.222","port":0,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"final":{"url":{"schema":"https","addr":"security-amlcheck.help/","fqdn":"security-amlcheck.help","domain":"security-amlcheck.help","tld":"help"},"title":"AMLBot - Comprehensive","dom":{"size":0,"mime_type":"text/plain; charset=utf-8","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","dom_hash":"domhash1f07f384c75181c66badb60ab1ec770b","first_seen":"","last_seen":"","times_seen":0,"resource_available":false,"data":null}},"submit":{"url":{"schema":"https","addr":"security-amlcheck.help","fqdn":"security-amlcheck.help","domain":"security-amlcheck.help","tld":"help"},"ip":{"addr":"104.21.7.222","port":0,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"tags":null,"meta":null,"user":{"user_id":"akbkyowd9geqr98"}},"settings":{"access":"public","device_type":"desktop","expires_at":"2027-02-16T23:29:59Z","useragent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0","referer":"","cookies":null,"exit_node":"z0yflva4pidy47h"},"stats":{"alert_count":{"ids":0,"urlquery":0,"analyzer":1}},"detection":{"ids":null,"analyzer":[{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2026-01-12","alert":"Sinkholed","trigger":"security-amlcheck.help","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null},"summary":[{"fqdn":"security-amlcheck.help","ip":{"addr":"172.67.156.125","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"domain_registered":"unknown","domain_rank":0,"first_seen":"No data","last_seen":"No data","alert_count":2,"request_count":2,"received_data":4042564,"sent_data":1073,"comment":"","tags":null,"fingerprints":[{"name":"jQuery","description":"jQuery is a JavaScript library which is a free, open-source software designed to simplify HTML DOM tree traversal and manipulation, as well as event handling, CSS animation, and Ajax.","website":"https://jquery.com","common_platform_enumeration":"cpe:2.3:a:jquery:jquery:*:*:*:*:*:*:*:*","icon":"jQuery.svg","categories":["JavaScript libraries"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}]}],"files":null,"artifacts":{"windows_shortcuts":null,"files":null,"telegram":null,"pdfs":null,"clipboard":null},"sensors":{"ids":null,"analyzer":null,"urlquery":null},"javascript":{"script":[{"url":{"schema":"https","addr":"security-amlcheck.help/","fqdn":"security-amlcheck.help","domain":"security-amlcheck.help","tld":"help"},"ip":{"addr":"172.67.156.125","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"scriptElement","is_inline":true,"md5":"bba7791f0bd73e3f11b2dceb6c44e851","sha1":"9999a6a44235811c70277dd0b9bcf22e9269ffbb","sha256":"9f020d88af4ae36474dd4711e90cc96fbe208e95299896fd99d4aabd90962b4c","sha512":"978a41abc87c002d5beb4211e7df2e91a663d19dd7cb83ec8804036121bba9dbc45695a719bfa16b069e08324215966752ab05cdc51a3ed2701df93867320c17","ssdeep":"","tlshash":"e711f11db17417327dab983f692361df3ab3551fd60829203c6ea9443fb4e60aae1e01","size":994,"data":"","first_seen":"2025-05-31T13:36:12.286712Z","last_seen":"2026-06-02T23:16:51.407086Z","times_seen":52,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"security-amlcheck.help/","fqdn":"security-amlcheck.help","domain":"security-amlcheck.help","tld":"help"},"ip":{"addr":"172.67.156.125","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"scriptElement","is_inline":true,"md5":"b4303ecf9a89a4922c3c0f9950a2d623","sha1":"34d011c7afd04cc150c3fce79d9a73b4dbdcc688","sha256":"4d3c4d738ad333973c6950e2b960185c758d737b305e8983e20d25e10433fc99","sha512":"d42f08a1942c0902232f8e5684a79b8a9464bd2c4d4b3d161595cf28a49f3e10b00c6a980bb2ff0c557be3bcef235bd5725745b232cf6b59e3b055e3727cd6ca","ssdeep":"192:624QkPXCOQXW7cIrI8nIrI9stWn7PMCMmBH0GP/QkOaOipmEnSlwZ5M5aHRIh8yH:62MC7Xs3sJs95pKskk+","tlshash":"0552742067f6142d7393d164ef6693161728e243e1099a7c3f5c0aa0df8f529dcbb69c","size":14244,"data":"","first_seen":"2026-01-12T23:30:21.177013Z","last_seen":"2026-01-12T23:30:21.177013Z","times_seen":1,"alerts":{"ids":null,"analyzer":null,"urlquery":null}}],"eval":null,"write":null,"console":null},"http":[{"url":{"schema":"https","addr":"security-amlcheck.help/","fqdn":"security-amlcheck.help","domain":"security-amlcheck.help","tld":"help"},"ip":{"addr":"172.67.156.125","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":true,"resource_type":"document","requested_by":"","date":"2026-01-12T23:29:35.692Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"security-amlcheck.help","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Tue, 30 Dec 2025 08:46:59 GMT","end":"Mon, 30 Mar 2026 09:45:18 GMT"},"fingerprint":{"sha1":"B8:C1:E4:D0:E1:43:C0:7F:E8:C9:99:93:2C:BA:50:7C:C3:EF:8D:02","sha256":"31:89:CC:C7:56:B8:A0:48:E0:42:8B:86:14:72:D7:34:28:E9:21:1B:3C:0F:31:3F:55:64:6D:6B:AE:91:C8:F3"}}},"request":{"raw":"GET / HTTP/1.1\r\nHost: security-amlcheck.help\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nUpgrade-Insecure-Requests: 1\r\nSec-Fetch-Dest: document\r\nSec-Fetch-Mode: navigate\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ndate: Mon, 12 Jan 2026 23:29:36 GMT\r\ncontent-type: text/html; charset=UTF-8\r\nserver: cloudflare\r\nset-cookie: flow=13585; expires=Tue, 13-Jan-2026 00:25:35 GMT; Max-Age=3360; path=/\npechenka=200ae348e07330ee5b23b2d8c0a094ca; path=/\nflow=13585; expires=Wed, 11-Feb-2026 23:29:36 GMT; Max-Age=2592000; path=/\nflow=13585; expires=Tue, 13-Jan-2026 00:25:36 GMT; Max-Age=3360; path=/\nchannel_id=1047; path=/\nextspecck_v9u382hIMpq0MS2palcm=0; expires=Sun, 08-Nov-2026 23:29:36 GMT; Max-Age=25920000; path=/\nextspecck_9cj328JSmqOote92K3av=30417764; expires=Sun, 08-Nov-2026 23:29:36 GMT; Max-Age=25920000; path=/\r\nexpires: Thu, 19 Nov 1981 08:52:00 GMT\r\ncache-control: no-store, no-cache, must-revalidate\r\npragma: no-cache\r\naccess-control-allow-origin: *\r\naccess-control-allow-headers: *\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=iHQRbXK9E0QvmkVnzkA67PXkPF%2F8zAtbzONhKcv7RHO9dHY24t9q6Lg3mbR63kaRZON%2F7QZYN45Mjq1qnkOeUh%2BUaYpxPVzxfQiR0LdmhfVga25W\"}]}\r\ncf-cache-status: DYNAMIC\r\nvary: accept-encoding\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncontent-encoding: br\r\ncf-ray: 9bd06fd6cc39569c-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"jQuery","description":"jQuery is a JavaScript library which is a free, open-source software designed to simplify HTML DOM tree traversal and manipulation, as well as event handling, CSS animation, and Ajax.","website":"https://jquery.com","common_platform_enumeration":"cpe:2.3:a:jquery:jquery:*:*:*:*:*:*:*:*","icon":"jQuery.svg","categories":["JavaScript libraries"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":709211,"size_decoded":0,"mime_type":"text/html; charset=UTF-8","magic":"HTML document, ASCII text, with very long lines (42698)","md5":"6388f6f97985c47d2ad632603904b27a","sha1":"ed12591b64796043ef67d10f188841b100281f1b","sha256":"de70747c635ff9fa9f68fd7deba7eca290c5d2e5aecfa8ca23685f4df2c23da7","sha512":"add3820b72f3b5309837751f578e5dd22ee74573e16ef985158cda5974259babcc60e2842e8323d9f5b0584ad264f23527e25dfcf2d3e5700219341f25bfdf13","ssdeep":"12288:zP/PSVpB189/iHL5hTW6uc7HtyEzPd2Yb4/5CY76T8RWhEEcY6rm2VP:zXWB8IL5hTd0E7dvY76TiKoP","tlshash":"5ee4027567a220f45c8392b9a3bb364d7f2980dbdd07a9f4f6ec09506f8a170cca3954","first_seen":"2026-01-12T23:30:21.170616Z","last_seen":"2026-01-12T23:30:21.170616Z","times_seen":1,"resource_available":false,"data":null}},"time_used":659,"timings":{"blocked":107,"dns":92,"connect":1,"send":0,"wait":439,"receive":0,"ssl":17},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2026-01-12","alert":"Sinkholed","trigger":"security-amlcheck.help","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"security-amlcheck.help/1642beb3377452cef1106373a2d61cc6/js/jquery.3.20.14.js","fqdn":"security-amlcheck.help","domain":"security-amlcheck.help","tld":"help"},"ip":{"addr":"172.67.156.125","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://security-amlcheck.help/","date":"2026-01-12T23:29:36.500Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"security-amlcheck.help","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Tue, 30 Dec 2025 08:46:59 GMT","end":"Mon, 30 Mar 2026 09:45:18 GMT"},"fingerprint":{"sha1":"B8:C1:E4:D0:E1:43:C0:7F:E8:C9:99:93:2C:BA:50:7C:C3:EF:8D:02","sha256":"31:89:CC:C7:56:B8:A0:48:E0:42:8B:86:14:72:D7:34:28:E9:21:1B:3C:0F:31:3F:55:64:6D:6B:AE:91:C8:F3"}}},"request":{"raw":"GET /1642beb3377452cef1106373a2d61cc6/js/jquery.3.20.14.js HTTP/1.1\r\nHost: security-amlcheck.help\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nCookie: flow=13585; pechenka=200ae348e07330ee5b23b2d8c0a094ca; channel_id=1047; extspecck_v9u382hIMpq0MS2palcm=0; extspecck_9cj328JSmqOote92K3av=30417764\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\nserver: cloudflare\r\ndate: Mon, 12 Jan 2026 23:29:36 GMT\r\ncontent-type: application/javascript\r\naccess-control-allow-origin: *\r\naccess-control-allow-headers: *\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=sDHdg5FYoCnN8%2BWFQjiIaaEfDA4OgvsctF%2F2XdWSvLhvptCOTpTJ%2BU%2BA0c%2BxSVJP6pUTPNb2mSzjDfSNG%2Blhvc7ZHZfpg%2BrgYOdiMdFKiGlcrzYU\"}]}\r\ncache-control: max-age=14400\r\ncf-cache-status: MISS\r\nlast-modified: Mon, 12 Jan 2026 23:29:36 GMT\r\ncontent-encoding: br\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=3,i=?0\r\nvary: accept-encoding\r\ncf-ray: 9bd06fdb2a74b4ff-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":3331368,"size_decoded":0,"mime_type":"application/javascript","magic":"JavaScript source, ASCII text, with very long lines (65536), with no line terminators","md5":"2ff6fab43ba34297370df23be54c4a9f","sha1":"acfc574eea0c71cc1c6932059d63321de910f2a9","sha256":"7859c02f2642f6d347c36f650df05788b7f112032d26726dffd93014e02f8cde","sha512":"b0efd8e59335314ca93febb154f85035ea28426d76279680f7544a7a9cda344d2c8827850a795fcdf11f044c9df041fae3cfe86cba1fd93b5e75680bbde67789","ssdeep":"24576:cPUquW85M8XOU/GyCVCPCeCTCN/ki1MoCPCZC0CNCGm7Dffs1SGoUT9FusNFhjO5:wuFYcEtprZ17Kl","tlshash":"0d25a343a2d0386605d35fb27a2750daec2d8fef618c5aa9b44dfc38b8e4154d6ec670","first_seen":"2026-01-12T23:30:21.173664Z","last_seen":"2026-01-12T23:30:21.173664Z","times_seen":1,"resource_available":false,"data":null}},"time_used":345,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":133,"receive":212,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2026-01-12","alert":"Sinkholed","trigger":"security-amlcheck.help","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}}]}