{"report_id":"87c8d001-c501-4881-af9f-84d72cee104f","version":0,"status":"done","tags":[],"date":"2026-08-10T19:15:06Z","url":{"schema":"https","addr":"return.st/?ref=dstatspace","fqdn":"return.st","domain":"return.st","tld":"st"},"ip":{"addr":"216.146.31.1","port":0,"asn":207731,"as":"Nxsr, Unipessoal Lda","country":"Taiwan","country_code":"TW"},"final":{"url":{"schema":"about","addr":"about:privatebrowsing","fqdn":"","domain":"","tld":""},"title":"New Private Tab","dom":{"size":19412,"mime_type":"text/html; charset=utf-8","magic":"JavaScript source, Unicode text, UTF-8 text, with very long lines (19409), with no line terminators","md5":"393d7a923bc6ebbb48a315e6d8acb806","sha1":"32c4789f2cf22762a98c77535dfbde926914f8d4","sha256":"73c0a6e7d7df9c074234d63379ad86e8dd7a5a33f8de0874be6c35f9d59fc429","sha512":"1c62bf4b7e79c0dcc9cae28ee9a7875a320a33d7e75360145e74631633fa5f84d824114cbaab03363cca35787123c2c422a6d027faa3aa3361e815e229517039","ssdeep":"384:hDrf5GNPKF4RAz/RpeGtL27qS7Qa6YiujVHoxUwMz2vLeemD876b7KRUaI:prf5G1KFDz/y6L2uWQ+iCoe2vLeemZqq","tlshash":"d3926db5fd64a03dc59b87da31edfb6c3034b107b91356b7b0ae12880ad9b679123e44","dom_hash":"domhasha17464155c9916b072960f3b556faa39","first_seen":"2026-08-10T19:15:10.237127Z","last_seen":"2026-08-10T19:15:10.237127Z","times_seen":1,"resource_available":false,"data":null}},"submit":{"url":{"schema":"https","addr":"return.st/?ref=dstatspace","fqdn":"return.st","domain":"return.st","tld":"st"},"ip":{"addr":"216.146.31.1","port":0,"asn":207731,"as":"Nxsr, Unipessoal Lda","country":"Taiwan","country_code":"TW"},"tags":null,"meta":null},"settings":{"access":"public","device_type":"desktop","expires_at":"2027-09-14T19:15:06Z","useragent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0","referer":"","cookies":null,"exit_node":"qguvgzjxzsgb3vs"},"stats":{"alert_count":{"ids":0,"urlquery":0,"analyzer":2}},"detection":{"ids":null,"analyzer":[{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-08-10","alert":"Sinkholed","trigger":"return.st","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-08-10","alert":"Sinkholed","trigger":"return.st","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null},"summary":[{"fqdn":"return.st","ip":{"addr":"216.146.31.1","port":443,"asn":207731,"as":"Nxsr, Unipessoal Lda","country":"Taiwan","country_code":"TW"},"domain_registered":"2025-07-21","domain_rank":0,"first_seen":"2026-04-05T17:44:25.174908Z","last_seen":"2026-08-10T18:35:25.381999Z","alert_count":22,"request_count":11,"received_data":2337993,"sent_data":6465,"comment":"","tags":null,"fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"Express","description":"Express is a web application framework for Node.js, released as free and open-source software under the MIT License. It is designed for building web applications and APIs.","website":"https://expressjs.com","common_platform_enumeration":"cpe:2.3:a:expressjs:express:*:*:*:*:*:*:*:*","icon":"Express.svg","categories":["Web frameworks","Web servers"]},{"name":"Node.js","description":"Node.js is an open-source, cross-platform, JavaScript runtime environment that executes JavaScript code outside a web browser.","website":"https://nodejs.org","common_platform_enumeration":"cpe:2.3:a:nodejs:node.js:*:*:*:*:*:*:*:*","icon":"Node.js.svg","categories":["Programming languages"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"OpenResty","description":"OpenResty is a web platform based on nginx which can run Lua scripts using its LuaJIT engine.","website":"https://openresty.org","common_platform_enumeration":"","icon":"OpenResty.svg","categories":["Web servers"]}]},{"fqdn":"cdn.diamwall.com","ip":{"addr":"216.146.31.1","port":443,"asn":207731,"as":"Nxsr, Unipessoal Lda","country":"Taiwan","country_code":"TW"},"domain_registered":"2021-09-07","domain_rank":0,"first_seen":"2021-11-17T22:14:12Z","last_seen":"2026-08-03T21:52:24.202855Z","alert_count":0,"request_count":2,"received_data":25926,"sent_data":1120,"comment":"","tags":null,"fingerprints":null}],"files":null,"artifacts":{"windows_shortcuts":null,"files":null,"telegram":null,"pdfs":null,"clipboard":null},"sensors":{"ids":null,"analyzer":null,"urlquery":null},"javascript":{"script":[{"url":{"schema":"https","addr":"return.st/?ref=dstatspace","fqdn":"return.st","domain":"return.st","tld":"st"},"ip":{"addr":"216.146.31.1","port":443,"asn":207731,"as":"Nxsr, Unipessoal Lda","country":"Taiwan","country_code":"TW"},"introduction_type":"eval","is_inline":false,"md5":"b2c118852b2127a122bd0857d75d7368","sha1":"11e486876215516a868107bbfc86990dd0b15d16","sha256":"2bb5b726c2b63309e08d7cc3419e05d15ac7e81be254a44955aeb01c1aeba206","sha512":"7b0707cae48382b3b2881d9a1ed4b97128aadcf5bda8ac420899ae6665a839fca0010d9a1cd50773b6ea1ddee2bb78706f85c380cdbae401972441025e57e003","ssdeep":"","tlshash":"1ef078a36e9b3048b13b30ae036f2300a99556cb268cdd15f94db6645f9040e89bc9d4","size":644,"data":"","first_seen":"2026-08-10T19:15:10.271195Z","last_seen":"2026-08-10T19:15:10.271195Z","times_seen":1,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"return.st/?ref=dstatspace","fqdn":"return.st","domain":"return.st","tld":"st"},"ip":{"addr":"216.146.31.1","port":443,"asn":207731,"as":"Nxsr, Unipessoal Lda","country":"Taiwan","country_code":"TW"},"introduction_type":"eval","is_inline":false,"md5":"f95ebb00f93e4331d112777069f16bb1","sha1":"f6e3850b64e12d253103eee830959980e550a852","sha256":"7ae9f61d16ce6708dd8176db8b6d1bafbcf91a84db9f93581ae90291464ccd60","sha512":"66bd4d776dc01694efed3aad4df02cb93fd9dec567427625f2c9f4e52f941e2928b49acc23893c8a4231e337b1a76cee7235df4004d8f3d7beae92ae45070eb5","ssdeep":"","tlshash":"20f0654ba6f25951053b70b0010f9414e358b423055d9d5efd6c5a94ef7012e89ddf9c","size":448,"data":"","first_seen":"2026-07-05T06:42:05.159682Z","last_seen":"2026-08-10T19:32:27.422063Z","times_seen":12,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"return.st/?ref=dstatspace","fqdn":"return.st","domain":"return.st","tld":"st"},"ip":{"addr":"216.146.31.1","port":443,"asn":207731,"as":"Nxsr, Unipessoal Lda","country":"Taiwan","country_code":"TW"},"introduction_type":"eval","is_inline":false,"md5":"03ee82efca9d519b240f77c17f1fc78a","sha1":"532fbc76cda8a37b01fc6e31347c4a8301c3f92a","sha256":"d21e176c54dc899084b51affa92f51766bd5dbc443843c60bfebfcb83155490b","sha512":"49f81d31f16bee6582e52989a88b0bd9b736c02a8a188db0f3aa88a1a7d56c5e056ecbb9232f187e45ad9cb8266cdfc1c8eb80f531d6cc0d1f1f3d477d134681","ssdeep":"","tlshash":"f831c2fb9df71061512770281b3f6b08f6a06013646cd861befca1187fe0a593659fad","size":1662,"data":"","first_seen":"2026-07-24T22:59:45.946622Z","last_seen":"2026-08-10T19:32:27.441034Z","times_seen":11,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"return.st/?ref=dstatspace","fqdn":"return.st","domain":"return.st","tld":"st"},"ip":{"addr":"216.146.31.1","port":443,"asn":207731,"as":"Nxsr, Unipessoal Lda","country":"Taiwan","country_code":"TW"},"introduction_type":"eval","is_inline":false,"md5":"07928d18511ba03c380374e66acadc90","sha1":"e32551df2e68552b92de2f774cd17b99b1e36aca","sha256":"ea4a83ff213dbd6cf72e9148d86f4c56ad0bf3423fbcce025b1cd138d4ace351","sha512":"f0c36d35f11442e08dd17d735552f0fdb8aabdc1236416bc2a6974ab2db3fd1bac69acc8e533c505aaf8ffa9b7f2a32652d7ca0f8465b8b0ad294661ffb99b19","ssdeep":"","tlshash":"6f018b1f6df670615533f83a8e1f510422135007488bedb4bddf6a608f5637a22a57a4","size":707,"data":"","first_seen":"2026-07-24T22:59:45.841152Z","last_seen":"2026-08-10T19:32:27.436694Z","times_seen":11,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"return.st/?ref=dstatspace","fqdn":"return.st","domain":"return.st","tld":"st"},"ip":{"addr":"216.146.31.1","port":443,"asn":207731,"as":"Nxsr, Unipessoal Lda","country":"Taiwan","country_code":"TW"},"introduction_type":"eval","is_inline":false,"md5":"0d787a00a41e289562d73308d7e2c09c","sha1":"1883440992744f7358923caf592617e7f4686338","sha256":"e45e8ef1da62d2e434a5674d4dcf634a9816c2784b58f189f8ab3757cc8fdd30","sha512":"7a2d32fd296d10385b63e09e8737c193448231a27f09caa4ca07c8e5e33f00761421fd6efb38c51540da6fb5fccacc762868f6dba018df505e27111f45b317fe","ssdeep":"","tlshash":"89213c5e09fa10256363647c06dfb001662669031a19db557defe660bf2233c63d9fbc","size":1417,"data":"","first_seen":"2026-07-24T22:59:45.877916Z","last_seen":"2026-08-10T19:32:27.485824Z","times_seen":11,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"return.st/.well-known/diamwall/load/html/5s.html","fqdn":"return.st","domain":"return.st","tld":"st"},"ip":{"addr":"216.146.31.1","port":443,"asn":207731,"as":"Nxsr, Unipessoal Lda","country":"Taiwan","country_code":"TW"},"introduction_type":"scriptElement","is_inline":true,"md5":"43f2f4bf22f29f7ac8b8a1179ea5828d","sha1":"a84bbf49a9cecd8bf33e60e473785b5b6db87c59","sha256":"01546af97c00c3d1fdba2cc23660fc29f5dfc55962a71800a09cc3e61e02584e","sha512":"c8529e4568ad17a869b10e71d7bc7a3a107b9f1f3e7c69f81e97cf29a03e04984afb48bea3b6f6cc5e662a35a1e2987132e7e6d91db826bcc3b12157f6f4b1b1","ssdeep":"","tlshash":"f5a0241440300fd443d000ddc7d35f11c03d0130070d51511df0450034c014f4d307f1","size":80,"data":"","first_seen":"2026-08-03T21:52:27.844159Z","last_seen":"2026-08-10T19:32:27.41997Z","times_seen":8,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"return.st/.well-known/diamwall/load/html/5s.html","fqdn":"return.st","domain":"return.st","tld":"st"},"ip":{"addr":"216.146.31.1","port":443,"asn":207731,"as":"Nxsr, Unipessoal Lda","country":"Taiwan","country_code":"TW"},"introduction_type":"scriptElement","is_inline":true,"md5":"d2fff389097b897172f06ae4a9e66c43","sha1":"614f972036d091ea2c889630fdf4231ed9837036","sha256":"5e1eb14f73424ff346bbd2d115b66ff20cb95dff6a6b4f78cf915732c91c5bc1","sha512":"6c9bdace89a4ad7cd1b9532479d84e5ab02442ce67da51da387b078e50a7e82238f89bd66219e455411f16377eeaf09f9d50de8e5094f02165c1e92058b1633b","ssdeep":"","tlshash":"8801fd98b160643a6fe718cc1a4bf7b2b03b570aa4bbd31a7619c541395468bf0338c4","size":804,"data":"","first_seen":"2026-08-03T21:52:27.845847Z","last_seen":"2026-08-10T19:32:27.420763Z","times_seen":8,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"return.st/.well-known/diamwall/load/html/5s.html","fqdn":"return.st","domain":"return.st","tld":"st"},"ip":{"addr":"216.146.31.1","port":443,"asn":207731,"as":"Nxsr, Unipessoal Lda","country":"Taiwan","country_code":"TW"},"introduction_type":"scriptElement","is_inline":true,"md5":"29304903182d15d40252c9516ae8486e","sha1":"cb904f6bdfc7e6500beed955a628f6e575c8c803","sha256":"6422f7418136be48517293256bc6a0621bfc82037c96ec8a7386ade45930354d","sha512":"631bce3b8f4f7b442cd3441bcb08176a7ad854f01c7f5b1afed7c1f7db2295bdded650f985474db9dede2824858d8adc395f1e92bd4c7195f9d73e2057436c5b","ssdeep":"","tlshash":"2161866f7651387546d739b776ffea88b93172147843e026586d88c89a70f4be123ec0","size":3331,"data":"","first_seen":"2026-08-03T21:52:27.847684Z","last_seen":"2026-08-10T19:32:27.421416Z","times_seen":8,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"return.st/?ref=dstatspace","fqdn":"return.st","domain":"return.st","tld":"st"},"ip":{"addr":"216.146.31.1","port":443,"asn":207731,"as":"Nxsr, Unipessoal Lda","country":"Taiwan","country_code":"TW"},"introduction_type":"eval","is_inline":false,"md5":"5f1469e67277af9db3da1e673adb5a54","sha1":"4326cc6c1fd0f1f2454fb22299875624093bfe40","sha256":"08e902a7d3d27dc2ad3276d83b73075677797ff3221931b2db9cf06db0da036f","sha512":"70c68833d81a64b206e176b47c1bc87e5327606dfed78ab9505e730dea4d105c732a0e04196da67e2725aeb578f7c3e7d49171ead0cdaaa8c900a75080fd1717","ssdeep":"","tlshash":"00d0229a79e1e0312206602c0b0e1d01ba1ec94368cdde90b48c8b61ff23c3b62a83c5","size":200,"data":"","first_seen":"2026-07-05T06:42:05.153264Z","last_seen":"2026-08-10T19:32:27.437406Z","times_seen":10,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"return.st/cdn-cgi/chl/v2/captcha/assets/cpt.lib?mclrdw=0c4a56\u0026sclrdw=2ea8c1","fqdn":"return.st","domain":"return.st","tld":"st"},"ip":{"addr":"216.146.31.1","port":443,"asn":207731,"as":"Nxsr, Unipessoal Lda","country":"Taiwan","country_code":"TW"},"introduction_type":"scriptElement","is_inline":false,"md5":"61120b3c678cd75c071c3a6e1ca625f7","sha1":"d2ef42b3cbaeada27defa878b211f893d6cd1bb5","sha256":"9233c90bdff112989e043273b0498b7f81de593598c77f48548ee00f5f2d57d1","sha512":"7146d7b61afb0cd8313a27a0e92fe51c79e766e3ca4c9f772d896bd848e9c5c50a30d0d4197d646f31c6d3c8106181073d04e50a93ccf77bd00a75790498db3e","ssdeep":"6144:Nfjr66bjdweyDP9h1XyW+NZSKGfpaevknXznS+n2KnH5ZkuVDHOXCQnjdX/64FfR:BG6i5zT1XL+6Rhae8jnN5H5YbR","tlshash":"73f481f4fe4922e9a94fd01780cecb2a99c0a974d64d93142dcc7f2b4e619ab470f761","size":783708,"data":"","first_seen":"2026-08-10T19:15:10.250035Z","last_seen":"2026-08-10T19:15:10.250035Z","times_seen":1,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"return.st/?ref=dstatspace","fqdn":"return.st","domain":"return.st","tld":"st"},"ip":{"addr":"216.146.31.1","port":443,"asn":207731,"as":"Nxsr, Unipessoal Lda","country":"Taiwan","country_code":"TW"},"introduction_type":"eval","is_inline":false,"md5":"00bb3fe29398d84c2bffa445182564c9","sha1":"c3f83a29e6337704215e7877170c75cde4f75cec","sha256":"4b63243476d324ddb349ae3320389fc23894d9f7a7e0d77451f307af8be42871","sha512":"d70b1639d194b4f6e4a73e6c944d5679dc0970bc6f2099da8f159c8353ee90ec3e957f28337432855518c5313aad4645ab6ce1e2e48ca3a8cedc0d9aaa2b17aa","ssdeep":"","tlshash":"681144ca4d9ca0104b0542d4804aec74bc2a9d3663dfca92f069c3701f122e6818fc6b","size":923,"data":"","first_seen":"2026-07-24T22:59:45.915692Z","last_seen":"2026-08-10T19:32:27.483184Z","times_seen":11,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"return.st/?ref=dstatspace","fqdn":"return.st","domain":"return.st","tld":"st"},"ip":{"addr":"216.146.31.1","port":443,"asn":207731,"as":"Nxsr, Unipessoal Lda","country":"Taiwan","country_code":"TW"},"introduction_type":"eval","is_inline":false,"md5":"b227a58774d745ec6bec75f403602539","sha1":"3a67407f6cc10020ee9a6a5118f3b0c000f3b92d","sha256":"b8f2a70194b4ee7d58e69a0cbf24c411a4b33fc58811bc2308717ff717b14c10","sha512":"4dcc7fcc43f1b2d3456c67b8a4f22154e173e07ec6833163aa45a7ebcebefb1ef073895c5edb88557e154006cb556e2604a3a1bc47e7258f3354544f41d5840b","ssdeep":"","tlshash":"3f21ee385db3021a753b65be07ef464972a0e1231e0ffc2eb40dd2006f56871a5b6ac5","size":1224,"data":"","first_seen":"2026-07-24T22:59:45.959472Z","last_seen":"2026-08-10T19:32:27.459601Z","times_seen":11,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"return.st/cdn-cgi/mitigation/v2/chl/chlb.lib?bdt=0\u0026b12=0\u0026brc=0","fqdn":"return.st","domain":"return.st","tld":"st"},"ip":{"addr":"216.146.31.1","port":443,"asn":207731,"as":"Nxsr, Unipessoal Lda","country":"Taiwan","country_code":"TW"},"introduction_type":"scriptElement","is_inline":false,"md5":"bafb57bca5b47c1587e0b0244e16b409","sha1":"b5d4c8c10bfeaf2019ff961ddbdd0d0b1ca0db53","sha256":"0403f3a6f937ddc1bce191ce7a167f6c82b92a3ff44d84213b4bd8aa31553acd","sha512":"f42d4a93fd8058ebaa9a3ee2c60c4555bb23479ea7bb04b59e725b32600f80bb037e004ef1051db4b5ea83823d45002aa7cb51e1c3cd50effa7a355239ceef17","ssdeep":"3072:8PlyKyiOZGkl3uuYl4OW/Sbx/ctj//Cc+u:8PlZ7QtYDdbxS//Zd","tlshash":"b9748d69eec503fb1ccb09f68e5d183d2ec069c17b9f10bc535bdb86406152a8b7a9c6","size":339673,"data":"","first_seen":"2026-08-10T19:15:10.256744Z","last_seen":"2026-08-10T19:15:10.256744Z","times_seen":1,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"return.st/?ref=dstatspace","fqdn":"return.st","domain":"return.st","tld":"st"},"ip":{"addr":"216.146.31.1","port":443,"asn":207731,"as":"Nxsr, Unipessoal Lda","country":"Taiwan","country_code":"TW"},"introduction_type":"eval","is_inline":false,"md5":"0b8afb6ab761fa9c450ae5ac8074791c","sha1":"8445caa978364012d6d66b639e5f341ce8ab40c2","sha256":"f0515fc31a20124a5979c5984a870b001071953e86d0f429dd2e5b1c8833a2eb","sha512":"75d574a4bfbaa625e83f568e16876869010288f760e8029ce76325c867342b3cf8544dfc12ba73f80e3e57d09c6a551f162893de26da93467c013a5a078beacc","ssdeep":"","tlshash":"eec0225ba4e590200178203d130f2a22731fc107518f2e90fac88330ff2203b4250440","size":191,"data":"","first_seen":"2026-07-05T06:42:05.195528Z","last_seen":"2026-08-10T19:32:27.425846Z","times_seen":11,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"return.st/?ref=dstatspace","fqdn":"return.st","domain":"return.st","tld":"st"},"ip":{"addr":"216.146.31.1","port":443,"asn":207731,"as":"Nxsr, Unipessoal Lda","country":"Taiwan","country_code":"TW"},"introduction_type":"eval","is_inline":false,"md5":"f3705176b48fac2269ba426d2603a044","sha1":"1b0ef56996d3a72f6153393e83f26b76d7253ac4","sha256":"eaa797588fdf4bee9ade1ac46bbfa59e087ab80acb9533033089f4d8fd8ac7c2","sha512":"bbb94d89ae9bc0c01878fcebb93672f47fc3afa7c22b65d5b090cbecd6562ff7d0c6724b38c3aa8de215bf471cde69314481608527426a64ffa72c75cb635f01","ssdeep":"","tlshash":"3ef09e163dfb60143c7f64ee431f91057a194503155af914f98cfa10afd093456bcad5","size":514,"data":"","first_seen":"2026-08-10T19:15:10.28674Z","last_seen":"2026-08-10T19:15:10.28674Z","times_seen":1,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"return.st/?ref=dstatspace","fqdn":"return.st","domain":"return.st","tld":"st"},"ip":{"addr":"216.146.31.1","port":443,"asn":207731,"as":"Nxsr, Unipessoal Lda","country":"Taiwan","country_code":"TW"},"introduction_type":"eval","is_inline":false,"md5":"b156ee43b09feb05f0566c2f4dfab40a","sha1":"4d68d38faa20b2d33bf7a87f5b7c49972abb59de","sha256":"077254b5c2c78a6b597bce1380080b024e7e77e3823d53b273e3817898339b12","sha512":"357b85768c3d2361d7d09ba8baa6dd074bea0c3d1cd57f6a926715994db54fe71d1b00faaf7f9b388357451bb10eae9a505a45cf54ec898c0c886b7bbacf2698","ssdeep":"","tlshash":"d4c04c8db5e6f540461b6594541b5148b17c861164dc1a50dc915a74af3406c8232a1c","size":136,"data":"","first_seen":"2026-07-05T06:42:05.244538Z","last_seen":"2026-08-10T19:32:27.438065Z","times_seen":12,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"return.st/?ref=dstatspace","fqdn":"return.st","domain":"return.st","tld":"st"},"ip":{"addr":"216.146.31.1","port":443,"asn":207731,"as":"Nxsr, Unipessoal Lda","country":"Taiwan","country_code":"TW"},"introduction_type":"eval","is_inline":false,"md5":"b2a5adfacb4d610ee10aa67631d9272c","sha1":"db7bbddd3dec71822e9f63ed2306fbecc15bed9a","sha256":"4a1d5e82681ab8762a2c04ce09bd815bf744142df7ef5c44d66b317adea5d1a6","sha512":"e7cb92d9d38a1f26569ca48567708bd49ffb83306d842bd1ba9b471b69a430221814b667248c476e8cab9982273292adf985b7297153c4a9a65c01c2b75ea799","ssdeep":"","tlshash":"cef0ae4a78f1212013176018459fd305b7394c331a4d5924bdada664ff24358d6b2bdb","size":506,"data":"","first_seen":"2026-07-24T22:59:45.964739Z","last_seen":"2026-08-10T19:32:27.427547Z","times_seen":11,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"return.st/?ref=dstatspace","fqdn":"return.st","domain":"return.st","tld":"st"},"ip":{"addr":"216.146.31.1","port":443,"asn":207731,"as":"Nxsr, Unipessoal Lda","country":"Taiwan","country_code":"TW"},"introduction_type":"eval","is_inline":false,"md5":"befcac03d26f726f3299cee2aa00ef0e","sha1":"102fbacd8f8ce574c96c5cd8661a3e591f67b70d","sha256":"f5ef295f9a2b878453e55c9d8d19596ac893507aa2127f64a074132842a8b609","sha512":"7ec018d299a6c9614395256fb542db4e0e87d7ac9b4eb0fe99a8ad905963ef85efeed8401a5ed409b425f3924bef26cb82610f34f60aa3ea47392ee888ec3d8b","ssdeep":"","tlshash":"13118ced6ce7a018e037307a073f9960b3be4553069ded25fe1cd209df60a284795ac5","size":955,"data":"","first_seen":"2026-07-24T22:59:45.880063Z","last_seen":"2026-08-10T19:32:27.434627Z","times_seen":11,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"return.st/?ref=dstatspace","fqdn":"return.st","domain":"return.st","tld":"st"},"ip":{"addr":"216.146.31.1","port":443,"asn":207731,"as":"Nxsr, Unipessoal Lda","country":"Taiwan","country_code":"TW"},"introduction_type":"eval","is_inline":false,"md5":"daf731dee159555066705f083276738b","sha1":"1a5f1df115158e483d905ed892e83087826fce32","sha256":"105e0c459cd589bd31d75db65f7a28597bc1e1168be41e2f0a47254e05f7cdb1","sha512":"99a9ffb781a96b7bedb8651da8dc83761b8b06b99dfe52e7c6f1ca66684cba890b1437928d54b4d399b8491608eb42c09d92b0e34eaedf73762603bee534af2d","ssdeep":"","tlshash":"f801491facf73095522bf87c676f214450225007054dea44bceec7a00f122b82f16b9c","size":725,"data":"","first_seen":"2026-07-24T22:59:45.829022Z","last_seen":"2026-08-10T19:32:27.423438Z","times_seen":11,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"return.st/?ref=dstatspace","fqdn":"return.st","domain":"return.st","tld":"st"},"ip":{"addr":"216.146.31.1","port":443,"asn":207731,"as":"Nxsr, Unipessoal Lda","country":"Taiwan","country_code":"TW"},"introduction_type":"eval","is_inline":false,"md5":"ee35efc53be6c10f3f343fe2e1a572ac","sha1":"1de2c43e80bfd6f4b975f1ecb6804b4291a6c3c1","sha256":"e95a3e13f94865bfe9d2b52eae8264c2991ab07d9371eb4aa4af5a13d297c127","sha512":"bda6ef79d0741c68fb6d24c3eccfe787374673368e0d1de13bf53b71b655682b17a1f67787a3b1c150453738448670356906df6cb2c50e0e2f64db78b6a8b9f6","ssdeep":"","tlshash":"26f07da52eef1959290f949d0b6f9802a3488d12035de80d775cea019f94d34a5f94dd","size":625,"data":"","first_seen":"2026-08-10T19:15:10.293256Z","last_seen":"2026-08-10T19:15:10.293256Z","times_seen":1,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"return.st/?ref=dstatspace","fqdn":"return.st","domain":"return.st","tld":"st"},"ip":{"addr":"216.146.31.1","port":443,"asn":207731,"as":"Nxsr, Unipessoal Lda","country":"Taiwan","country_code":"TW"},"introduction_type":"eval","is_inline":false,"md5":"f9f76d0af70a739158af73b1056288d8","sha1":"4d48b8eae65be17061a2b7fa4788f5018b53d770","sha256":"d534efe924629e33bb4cc5bddee12fa74050b1ae5f761657152887a245972166","sha512":"a59873a86681273bb51546dc9f7c0dae667884955d10658bfef638f088460abeb04c48435c672f0baf65e503fe58689a497700cefbdb3d722ea19eaab3a9dc27","ssdeep":"","tlshash":"24d023da1de9e0105459206d072e1e05b3ad5507558fed81b89c0b20ef1083383e6580","size":204,"data":"","first_seen":"2026-07-05T06:42:05.248349Z","last_seen":"2026-08-10T19:32:27.486753Z","times_seen":11,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"return.st/?ref=dstatspace","fqdn":"return.st","domain":"return.st","tld":"st"},"ip":{"addr":"216.146.31.1","port":443,"asn":207731,"as":"Nxsr, Unipessoal Lda","country":"Taiwan","country_code":"TW"},"introduction_type":"eval","is_inline":false,"md5":"3ed302b52a2a16226c2ca363717767d4","sha1":"d3d579be5471703e270190b8237130d621dd2c89","sha256":"29c49244ecb5a870390c3cb23d7898d58cb2ccd4c6de00c1ba8675051fe6face","sha512":"2e12e433893f06e9ce754b0adc582aa415e34f2266626dc4de6ea4132ae2cae8cecfecfa95e6757ed2f814289b23ecd8b75efe8ebd1c6384f8b6ca50d34a5721","ssdeep":"","tlshash":"cc90045c30d5703405f175513507c1447c3c0703c45d05c15d0571c0d7750f44175d5c","size":44,"data":"","first_seen":"2026-07-05T06:42:05.19981Z","last_seen":"2026-08-10T19:32:27.414616Z","times_seen":12,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"return.st/?ref=dstatspace","fqdn":"return.st","domain":"return.st","tld":"st"},"ip":{"addr":"216.146.31.1","port":443,"asn":207731,"as":"Nxsr, Unipessoal Lda","country":"Taiwan","country_code":"TW"},"introduction_type":"eval","is_inline":false,"md5":"bd930cc4d1dc01cbffe993eb4c4d0162","sha1":"e78f769f1fe632eb8b0d981a506923ef604eb9c0","sha256":"a98704af9693999f4c602b7d5ac81f987144a9ec8cf395ac6123b7bc95f3f53e","sha512":"d2601944110c826a78d5c76a9b9c033b086265182dd89cb4256d1f8dca8d97ce4087b0bcb282469a79c61a43e8609aeb67a3d3659c69317f203ed5862812f674","ssdeep":"","tlshash":"32014c9b5deb6064091bb0e98b1f510221b2a1172e4dde373d8d16109f269ac85b47c8","size":715,"data":"","first_seen":"2026-07-24T22:59:45.931843Z","last_seen":"2026-08-10T19:32:27.475792Z","times_seen":11,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"return.st/?ref=dstatspace","fqdn":"return.st","domain":"return.st","tld":"st"},"ip":{"addr":"216.146.31.1","port":443,"asn":207731,"as":"Nxsr, Unipessoal Lda","country":"Taiwan","country_code":"TW"},"introduction_type":"eval","is_inline":false,"md5":"4dd4b5dbf6fd88f7bbc83364609258d0","sha1":"1b6a0bdd67e6aa5d300789b726a01058ace6a3f1","sha256":"99c19296193cdb24ee16a09561c4d675354aa38d9775e89275bf871fc9089bcb","sha512":"6a63d9ba00102d721dc2b47a24c93924844d256541fa655ba66571e4499a485d18027347f823b52dbbd546449a07e31eb4c4bd5c8e09392202831909d341f153","ssdeep":"","tlshash":"34e02214fce613a8321aa12d0b2f502ab3288803a40ecd11be1c7301bfd46340baa9d9","size":420,"data":"","first_seen":"2026-07-24T22:59:45.815549Z","last_seen":"2026-08-10T19:32:27.471401Z","times_seen":11,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"return.st/?ref=dstatspace","fqdn":"return.st","domain":"return.st","tld":"st"},"ip":{"addr":"216.146.31.1","port":443,"asn":207731,"as":"Nxsr, Unipessoal Lda","country":"Taiwan","country_code":"TW"},"introduction_type":"eval","is_inline":false,"md5":"0b6ab4a2f5f6a7f384b002c7f200aeec","sha1":"2bef437954fafdff0a51a263b6df71352e3b6843","sha256":"162a47a48591cbaa78ae001e6cdd42196eda96c67e4b711b05663da51ab5f59e","sha512":"d738f2d0cf61e18866fa5d0b38f2de915fce3497db0cbd8374d907f387a75d4ec01e28db96075d6c471aa358980a784778a4cf82e813a5b3f2428d003671a9a7","ssdeep":"","tlshash":"43e092e7f097012ee01d122d1dab8024fb34e716205d8715bafd16d5ef6212c8b5870a","size":380,"data":"","first_seen":"2026-07-05T06:42:05.175894Z","last_seen":"2026-08-10T19:32:27.46143Z","times_seen":12,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"return.st/?ref=dstatspace","fqdn":"return.st","domain":"return.st","tld":"st"},"ip":{"addr":"216.146.31.1","port":443,"asn":207731,"as":"Nxsr, Unipessoal Lda","country":"Taiwan","country_code":"TW"},"introduction_type":"eval","is_inline":false,"md5":"2423305e983d0a4db698aac1ae936dcc","sha1":"da1d4a8486ee9cbede684968ae62d0c72381cb2c","sha256":"1867e7a7acf5e07045644cddd2be637dfd23928fefd0c956d114160606c3225f","sha512":"3a1dd068c03d9f3d33d3f4075ab23275bd7994b1752d2666444ba1c2bfe8ee47b182386c3d5f930d440810c0ccf2b18472b6cc8461173bb1a65cb24ae40a41de","ssdeep":"","tlshash":"4ad0a9cbf0c7200ae50e13692c0b8078f724a624608c834098b85381ff9306c5b60b1e","size":210,"data":"","first_seen":"2026-07-05T06:42:05.149655Z","last_seen":"2026-08-10T19:32:27.446482Z","times_seen":12,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"return.st/?ref=dstatspace","fqdn":"return.st","domain":"return.st","tld":"st"},"ip":{"addr":"216.146.31.1","port":443,"asn":207731,"as":"Nxsr, Unipessoal Lda","country":"Taiwan","country_code":"TW"},"introduction_type":"eval","is_inline":false,"md5":"f1e6c01d6af8cacd31fcd91315b9dc1e","sha1":"f0b134eebeefab7cbc9557dfd2f8c21a01229edd","sha256":"48606d26e2519763b908e1386913b64295a5809cccc3992f262b04fa7d20583f","sha512":"252352ec7ac0588a40bbde246a95b9d7af965913491d52cfce7c508f197f6488c13cd0d9db975c807a0375a8ab8f674c8a83961358b15a27161c5d2b5ab95914","ssdeep":"","tlshash":"b3e0df493ede6059655e30b8170fb001a61645061a8efd10bd5db2213f5082582fcee8","size":330,"data":"","first_seen":"2026-07-05T06:42:05.193271Z","last_seen":"2026-08-10T19:32:27.452694Z","times_seen":12,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"return.st/?ref=dstatspace","fqdn":"return.st","domain":"return.st","tld":"st"},"ip":{"addr":"216.146.31.1","port":443,"asn":207731,"as":"Nxsr, Unipessoal Lda","country":"Taiwan","country_code":"TW"},"introduction_type":"eval","is_inline":false,"md5":"705ad0af105ea88015959a3a0dc1711d","sha1":"dc469f69635bee32b4b1f0a9092aa17be29b1e23","sha256":"ebc7d866930563b805b8f036f8c99acc9ec73922bba3030c23367a7f46a48f0f","sha512":"4fbe07de80883a0aabbc9ad0df5a2b294e56363b5dd48077bca1986b7004cbb45e09af27b94fc7f700d4f09c50855da1cbd1c94cec8b96fe5508037a1bf62b23","ssdeep":"","tlshash":"71f059622dbb5008696f54ae175fa00579595403115af910f84df6209f9083452bc8d8","size":513,"data":"","first_seen":"2026-08-10T19:15:10.304609Z","last_seen":"2026-08-10T19:15:10.304609Z","times_seen":1,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"return.st/?ref=dstatspace","fqdn":"return.st","domain":"return.st","tld":"st"},"ip":{"addr":"216.146.31.1","port":443,"asn":207731,"as":"Nxsr, Unipessoal Lda","country":"Taiwan","country_code":"TW"},"introduction_type":"eval","is_inline":false,"md5":"ce521b72da698dde5021db0ac9ab2e3f","sha1":"b570b7ae83d69a829d0f13d789f237bc86ce522c","sha256":"c45ca9b00a609e421ef3fdeea2c3787338b2e33fce9a1cf02f02d7f548875e92","sha512":"4ccb9a50348e76ab4a72be9e9f021a85bbe201fe03cace5b8de8276701626d803467c7bd4987b33390f638cf3f16c682c2a000a1d2b48abf1d03aeb24ce0d3b5","ssdeep":"","tlshash":"64f07d1f89e4123d62332028156e2502633986135e1bff147b5c72206fa661824f8fb8","size":642,"data":"","first_seen":"2026-07-24T22:59:45.945065Z","last_seen":"2026-08-10T19:32:27.422757Z","times_seen":11,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"return.st/?ref=dstatspace","fqdn":"return.st","domain":"return.st","tld":"st"},"ip":{"addr":"216.146.31.1","port":443,"asn":207731,"as":"Nxsr, Unipessoal Lda","country":"Taiwan","country_code":"TW"},"introduction_type":"eval","is_inline":false,"md5":"965b8820ecdbcd0085b26128c20d20b3","sha1":"7af10bdff923aa6a4ede91dfdf6317cc28647a46","sha256":"97c8877ec11fbf8b2684b568d26b395dd2041edee1b975a106b7e7586c456c22","sha512":"21479ac67441c0d4850cee18f5def62bc8eaed25a883150d1181d2c8e93c845275a89fb29f17b36d64237e29dd13f5179d292a975f903e328358e584236d3586","ssdeep":"","tlshash":"35b012463b8c640c24b39493c54f44c4ac5c4615622cf7a8ea0ce852d8e3d1a10ff9d9","size":118,"data":"","first_seen":"2026-08-10T19:15:10.307885Z","last_seen":"2026-08-10T19:15:10.307885Z","times_seen":1,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"return.st/?ref=dstatspace","fqdn":"return.st","domain":"return.st","tld":"st"},"ip":{"addr":"216.146.31.1","port":443,"asn":207731,"as":"Nxsr, Unipessoal Lda","country":"Taiwan","country_code":"TW"},"introduction_type":"eval","is_inline":false,"md5":"d11bf93485abd8d3f96e4d8bda0a8d40","sha1":"099cbfc74f8aac8b187e476a23466bf1445b2b33","sha256":"cb458b70b3623be63c9496524fbc9ca355f5eeace580471e3de10ff08d61b039","sha512":"1f37b372caeea58041297b19b525de77c1f606c79949a72442e0802557294b170f1f6ce5266a31669acc2899ec0302f7dfecc7884ed32bf04ea0570346653b5e","ssdeep":"","tlshash":"c30168862a9b205df39b2078024f300191169d1b5d4ffa10f80c56226f515a951bcecd","size":725,"data":"","first_seen":"2026-07-05T06:42:05.142911Z","last_seen":"2026-08-10T19:32:27.442516Z","times_seen":10,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"return.st/?ref=dstatspace","fqdn":"return.st","domain":"return.st","tld":"st"},"ip":{"addr":"216.146.31.1","port":443,"asn":207731,"as":"Nxsr, Unipessoal Lda","country":"Taiwan","country_code":"TW"},"introduction_type":"eval","is_inline":false,"md5":"845e9dfdfe73ed1cc0ef9678291b7112","sha1":"17801ef80409dfad59cff22d41ecb7ba64c3e7ab","sha256":"7952f794b1c6acfe995942edaec7b5fa31cc23bbaaa40703c908a732a4290037","sha512":"8b4376a9a744dbd29f7f3000fcd1e123c485e6671f8036e6a7dd01abdb0a8bdd84773adfd2a28f3939c37d4b5ae0335a932f64844c19f803e6a3042e0724585e","ssdeep":"3072:HMdaK4oNpPDXw5e00XqE0DpZM76nsy7X6rNpYLztwL:HMdae7PDJhXV0Dpu76skoNp0ztwL","tlshash":"8324b5d2c0a20096fb97833e43f5580d9a65cf1e3eb709b99f72df7a19b1c091a825d1","size":210091,"data":"","first_seen":"2026-08-10T19:15:10.262884Z","last_seen":"2026-08-10T19:15:10.262884Z","times_seen":1,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"return.st/?ref=dstatspace","fqdn":"return.st","domain":"return.st","tld":"st"},"ip":{"addr":"216.146.31.1","port":443,"asn":207731,"as":"Nxsr, Unipessoal Lda","country":"Taiwan","country_code":"TW"},"introduction_type":"eval","is_inline":false,"md5":"523654855ca3c3f89ad4be6e3d4aa28c","sha1":"691411f6967c9607111f29281afd2f2c2a11313e","sha256":"a46e95fc0c4d9224e6b9c6da6c61eca35dfd6eceeb71f1b39e09126625c9e5e0","sha512":"9d6c5334f6951067d488df4725405d5ebb8e4f6e6be2a50df2ba4522d167beefebb1f25f47c52b4b1753fa6de8eb148fc2db14a6148e1e3b697d6ab23eca2301","ssdeep":"","tlshash":"faf027175cfe76f4193ea518039f28236a24846f978adf4c7ec8d2249f28320d2db094","size":492,"data":"","first_seen":"2026-07-24T22:59:45.855432Z","last_seen":"2026-08-10T19:32:27.429063Z","times_seen":11,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"return.st/?ref=dstatspace","fqdn":"return.st","domain":"return.st","tld":"st"},"ip":{"addr":"216.146.31.1","port":443,"asn":207731,"as":"Nxsr, Unipessoal Lda","country":"Taiwan","country_code":"TW"},"introduction_type":"eval","is_inline":false,"md5":"36fac6e9ac14781fcc7df306cfe1888f","sha1":"efc712f9fda261712366e49dac7ce247f4a0fe39","sha256":"d142cd23b9aef360b3795bf16ac3525cebfe43627033392cc182b5902239b7d7","sha512":"def9b084f4d13c6315c1323166b883c6942bf6d5b96a6189b079f4c43e3a88735794f800c65d7b8d8251bba516505cadc49f74e8a1c7d88a796fa36b0fd79b8b","ssdeep":"","tlshash":"fed0a71de3f4192c04063310665e83647615f022a8dc5045f6bce2704fd085dd82076e","size":219,"data":"","first_seen":"2026-07-24T22:59:45.868347Z","last_seen":"2026-08-10T19:32:27.447503Z","times_seen":11,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"return.st/?ref=dstatspace","fqdn":"return.st","domain":"return.st","tld":"st"},"ip":{"addr":"216.146.31.1","port":443,"asn":207731,"as":"Nxsr, Unipessoal Lda","country":"Taiwan","country_code":"TW"},"introduction_type":"eval","is_inline":false,"md5":"02546f7f5fb2e7917eab04d2fa9ef182","sha1":"a96e27a7916fb2ad7d54037b5575a81dfdeacfe4","sha256":"83823f6b4290e98068d4da007431ea5e96b72969d87cb8649e695f83cc5d88b0","sha512":"be9b10baf4419bbf131cd379713a44d61b26ec799018301bbc09553e34a4fb161b93e81597bce82277df5fa7fb8e96b5b8f0ec0c5ac1ad9efff1d206ce1848c7","ssdeep":"","tlshash":"6fa0025d24f52052566b517a156f810424355121509aca643d9e51c5df5017853425dc","size":84,"data":"","first_seen":"2026-07-05T06:42:05.187432Z","last_seen":"2026-08-10T19:32:27.466948Z","times_seen":12,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"return.st/?ref=dstatspace","fqdn":"return.st","domain":"return.st","tld":"st"},"ip":{"addr":"216.146.31.1","port":443,"asn":207731,"as":"Nxsr, Unipessoal Lda","country":"Taiwan","country_code":"TW"},"introduction_type":"eval","is_inline":false,"md5":"5f172b37988434259394fb849394a96d","sha1":"3b437d1537ee25d86cfe39909ddba428d46e9845","sha256":"ee55acf64feff4a0c289dbbbd62e734bb10385bae6bd59dbc013233121e02bf5","sha512":"2517d90db26ad34d384d6fb4d34d31dd0ce82620ccdf97473efe741c8bf7b4b1c23bc669abdf72db295f2305b4c3a00ebb826765fd4ac7945b9452fedb44d938","ssdeep":"","tlshash":"7ba0025c24d16117266bb150135fa154fa5d28171e68d6048888b193a72446bf753468","size":60,"data":"","first_seen":"2026-07-24T22:59:45.8429Z","last_seen":"2026-08-10T19:32:27.465446Z","times_seen":11,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"return.st/?ref=dstatspace","fqdn":"return.st","domain":"return.st","tld":"st"},"ip":{"addr":"216.146.31.1","port":443,"asn":207731,"as":"Nxsr, Unipessoal Lda","country":"Taiwan","country_code":"TW"},"introduction_type":"eval","is_inline":false,"md5":"92436bd209553a02c4e057aac1f6aa27","sha1":"96478671025676e5268ae6371c245a189e934e15","sha256":"99ab9faaa5e314197ab468321d767009b4f21712dbdcd6ca366c976b31953810","sha512":"6cd9b1b6ebd854bf79dbde1e091a831842e0897da9d54d7c372bfd200a768118bec54e14b99bd4731b30eef6cbf3ca67ccaf2f3feaf47870a5aef82cf422059a","ssdeep":"","tlshash":"8121894caeeb2210035770f8036b5446f254a10b6b8dce90fe5c76415f85b70ba767e2","size":1173,"data":"","first_seen":"2026-07-24T22:59:45.845173Z","last_seen":"2026-08-10T19:32:27.399625Z","times_seen":11,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"return.st/?ref=dstatspace","fqdn":"return.st","domain":"return.st","tld":"st"},"ip":{"addr":"216.146.31.1","port":443,"asn":207731,"as":"Nxsr, Unipessoal Lda","country":"Taiwan","country_code":"TW"},"introduction_type":"eval","is_inline":false,"md5":"ca9510c27532834d74765cd309717973","sha1":"2d13e934936ba9a5bd293acc642c33596b3e5ef8","sha256":"7997870646498b4e076305f7720da8397745fbbbece0dd69b8e4c793e7324253","sha512":"bcc55b0e615f0d062577c898fb2de27874cd354b00b736a50ab5fe8aaac319b6a9cd464e5dbb7df1bbb2de2811f8c4d29417c449a7894eb2534ab07904e1fc53","ssdeep":"","tlshash":"6af028b995e2605d402b542a062fc85c71bc911307edd925fd6ce2081fe0828227afc9","size":600,"data":"","first_seen":"2026-07-24T22:59:45.856435Z","last_seen":"2026-08-10T19:32:27.438899Z","times_seen":11,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"return.st/?ref=dstatspace","fqdn":"return.st","domain":"return.st","tld":"st"},"ip":{"addr":"216.146.31.1","port":443,"asn":207731,"as":"Nxsr, Unipessoal Lda","country":"Taiwan","country_code":"TW"},"introduction_type":"eval","is_inline":false,"md5":"29d9ae7a77633964619c46996b2fe058","sha1":"9fe75d4310c325729c58d774b9dbd3467099cbc5","sha256":"82bc782e22a1206a760b98e7e8203f2d1286b3db387f3b226953ac22ef328d3f","sha512":"37a7b40145a4d63a28bf4509be1708440a2d7216594059c974b62eaa226fe336864a9eb38d2d6440423b8af57bebdd842cd9dcad4480cce71ca01eb20e3dfe9a","ssdeep":"","tlshash":"afe092e9d8e561b82511d024c9bdd358a9eac5e3034dcdb0f1d86250af5287233b90d8","size":372,"data":"","first_seen":"2026-07-24T22:59:45.828014Z","last_seen":"2026-08-10T19:32:27.458574Z","times_seen":11,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"return.st/?ref=dstatspace","fqdn":"return.st","domain":"return.st","tld":"st"},"ip":{"addr":"216.146.31.1","port":443,"asn":207731,"as":"Nxsr, Unipessoal Lda","country":"Taiwan","country_code":"TW"},"introduction_type":"eval","is_inline":false,"md5":"0beda254adf4575e4c864d374801f75d","sha1":"fb21d3d8b4a9c3c10066a51635a2f8fe85719a81","sha256":"6a74b999723ed843e172d3575be34b47881161eb35238d2657241bbd3eab87d2","sha512":"58fe4b1221abbadfe8ede5d491ad18bd9a05a37095004fd8ad32b1fb45aa1dc0057db253a996e576488bbc56250e411460893e27287d3e14f37eb5182136a387","ssdeep":"","tlshash":"fa21606998fe9454505b60281aefc428b7fea293016cde91bc9d514dcf70638077af94","size":1162,"data":"","first_seen":"2026-07-24T22:59:45.971764Z","last_seen":"2026-08-10T19:32:27.476662Z","times_seen":11,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"return.st/?ref=dstatspace","fqdn":"return.st","domain":"return.st","tld":"st"},"ip":{"addr":"216.146.31.1","port":443,"asn":207731,"as":"Nxsr, Unipessoal Lda","country":"Taiwan","country_code":"TW"},"introduction_type":"eval","is_inline":false,"md5":"00f4c10c9233463bd1d17603315353d6","sha1":"4cad428bd2e23d47094c41231bda82afe5ea213f","sha256":"7167181f37a51fa8d331badcfb5a3aa21d17ca98ae5f9b243cd83ac5ab620953","sha512":"7697b9176a949360fef4704117744845c5ff0a6279d6fd577dbbd95a98bd2d906a54683f003efd01e51dff7e2ef7f0bcbabc341e4cfe65e06550b33a93c25cd3","ssdeep":"12288:geGB8VAUzv0O+KSFWNzBBDP29WxuZ2YGumAjvR+g3y6g:0BKXz0O+5FWNzvDP29ZTXrvkg3yj","tlshash":"3cc42afae281085c7b0e2cfb65dd5e7e224268b99b8d127d3b44bd474c17919302e9ec","size":578424,"data":"","first_seen":"2026-08-10T19:15:10.24714Z","last_seen":"2026-08-10T19:15:10.24714Z","times_seen":1,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"return.st/?ref=dstatspace","fqdn":"return.st","domain":"return.st","tld":"st"},"ip":{"addr":"216.146.31.1","port":443,"asn":207731,"as":"Nxsr, Unipessoal Lda","country":"Taiwan","country_code":"TW"},"introduction_type":"eval","is_inline":false,"md5":"ea638aa1a8a95af36306ce60a0d19c3e","sha1":"1f003188c00fa1c41550ccc1203faedbd05cd84e","sha256":"03ff05809e3b5fd1a7d59f217c755e857d709af2dc8b2f177f44343d3043df49","sha512":"27e072169912a33a54c435b87b6b1380937bd353e8f2898a79f3130779567dfa2c59a95feb15d181191cee827700a32b25aff65c3f9662d252854a9ec897e6fd","ssdeep":"","tlshash":"0ce065999cdb6061251925342d6fc0057768ac07105dc945fe685550bfc105cc274bb9","size":399,"data":"","first_seen":"2026-07-24T22:59:45.927521Z","last_seen":"2026-08-10T19:32:27.468028Z","times_seen":11,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"return.st/?ref=dstatspace","fqdn":"return.st","domain":"return.st","tld":"st"},"ip":{"addr":"216.146.31.1","port":443,"asn":207731,"as":"Nxsr, Unipessoal Lda","country":"Taiwan","country_code":"TW"},"introduction_type":"eval","is_inline":false,"md5":"a7ff6d789a9cfaf4919a98d730f8ed8c","sha1":"d20c81eec393450b90c7a8ec9dee01a26831c3bf","sha256":"28ef816ab9ab3c76469d5fadefb1ef9205e07eab4a89f43d891284a0a388ba6f","sha512":"8679677b44872816f6c76de33aeabcd6f74b96a4cad8908e7f3074437a1c2f4d0c8a83724abc24a324eb0c006ee6c53da9a8014703b5a36d1651b17e5f6f13d3","ssdeep":"","tlshash":"b1117b3c7464041a352759bc996f4090a2694c27c89abc52f91cb60cdf52d7c0298ba0","size":974,"data":"","first_seen":"2026-07-24T22:59:45.885236Z","last_seen":"2026-08-10T19:32:27.430775Z","times_seen":11,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"return.st/?ref=dstatspace","fqdn":"return.st","domain":"return.st","tld":"st"},"ip":{"addr":"216.146.31.1","port":443,"asn":207731,"as":"Nxsr, Unipessoal Lda","country":"Taiwan","country_code":"TW"},"introduction_type":"eval","is_inline":false,"md5":"3ce090cb068a45f4e8238fcd50b25154","sha1":"19f65381331145766c654641a548f4ba5b748f6e","sha256":"e4ca8c2455ce000a33d7bb39f928b5b7d3f79da290f015fce3dba1e901a30171","sha512":"3452d6d149401ff34157c4472c558fcb179606e2b82eccf95c4af7a5a624c2ea36c7bc110faa69510e6341c1d261298189f5224b4d6fa6c4103f16eda52b853c","ssdeep":"","tlshash":"32e030ad5cf22171013aa03d002e6310773ae833675eaab4bbdc26286f2017696a9f14","size":432,"data":"","first_seen":"2026-07-24T22:59:45.832134Z","last_seen":"2026-08-10T19:32:27.429901Z","times_seen":11,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"return.st/?ref=dstatspace","fqdn":"return.st","domain":"return.st","tld":"st"},"ip":{"addr":"216.146.31.1","port":443,"asn":207731,"as":"Nxsr, Unipessoal Lda","country":"Taiwan","country_code":"TW"},"introduction_type":"eval","is_inline":false,"md5":"132a7a8e4e21e34da2c3958738cfc0f0","sha1":"ab25bec2ef4c0d4d88be8aff56059dd3cd89e989","sha256":"e2419bb01aa150a36691888547c0bc676aff98a5cb7305bac8e2d76b1ab139f6","sha512":"42abe927261255cacd22c2d3adcc32d200b15c4af109de203bd1babc94be868c0b3f122a1af17ca3b497c91fbc692e86f5a0ea2656b0328ac7499fc7b07bf321","ssdeep":"","tlshash":"a601f7194dfe04611643353d072fa144b37684ab185deaf87c8cc2159f85d2e256eef4","size":687,"data":"","first_seen":"2026-07-24T22:59:45.963611Z","last_seen":"2026-08-10T19:32:27.441753Z","times_seen":11,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"return.st/?ref=dstatspace","fqdn":"return.st","domain":"return.st","tld":"st"},"ip":{"addr":"216.146.31.1","port":443,"asn":207731,"as":"Nxsr, Unipessoal Lda","country":"Taiwan","country_code":"TW"},"introduction_type":"eval","is_inline":false,"md5":"12d39a6b845d5179e7df3b6a25e7b2e1","sha1":"1430074420f541b0a797937544e53e6fdf49dd45","sha256":"93616cfb73b6a401b8df60b7e21b907766e920c5445d485f28f355fc1622cd4c","sha512":"6680883e85a05481536f7a555b1894276fb60772f1a395de66eb29a8443c2f53afe4e040f2bbffb664483ceab7a80696ae7c4e25cc6b8d0368c44a65177fd402","ssdeep":"","tlshash":"4b411217de8b20981933e80f877b054e124d846b7d4fc421748da03adfaa93aa67e5d4","size":2125,"data":"","first_seen":"2026-07-24T22:59:45.869746Z","last_seen":"2026-08-10T19:32:27.460535Z","times_seen":11,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"return.st/?ref=dstatspace","fqdn":"return.st","domain":"return.st","tld":"st"},"ip":{"addr":"216.146.31.1","port":443,"asn":207731,"as":"Nxsr, Unipessoal Lda","country":"Taiwan","country_code":"TW"},"introduction_type":"eval","is_inline":false,"md5":"671167404ef561d8954f85f765f42b69","sha1":"1ec24957ee3b410d839bb9444c7489271cbb7e35","sha256":"39bef79c01c2f6bc974c580935736d3f2ae4fa71c9effe7115956cb7b9411887","sha512":"90f68602d955c4cf0d12fa9556c2a9258fd25ee3abc0c2abaae529c47bc151f226d22a88d77556eb46e2203bef8edb9adac6eca80ca504d6eb76d0f7a45aa087","ssdeep":"","tlshash":"8bf0a4af1ef3a522913c203f4a4db0007326c4b3839e8ee0f6855e759f9007b03aae44","size":554,"data":"","first_seen":"2026-07-05T06:42:05.169402Z","last_seen":"2026-08-10T19:32:27.453729Z","times_seen":12,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"return.st/?ref=dstatspace","fqdn":"return.st","domain":"return.st","tld":"st"},"ip":{"addr":"216.146.31.1","port":443,"asn":207731,"as":"Nxsr, Unipessoal Lda","country":"Taiwan","country_code":"TW"},"introduction_type":"eval","is_inline":false,"md5":"b352d86989770ae227d1324e55e3a4ea","sha1":"4d142c7b92821ec3fe0dd3fe2580366e1b4ad277","sha256":"f3259a4c8ed48d854ba80090bede5c6c9a14386b2f9f6e7ce32bc5e85308b042","sha512":"e50ec5cf6b2eed41d75cdcdf1a703dc1d31ce92de248dbb09693a24c1a5b7e2f38f339d3e205bedfe8b9fbc64665720fe9e8d2a95983058d3e0a948659502810","ssdeep":"","tlshash":"ebf050daeaf65845664ea274522dd0d53bdca02311ac9d04fc8c53445f885240291fdd","size":519,"data":"","first_seen":"2026-07-24T22:59:45.826943Z","last_seen":"2026-08-10T19:32:27.484059Z","times_seen":11,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"return.st/?ref=dstatspace","fqdn":"return.st","domain":"return.st","tld":"st"},"ip":{"addr":"216.146.31.1","port":443,"asn":207731,"as":"Nxsr, Unipessoal Lda","country":"Taiwan","country_code":"TW"},"introduction_type":"eval","is_inline":false,"md5":"f99b4de0d3a6ba04b21ec6a61308d921","sha1":"ac376ad3b80f2e76771150d8d69836d5685f6806","sha256":"3a3dc40819b64a689388925fd59a3dcb74e4f24ada6f1d7c06a0c3141fb8f67a","sha512":"acb6cf5b95f6556e3f1fc1b17c1798774666b71ee9830dfdf0b26b78eccb4e8b9146850c45dc1096f8a545db10938d7ee9181695272f62a94efdf9547da631bc","ssdeep":"","tlshash":"5df02b78bce7102c712f245d436f9084e29d48132498e9957bce33ae0f50d2499e9e58","size":545,"data":"","first_seen":"2026-08-10T14:24:56.030103Z","last_seen":"2026-08-10T19:32:27.417981Z","times_seen":6,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"return.st/?ref=dstatspace","fqdn":"return.st","domain":"return.st","tld":"st"},"ip":{"addr":"216.146.31.1","port":443,"asn":207731,"as":"Nxsr, Unipessoal Lda","country":"Taiwan","country_code":"TW"},"introduction_type":"eval","is_inline":false,"md5":"00cca122acc32125512a998f00e1793e","sha1":"f73d8ca58ddf7c9ca17871963605abf5af31b7de","sha256":"96c4e6f0c3b456b7ca039273505afa0523b3513ae513478fbcd0d54e456de18a","sha512":"2d3c4503386310088fb4a674bc39bfac0543959eb4710562f42de5ec7278324725619fe0c491ec1f7a078e4c2f463b4f75e6ffe7ce7da36dbac8a3954b236d7a","ssdeep":"","tlshash":"b3113a0e58f32019267bb8786f2f5004551166174859ee893ecea6705f4336923f0fa4","size":1002,"data":"","first_seen":"2026-07-24T22:59:45.819958Z","last_seen":"2026-08-10T19:32:27.477559Z","times_seen":10,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"return.st/?ref=dstatspace","fqdn":"return.st","domain":"return.st","tld":"st"},"ip":{"addr":"216.146.31.1","port":443,"asn":207731,"as":"Nxsr, Unipessoal Lda","country":"Taiwan","country_code":"TW"},"introduction_type":"eval","is_inline":false,"md5":"a287ed46865fa4b07779dd759ef01137","sha1":"eb916c85c52fcf6bc3d51ef4bd76dfc0779e13c3","sha256":"0206dab339cc45d86188d1a13c3c0ec011460f92dd521439d1d44dbc619fa55d","sha512":"e7b6457e4f97abf591270694e0b55d55eac8c8faea4eb503f08a1c0263deedf28455257769bb68b42e7754a2990ea6c9a27950f5dac9f212dacc6924ee2214d6","ssdeep":"","tlshash":"71d0226628e5a430122a71281b0f7a1a721b8537524dae007c8c4b10ff310b395a43c5","size":195,"data":"","first_seen":"2026-07-05T06:42:05.157973Z","last_seen":"2026-08-10T19:32:27.412962Z","times_seen":7,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"return.st/?ref=dstatspace","fqdn":"return.st","domain":"return.st","tld":"st"},"ip":{"addr":"216.146.31.1","port":443,"asn":207731,"as":"Nxsr, Unipessoal Lda","country":"Taiwan","country_code":"TW"},"introduction_type":"eval","is_inline":false,"md5":"cb7de10071d7e6465a2ca600e12d35bd","sha1":"c51ca4852338f4942d3d2c875437eedd310ab11f","sha256":"369e88583dff55889ca170042804de53cbc6623a0d5b96f0107609e9b879a42b","sha512":"e66593bd561229fa6318fc0807a0137e0ec8fbae94c33eb08b83a71d168072529d30af2189737a8f5032361d3710cfec2fcf22139e4bc72eec34746b68024e50","ssdeep":"","tlshash":"99019cacf8e6303454772034166fc845e32e428b483cfdf0fa9c92a48f601648760bd8","size":750,"data":"","first_seen":"2026-07-24T22:59:45.861364Z","last_seen":"2026-08-10T19:32:27.479414Z","times_seen":11,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"return.st/?ref=dstatspace","fqdn":"return.st","domain":"return.st","tld":"st"},"ip":{"addr":"216.146.31.1","port":443,"asn":207731,"as":"Nxsr, Unipessoal Lda","country":"Taiwan","country_code":"TW"},"introduction_type":"eval","is_inline":false,"md5":"328533fcf99b24ea5fc5b5fa7f075923","sha1":"45fbb9da3730a78cfb1985f7e3636db1ec63d85c","sha256":"85e59efff6f73f20b16c244df294a62abb7be32b67fa51350d69045447bdd9aa","sha512":"67dcb618e7b198abc97ed4928ac4e1cd112e311de679d39366873d0b3bf21037792f5b22f7806043982ada951bf7851c8796a580009676e3b1068aeb3eca8f0e","ssdeep":"","tlshash":"8841f1aa5cbb2021b327317cc75f05402133d653020eed54fb5d6a65af52274a26fbd4","size":2251,"data":"","first_seen":"2026-07-24T22:59:45.875596Z","last_seen":"2026-08-10T19:32:27.401173Z","times_seen":11,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"return.st/?ref=dstatspace","fqdn":"return.st","domain":"return.st","tld":"st"},"ip":{"addr":"216.146.31.1","port":443,"asn":207731,"as":"Nxsr, Unipessoal Lda","country":"Taiwan","country_code":"TW"},"introduction_type":"eval","is_inline":false,"md5":"85190737cc7b75b98d6a9ca71b194548","sha1":"1a8ebf27d704dada047d19d933d11a70e6e1d486","sha256":"f05525993a4143be2b728a8f00878091c5b1e4a51f82962154889249b28eddbc","sha512":"3171cfc0dca446e57424d02c641b4099ef686344fa31e2524208ac59ccddf8f39dc759f6b92a9ceff6bf0358a57cf889e9c6ec889d54e87eafb8d55a0f3a2d6b","ssdeep":"","tlshash":"7bd0a9cbf0c7200ae50d13692c0b8078f724a625608c834098b85381ff9206c4b60b1e","size":210,"data":"","first_seen":"2026-07-05T06:42:05.238595Z","last_seen":"2026-08-10T19:32:27.416953Z","times_seen":12,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"return.st/?ref=dstatspace","fqdn":"return.st","domain":"return.st","tld":"st"},"ip":{"addr":"216.146.31.1","port":443,"asn":207731,"as":"Nxsr, Unipessoal Lda","country":"Taiwan","country_code":"TW"},"introduction_type":"eval","is_inline":false,"md5":"db1bf59aee78484e114e9100c0425943","sha1":"9d8f09f8ecb8e6c24f7735198b72be4b1624bfd1","sha256":"31fcacf0e8330814fd17bacd62a2dbbdd0d55f758bca585f8ff74de0e17c3141","sha512":"7bc69f580b634f54685ec29fb5c5a756f070133f5bc0ed5ffa30851e81180d06c837ac06e91157b2d05f7ce9b61ef0d674035678bb880a6e579cca76810ccb57","ssdeep":"","tlshash":"4bd0a79ee4c6113cc00d1568481b8439f334e91509cda208fda093c8af2502c5be4b09","size":209,"data":"","first_seen":"2026-07-05T06:42:05.144468Z","last_seen":"2026-08-10T19:32:27.432754Z","times_seen":12,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"return.st/?ref=dstatspace","fqdn":"return.st","domain":"return.st","tld":"st"},"ip":{"addr":"216.146.31.1","port":443,"asn":207731,"as":"Nxsr, Unipessoal Lda","country":"Taiwan","country_code":"TW"},"introduction_type":"eval","is_inline":false,"md5":"afb39d90d4b0008769e0abf03be78850","sha1":"b802fa77e2cafa991408b25be14e64b7d808e3da","sha256":"a1f49c0071008c2266eab458e50572aaadefb49d48f9db01d25da5fdb26adc5d","sha512":"3fb7007e19c73e2d07ffe58acdb07e88208c3cf979734c1de92a092b8f14b4922ca1cee6340d3f3abd1a1970a29bb3d26d22101e66aa46ae4528babaccd8376f","ssdeep":"48:8bDJbxPTTei/b3I/SY4SpHQK/UqUjdoTxRP1sA9k8x1QvBMZcsqREYKFNG6TeEEe:ixnH/8KYjpHQK/UqUjdfwkFnQ/NeP5r0","tlshash":"7d91758bcdef3c008ba7644a07ef15c1142da7872d99d19eb99de5d40f8202e0ad8f9d","size":4437,"data":"","first_seen":"2026-08-10T19:15:10.351976Z","last_seen":"2026-08-10T19:15:10.351976Z","times_seen":1,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"return.st/?ref=dstatspace","fqdn":"return.st","domain":"return.st","tld":"st"},"ip":{"addr":"216.146.31.1","port":443,"asn":207731,"as":"Nxsr, Unipessoal Lda","country":"Taiwan","country_code":"TW"},"introduction_type":"eval","is_inline":false,"md5":"9dffc3bac180ad02c5b49d863b52ebcf","sha1":"5ab1a914d69f4d619d015c343f96c13ae3a1e01e","sha256":"1d65526e9af933232efb62863f12fd671c0dad92ac8f0e42471712644cf06c1a","sha512":"834d1e44581033476940acfa9910a7f11da7625394b13e49e71ea47acd4378df9beb8b76a88c84cec4657a9092e005a848fc60aad9c2f7bddfa0d042ef26f0ae","ssdeep":"","tlshash":"baf0ac4fc4cd003d545f1838296ad455a6fce10b084df9627eb0a608afe012c03f5fa1","size":588,"data":"","first_seen":"2026-07-24T22:59:45.936377Z","last_seen":"2026-08-10T19:32:27.439577Z","times_seen":11,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"return.st/?ref=dstatspace","fqdn":"return.st","domain":"return.st","tld":"st"},"ip":{"addr":"216.146.31.1","port":443,"asn":207731,"as":"Nxsr, Unipessoal Lda","country":"Taiwan","country_code":"TW"},"introduction_type":"eval","is_inline":false,"md5":"b3fa3820f94d425fbe15804051d3fdcb","sha1":"6b92d10c32ca07d26de97966330a4dbff6e240e3","sha256":"c10c59f976754e030d527e88102758d72b44af199dcb445ee884a64fe5158a6a","sha512":"5d5c1ae8a753bff1ba5eb7c4828b0e5c80628832ee0021058789911da96de6704c01bf8c7481a056475bfb311a578bf3dbf7c1ba347eca6c1b6d328504669d4f","ssdeep":"","tlshash":"48e0cdef74c370f4150c4556145ed005fd7e7556155d8401f45495406ec4d6c92b9bf7","size":304,"data":"","first_seen":"2026-07-24T22:59:45.860438Z","last_seen":"2026-08-10T19:32:27.492313Z","times_seen":11,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"return.st/?ref=dstatspace","fqdn":"return.st","domain":"return.st","tld":"st"},"ip":{"addr":"216.146.31.1","port":443,"asn":207731,"as":"Nxsr, Unipessoal Lda","country":"Taiwan","country_code":"TW"},"introduction_type":"eval","is_inline":false,"md5":"194caf08a58f1bbf0b8bf0fab4e44845","sha1":"38a374718b4330aec369eb55412cb2eec4668077","sha256":"b917cdbf206ee16f6b29ee9109ea5e435228e59b536772b1c9b2c7782d268a17","sha512":"c8c8fb2751803e7316323763e5bc427d5ad2c92aa90f39fec979b8a6a423891280abf6232027ed1ab7f4d8cbcf24bcc3b38c0505e5dba3c685423b1253491fb1","ssdeep":"","tlshash":"d8d012902da26500021a734c142f65456565d423fcafb8897dd5c710bf1847d7b7e97d","size":196,"data":"","first_seen":"2026-07-24T22:59:45.887429Z","last_seen":"2026-08-10T19:32:27.470326Z","times_seen":11,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"return.st/?ref=dstatspace","fqdn":"return.st","domain":"return.st","tld":"st"},"ip":{"addr":"216.146.31.1","port":443,"asn":207731,"as":"Nxsr, Unipessoal Lda","country":"Taiwan","country_code":"TW"},"introduction_type":"eval","is_inline":false,"md5":"af73b70d12e36024d45673de0ce42a98","sha1":"84aaa0860cabbfd5fba30aacc355644a59723dd0","sha256":"5c78052857e07cc0ae3c29b891ea675daf383d8b488927309f7427627103b310","sha512":"5e4df08b216e61f866d650700cf8e2269ba6fb37c7e1d693cadadb89bafe9b4014f9c2366515a130019acb92ddc62892a1825b27e63ad67eb00a261a69432d03","ssdeep":"","tlshash":"7ff0620e68f12025a633bd2dddbfa104511251471809ea987ddea9701f473386692af4","size":606,"data":"","first_seen":"2026-07-24T22:59:45.965778Z","last_seen":"2026-08-10T19:32:27.481188Z","times_seen":11,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"return.st/.well-known/diamwall/load/html/5s.html","fqdn":"return.st","domain":"return.st","tld":"st"},"ip":{"addr":"216.146.31.1","port":443,"asn":207731,"as":"Nxsr, Unipessoal Lda","country":"Taiwan","country_code":"TW"},"introduction_type":"eventHandler","is_inline":false,"md5":"92ee952ffb2792d6d99a563bfeece2a1","sha1":"a31e8904cd52556769c699df4cc2f42f4b4812e8","sha256":"0ccd034a254309eec7e9aa9144e43dd7fe66506801a66e5138d5794952583344","sha512":"a3759bcfbf0ecff0c68ee1d244e2afce1cbecc2eb9b1c514d254f9f0a115b7640697fbd8c540595116ae973ea34e4e688a58368e44b629f761323fd0da2fa5ea","ssdeep":"","tlshash":"15c080543d2c417d0aa1577766f5d787f66121557086c0164c44dc6d3cd4bc70555474","size":180,"data":"","first_seen":"2026-08-03T21:52:27.860944Z","last_seen":"2026-08-10T19:32:27.434028Z","times_seen":8,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"return.st/?ref=dstatspace","fqdn":"return.st","domain":"return.st","tld":"st"},"ip":{"addr":"216.146.31.1","port":443,"asn":207731,"as":"Nxsr, Unipessoal Lda","country":"Taiwan","country_code":"TW"},"introduction_type":"eval","is_inline":false,"md5":"0623c9572c4b8f43ea231655fd425472","sha1":"186ac8c412f30efead17c8a30554c401b9ce70df","sha256":"e4e5d47bbe0cbe691930fe5c4fcf85a9818a1116680b6f667c3478c7073bf055","sha512":"7c64a3e9e18f67a068a645a22aea88fd6bcf8ee4ca4d1af313b162c26ab99046b772ac120c9e0c8a3aa3ac75198e7f8491ad406f05c4ccde35ee93e6e3f5acb7","ssdeep":"","tlshash":"a0f04978ec81e01ce0df50b6833b8474b9bc5627062de662ba2eb20d0fb072c0154f88","size":635,"data":"","first_seen":"2026-07-24T22:59:45.807606Z","last_seen":"2026-08-10T19:32:27.455478Z","times_seen":11,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"return.st/?ref=dstatspace","fqdn":"return.st","domain":"return.st","tld":"st"},"ip":{"addr":"216.146.31.1","port":443,"asn":207731,"as":"Nxsr, Unipessoal Lda","country":"Taiwan","country_code":"TW"},"introduction_type":"eval","is_inline":false,"md5":"c1462ec71924e370490b3d4b5e8bc4cc","sha1":"bee6a69107e496b47e592c89f3ffd2ec961cb46b","sha256":"5756aeb3744932f8572e440e6b3c55c202848708e48bc11938fe87f75b99aeff","sha512":"79486c09bf482a3db400fb9541e94fa811dea654adca6602ebfa4ad27355294a4748360962de5aab7a4ab53e6c00400a6e1c00f775ae68f7bc4f19a0a6c5b80f","ssdeep":"","tlshash":"12d02b8c7ae5d66d478920c038cac1236d78fc3517ef1c5ac141d460f57857577b0643","size":288,"data":"","first_seen":"2026-07-24T22:59:45.895313Z","last_seen":"2026-08-10T19:32:27.45459Z","times_seen":11,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"return.st/?ref=dstatspace","fqdn":"return.st","domain":"return.st","tld":"st"},"ip":{"addr":"216.146.31.1","port":443,"asn":207731,"as":"Nxsr, Unipessoal Lda","country":"Taiwan","country_code":"TW"},"introduction_type":"eval","is_inline":false,"md5":"ce75f12a3381b6bcca29f4805fb2c53e","sha1":"712f9915b8cc2652fc70dc61875a7fa175db9947","sha256":"a7e11c77a2d4c5e59131a43e3dc2a5d71dcea670c9cd96c54791dc2683c64dd6","sha512":"56d7c0100a046fed0ca519f63eef73773e5f93b1244a11c094b7974185d6ce453738a3099c90b264e36a626ab3f68d44ea6aead2cdb0c0466136c9f4503b655f","ssdeep":"","tlshash":"82a0029db9e57100914e75f4501f4458f72c955124dd5b09eca897c4df3103c8622b1d","size":68,"data":"","first_seen":"2026-07-05T06:42:05.155296Z","last_seen":"2026-08-10T19:32:27.472316Z","times_seen":12,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"return.st/?ref=dstatspace","fqdn":"return.st","domain":"return.st","tld":"st"},"ip":{"addr":"216.146.31.1","port":443,"asn":207731,"as":"Nxsr, Unipessoal Lda","country":"Taiwan","country_code":"TW"},"introduction_type":"eval","is_inline":false,"md5":"7c530f261b7d5ef43b136c8b0499305f","sha1":"7e5009e587fb375916a5e1e36c6b7f471af49e9c","sha256":"f0cb66826d4a66125a68d733752a1a02a035fb2de53a8245455205e2590496f3","sha512":"ef97eab4b7238fc0854d0a926eb335e19126348567bb7c52993e9e22233739acc7cec0ee130c86796afd48be855e61bb920aa6bf9e452b7ddca91be3a7d5d441","ssdeep":"","tlshash":"34119b5d4eba12388323b16d2b6fe36225330443480aceb4bf9ccb546f647685169e88","size":960,"data":"","first_seen":"2026-07-24T22:59:45.830049Z","last_seen":"2026-08-10T19:32:27.411949Z","times_seen":11,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"return.st/?ref=dstatspace","fqdn":"return.st","domain":"return.st","tld":"st"},"ip":{"addr":"216.146.31.1","port":443,"asn":207731,"as":"Nxsr, Unipessoal Lda","country":"Taiwan","country_code":"TW"},"introduction_type":"eval","is_inline":false,"md5":"d5c8c6af1299e6dd711f42b3e82b0baf","sha1":"c9a13582ee7a756e21192c4aaab5a23676e06177","sha256":"6a6766f9fbdd726e3ffa51bc9f56fd850f357d7cc7497594664b8b6c83a1cd36","sha512":"1e8aaa615bf1e4154e8e99b854baa1ef6dfbe087458d7245ae6bb58b87bade85c53f972c11f5d5db5d42dae28e14cbf1985c02836337eb39be4dc699511aa573","ssdeep":"","tlshash":"a5f078e36eab3048b13b30ae032f23006995568b268ccc11f94db6646f9040e8dbd9d4","size":641,"data":"","first_seen":"2026-08-10T19:15:10.381734Z","last_seen":"2026-08-10T19:15:10.381734Z","times_seen":1,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"return.st/?ref=dstatspace","fqdn":"return.st","domain":"return.st","tld":"st"},"ip":{"addr":"216.146.31.1","port":443,"asn":207731,"as":"Nxsr, Unipessoal Lda","country":"Taiwan","country_code":"TW"},"introduction_type":"eval","is_inline":false,"md5":"eccf6abe39126b8050aea5fd1ed36eb5","sha1":"012addc5abe9fa77cf17c7aaec19123b7c6566f2","sha256":"d719c66e52926aa30dcca142925df4fc98c36f335e5ddb29f344c09b05bb444e","sha512":"28689fdb718eb5dfbe50ae520b0e54cbdeb14cf38922d9df908815d3832de9516cd961e1a36cbbca41ee4ea7edf8b4bc2e11e1d88d133179e55afca6fb0e1440","ssdeep":"","tlshash":"7ef04f6e1ea3513005ac20ff190e7411b733c477679d9b60b15389b5af9812e63a5b89","size":561,"data":"","first_seen":"2026-07-24T22:59:45.919473Z","last_seen":"2026-08-10T19:32:27.400168Z","times_seen":11,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"return.st/?ref=dstatspace","fqdn":"return.st","domain":"return.st","tld":"st"},"ip":{"addr":"216.146.31.1","port":443,"asn":207731,"as":"Nxsr, Unipessoal Lda","country":"Taiwan","country_code":"TW"},"introduction_type":"eval","is_inline":false,"md5":"e40b7ac84c2a276020064d91edce0c2e","sha1":"413b236a3e3dedac229fde06a88b234dce963514","sha256":"11b0aa434522a643d22a08aea44728c3e3ba825ffd6cd5e8dbe00848f57b947e","sha512":"1b05e9438e7cf6f3500caeae07a4faac21a69c24241b9f4ea9eedaec59781099bfba05bce6d75301b46939ebce8d957aa77c695db23261f7f664735984a65c39","ssdeep":"","tlshash":"4bf04c44bab605182d27457e437f41087254a02b1a1efc1ebc4cb600af5a83878f5ff6","size":620,"data":"","first_seen":"2026-07-24T22:59:45.942947Z","last_seen":"2026-08-10T19:32:27.480303Z","times_seen":11,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"return.st/?ref=dstatspace","fqdn":"return.st","domain":"return.st","tld":"st"},"ip":{"addr":"216.146.31.1","port":443,"asn":207731,"as":"Nxsr, Unipessoal Lda","country":"Taiwan","country_code":"TW"},"introduction_type":"eval","is_inline":false,"md5":"06597f6b4fc8b652578a7c79d5a3cb20","sha1":"0cc9d2bb199dec00b70f2a29286b1964b24c8fd7","sha256":"4cea7ba1f66fcdfccc17a19b3378f1ca6b40b1d426325a9dc712be9785e53a1a","sha512":"86b5f52a827ce13f9e488f7637b457512ee970cb99e01e52f035423f0f9b8292eb947a979064e91e3c6c9c5e20f075bef439db3d35a4db2d7ea614d0cd7dabad","ssdeep":"","tlshash":"3df078262fab5518a91f949d03af4c09a258ac13030ced5eba9cfb109f81d18b1f84d9","size":633,"data":"","first_seen":"2026-08-10T19:15:10.387544Z","last_seen":"2026-08-10T19:15:10.387544Z","times_seen":1,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"return.st/?ref=dstatspace","fqdn":"return.st","domain":"return.st","tld":"st"},"ip":{"addr":"216.146.31.1","port":443,"asn":207731,"as":"Nxsr, Unipessoal Lda","country":"Taiwan","country_code":"TW"},"introduction_type":"eval","is_inline":false,"md5":"287bb9a6e9b497e043972b22972f215b","sha1":"5f014478a1512d22b285685bfac014755bbe5dfb","sha256":"e6f0d3c903898acadc381aaad7afb5b04a8d65b5ad63c4aefb0805f839e28030","sha512":"8e05f478c515839d57e3cb89e325771582097b0670e504c01a22882aa2d11110fe6ff47677ad86f6271cfffa65e4b14a90735fbbfdc256e4b335299084f036e0","ssdeep":"","tlshash":"aff0c9223ebb9004382f54ae430f90053d180113125ae910f84cf610af8083011bc8d4","size":515,"data":"","first_seen":"2026-08-10T19:15:10.38984Z","last_seen":"2026-08-10T19:15:10.38984Z","times_seen":1,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"return.st/?ref=dstatspace","fqdn":"return.st","domain":"return.st","tld":"st"},"ip":{"addr":"216.146.31.1","port":443,"asn":207731,"as":"Nxsr, Unipessoal Lda","country":"Taiwan","country_code":"TW"},"introduction_type":"eval","is_inline":false,"md5":"8e0b88edd9680042f9a2910ce1fa8339","sha1":"75ea16c09125f4ef2b11b5ad20b116466a3b0275","sha256":"a8a3a9db15a68634a52e66ae64f351306f1b76e26d595ba7dda563cb53670174","sha512":"a7cf89f41919d74d7245586e59c5655678c546a36996573b393bd4eed0f218be1e5b7fdcffd5630737b4f1cdb047a41346c4f3889c26364a820b58dfc8b66052","ssdeep":"96:Zc+chsZSYThksH7cYpsuw0ucMJHwFLax1T5l0:ZCASk7RpOkIx1H0","tlshash":"09f1900eceaf3c501b6ab94a17df18c2651db39b1c91c44db89ee7c05f4413a16d879c","size":7927,"data":"","first_seen":"2026-07-24T22:59:45.975248Z","last_seen":"2026-08-10T19:32:27.478432Z","times_seen":11,"alerts":{"ids":null,"analyzer":null,"urlquery":null}}],"eval":null,"write":null,"console":[{"level":"debug","text":"map[actor:server1.conn0.watcher17.process7//obj45 class:Object extensible:true frozen:false isError:false ownPropertyLength:1 preview:map[kind:Object ownProperties:map[toString:map[configurable:true enumerable:true value:map[actor:server1.conn0.watcher17.process7//obj46 class:Function displayName:toString extensible:true frozen:false isAsync:false isClassConstructor:false isError:false isGenerator:false location:map[column:26551 line:1 url:https://return.st/cdn-cgi/mitigation/v2/chl/chlb.lib?bdt=0\u0026b12=0\u0026brc=0] ownPropertyLength:3 parameterNames:[] sealed:false type:object] writable:true]] ownPropertiesLength:1] sealed:false type:object]","filename":"https://return.st/cdn-cgi/mitigation/v2/chl/chlb.lib?bdt=0\u0026b12=0\u0026brc=0","line_number":1,"column_number":26688},{"level":"debug","text":"map[actor:server1.conn0.watcher17.process7//obj47 class:Object extensible:true frozen:false isError:false ownPropertyLength:0 preview:map[kind:Object ownProperties:map[] ownPropertiesLength:0 ownSymbols:[] ownSymbolsLength:1] sealed:false type:object]","filename":"https://return.st/cdn-cgi/mitigation/v2/chl/chlb.lib?bdt=0\u0026b12=0\u0026brc=0","line_number":1,"column_number":28416},{"level":"debug","text":"","filename":"https://return.st/cdn-cgi/mitigation/v2/chl/chlb.lib?bdt=0\u0026b12=0\u0026brc=0","line_number":1,"column_number":28708},{"level":"debug","text":"map[actor:server1.conn0.watcher17.process7//obj52 class:Object extensible:true frozen:false isError:false ownPropertyLength:1 preview:map[kind:Object ownProperties:map[toString:map[configurable:true enumerable:true value:map[actor:server1.conn0.watcher17.process7//obj53 class:Function displayName:toString extensible:true frozen:false isAsync:false isClassConstructor:false isError:false isGenerator:false location:map[column:26551 line:1 url:https://return.st/cdn-cgi/mitigation/v2/chl/chlb.lib?bdt=0\u0026b12=0\u0026brc=0] ownPropertyLength:3 parameterNames:[] sealed:false type:object] writable:true]] ownPropertiesLength:1] sealed:false type:object]","filename":"https://return.st/cdn-cgi/mitigation/v2/chl/chlb.lib?bdt=0\u0026b12=0\u0026brc=0","line_number":1,"column_number":26688},{"level":"debug","text":"map[actor:server1.conn0.watcher17.process7//obj54 class:Object extensible:true frozen:false isError:false ownPropertyLength:0 preview:map[kind:Object ownProperties:map[] ownPropertiesLength:0 ownSymbols:[] ownSymbolsLength:1] sealed:false type:object]","filename":"https://return.st/cdn-cgi/mitigation/v2/chl/chlb.lib?bdt=0\u0026b12=0\u0026brc=0","line_number":1,"column_number":28416},{"level":"debug","text":"","filename":"https://return.st/cdn-cgi/mitigation/v2/chl/chlb.lib?bdt=0\u0026b12=0\u0026brc=0","line_number":1,"column_number":28708},{"level":"debug","text":"map[actor:server1.conn0.watcher17.process7//obj56 class:Object extensible:true frozen:false isError:false ownPropertyLength:1 preview:map[kind:Object ownProperties:map[toString:map[configurable:true enumerable:true value:map[actor:server1.conn0.watcher17.process7//obj57 class:Function displayName:toString extensible:true frozen:false isAsync:false isClassConstructor:false isError:false isGenerator:false location:map[column:339404 line:1 url:https://return.st/cdn-cgi/mitigation/v2/chl/chlb.lib?bdt=0\u0026b12=0\u0026brc=0] ownPropertyLength:3 parameterNames:[] sealed:false type:object] writable:true]] ownPropertiesLength:1] sealed:false type:object]","filename":"https://return.st/cdn-cgi/mitigation/v2/chl/chlb.lib?bdt=0\u0026b12=0\u0026brc=0 line 1 \u003e eval","line_number":1,"column_number":339540},{"level":"debug","text":"map[actor:server1.conn0.watcher17.process7//obj58 class:Object extensible:true frozen:false isError:false ownPropertyLength:0 preview:map[kind:Object ownProperties:map[] ownPropertiesLength:0 ownSymbols:[] ownSymbolsLength:1] sealed:false type:object]","filename":"https://return.st/cdn-cgi/mitigation/v2/chl/chlb.lib?bdt=0\u0026b12=0\u0026brc=0 line 1 \u003e eval","line_number":1,"column_number":340195},{"level":"debug","text":"","filename":"https://return.st/cdn-cgi/mitigation/v2/chl/chlb.lib?bdt=0\u0026b12=0\u0026brc=0 line 1 \u003e eval","line_number":1,"column_number":340577},{"level":"debug","text":"map[actor:server1.conn0.watcher17.process7//obj99 class:Object extensible:true frozen:false isError:false ownPropertyLength:1 preview:map[kind:Object ownProperties:map[toString:map[configurable:true enumerable:true value:map[actor:server1.conn0.watcher17.process7//obj100 class:Function displayName:toString extensible:true frozen:false isAsync:false isClassConstructor:false isError:false isGenerator:false location:map[column:264131 line:1 url:https://return.st/cdn-cgi/chl/v2/captcha/assets/cpt.lib?mclrdw=0c4a56\u0026sclrdw=2ea8c1] ownPropertyLength:3 parameterNames:[] sealed:false type:object] writable:true]] ownPropertiesLength:1] sealed:false type:object]","filename":"https://return.st/cdn-cgi/chl/v2/captcha/assets/cpt.lib?mclrdw=0c4a56\u0026sclrdw=2ea8c1","line_number":1,"column_number":264770},{"level":"debug","text":"map[actor:server1.conn0.watcher17.process7//obj101 class:Object extensible:true frozen:false isError:false ownPropertyLength:0 preview:map[kind:Object ownProperties:map[] ownPropertiesLength:0 ownSymbols:[] ownSymbolsLength:1] sealed:false type:object]","filename":"https://return.st/cdn-cgi/chl/v2/captcha/assets/cpt.lib?mclrdw=0c4a56\u0026sclrdw=2ea8c1","line_number":1,"column_number":266617},{"level":"debug","text":"","filename":"https://return.st/cdn-cgi/chl/v2/captcha/assets/cpt.lib?mclrdw=0c4a56\u0026sclrdw=2ea8c1","line_number":1,"column_number":267380},{"level":"debug","text":"map[actor:server1.conn0.watcher17.process7//obj110 class:Object extensible:true frozen:false isError:false ownPropertyLength:1 preview:map[kind:Object ownProperties:map[toString:map[configurable:true enumerable:true value:map[actor:server1.conn0.watcher17.process7//obj111 class:Function displayName:toString extensible:true frozen:false isAsync:false isClassConstructor:false isError:false isGenerator:false location:map[column:339404 line:1 url:https://return.st/cdn-cgi/mitigation/v2/chl/chlb.lib?bdt=0\u0026b12=0\u0026brc=0] ownPropertyLength:3 parameterNames:[] sealed:false type:object] writable:true]] ownPropertiesLength:1] sealed:false type:object]","filename":"https://return.st/cdn-cgi/mitigation/v2/chl/chlb.lib?bdt=0\u0026b12=0\u0026brc=0 line 1 \u003e eval","line_number":1,"column_number":339540},{"level":"debug","text":"map[actor:server1.conn0.watcher17.process7//obj112 class:Object extensible:true frozen:false isError:false ownPropertyLength:0 preview:map[kind:Object ownProperties:map[] ownPropertiesLength:0 ownSymbols:[] ownSymbolsLength:1] sealed:false type:object]","filename":"https://return.st/cdn-cgi/mitigation/v2/chl/chlb.lib?bdt=0\u0026b12=0\u0026brc=0 line 1 \u003e eval","line_number":1,"column_number":340195},{"level":"debug","text":"","filename":"https://return.st/cdn-cgi/mitigation/v2/chl/chlb.lib?bdt=0\u0026b12=0\u0026brc=0 line 1 \u003e eval","line_number":1,"column_number":340577},{"level":"debug","text":"map[actor:server1.conn0.watcher17.process7//obj113 class:Object extensible:true frozen:false isError:false ownPropertyLength:1 preview:map[kind:Object ownProperties:map[toString:map[configurable:true enumerable:true value:map[actor:server1.conn0.watcher17.process7//obj114 class:Function displayName:toString extensible:true frozen:false isAsync:false isClassConstructor:false isError:false isGenerator:false location:map[column:264131 line:1 url:https://return.st/cdn-cgi/chl/v2/captcha/assets/cpt.lib?mclrdw=0c4a56\u0026sclrdw=2ea8c1] ownPropertyLength:3 parameterNames:[] sealed:false type:object] writable:true]] ownPropertiesLength:1] sealed:false type:object]","filename":"https://return.st/cdn-cgi/chl/v2/captcha/assets/cpt.lib?mclrdw=0c4a56\u0026sclrdw=2ea8c1","line_number":1,"column_number":264770},{"level":"debug","text":"map[actor:server1.conn0.watcher17.process7//obj115 class:Object extensible:true frozen:false isError:false ownPropertyLength:0 preview:map[kind:Object ownProperties:map[] ownPropertiesLength:0 ownSymbols:[] ownSymbolsLength:1] sealed:false type:object]","filename":"https://return.st/cdn-cgi/chl/v2/captcha/assets/cpt.lib?mclrdw=0c4a56\u0026sclrdw=2ea8c1","line_number":1,"column_number":266617},{"level":"debug","text":"","filename":"https://return.st/cdn-cgi/chl/v2/captcha/assets/cpt.lib?mclrdw=0c4a56\u0026sclrdw=2ea8c1","line_number":1,"column_number":267380},{"level":"debug","text":"map[actor:server1.conn0.watcher17.process7//obj117 class:Object extensible:true frozen:false isError:false ownPropertyLength:1 preview:map[kind:Object ownProperties:map[toString:map[configurable:true enumerable:true value:map[actor:server1.conn0.watcher17.process7//obj118 class:Function displayName:toString extensible:true frozen:false isAsync:false isClassConstructor:false isError:false isGenerator:false location:map[column:87120 line:1 url:https://return.st/cdn-cgi/mitigation/v2/chl/chlb.lib?bdt=0\u0026b12=0\u0026brc=0] ownPropertyLength:3 parameterNames:[] sealed:false type:object] writable:true]] ownPropertiesLength:1] sealed:false type:object]","filename":"https://return.st/cdn-cgi/mitigation/v2/chl/chlb.lib?bdt=0\u0026b12=0\u0026brc=0 line 1 \u003e eval line 1 \u003e eval","line_number":1,"column_number":87257},{"level":"debug","text":"map[actor:server1.conn0.watcher17.process7//obj119 class:Object extensible:true frozen:false isError:false ownPropertyLength:0 preview:map[kind:Object ownProperties:map[] ownPropertiesLength:0 ownSymbols:[] ownSymbolsLength:1] sealed:false type:object]","filename":"https://return.st/cdn-cgi/mitigation/v2/chl/chlb.lib?bdt=0\u0026b12=0\u0026brc=0 line 1 \u003e eval line 1 \u003e eval","line_number":1,"column_number":87952},{"level":"debug","text":"","filename":"https://return.st/cdn-cgi/mitigation/v2/chl/chlb.lib?bdt=0\u0026b12=0\u0026brc=0 line 1 \u003e eval line 1 \u003e eval","line_number":1,"column_number":88354},{"level":"debug","text":"map[actor:server1.conn0.watcher17.process7//obj129 class:Proxy preview:map[kind:Object ownProperties:map[\u003chandler\u003e:map[value:map[actor:server1.conn0.watcher17.process7//obj131 class:Object extensible:true frozen:false isError:false ownPropertyLength:3 sealed:false type:object]] \u003ctarget\u003e:map[value:map[actor:server1.conn0.watcher17.process7//obj130 class:Object extensible:true frozen:false isError:false ownPropertyLength:0 sealed:false type:object]]] ownPropertiesLength:2] type:object]","filename":"https://return.st/cdn-cgi/mitigation/v2/chl/chlb.lib?bdt=0\u0026b12=0\u0026brc=0 line 1 \u003e eval line 1 \u003e eval line 1 \u003e eval","line_number":30,"column_number":15},{"level":"debug","text":"map[actor:server1.conn0.watcher17.process7//obj132 class:Proxy preview:map[kind:Object ownProperties:map[\u003chandler\u003e:map[value:map[actor:server1.conn0.watcher17.process7//obj134 class:Object extensible:true frozen:false isError:false ownPropertyLength:3 sealed:false type:object]] \u003ctarget\u003e:map[value:map[actor:server1.conn0.watcher17.process7//obj133 class:Object extensible:true frozen:false isError:false ownPropertyLength:0 sealed:false type:object]]] ownPropertiesLength:2] type:object]","filename":"https://return.st/cdn-cgi/mitigation/v2/chl/chlb.lib?bdt=0\u0026b12=0\u0026brc=0 line 1 \u003e eval line 1 \u003e eval line 1 \u003e eval","line_number":31,"column_number":15}]},"http":[{"url":{"schema":"https","addr":"cdn.diamwall.com/cdn-cgi/static/img/favicon/favicon.ico","fqdn":"cdn.diamwall.com","domain":"diamwall.com","tld":"com"},"ip":{"addr":"216.146.31.1","port":443,"asn":207731,"as":"Nxsr, Unipessoal Lda","country":"Taiwan","country_code":"TW"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://return.st/?ref=dstatspace","date":"2026-08-10T19:14:59.370Z","timestamp":1786389299370,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"diamwall.com","organization":""},"issuer":{"commonName":"YE1","organization":"Let's Encrypt"},"validity":{"start":"Wed, 10 Jun 2026 21:31:47 GMT","end":"Tue, 08 Sep 2026 21:31:46 GMT"},"fingerprint":{"sha1":"8C:CE:56:A6:E5:6A:1C:36:24:87:DE:1E:74:C8:F1:E2:4D:8B:EB:F9","sha256":"93:78:57:6C:F1:81:2A:18:63:0B:12:0A:AF:E6:75:3E:DC:3D:DB:86:82:EB:B7:94:E8:1C:59:68:73:21:EB:A6"}}},"request":{"raw":"GET /cdn-cgi/static/img/favicon/favicon.ico HTTP/1.1\r\nHost: cdn.diamwall.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-Fetch-Storage-Access: none\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://return.st/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPriority: u=6\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nServer: DiamWall\r\nDate: Mon, 10 Aug 2026 19:14:59 GMT\r\nContent-Type: image/x-icon\r\nContent-Length: 15406\r\nLast-Modified: Mon, 27 Apr 2026 13:23:53 GMT\r\nConnection: keep-alive\r\nVary: Accept-Encoding\r\nETag: \"69ef6369-3c2e\"\r\nAccess-Control-Allow-Origin: *\r\nAccept-Ranges: bytes\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":null,"data":{"size":15406,"size_decoded":15701,"mime_type":"image/x-icon","magic":"MS Windows icon resource - 3 icons, 16x16, 32 bits/pixel, 32x32, 32 bits/pixel","md5":"38dfe099ebf0b5f01c9ab7f97971f417","sha1":"e3b7a470e853edf6eb71f816fe59619a93059c14","sha256":"55448d2fa1df25a26ec25a4d4b917b3f2705b02d407bb8aa754747f5e8789d32","sha512":"33344a9bd3b2c503b7e91bf2e24dd3f013994dba10f9b8efab5f78a047acb61287172e26c8a383088283e104b97188a1ba122717f90b58fd179212f96909bf59","ssdeep":"96:cJqB0pWjttK6HHHHHHHHHNvfHXv6gh1JDVncCgH8CY0hJM1x4e:9iWjtE6HHHHHHHHHNnXZhLDuhb","tlshash":"3762b70feb86a9dace5c1fb444aa2f013224b08bab579307531c64746d172f49a992dc","first_seen":"2024-08-20T10:09:24.764033Z","last_seen":"2026-08-10T19:32:27.394179Z","times_seen":14,"resource_available":false,"data":null}},"time_used":36,"timings":{"blocked":0,"dns":3,"connect":8,"send":0,"wait":9,"receive":1,"ssl":15},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"return.st/cdn-cgi/mitigation/v2/chl/chlb.lib?bdt=0\u0026b12=0\u0026brc=0","fqdn":"return.st","domain":"return.st","tld":"st"},"ip":{"addr":"216.146.31.1","port":443,"asn":207731,"as":"Nxsr, Unipessoal Lda","country":"Taiwan","country_code":"TW"},"is_navigation_request":false,"resource_type":"fetch","requested_by":"https://return.st/?ref=dstatspace","date":"2026-08-10T19:14:59.372Z","timestamp":1786389299372,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"return.st","organization":""},"issuer":{"commonName":"YE1","organization":"Let's Encrypt"},"validity":{"start":"Mon, 06 Jul 2026 14:07:23 GMT","end":"Sun, 04 Oct 2026 14:07:22 GMT"},"fingerprint":{"sha1":"40:A0:76:A0:C1:D5:44:37:24:4B:27:90:51:25:DB:03:CB:97:5F:DE","sha256":"02:BF:B1:92:71:94:2C:AD:50:53:82:AA:28:2F:98:69:02:71:5C:6C:F0:CE:2D:B0:7A:74:F2:83:B6:64:B4:16"}}},"request":{"raw":"GET /cdn-cgi/mitigation/v2/chl/chlb.lib?bdt=0\u0026b12=0\u0026brc=0 HTTP/1.1\r\nHost: return.st\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://return.st/?ref=dstatspace\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nCookie: __diamwall=0x3465975257; dwid=67376803f73b711f6f7529ab69b882c4; _dwa=0\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=4\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nserver: openresty\r\ndate: Mon, 10 Aug 2026 19:14:59 GMT\r\ncontent-type: application/javascript; charset=utf-8\r\nvary: Accept-Encoding\r\nx-powered-by: Express\r\ncache-control: private, no-store\r\netag: W/\"5b7f4-LNuU20SLCOPx6IHr7hn2JziUR1s\"\r\nstrict-transport-security: max-age=31536000; includeSubDomains; preload\r\nx-frame-options: sameorigin\r\nx-content-type-options: nosniff\r\nx-xss-protection: 1; mode=block\r\ncontent-encoding: br\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"Express","description":"Express is a web application framework for Node.js, released as free and open-source software under the MIT License. It is designed for building web applications and APIs.","website":"https://expressjs.com","common_platform_enumeration":"cpe:2.3:a:expressjs:express:*:*:*:*:*:*:*:*","icon":"Express.svg","categories":["Web frameworks","Web servers"]},{"name":"Node.js","description":"Node.js is an open-source, cross-platform, JavaScript runtime environment that executes JavaScript code outside a web browser.","website":"https://nodejs.org","common_platform_enumeration":"cpe:2.3:a:nodejs:node.js:*:*:*:*:*:*:*:*","icon":"Node.js.svg","categories":["Programming languages"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"OpenResty","description":"OpenResty is a web platform based on nginx which can run Lua scripts using its LuaJIT engine.","website":"https://openresty.org","common_platform_enumeration":"","icon":"OpenResty.svg","categories":["Web servers"]}],"data":{"size":374772,"size_decoded":86362,"mime_type":"application/javascript; charset=utf-8","magic":"ASCII text, with very long lines (65536), with no line terminators","md5":"1f2a56e1f0aa87e8d591fd417d2b8b05","sha1":"2cdb94db448b08e3f1e881ebee19f6273894475b","sha256":"c437f917535afd24e6b64f6f20b9840744558178afe2748a4171b35116d624f4","sha512":"3506d1ef2671b1997dc391ab76659a8bb84269f8f7d563cf363c131721dba633c885ab769edad9c52a66e33d2e842d0a8c1ba8190ec8b570854b032a62cd563b","ssdeep":"1536:B0Ic/N3O8oi3uymwaGe6XMnqSuI9VgkA646PBhPzEWOKwRDeh2v7WoNLTAxfOfnD:BQ/dO8o6JMn9KiPhfmo3oVdGckJt9ofP","tlshash":"9f8408c7e68525f9e14ba0eccbde20ad92685f1371ea430e3a7ac3715d7f41a4e2c521","first_seen":"2026-08-10T19:15:10.244392Z","last_seen":"2026-08-10T19:15:10.244392Z","times_seen":1,"resource_available":false,"data":null}},"time_used":509,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":509,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-08-10","alert":"Sinkholed","trigger":"return.st","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-08-10","alert":"Sinkholed","trigger":"return.st","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"return.st/cdn-cgi/mitigation/v2/chl/lib/a1ba89a364b4","fqdn":"return.st","domain":"return.st","tld":"st"},"ip":{"addr":"216.146.31.1","port":443,"asn":207731,"as":"Nxsr, Unipessoal Lda","country":"Taiwan","country_code":"TW"},"is_navigation_request":false,"resource_type":"fetch","requested_by":"https://return.st/?ref=dstatspace","date":"2026-08-10T19:14:59.916Z","timestamp":1786389299916,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"return.st","organization":""},"issuer":{"commonName":"YE1","organization":"Let's Encrypt"},"validity":{"start":"Mon, 06 Jul 2026 14:07:23 GMT","end":"Sun, 04 Oct 2026 14:07:22 GMT"},"fingerprint":{"sha1":"40:A0:76:A0:C1:D5:44:37:24:4B:27:90:51:25:DB:03:CB:97:5F:DE","sha256":"02:BF:B1:92:71:94:2C:AD:50:53:82:AA:28:2F:98:69:02:71:5C:6C:F0:CE:2D:B0:7A:74:F2:83:B6:64:B4:16"}}},"request":{"raw":"GET /cdn-cgi/mitigation/v2/chl/lib/a1ba89a364b4 HTTP/1.1\r\nHost: return.st\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://return.st/?ref=dstatspace\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nCookie: __diamwall=0x3465975257; dwid=67376803f73b711f6f7529ab69b882c4; _dwa=0\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=4\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nserver: openresty\r\ndate: Mon, 10 Aug 2026 19:15:00 GMT\r\ncontent-type: application/javascript; charset=utf-8\r\nvary: Accept-Encoding\r\nx-powered-by: Express\r\ncache-control: no-store, no-cache, must-revalidate\r\nx-dw-variant-spec-id: f592f21cc02e\r\nx-dw-core-hash: 7167181f37a51fa8d331badcfb5a3aa21d17ca98ae5f9b243cd83ac5ab620953\r\netag: W/\"8d378-TK1Ci9LiPUcJTEEjG9qCr+XqIT8\"\r\nstrict-transport-security: max-age=31536000; includeSubDomains; preload\r\nx-frame-options: sameorigin\r\nx-content-type-options: nosniff\r\nx-xss-protection: 1; mode=block\r\ncontent-encoding: br\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Node.js","description":"Node.js is an open-source, cross-platform, JavaScript runtime environment that executes JavaScript code outside a web browser.","website":"https://nodejs.org","common_platform_enumeration":"cpe:2.3:a:nodejs:node.js:*:*:*:*:*:*:*:*","icon":"Node.js.svg","categories":["Programming languages"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"OpenResty","description":"OpenResty is a web platform based on nginx which can run Lua scripts using its LuaJIT engine.","website":"https://openresty.org","common_platform_enumeration":"","icon":"OpenResty.svg","categories":["Web servers"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"Express","description":"Express is a web application framework for Node.js, released as free and open-source software under the MIT License. It is designed for building web applications and APIs.","website":"https://expressjs.com","common_platform_enumeration":"cpe:2.3:a:expressjs:express:*:*:*:*:*:*:*:*","icon":"Express.svg","categories":["Web frameworks","Web servers"]}],"data":{"size":578424,"size_decoded":306587,"mime_type":"application/javascript; charset=utf-8","magic":"ASCII text, with very long lines (65536), with no line terminators","md5":"00f4c10c9233463bd1d17603315353d6","sha1":"4cad428bd2e23d47094c41231bda82afe5ea213f","sha256":"7167181f37a51fa8d331badcfb5a3aa21d17ca98ae5f9b243cd83ac5ab620953","sha512":"7697b9176a949360fef4704117744845c5ff0a6279d6fd577dbbd95a98bd2d906a54683f003efd01e51dff7e2ef7f0bcbabc341e4cfe65e06550b33a93c25cd3","ssdeep":"12288:geGB8VAUzv0O+KSFWNzBBDP29WxuZ2YGumAjvR+g3y6g:0BKXz0O+5FWNzvDP29ZTXrvkg3yj","tlshash":"3cc42afae281085c7b0e2cfb65dd5e7e224268b99b8d127d3b44bd474c17919302e9ec","first_seen":"2026-08-10T19:15:10.24714Z","last_seen":"2026-08-10T19:15:10.24714Z","times_seen":1,"resource_available":true,"data":null}},"time_used":429,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":429,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-08-10","alert":"Sinkholed","trigger":"return.st","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-08-10","alert":"Sinkholed","trigger":"return.st","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"return.st/cdn-cgi/chl/v2/captcha/assets/cpt.lib?mclrdw=0c4a56\u0026sclrdw=2ea8c1","fqdn":"return.st","domain":"return.st","tld":"st"},"ip":{"addr":"216.146.31.1","port":443,"asn":207731,"as":"Nxsr, Unipessoal Lda","country":"Taiwan","country_code":"TW"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://return.st/.well-known/diamwall/load/html/5s.html","date":"2026-08-10T19:14:59.918Z","timestamp":1786389299918,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"return.st","organization":""},"issuer":{"commonName":"YE1","organization":"Let's Encrypt"},"validity":{"start":"Mon, 06 Jul 2026 14:07:23 GMT","end":"Sun, 04 Oct 2026 14:07:22 GMT"},"fingerprint":{"sha1":"40:A0:76:A0:C1:D5:44:37:24:4B:27:90:51:25:DB:03:CB:97:5F:DE","sha256":"02:BF:B1:92:71:94:2C:AD:50:53:82:AA:28:2F:98:69:02:71:5C:6C:F0:CE:2D:B0:7A:74:F2:83:B6:64:B4:16"}}},"request":{"raw":"GET /cdn-cgi/chl/v2/captcha/assets/cpt.lib?mclrdw=0c4a56\u0026sclrdw=2ea8c1 HTTP/1.1\r\nHost: return.st\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://return.st/.well-known/diamwall/load/html/5s.html\r\nCookie: __diamwall=0x3465975257; dwid=67376803f73b711f6f7529ab69b882c4; _dwa=0\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nserver: openresty\r\ndate: Mon, 10 Aug 2026 19:15:00 GMT\r\ncontent-type: application/javascript; charset=utf-8\r\nvary: Accept-Encoding\r\nx-powered-by: Express\r\ncache-control: private, no-store\r\nx-dw-variant-spec-id: 80bf00ac7504\r\netag: W/\"bf55c-0u9Cs8uuraJ976h4shH4k9bNG7U\"\r\nstrict-transport-security: max-age=31536000; includeSubDomains; preload\r\nx-frame-options: sameorigin\r\nx-content-type-options: nosniff\r\nx-xss-protection: 1; mode=block\r\ncontent-encoding: br\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Express","description":"Express is a web application framework for Node.js, released as free and open-source software under the MIT License. It is designed for building web applications and APIs.","website":"https://expressjs.com","common_platform_enumeration":"cpe:2.3:a:expressjs:express:*:*:*:*:*:*:*:*","icon":"Express.svg","categories":["Web frameworks","Web servers"]},{"name":"Node.js","description":"Node.js is an open-source, cross-platform, JavaScript runtime environment that executes JavaScript code outside a web browser.","website":"https://nodejs.org","common_platform_enumeration":"cpe:2.3:a:nodejs:node.js:*:*:*:*:*:*:*:*","icon":"Node.js.svg","categories":["Programming languages"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"OpenResty","description":"OpenResty is a web platform based on nginx which can run Lua scripts using its LuaJIT engine.","website":"https://openresty.org","common_platform_enumeration":"","icon":"OpenResty.svg","categories":["Web servers"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":783708,"size_decoded":280624,"mime_type":"application/javascript; charset=utf-8","magic":"ASCII text, with very long lines (65536), with no line terminators","md5":"61120b3c678cd75c071c3a6e1ca625f7","sha1":"d2ef42b3cbaeada27defa878b211f893d6cd1bb5","sha256":"9233c90bdff112989e043273b0498b7f81de593598c77f48548ee00f5f2d57d1","sha512":"7146d7b61afb0cd8313a27a0e92fe51c79e766e3ca4c9f772d896bd848e9c5c50a30d0d4197d646f31c6d3c8106181073d04e50a93ccf77bd00a75790498db3e","ssdeep":"6144:Nfjr66bjdweyDP9h1XyW+NZSKGfpaevknXznS+n2KnH5ZkuVDHOXCQnjdX/64FfR:BG6i5zT1XL+6Rhae8jnN5H5YbR","tlshash":"73f481f4fe4922e9a94fd01780cecb2a99c0a974d64d93142dcc7f2b4e619ab470f761","first_seen":"2026-08-10T19:15:10.250035Z","last_seen":"2026-08-10T19:15:10.250035Z","times_seen":1,"resource_available":true,"data":null}},"time_used":427,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":427,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-08-10","alert":"Sinkholed","trigger":"return.st","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-08-10","alert":"Sinkholed","trigger":"return.st","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"return.st/cdn-cgi/challenge/v2/api/init","fqdn":"return.st","domain":"return.st","tld":"st"},"ip":{"addr":"216.146.31.1","port":443,"asn":207731,"as":"Nxsr, Unipessoal Lda","country":"Taiwan","country_code":"TW"},"is_navigation_request":false,"resource_type":"fetch","requested_by":"https://return.st/?ref=dstatspace","date":"2026-08-10T19:15:00.900Z","timestamp":1786389300900,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"return.st","organization":""},"issuer":{"commonName":"YE1","organization":"Let's Encrypt"},"validity":{"start":"Mon, 06 Jul 2026 14:07:23 GMT","end":"Sun, 04 Oct 2026 14:07:22 GMT"},"fingerprint":{"sha1":"40:A0:76:A0:C1:D5:44:37:24:4B:27:90:51:25:DB:03:CB:97:5F:DE","sha256":"02:BF:B1:92:71:94:2C:AD:50:53:82:AA:28:2F:98:69:02:71:5C:6C:F0:CE:2D:B0:7A:74:F2:83:B6:64:B4:16"}}},"request":{"raw":"POST /cdn-cgi/challenge/v2/api/init HTTP/1.1\r\nHost: return.st\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://return.st/?ref=dstatspace\r\nContent-Type: application/json\r\nContent-Length: 123\r\nOrigin: https://return.st\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nCookie: __diamwall=0x3465975257; dwid=67376803f73b711f6f7529ab69b882c4; _dwa=0\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=4\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"POST","post_data":{"size":123,"data":"{\"sv\":3,\"sp\":\"f592f21cc02e\",\"k\":\"BDvqz+BgY2xi7QH/wRIB6EAOkghMvZi1wfB7Vxk2LygwCPTyz7NmT8RXdCyxFsWpRMrCTf1rhE2hkCrcD7oTjXg=\"}"}},"response":{"raw":"HTTP/2 200 \r\nserver: openresty\r\ndate: Mon, 10 Aug 2026 19:15:01 GMT\r\ncontent-type: application/json; charset=utf-8\r\nvary: Accept-Encoding\r\nx-powered-by: Express\r\netag: W/\"c88-8u9kGmrPDgskZ/Ft6XHUIcLqjg8\"\r\nstrict-transport-security: max-age=31536000; includeSubDomains; preload\r\nx-frame-options: sameorigin\r\nx-content-type-options: nosniff\r\nx-xss-protection: 1; mode=block\r\ncontent-encoding: br\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Node.js","description":"Node.js is an open-source, cross-platform, JavaScript runtime environment that executes JavaScript code outside a web browser.","website":"https://nodejs.org","common_platform_enumeration":"cpe:2.3:a:nodejs:node.js:*:*:*:*:*:*:*:*","icon":"Node.js.svg","categories":["Programming languages"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"OpenResty","description":"OpenResty is a web platform based on nginx which can run Lua scripts using its LuaJIT engine.","website":"https://openresty.org","common_platform_enumeration":"","icon":"OpenResty.svg","categories":["Web servers"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"Express","description":"Express is a web application framework for Node.js, released as free and open-source software under the MIT License. It is designed for building web applications and APIs.","website":"https://expressjs.com","common_platform_enumeration":"cpe:2.3:a:expressjs:express:*:*:*:*:*:*:*:*","icon":"Express.svg","categories":["Web frameworks","Web servers"]}],"data":{"size":3208,"size_decoded":2862,"mime_type":"application/json; charset=utf-8","magic":"JSON text data","md5":"f0916d6b180e65da80cc47bc0321752b","sha1":"f2ef641a6acf0e0b2467f16de971d421c2ea8e0f","sha256":"64748c83e824d45d838f98e8a8704d2fd90eb08cb0bdfc9e09572341acfa7831","sha512":"a6e5f914e8c221f5040ff9e24acd7eeec6640f86dbefb0b0001709d4fd192411eceab0e16dc9325a7cb1bf954dd81ade37edb0851acc2f739d8bbc58bd6a77b4","ssdeep":"","tlshash":"fc614a26def5b3a789a30d4734f5d4c6ba5316bf1d88f413ad101e91b889900cf1a6ea","first_seen":"2026-08-10T19:15:10.252651Z","last_seen":"2026-08-10T19:15:10.252651Z","times_seen":1,"resource_available":false,"data":null}},"time_used":145,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":145,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-08-10","alert":"Sinkholed","trigger":"return.st","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-08-10","alert":"Sinkholed","trigger":"return.st","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"return.st/?ref=dstatspace","fqdn":"return.st","domain":"return.st","tld":"st"},"ip":{"addr":"216.146.31.1","port":443,"asn":207731,"as":"Nxsr, Unipessoal Lda","country":"Taiwan","country_code":"TW"},"is_navigation_request":true,"resource_type":"document","requested_by":"","date":"2026-08-10T19:14:27.716Z","timestamp":1786389267716,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"return.st","organization":""},"issuer":{"commonName":"YE1","organization":"Let's Encrypt"},"validity":{"start":"Mon, 06 Jul 2026 14:07:23 GMT","end":"Sun, 04 Oct 2026 14:07:22 GMT"},"fingerprint":{"sha1":"40:A0:76:A0:C1:D5:44:37:24:4B:27:90:51:25:DB:03:CB:97:5F:DE","sha256":"02:BF:B1:92:71:94:2C:AD:50:53:82:AA:28:2F:98:69:02:71:5C:6C:F0:CE:2D:B0:7A:74:F2:83:B6:64:B4:16"}}},"request":{"raw":"GET /?ref=dstatspace HTTP/1.1\r\nHost: return.st\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nUpgrade-Insecure-Requests: 1\r\nSec-Fetch-Dest: document\r\nSec-Fetch-Mode: navigate\r\nSec-Fetch-Site: none\r\nPriority: u=0, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 307 \r\nserver: openresty\r\ndate: Mon, 10 Aug 2026 19:14:58 GMT\r\ncontent-type: text/html\r\ncontent-length: 167\r\nlocation: https://return.st/?ref=dstatspace\r\nset-cookie: __diamwall=0x3465975257; Path=/; Expires=Mon, 10 Aug 2026 19:19:58 GMT; Domain=.return.st; Secure; SameSite=None\r\ncache-control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0\r\npragma: no-cache\r\nx-accel-expires: 0\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"307","status_text":"","fingerprints":[{"name":"OpenResty","description":"OpenResty is a web platform based on nginx which can run Lua scripts using its LuaJIT engine.","website":"https://openresty.org","common_platform_enumeration":"","icon":"OpenResty.svg","categories":["Web servers"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":0,"size_decoded":0,"mime_type":"text/html","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-08-11T05:57:28.976551Z","times_seen":17831158,"resource_available":true,"data":null}},"time_used":61277,"timings":{"blocked":-1,"dns":30621,"connect":30626,"send":0,"wait":8,"receive":0,"ssl":21},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-08-10","alert":"Sinkholed","trigger":"return.st","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-08-10","alert":"Sinkholed","trigger":"return.st","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"return.st/.well-known/diamwall/load/html/5s.html","fqdn":"return.st","domain":"return.st","tld":"st"},"ip":{"addr":"216.146.31.1","port":443,"asn":207731,"as":"Nxsr, Unipessoal Lda","country":"Taiwan","country_code":"TW"},"is_navigation_request":false,"resource_type":"subdocument","requested_by":"https://return.st/?ref=dstatspace","date":"2026-08-10T19:14:58.577Z","timestamp":1786389298577,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"return.st","organization":""},"issuer":{"commonName":"YE1","organization":"Let's Encrypt"},"validity":{"start":"Mon, 06 Jul 2026 14:07:23 GMT","end":"Sun, 04 Oct 2026 14:07:22 GMT"},"fingerprint":{"sha1":"40:A0:76:A0:C1:D5:44:37:24:4B:27:90:51:25:DB:03:CB:97:5F:DE","sha256":"02:BF:B1:92:71:94:2C:AD:50:53:82:AA:28:2F:98:69:02:71:5C:6C:F0:CE:2D:B0:7A:74:F2:83:B6:64:B4:16"}}},"request":{"raw":"GET /.well-known/diamwall/load/html/5s.html HTTP/1.1\r\nHost: return.st\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://return.st/?ref=dstatspace\r\nCookie: __diamwall=0x3465975257; dwid=67376803f73b711f6f7529ab69b882c4; _dwa=0\r\nUpgrade-Insecure-Requests: 1\r\nSec-Fetch-Dest: iframe\r\nSec-Fetch-Mode: navigate\r\nSec-Fetch-Site: same-origin\r\nPriority: u=4\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nserver: openresty\r\ndate: Mon, 10 Aug 2026 19:14:58 GMT\r\ncontent-type: text/html\r\nlast-modified: Sun, 02 Aug 2026 18:48:53 GMT\r\nvary: Accept-Encoding\r\netag: W/\"6a6f9115-43bc\"\r\nstrict-transport-security: max-age=31536000; includeSubDomains; preload\r\nx-frame-options: sameorigin\r\nx-content-type-options: nosniff\r\nx-xss-protection: 1; mode=block\r\ncontent-encoding: br\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"OpenResty","description":"OpenResty is a web platform based on nginx which can run Lua scripts using its LuaJIT engine.","website":"https://openresty.org","common_platform_enumeration":"","icon":"OpenResty.svg","categories":["Web servers"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":17340,"size_decoded":9079,"mime_type":"text/html","magic":"HTML document, ASCII text, with very long lines (17340), with no line terminators","md5":"7f21fc605a1d55df8558305cc5b72d08","sha1":"a183e481181bf90520692972448578d6bf03e775","sha256":"2f2471f9076c3cb8e32c4b389be2efdb2177fe6c15a79bd713bd0b98f8683660","sha512":"e30af18ad517f1b7d82b8803ddcacc640d1ab52d2c3c1e2bf910458926345ea00e6405160a18499408efe9767ac2f90065a3d8144ce1d70ef05734d990d2abce","ssdeep":"384:r1FyNlKF4RAf/Rpf7qS7Qa6YiujVHoxLJHD876b7KRUx:r1FybKFDf/buWQ+iCohZqRUx","tlshash":"00726cf5bd74a03cc6cb87a631eef66d7539b103b81356b7a4ae01840ad47675133e44","first_seen":"2026-08-03T21:52:27.830452Z","last_seen":"2026-08-10T19:32:27.390456Z","times_seen":8,"resource_available":false,"data":null}},"time_used":10,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":10,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-08-10","alert":"Sinkholed","trigger":"return.st","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-08-10","alert":"Sinkholed","trigger":"return.st","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"return.st/cdn-cgi/mitigation/v2/chl/chlb.lib?bdt=0\u0026b12=0\u0026brc=0","fqdn":"return.st","domain":"return.st","tld":"st"},"ip":{"addr":"216.146.31.1","port":443,"asn":207731,"as":"Nxsr, Unipessoal Lda","country":"Taiwan","country_code":"TW"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://return.st/?ref=dstatspace","date":"2026-08-10T19:14:58.579Z","timestamp":1786389298579,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"return.st","organization":""},"issuer":{"commonName":"YE1","organization":"Let's Encrypt"},"validity":{"start":"Mon, 06 Jul 2026 14:07:23 GMT","end":"Sun, 04 Oct 2026 14:07:22 GMT"},"fingerprint":{"sha1":"40:A0:76:A0:C1:D5:44:37:24:4B:27:90:51:25:DB:03:CB:97:5F:DE","sha256":"02:BF:B1:92:71:94:2C:AD:50:53:82:AA:28:2F:98:69:02:71:5C:6C:F0:CE:2D:B0:7A:74:F2:83:B6:64:B4:16"}}},"request":{"raw":"GET /cdn-cgi/mitigation/v2/chl/chlb.lib?bdt=0\u0026b12=0\u0026brc=0 HTTP/1.1\r\nHost: return.st\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://return.st/?ref=dstatspace\r\nCookie: __diamwall=0x3465975257; dwid=67376803f73b711f6f7529ab69b882c4; _dwa=0\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nserver: openresty\r\ndate: Mon, 10 Aug 2026 19:14:58 GMT\r\ncontent-type: application/javascript; charset=utf-8\r\nvary: Accept-Encoding\r\nx-powered-by: Express\r\ncache-control: private, no-store\r\netag: W/\"52ed9-tdTIwQv+ryAZ/5Yd290NCxyg21M\"\r\nstrict-transport-security: max-age=31536000; includeSubDomains; preload\r\nx-frame-options: sameorigin\r\nx-content-type-options: nosniff\r\nx-xss-protection: 1; mode=block\r\ncontent-encoding: br\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"Express","description":"Express is a web application framework for Node.js, released as free and open-source software under the MIT License. It is designed for building web applications and APIs.","website":"https://expressjs.com","common_platform_enumeration":"cpe:2.3:a:expressjs:express:*:*:*:*:*:*:*:*","icon":"Express.svg","categories":["Web frameworks","Web servers"]},{"name":"Node.js","description":"Node.js is an open-source, cross-platform, JavaScript runtime environment that executes JavaScript code outside a web browser.","website":"https://nodejs.org","common_platform_enumeration":"cpe:2.3:a:nodejs:node.js:*:*:*:*:*:*:*:*","icon":"Node.js.svg","categories":["Programming languages"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"OpenResty","description":"OpenResty is a web platform based on nginx which can run Lua scripts using its LuaJIT engine.","website":"https://openresty.org","common_platform_enumeration":"","icon":"OpenResty.svg","categories":["Web servers"]}],"data":{"size":339673,"size_decoded":86354,"mime_type":"application/javascript; charset=utf-8","magic":"ASCII text, with very long lines (65536), with no line terminators","md5":"bafb57bca5b47c1587e0b0244e16b409","sha1":"b5d4c8c10bfeaf2019ff961ddbdd0d0b1ca0db53","sha256":"0403f3a6f937ddc1bce191ce7a167f6c82b92a3ff44d84213b4bd8aa31553acd","sha512":"f42d4a93fd8058ebaa9a3ee2c60c4555bb23479ea7bb04b59e725b32600f80bb037e004ef1051db4b5ea83823d45002aa7cb51e1c3cd50effa7a355239ceef17","ssdeep":"3072:8PlyKyiOZGkl3uuYl4OW/Sbx/ctj//Cc+u:8PlZ7QtYDdbxS//Zd","tlshash":"b9748d69eec503fb1ccb09f68e5d183d2ec069c17b9f10bc535bdb86406152a8b7a9c6","first_seen":"2026-08-10T19:15:10.256744Z","last_seen":"2026-08-10T19:15:10.256744Z","times_seen":1,"resource_available":true,"data":null}},"time_used":503,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":503,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-08-10","alert":"Sinkholed","trigger":"return.st","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-08-10","alert":"Sinkholed","trigger":"return.st","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"return.st/cdn-cgi/challenge/translations","fqdn":"return.st","domain":"return.st","tld":"st"},"ip":{"addr":"216.146.31.1","port":443,"asn":207731,"as":"Nxsr, Unipessoal Lda","country":"Taiwan","country_code":"TW"},"is_navigation_request":false,"resource_type":"fetch","requested_by":"https://return.st/.well-known/diamwall/load/html/5s.html","date":"2026-08-10T19:14:58.619Z","timestamp":1786389298619,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"return.st","organization":""},"issuer":{"commonName":"YE1","organization":"Let's Encrypt"},"validity":{"start":"Mon, 06 Jul 2026 14:07:23 GMT","end":"Sun, 04 Oct 2026 14:07:22 GMT"},"fingerprint":{"sha1":"40:A0:76:A0:C1:D5:44:37:24:4B:27:90:51:25:DB:03:CB:97:5F:DE","sha256":"02:BF:B1:92:71:94:2C:AD:50:53:82:AA:28:2F:98:69:02:71:5C:6C:F0:CE:2D:B0:7A:74:F2:83:B6:64:B4:16"}}},"request":{"raw":"GET /cdn-cgi/challenge/translations HTTP/1.1\r\nHost: return.st\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://return.st/.well-known/diamwall/load/html/5s.html\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nCookie: __diamwall=0x3465975257; dwid=67376803f73b711f6f7529ab69b882c4; _dwa=0\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=4\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nserver: openresty\r\ndate: Mon, 10 Aug 2026 19:14:58 GMT\r\ncontent-type: application/json; charset=utf-8\r\nvary: Accept-Encoding\r\nx-powered-by: Express\r\netag: W/\"1e8-e43RvgaRlVMMe6jHL/aCR9wZ/QQ\"\r\nstrict-transport-security: max-age=31536000; includeSubDomains; preload\r\nx-frame-options: sameorigin\r\nx-content-type-options: nosniff\r\nx-xss-protection: 1; mode=block\r\ncontent-encoding: br\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"OpenResty","description":"OpenResty is a web platform based on nginx which can run Lua scripts using its LuaJIT engine.","website":"https://openresty.org","common_platform_enumeration":"","icon":"OpenResty.svg","categories":["Web servers"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"Express","description":"Express is a web application framework for Node.js, released as free and open-source software under the MIT License. It is designed for building web applications and APIs.","website":"https://expressjs.com","common_platform_enumeration":"cpe:2.3:a:expressjs:express:*:*:*:*:*:*:*:*","icon":"Express.svg","categories":["Web frameworks","Web servers"]},{"name":"Node.js","description":"Node.js is an open-source, cross-platform, JavaScript runtime environment that executes JavaScript code outside a web browser.","website":"https://nodejs.org","common_platform_enumeration":"cpe:2.3:a:nodejs:node.js:*:*:*:*:*:*:*:*","icon":"Node.js.svg","categories":["Programming languages"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":488,"size_decoded":720,"mime_type":"application/json; charset=utf-8","magic":"JSON text data","md5":"bd55a012febf2d42b5b2f0a980110844","sha1":"7b8dd1be069195530c7ba8c72ff68247dc19fd04","sha256":"acbaca1a82463eb6a9f0e113b1d7a8a4adb18fff6788f4fbe2ef62dc111ff5dd","sha512":"e2ce078e291d84f80fcead069c4a1625823026839d1beba8cd3b12ec9736e8a6400bb7af5445fcec87d79cfca8751ec9687f3b25e69b19f1d18bf9d6ae69184c","ssdeep":"","tlshash":"a3f00e57c08c91740ba28442788b2791d740906833e4657758ab11ec0262390e2b3bc7","first_seen":"2026-07-05T06:42:05.123609Z","last_seen":"2026-08-10T19:32:27.393309Z","times_seen":12,"resource_available":false,"data":null}},"time_used":83,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":83,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-08-10","alert":"Sinkholed","trigger":"return.st","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-08-10","alert":"Sinkholed","trigger":"return.st","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"return.st/cdn-cgi/chl/v2/captcha/assets/cpt.css","fqdn":"return.st","domain":"return.st","tld":"st"},"ip":{"addr":"216.146.31.1","port":443,"asn":207731,"as":"Nxsr, Unipessoal Lda","country":"Taiwan","country_code":"TW"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://return.st/.well-known/diamwall/load/html/5s.html","date":"2026-08-10T19:15:00.854Z","timestamp":1786389300854,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"return.st","organization":""},"issuer":{"commonName":"YE1","organization":"Let's Encrypt"},"validity":{"start":"Mon, 06 Jul 2026 14:07:23 GMT","end":"Sun, 04 Oct 2026 14:07:22 GMT"},"fingerprint":{"sha1":"40:A0:76:A0:C1:D5:44:37:24:4B:27:90:51:25:DB:03:CB:97:5F:DE","sha256":"02:BF:B1:92:71:94:2C:AD:50:53:82:AA:28:2F:98:69:02:71:5C:6C:F0:CE:2D:B0:7A:74:F2:83:B6:64:B4:16"}}},"request":{"raw":"GET /cdn-cgi/chl/v2/captcha/assets/cpt.css HTTP/1.1\r\nHost: return.st\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://return.st/.well-known/diamwall/load/html/5s.html\r\nCookie: __diamwall=0x3465975257; dwid=67376803f73b711f6f7529ab69b882c4; _dwa=0\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=2\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nserver: openresty\r\ndate: Mon, 10 Aug 2026 19:15:01 GMT\r\ncontent-type: text/css; charset=UTF-8\r\nvary: Accept-Encoding\r\nx-powered-by: Express\r\ncache-control: private, no-store, no-cache, must-revalidate\r\nlast-modified: Tue, 04 Aug 2026 13:49:43 GMT\r\netag: W/\"5e81-19fcd098cd8\"\r\nstrict-transport-security: max-age=31536000; includeSubDomains; preload\r\nx-frame-options: sameorigin\r\nx-content-type-options: nosniff\r\nx-xss-protection: 1; mode=block\r\ncontent-encoding: br\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Express","description":"Express is a web application framework for Node.js, released as free and open-source software under the MIT License. It is designed for building web applications and APIs.","website":"https://expressjs.com","common_platform_enumeration":"cpe:2.3:a:expressjs:express:*:*:*:*:*:*:*:*","icon":"Express.svg","categories":["Web frameworks","Web servers"]},{"name":"Node.js","description":"Node.js is an open-source, cross-platform, JavaScript runtime environment that executes JavaScript code outside a web browser.","website":"https://nodejs.org","common_platform_enumeration":"cpe:2.3:a:nodejs:node.js:*:*:*:*:*:*:*:*","icon":"Node.js.svg","categories":["Programming languages"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"OpenResty","description":"OpenResty is a web platform based on nginx which can run Lua scripts using its LuaJIT engine.","website":"https://openresty.org","common_platform_enumeration":"","icon":"OpenResty.svg","categories":["Web servers"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":24193,"size_decoded":5549,"mime_type":"text/css; charset=UTF-8","magic":"ASCII text","md5":"11fa9ba2e8f7d0dc3a0282957bb8d18e","sha1":"fe416b7047693cc7c8709b3ae96b0e0ab0df7b75","sha256":"c59d2074f457e25fb43b5350bfe5ac08885789f9ba0504d9d90b694ff15cc2ea","sha512":"355d90df3b9f968d4c15ac87c3ebce2190c28715f6b128e868a4d9ab0668d3ba5ff1932c9c72397a621d4509236cb86a1753678a984927c349a213931c571e99","ssdeep":"384:gSNPiXOrrcLKTVuPKcFWNiTQIeBqbbKhOPJQX1pA5kan+YoSwB:gSJiXO0LKTVuPKcFWNiTQIegbbKhOPJC","tlshash":"ddb2227877fbc5287c2b85db25e35758633c6042b906fbac66a3a0696f593fc0172e40","first_seen":"2026-08-10T14:24:55.933621Z","last_seen":"2026-08-10T19:32:27.377714Z","times_seen":9,"resource_available":false,"data":null}},"time_used":191,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":191,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-08-10","alert":"Sinkholed","trigger":"return.st","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-08-10","alert":"Sinkholed","trigger":"return.st","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"return.st/cdn-cgi/mitigation/v2/chl/stage/2.f592f21cc02e.1786389391002.95ee6c7bc326bd1789110a58.5c622bf71c6be65546126f59625bc3155279b8a1564a2bc70be742e4596e4b70","fqdn":"return.st","domain":"return.st","tld":"st"},"ip":{"addr":"216.146.31.1","port":443,"asn":207731,"as":"Nxsr, Unipessoal Lda","country":"Taiwan","country_code":"TW"},"is_navigation_request":false,"resource_type":"fetch","requested_by":"https://return.st/?ref=dstatspace","date":"2026-08-10T19:15:01.088Z","timestamp":1786389301088,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"return.st","organization":""},"issuer":{"commonName":"YE1","organization":"Let's Encrypt"},"validity":{"start":"Mon, 06 Jul 2026 14:07:23 GMT","end":"Sun, 04 Oct 2026 14:07:22 GMT"},"fingerprint":{"sha1":"40:A0:76:A0:C1:D5:44:37:24:4B:27:90:51:25:DB:03:CB:97:5F:DE","sha256":"02:BF:B1:92:71:94:2C:AD:50:53:82:AA:28:2F:98:69:02:71:5C:6C:F0:CE:2D:B0:7A:74:F2:83:B6:64:B4:16"}}},"request":{"raw":"GET /cdn-cgi/mitigation/v2/chl/stage/2.f592f21cc02e.1786389391002.95ee6c7bc326bd1789110a58.5c622bf71c6be65546126f59625bc3155279b8a1564a2bc70be742e4596e4b70 HTTP/1.1\r\nHost: return.st\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://return.st/?ref=dstatspace\r\nX-DW-Stage-Key: MNJ7Wrdgtca5E2eluYYW0VZvpNh82vMh1qxpMLRlfuc\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nCookie: __dwsk_95ee6c7bc326bd1789110a58=MNJ7Wrdgtca5E2eluYYW0VZvpNh82vMh1qxpMLRlfuc; __diamwall=0x3465975257; dwid=67376803f73b711f6f7529ab69b882c4; _dwa=0\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=4\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nserver: openresty\r\ndate: Mon, 10 Aug 2026 19:15:01 GMT\r\ncontent-type: application/javascript; charset=utf-8\r\nvary: Accept-Encoding\r\nx-powered-by: Express\r\ncache-control: private, no-store, no-cache, must-revalidate\r\netag: W/\"334ab-F4Ae+AQJ361Zz/ItQey3umTD56s\"\r\nstrict-transport-security: max-age=31536000; includeSubDomains; preload\r\nx-frame-options: sameorigin\r\nx-content-type-options: nosniff\r\nx-xss-protection: 1; mode=block\r\ncontent-encoding: br\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"OpenResty","description":"OpenResty is a web platform based on nginx which can run Lua scripts using its LuaJIT engine.","website":"https://openresty.org","common_platform_enumeration":"","icon":"OpenResty.svg","categories":["Web servers"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"Express","description":"Express is a web application framework for Node.js, released as free and open-source software under the MIT License. It is designed for building web applications and APIs.","website":"https://expressjs.com","common_platform_enumeration":"cpe:2.3:a:expressjs:express:*:*:*:*:*:*:*:*","icon":"Express.svg","categories":["Web frameworks","Web servers"]},{"name":"Node.js","description":"Node.js is an open-source, cross-platform, JavaScript runtime environment that executes JavaScript code outside a web browser.","website":"https://nodejs.org","common_platform_enumeration":"cpe:2.3:a:nodejs:node.js:*:*:*:*:*:*:*:*","icon":"Node.js.svg","categories":["Programming languages"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":210091,"size_decoded":93273,"mime_type":"application/javascript; charset=utf-8","magic":"ASCII text, with very long lines (65536), with no line terminators","md5":"845e9dfdfe73ed1cc0ef9678291b7112","sha1":"17801ef80409dfad59cff22d41ecb7ba64c3e7ab","sha256":"7952f794b1c6acfe995942edaec7b5fa31cc23bbaaa40703c908a732a4290037","sha512":"8b4376a9a744dbd29f7f3000fcd1e123c485e6671f8036e6a7dd01abdb0a8bdd84773adfd2a28f3939c37d4b5ae0335a932f64844c19f803e6a3042e0724585e","ssdeep":"3072:HMdaK4oNpPDXw5e00XqE0DpZM76nsy7X6rNpYLztwL:HMdae7PDJhXV0Dpu76skoNp0ztwL","tlshash":"8324b5d2c0a20096fb97833e43f5580d9a65cf1e3eb709b99f72df7a19b1c091a825d1","first_seen":"2026-08-10T19:15:10.262884Z","last_seen":"2026-08-10T19:15:10.262884Z","times_seen":1,"resource_available":true,"data":null}},"time_used":363,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":363,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-08-10","alert":"Sinkholed","trigger":"return.st","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-08-10","alert":"Sinkholed","trigger":"return.st","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"cdn.diamwall.com/cdn-cgi/static/img/logo_no_shadow.png","fqdn":"cdn.diamwall.com","domain":"diamwall.com","tld":"com"},"ip":{"addr":"216.146.31.1","port":443,"asn":207731,"as":"Nxsr, Unipessoal Lda","country":"Taiwan","country_code":"TW"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://return.st/.well-known/diamwall/load/html/5s.html","date":"2026-08-10T19:15:01.100Z","timestamp":1786389301100,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"diamwall.com","organization":""},"issuer":{"commonName":"YE1","organization":"Let's Encrypt"},"validity":{"start":"Wed, 10 Jun 2026 21:31:47 GMT","end":"Tue, 08 Sep 2026 21:31:46 GMT"},"fingerprint":{"sha1":"8C:CE:56:A6:E5:6A:1C:36:24:87:DE:1E:74:C8:F1:E2:4D:8B:EB:F9","sha256":"93:78:57:6C:F1:81:2A:18:63:0B:12:0A:AF:E6:75:3E:DC:3D:DB:86:82:EB:B7:94:E8:1C:59:68:73:21:EB:A6"}}},"request":{"raw":"GET /cdn-cgi/static/img/logo_no_shadow.png HTTP/1.1\r\nHost: cdn.diamwall.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-Fetch-Storage-Access: none\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://return.st/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPriority: u=4, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nServer: DiamWall\r\nDate: Mon, 10 Aug 2026 19:15:01 GMT\r\nContent-Type: image/png\r\nContent-Length: 9934\r\nLast-Modified: Mon, 27 Apr 2026 13:23:54 GMT\r\nConnection: keep-alive\r\nVary: Accept-Encoding\r\nETag: \"69ef636a-26ce\"\r\nAccess-Control-Allow-Origin: *\r\nAccept-Ranges: bytes\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":null,"data":{"size":9934,"size_decoded":10225,"mime_type":"image/png","magic":"PNG image data, 276 x 180, 8-bit/color RGBA, non-interlaced","md5":"59b5aa200dcd1b8cd8232c0e9a75df7c","sha1":"0ba8c38cad98d42ae2169e7d3dff5020f3b67016","sha256":"d3d3f1cb8343debac5df6aefbab6481c6d70d3e203a706e74fd1ae87e8418b07","sha512":"25d8088a6074081848c2f99bf5683ace59294a64c6616f091ac7004cf8b2ec672b0b2e065636431916b080d99854d84ff305f9a65ef8542d02346e14d88470dd","ssdeep":"192:2SsknWWbq7GzhnS2P/nC2TExMfB4mJl4CZuxQX9:Z/nW4qqhnS2nbTExXmz4AO49","tlshash":"53229e08fc02bd80688da1056aead09155bb4fd05ea4e001bedd8d6ebae443cdc5e3d6","first_seen":"2024-08-20T10:09:24.763142Z","last_seen":"2026-08-10T19:32:27.384199Z","times_seen":11,"resource_available":false,"data":null}},"time_used":9,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":9,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"return.st/?ref=dstatspace","fqdn":"return.st","domain":"return.st","tld":"st"},"ip":{"addr":"216.146.31.1","port":443,"asn":207731,"as":"Nxsr, Unipessoal Lda","country":"Taiwan","country_code":"TW"},"is_navigation_request":true,"resource_type":"document","requested_by":"","date":"2026-08-10T19:14:58.383Z","timestamp":1786389298383,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"return.st","organization":""},"issuer":{"commonName":"YE1","organization":"Let's Encrypt"},"validity":{"start":"Mon, 06 Jul 2026 14:07:23 GMT","end":"Sun, 04 Oct 2026 14:07:22 GMT"},"fingerprint":{"sha1":"40:A0:76:A0:C1:D5:44:37:24:4B:27:90:51:25:DB:03:CB:97:5F:DE","sha256":"02:BF:B1:92:71:94:2C:AD:50:53:82:AA:28:2F:98:69:02:71:5C:6C:F0:CE:2D:B0:7A:74:F2:83:B6:64:B4:16"}}},"request":{"raw":"GET /?ref=dstatspace HTTP/1.1\r\nHost: return.st\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nCookie: __diamwall=0x3465975257\r\nUpgrade-Insecure-Requests: 1\r\nSec-Fetch-Dest: document\r\nSec-Fetch-Mode: navigate\r\nSec-Fetch-Site: none\r\nPriority: u=0, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 513 \r\nserver: openresty\r\ndate: Mon, 10 Aug 2026 19:14:58 GMT\r\ncontent-type: text/html\r\ncontent-length: 1083\r\nset-cookie: __diamwall=0x3465975257; Path=/; Expires=Mon, 10 Aug 2026 19:19:58 GMT; Domain=.return.st; Secure; SameSite=None\r\nexpires: Thu, 01 Jan 1970 00:00:01 GMT\r\ncache-control: no-cache\r\nalt-svc: h3=\":443\"; ma=86400\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"513","status_text":"","fingerprints":[{"name":"OpenResty","description":"OpenResty is a web platform based on nginx which can run Lua scripts using its LuaJIT engine.","website":"https://openresty.org","common_platform_enumeration":"","icon":"OpenResty.svg","categories":["Web servers"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":1083,"size_decoded":1442,"mime_type":"text/html","magic":"HTML document, ASCII text","md5":"807acb6d11702bd45371d77ea77fa750","sha1":"7b14f1a1bd31165517723973ed0c83e353ebaac4","sha256":"9c24c90aca7cf687b7702e3dfffee9b9914f76b61c48b42ef3c5fbf3223065dd","sha512":"325c8aea83bb881fa365faf1638bb78e2cae853d92e00b4d61fa08b1e78f42fb9ac741da5398f6450cdccb33686e0f14a0c0398785915dd962312803bdf40536","ssdeep":"","tlshash":"e01160b38d01cc3bc0208312bfd6ea0c9663e49983d1980050967093a27cf071a36e8c","first_seen":"2026-08-10T19:15:10.268935Z","last_seen":"2026-08-10T19:15:10.268935Z","times_seen":1,"resource_available":false,"data":null}},"time_used":8,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":8,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-08-10","alert":"Sinkholed","trigger":"return.st","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-08-10","alert":"Sinkholed","trigger":"return.st","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null}],"urlquery":null}}]}