{"report_id":"8a133834-baba-4a28-9b63-6a3601f29952","version":0,"status":"done","tags":[],"date":"2026-10-09T16:30:12Z","url":{"schema":"http","addr":"walletupdate.us/","fqdn":"walletupdate.us","domain":"walletupdate.us","tld":"us"},"ip":{"addr":"216.252.233.9","port":0,"asn":965,"as":"Webhosting Holdings LLC","country":"United States","country_code":"US"},"final":{"url":{"schema":"https","addr":"walletupdate.us/","fqdn":"walletupdate.us","domain":"walletupdate.us","tld":"us"},"title":"Ultimate Blogging Championship","dom":{"size":69458,"mime_type":"text/html; charset=utf-8","magic":"HTML document, Unicode text, UTF-8 text, with very long lines (20776)","md5":"1eaaa32250532ab6d33bfbcfc865a336","sha1":"37d6294eb24593560743d70559ce363aec5d5950","sha256":"b83e1473b20df4b712f5f1857d2619f864cdff75f76b5859e2fd7a98b5873194","sha512":"63009bda7b7a31481df53486abfdebc0523ee0ded98f8ea6ed601b47a407a447c0cbc1b210b1bfcbded8347c7e90c7c53c7f50f795885c6dd1963a155024111a","ssdeep":"1536:LkUckRiBmgT0cTrnbO23kv5ypdz1nT8nZobXemlUVuXwam2Z6Rv:LkUckRiBmgT0cTrnbO23kv0iZobXemla","tlshash":"8f6375a157b048f5797f833b5e44a2185627e902ca0977e5b0f3d294758cfa60ae3b0f","dom_hash":"domhash1520707cffe12821b979f76f82aa2082","first_seen":"2026-10-09T15:48:29.044242Z","last_seen":"2026-10-09T16:30:14.313912Z","times_seen":2,"resource_available":false,"data":null}},"submit":{"url":{"schema":"http","addr":"walletupdate.us/","fqdn":"walletupdate.us","domain":"walletupdate.us","tld":"us"},"ip":{"addr":"216.252.233.9","port":0,"asn":965,"as":"Webhosting Holdings LLC","country":"United States","country_code":"US"},"tags":null,"meta":null},"settings":{"access":"public","device_type":"desktop","expires_at":"2027-11-13T16:30:12Z","useragent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0","referer":"","cookies":null,"exit_node":"qguvgzjxzsgb3vs"},"stats":{"alert_count":{"ids":0,"urlquery":0,"analyzer":3}},"detection":{"ids":null,"analyzer":[{"sensor_name":"infosec_yara","sensor_type":"yara","title":"YARAhub by abuse.ch","description":"YARAhub by abuse.ch","scan_date":"2026-10-09","alert":"Detects SocGholish obfuscated variant first observed in July 2022","trigger":"walletupdate.us/wp-includes/js/dist/script-modules/interactivity/index.min.js?ver=efaa5193bbad9c60ffd1","verdict":"malware","severity":"medium","comment":"","link":"https://yaraify.abuse.ch/yarahub/","meta":{"author":"Ankit Anubhav -ankitanubhav.info","date":"2022-07-19","description":"Detects SocGholish obfuscated variant first observed in July 2022","malpedia_family":"js.fakeupdates","rule":"SocGholish_Variant_B","yarahub_author_email":"ankit.yara@inbox.ru","yarahub_author_twitter":"@ankit_anubhav","yarahub_license":"CC0 1.0","yarahub_reference_link":"https://twitter.com/ankit_anubhav/status/1549246034831781888","yarahub_reference_md5":"4fcc9569ca63cb2f5777954ac4c9290f","yarahub_rule_matching_tlp":"TLP:WHITE","yarahub_rule_sharing_tlp":"TLP:WHITE","yarahub_uuid":"df3d194a-c6bc-4440-bad9-461e0e7962fd"}},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-10-09","alert":"Sinkholed","trigger":"walletupdate.us","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-10-09","alert":"Sinkholed","trigger":"walletupdate.us","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null}],"urlquery":null},"summary":[{"fqdn":"walletupdate.us","ip":{"addr":"216.252.233.9","port":443,"asn":40676,"as":"AS40676","country":"United States","country_code":"US"},"domain_registered":"2026-02-18","domain_rank":0,"first_seen":"2026-10-09T15:48:25.256456Z","last_seen":"2026-10-09T15:48:25.256456Z","alert_count":13,"request_count":6,"received_data":190664,"sent_data":3034,"comment":"","tags":null,"fingerprints":[{"name":"WordPress Site Editor","description":"Full Site Editing enables users to design and customize their entire WordPress website with a block-based editor.","website":"https://wordpress.org/documentation/article/site-editor/","common_platform_enumeration":"","icon":"WordPress.svg","categories":["Page builders"]},{"name":"WordPress Block Editor","description":"Sites using the WordPress Block Editor, also known as Gutenberg.","website":"https://wordpress.org/gutenberg/","common_platform_enumeration":"","icon":"WordPress.svg","categories":["Page builders"]},{"name":"WordPress:7.1.3","description":"WordPress is a free and open-source content management system written in PHP and paired with a MySQL or MariaDB database. Features include a plugin architecture and a template system.","website":"https://wordpress.org","common_platform_enumeration":"cpe:2.3:a:wordpress:wordpress:*:*:*:*:*:*:*:*","icon":"WordPress.svg","categories":["CMS","Blogs"]},{"name":"MySQL","description":"MySQL is an open-source relational database management system.","website":"https://mysql.com","common_platform_enumeration":"cpe:2.3:a:mysql:mysql:*:*:*:*:*:*:*:*","icon":"MySQL.svg","categories":["Databases"]},{"name":"PHP","description":"PHP is a general-purpose scripting language used for web development.","website":"https://php.net","common_platform_enumeration":"cpe:2.3:a:php:php:*:*:*:*:*:*:*:*","icon":"PHP.svg","categories":["Programming languages"]},{"name":"Apache HTTP Server","description":"Apache is a free and open-source cross-platform web server software.","website":"https://httpd.apache.org/","common_platform_enumeration":"cpe:2.3:a:apache:http_server:*:*:*:*:*:*:*:*","icon":"Apache.svg","categories":["Web servers"]}]}],"files":null,"artifacts":{"windows_shortcuts":null,"files":null,"telegram":null,"pdfs":null,"clipboard":null},"sensors":{"ids":null,"analyzer":null,"urlquery":null},"javascript":{"script":[{"url":{"schema":"https","addr":"walletupdate.us/wp-includes/js/dist/script-modules/interactivity/index.min.js?ver=efaa5193bbad9c60ffd1","fqdn":"walletupdate.us","domain":"walletupdate.us","tld":"us"},"ip":{"addr":"216.252.233.9","port":443,"asn":40676,"as":"AS40676","country":"United States","country_code":"US"},"introduction_type":"scriptElement","is_inline":false,"md5":"f0866401d2e6bf0b38495c9f278cf96a","sha1":"78a648d27819f61c8b8678d64632d2c35ac6801f","sha256":"726ac59577c8aeeec94c61bfb7791a709e401b5d871d35c39a65cd948f6124e3","sha512":"7889b5b5b511b2d7af4752fb4d4ae4edcf96b18351224867e39c5dbff54fb6fadf3e18a40bfa35cd803d34426e95623768e64a132282f1813525a7d1844f101f","ssdeep":"768:oqEYJ8Mc56JH6u0HpQPu3iU7bwUCD2XZjVV300FKKh:YYJC0cHWujsIl39KKh","tlshash":"37031af8b2a8703183ef50b5503f040bf3366968588d8068ba65d4eb68f454a51f7fbd","size":40106,"data":"","first_seen":"2026-05-21T20:58:39.683163Z","last_seen":"2026-10-09T19:22:30.12153Z","times_seen":13648,"alerts":{"ids":null,"analyzer":[{"sensor_name":"infosec_yara","sensor_type":"yara","title":"YARAhub by abuse.ch","description":"YARAhub by abuse.ch","scan_date":"2026-10-09","alert":"Detects SocGholish obfuscated variant first observed in July 2022","trigger":"walletupdate.us/wp-includes/js/dist/script-modules/interactivity/index.min.js?ver=efaa5193bbad9c60ffd1","verdict":"malware","severity":"medium","comment":"","link":"https://yaraify.abuse.ch/yarahub/","meta":{"author":"Ankit Anubhav -ankitanubhav.info","date":"2022-07-19","description":"Detects SocGholish obfuscated variant first observed in July 2022","malpedia_family":"js.fakeupdates","rule":"SocGholish_Variant_B","yarahub_author_email":"ankit.yara@inbox.ru","yarahub_author_twitter":"@ankit_anubhav","yarahub_license":"CC0 1.0","yarahub_reference_link":"https://twitter.com/ankit_anubhav/status/1549246034831781888","yarahub_reference_md5":"4fcc9569ca63cb2f5777954ac4c9290f","yarahub_rule_matching_tlp":"TLP:WHITE","yarahub_rule_sharing_tlp":"TLP:WHITE","yarahub_uuid":"df3d194a-c6bc-4440-bad9-461e0e7962fd"}}],"urlquery":null}},{"url":{"schema":"https","addr":"walletupdate.us/wp-includes/js/dist/script-modules/block-library/navigation/view.min.js?ver=1bf28ded04f9f188bdcb","fqdn":"walletupdate.us","domain":"walletupdate.us","tld":"us"},"ip":{"addr":"216.252.233.9","port":443,"asn":40676,"as":"AS40676","country":"United States","country_code":"US"},"introduction_type":"scriptElement","is_inline":false,"md5":"fa40dd851aca7b8c45de7991f13a8683","sha1":"4b9cb946ef66b3cc547f971b7915f023dd84da37","sha256":"fbe11af6f29f55ae480e2058aad3ac400315d2792c3b14346f016b70cebf3bb3","sha512":"51ea7694116308ed78b1a417f96ad0c41e842f8a94dd9640f3456c60ae53eea18fb908405c059675b56278986671c42d37f5d9049db2159558c10e73e1f50100","ssdeep":"","tlshash":"39517179726575b6cefe4788f330d538b3619dc1040a1442bd1806dfaaaeea1c1e1f6a","size":3033,"data":"","first_seen":"2026-07-31T14:57:46.364913Z","last_seen":"2026-10-09T19:50:03.026871Z","times_seen":2729,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"walletupdate.us/wp-includes/js/wp-emoji-release.min.js?ver=7.1.3","fqdn":"walletupdate.us","domain":"walletupdate.us","tld":"us"},"ip":{"addr":"216.252.233.9","port":443,"asn":40676,"as":"AS40676","country":"United States","country_code":"US"},"introduction_type":"scriptElement","is_inline":false,"md5":"7dcb0bb1f67bc5cd9aa86bc0577108e3","sha1":"c90b1ed149a278c322a63f3a79443ccce5592382","sha256":"063840b4b3f5869e0f0d078bab8bd29cfb3a59ee85e8e3edbbec35a8fe846fd3","sha512":"d09c60fc702e1d3fb839685770b2626a64cbc6373ac4bf3a63c3536caef34f4f6caf76adfbd5c2d15bed6e1396ed4f3ca80f6673e3421b2ae2f9e7aa5ccf16f2","ssdeep":"384:WzevzApRZTbbUL3px/bEg1XgA5OOkpJTX:Wsk9bUL3px/YqXgAP+hX","tlshash":"79a2949ba33a4e8f343e3bd78d968f4dc9da555321c0e079dbefb6c169a00568274c90","size":22752,"data":"","first_seen":"2026-06-05T05:27:24.795617Z","last_seen":"2026-10-09T19:24:20.496932Z","times_seen":78050,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"walletupdate.us/wp-includes/js/wp-emoji-loader.min.js","fqdn":"walletupdate.us","domain":"walletupdate.us","tld":"us"},"ip":{"addr":"216.252.233.9","port":443,"asn":40676,"as":"AS40676","country":"United States","country_code":"US"},"introduction_type":"scriptElement","is_inline":false,"md5":"a44f348f57872998c8fe7b8d3b23670a","sha1":"62fbd98054f063a0339d5ae7e7bc86d7c92a524e","sha256":"00bd6099618b2fab7a685403c323f68dcff868917ef0261abee0d55bb5966f9d","sha512":"db82eddc905c5ad234b134b9e86412887b3e8e054d9540e5a32a15ee7fe4267d0f1f7de2b1c4959b7369dedabfb3ee814771260606d5ff7b369d1f1741b85bc8","ssdeep":"","tlshash":"ae61b699eb7938df33fa01f3653a0d4beb604436e784d038c9ae631424b1893c375a0a","size":3332,"data":"","first_seen":"2026-10-09T15:48:29.068926Z","last_seen":"2026-10-09T16:30:14.337006Z","times_seen":2,"alerts":{"ids":null,"analyzer":null,"urlquery":null}}],"eval":null,"write":null,"console":null},"http":[{"url":{"schema":"https","addr":"walletupdate.us/","fqdn":"walletupdate.us","domain":"walletupdate.us","tld":"us"},"ip":{"addr":"216.252.233.9","port":443,"asn":40676,"as":"AS40676","country":"United States","country_code":"US"},"is_navigation_request":true,"resource_type":"document","requested_by":"","date":"2026-10-09T16:23:28.706Z","timestamp":1791563008706,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"walletupdate.us","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Wed, 07 Oct 2026 15:25:00 GMT","end":"Tue, 05 Jan 2027 15:24:59 GMT"},"fingerprint":{"sha1":"27:FB:C4:9B:B5:D9:B8:4E:6F:0B:89:35:79:FC:3E:86:6F:AF:CF:23","sha256":"F6:92:4B:4B:59:0B:3D:51:D9:20:AF:99:3D:70:E3:73:00:A9:CB:F8:11:07:A3:C4:EF:B4:D1:1E:AE:BA:44:8C"}}},"request":{"raw":"GET / HTTP/1.1\r\nHost: walletupdate.us\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nUpgrade-Insecure-Requests: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: document\r\nSec-Fetch-Mode: navigate\r\nSec-Fetch-Site: none\r\nPriority: u=0, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Fri, 09 Oct 2026 16:23:28 GMT\r\nServer: Apache\r\nLink: \u003chttps://walletupdate.us/index.php?rest_route=/\u003e; rel=\"https://api.w.org/\"\r\nKeep-Alive: timeout=5, max=100\r\nConnection: Keep-Alive\r\nTransfer-Encoding: chunked\r\nContent-Type: text/html; charset=UTF-8\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"WordPress Site Editor","description":"Full Site Editing enables users to design and customize their entire WordPress website with a block-based editor.","website":"https://wordpress.org/documentation/article/site-editor/","common_platform_enumeration":"","icon":"WordPress.svg","categories":["Page builders"]},{"name":"WordPress Block Editor","description":"Sites using the WordPress Block Editor, also known as Gutenberg.","website":"https://wordpress.org/gutenberg/","common_platform_enumeration":"","icon":"WordPress.svg","categories":["Page builders"]},{"name":"WordPress:7.1.3","description":"WordPress is a free and open-source content management system written in PHP and paired with a MySQL or MariaDB database. Features include a plugin architecture and a template system.","website":"https://wordpress.org","common_platform_enumeration":"cpe:2.3:a:wordpress:wordpress:*:*:*:*:*:*:*:*","icon":"WordPress.svg","categories":["CMS","Blogs"]},{"name":"MySQL","description":"MySQL is an open-source relational database management system.","website":"https://mysql.com","common_platform_enumeration":"cpe:2.3:a:mysql:mysql:*:*:*:*:*:*:*:*","icon":"MySQL.svg","categories":["Databases"]},{"name":"PHP","description":"PHP is a general-purpose scripting language used for web development.","website":"https://php.net","common_platform_enumeration":"cpe:2.3:a:php:php:*:*:*:*:*:*:*:*","icon":"PHP.svg","categories":["Programming languages"]},{"name":"Apache HTTP Server","description":"Apache is a free and open-source cross-platform web server software.","website":"https://httpd.apache.org/","common_platform_enumeration":"cpe:2.3:a:apache:http_server:*:*:*:*:*:*:*:*","icon":"Apache.svg","categories":["Web servers"]}],"data":{"size":69389,"size_decoded":69667,"mime_type":"text/html; charset=UTF-8","magic":"HTML document, ASCII text, with very long lines (20776)","md5":"cc066581e72acfde64f761b98060eedf","sha1":"a256d5e06915ef815dab4c0b53c077768f722ef6","sha256":"3429cea496fee536bcca9a3b0128e6957decf0a0110796faf5d56f8bc2038f96","sha512":"df6b810b1b31cccaea67138547c2fe33bbc6af3ed039ce7af33ebb5a217d0d77b950842b0ce6c865f283493ab8e8ae2134f095f1637627add03111cd37fe3b95","ssdeep":"1536:u0UckRiBmgT0cTrnbO23kv5ypdz1nT8eZMpm4wvSAIXuTVFZ6RT:u0UckRiBmgT0cTrnbO23kv0xZMpm4wvA","tlshash":"a46374a157b048f5797f833b5e44a2185627e902ca0937e5f0f3d294758cfa60ae3b0b","first_seen":"2026-10-09T15:48:29.060472Z","last_seen":"2026-10-09T16:30:14.318988Z","times_seen":2,"resource_available":true,"data":null}},"time_used":497,"timings":{"blocked":-1,"dns":5,"connect":23,"send":0,"wait":346,"receive":73,"ssl":50},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-10-09","alert":"Sinkholed","trigger":"walletupdate.us","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-10-09","alert":"Sinkholed","trigger":"walletupdate.us","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"walletupdate.us/wp-includes/js/dist/script-modules/interactivity/index.min.js?ver=efaa5193bbad9c60ffd1","fqdn":"walletupdate.us","domain":"walletupdate.us","tld":"us"},"ip":{"addr":"216.252.233.9","port":443,"asn":40676,"as":"AS40676","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://walletupdate.us/","date":"2026-10-09T16:23:29.400Z","timestamp":1791563009400,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"walletupdate.us","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Wed, 07 Oct 2026 15:25:00 GMT","end":"Tue, 05 Jan 2027 15:24:59 GMT"},"fingerprint":{"sha1":"27:FB:C4:9B:B5:D9:B8:4E:6F:0B:89:35:79:FC:3E:86:6F:AF:CF:23","sha256":"F6:92:4B:4B:59:0B:3D:51:D9:20:AF:99:3D:70:E3:73:00:A9:CB:F8:11:07:A3:C4:EF:B4:D1:1E:AE:BA:44:8C"}}},"request":{"raw":"GET /wp-includes/js/dist/script-modules/interactivity/index.min.js?ver=efaa5193bbad9c60ffd1 HTTP/1.1\r\nHost: walletupdate.us\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://walletupdate.us/\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=4\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Fri, 09 Oct 2026 16:23:29 GMT\r\nServer: Apache\r\nLast-Modified: Tue, 30 Jun 2026 05:03:52 GMT\r\nAccept-Ranges: bytes\r\nContent-Length: 40106\r\nKeep-Alive: timeout=5, max=99\r\nConnection: Keep-Alive\r\nContent-Type: text/javascript\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Apache HTTP Server","description":"Apache is a free and open-source cross-platform web server software.","website":"https://httpd.apache.org/","common_platform_enumeration":"cpe:2.3:a:apache:http_server:*:*:*:*:*:*:*:*","icon":"Apache.svg","categories":["Web servers"]}],"data":{"size":40106,"size_decoded":40355,"mime_type":"text/javascript","magic":"JavaScript source, ASCII text, with very long lines (40105)","md5":"f0866401d2e6bf0b38495c9f278cf96a","sha1":"78a648d27819f61c8b8678d64632d2c35ac6801f","sha256":"726ac59577c8aeeec94c61bfb7791a709e401b5d871d35c39a65cd948f6124e3","sha512":"7889b5b5b511b2d7af4752fb4d4ae4edcf96b18351224867e39c5dbff54fb6fadf3e18a40bfa35cd803d34426e95623768e64a132282f1813525a7d1844f101f","ssdeep":"768:oqEYJ8Mc56JH6u0HpQPu3iU7bwUCD2XZjVV300FKKh:YYJC0cHWujsIl39KKh","tlshash":"37031af8b2a8703183ef50b5503f040bf3366968588d8068ba65d4eb68f454a51f7fbd","first_seen":"2026-05-21T20:58:39.683163Z","last_seen":"2026-10-09T19:22:30.12153Z","times_seen":13648,"resource_available":true,"data":null}},"time_used":27,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":27,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"infosec_yara","sensor_type":"yara","title":"YARAhub by abuse.ch","description":"YARAhub by abuse.ch","scan_date":"2026-10-09","alert":"Detects SocGholish obfuscated variant first observed in July 2022","trigger":"walletupdate.us/wp-includes/js/dist/script-modules/interactivity/index.min.js?ver=efaa5193bbad9c60ffd1","verdict":"malware","severity":"medium","comment":"","link":"https://yaraify.abuse.ch/yarahub/","meta":{"author":"Ankit Anubhav -ankitanubhav.info","date":"2022-07-19","description":"Detects SocGholish obfuscated variant first observed in July 2022","malpedia_family":"js.fakeupdates","rule":"SocGholish_Variant_B","yarahub_author_email":"ankit.yara@inbox.ru","yarahub_author_twitter":"@ankit_anubhav","yarahub_license":"CC0 1.0","yarahub_reference_link":"https://twitter.com/ankit_anubhav/status/1549246034831781888","yarahub_reference_md5":"4fcc9569ca63cb2f5777954ac4c9290f","yarahub_rule_matching_tlp":"TLP:WHITE","yarahub_rule_sharing_tlp":"TLP:WHITE","yarahub_uuid":"df3d194a-c6bc-4440-bad9-461e0e7962fd"}},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-10-09","alert":"Sinkholed","trigger":"walletupdate.us","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-10-09","alert":"Sinkholed","trigger":"walletupdate.us","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"walletupdate.us/wp-includes/js/dist/script-modules/block-library/navigation/view.min.js?ver=1bf28ded04f9f188bdcb","fqdn":"walletupdate.us","domain":"walletupdate.us","tld":"us"},"ip":{"addr":"216.252.233.9","port":443,"asn":40676,"as":"AS40676","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://walletupdate.us/","date":"2026-10-09T16:23:29.403Z","timestamp":1791563009403,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"walletupdate.us","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Wed, 07 Oct 2026 15:25:00 GMT","end":"Tue, 05 Jan 2027 15:24:59 GMT"},"fingerprint":{"sha1":"27:FB:C4:9B:B5:D9:B8:4E:6F:0B:89:35:79:FC:3E:86:6F:AF:CF:23","sha256":"F6:92:4B:4B:59:0B:3D:51:D9:20:AF:99:3D:70:E3:73:00:A9:CB:F8:11:07:A3:C4:EF:B4:D1:1E:AE:BA:44:8C"}}},"request":{"raw":"GET /wp-includes/js/dist/script-modules/block-library/navigation/view.min.js?ver=1bf28ded04f9f188bdcb HTTP/1.1\r\nHost: walletupdate.us\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://walletupdate.us/\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=4\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Fri, 09 Oct 2026 16:23:29 GMT\r\nServer: Apache\r\nLast-Modified: Wed, 29 Jul 2026 16:31:56 GMT\r\nAccept-Ranges: bytes\r\nContent-Length: 3033\r\nKeep-Alive: timeout=5, max=100\r\nConnection: Keep-Alive\r\nContent-Type: text/javascript\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Apache HTTP Server","description":"Apache is a free and open-source cross-platform web server software.","website":"https://httpd.apache.org/","common_platform_enumeration":"cpe:2.3:a:apache:http_server:*:*:*:*:*:*:*:*","icon":"Apache.svg","categories":["Web servers"]}],"data":{"size":3033,"size_decoded":3282,"mime_type":"text/javascript","magic":"JavaScript source, ASCII text, with very long lines (3032)","md5":"fa40dd851aca7b8c45de7991f13a8683","sha1":"4b9cb946ef66b3cc547f971b7915f023dd84da37","sha256":"fbe11af6f29f55ae480e2058aad3ac400315d2792c3b14346f016b70cebf3bb3","sha512":"51ea7694116308ed78b1a417f96ad0c41e842f8a94dd9640f3456c60ae53eea18fb908405c059675b56278986671c42d37f5d9049db2159558c10e73e1f50100","ssdeep":"","tlshash":"39517179726575b6cefe4788f330d538b3619dc1040a1442bd1806dfaaaeea1c1e1f6a","first_seen":"2026-07-31T14:57:46.364913Z","last_seen":"2026-10-09T19:50:03.026871Z","times_seen":2729,"resource_available":true,"data":null}},"time_used":70,"timings":{"blocked":-1,"dns":0,"connect":20,"send":0,"wait":26,"receive":0,"ssl":24},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-10-09","alert":"Sinkholed","trigger":"walletupdate.us","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-10-09","alert":"Sinkholed","trigger":"walletupdate.us","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"walletupdate.us/wp-content/themes/twentytwentyfive/assets/fonts/manrope/Manrope-VariableFont_wght.woff2","fqdn":"walletupdate.us","domain":"walletupdate.us","tld":"us"},"ip":{"addr":"216.252.233.9","port":443,"asn":40676,"as":"AS40676","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"font","requested_by":"https://walletupdate.us/","date":"2026-10-09T16:23:29.419Z","timestamp":1791563009419,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"walletupdate.us","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Wed, 07 Oct 2026 15:25:00 GMT","end":"Tue, 05 Jan 2027 15:24:59 GMT"},"fingerprint":{"sha1":"27:FB:C4:9B:B5:D9:B8:4E:6F:0B:89:35:79:FC:3E:86:6F:AF:CF:23","sha256":"F6:92:4B:4B:59:0B:3D:51:D9:20:AF:99:3D:70:E3:73:00:A9:CB:F8:11:07:A3:C4:EF:B4:D1:1E:AE:BA:44:8C"}}},"request":{"raw":"GET /wp-content/themes/twentytwentyfive/assets/fonts/manrope/Manrope-VariableFont_wght.woff2 HTTP/1.1\r\nHost: walletupdate.us\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: identity\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://walletupdate.us/\r\nSec-Fetch-Dest: font\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Fri, 09 Oct 2026 16:23:29 GMT\r\nServer: Apache\r\nLast-Modified: Tue, 29 Oct 2024 04:02:18 GMT\r\nAccept-Ranges: bytes\r\nContent-Length: 53600\r\nKeep-Alive: timeout=5, max=98\r\nConnection: Keep-Alive\r\nContent-Type: font/woff2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Apache HTTP Server","description":"Apache is a free and open-source cross-platform web server software.","website":"https://httpd.apache.org/","common_platform_enumeration":"cpe:2.3:a:apache:http_server:*:*:*:*:*:*:*:*","icon":"Apache.svg","categories":["Web servers"]}],"data":{"size":53600,"size_decoded":53844,"mime_type":"font/woff2","magic":"Web Open Font Format (Version 2), TrueType, length 53600, version 1.0","md5":"a8ebc7eb54efacfda66d0a2531058ecd","sha1":"5b56dbe3d3eabe178719988f4fee76d9d4ad7079","sha256":"ce340d48531930f3f2c8b7c47d149f82c9f4413548dd216e0f4d9af94a87c374","sha512":"bde7ef9fa476ae2bf7220afadc1285dec21f1a51718f3633a82cd4d08ac0adafd02acf01db82b3c263ab8a87e2cb18a03830f302d664f4441629ec24678bf2ac","ssdeep":"1536:GcCtX6JRTj6XLzm1OSRKt9Vo3IGC9pT/UTQ+z/y:qX6DWXPmwSRIVPGC9pTREy","tlshash":"203302d1f44038206c75e3fbddecfb9434ea81aaf53945d384a658bc0f8056addb0264","first_seen":"2023-11-30T06:19:19Z","last_seen":"2026-10-09T19:50:19.422143Z","times_seen":13554,"resource_available":false,"data":null}},"time_used":36,"timings":{"blocked":-1,"dns":0,"connect":16,"send":0,"wait":26,"receive":1,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-10-09","alert":"Sinkholed","trigger":"walletupdate.us","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-10-09","alert":"Sinkholed","trigger":"walletupdate.us","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"walletupdate.us/favicon.ico","fqdn":"walletupdate.us","domain":"walletupdate.us","tld":"us"},"ip":{"addr":"216.252.233.9","port":443,"asn":40676,"as":"AS40676","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://walletupdate.us/","date":"2026-10-09T16:23:29.499Z","timestamp":1791563009499,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"walletupdate.us","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Wed, 07 Oct 2026 15:25:00 GMT","end":"Tue, 05 Jan 2027 15:24:59 GMT"},"fingerprint":{"sha1":"27:FB:C4:9B:B5:D9:B8:4E:6F:0B:89:35:79:FC:3E:86:6F:AF:CF:23","sha256":"F6:92:4B:4B:59:0B:3D:51:D9:20:AF:99:3D:70:E3:73:00:A9:CB:F8:11:07:A3:C4:EF:B4:D1:1E:AE:BA:44:8C"}}},"request":{"raw":"GET /favicon.ico HTTP/1.1\r\nHost: walletupdate.us\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://walletupdate.us/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=6\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 404 Not Found\r\nDate: Fri, 09 Oct 2026 16:23:29 GMT\r\nServer: Apache\r\nContent-Length: 315\r\nKeep-Alive: timeout=5, max=97\r\nConnection: Keep-Alive\r\nContent-Type: text/html; charset=iso-8859-1\r\n\r\n","headers":null,"cookies":null,"status_code":"404","status_text":"Not Found","fingerprints":[{"name":"Apache HTTP Server","description":"Apache is a free and open-source cross-platform web server software.","website":"https://httpd.apache.org/","common_platform_enumeration":"cpe:2.3:a:apache:http_server:*:*:*:*:*:*:*:*","icon":"Apache.svg","categories":["Web servers"]}],"data":{"size":315,"size_decoded":515,"mime_type":"text/html; charset=iso-8859-1","magic":"HTML document, ASCII text","md5":"a34ac19f4afae63adc5d2f7bc970c07f","sha1":"a82190fc530c265aa40a045c21770d967f4767b8","sha256":"d5a89e26beae0bc03ad18a0b0d1d3d75f87c32047879d25da11970cb5c4662a3","sha512":"42e53d96e5961e95b7a984d9c9778a1d3bd8ee0c87b8b3b515fa31f67c2d073c8565afc2f4b962c43668c4efa1e478da9bb0ecffa79479c7e880731bc4c55765","ssdeep":"","tlshash":"b0e0e75f41473347402252907dc110d1d505236b797161fd3d85b4ab501dc3dc99f7dc","first_seen":"2023-03-07T01:02:33Z","last_seen":"2026-10-09T16:42:22.363247Z","times_seen":147225,"resource_available":true,"data":null}},"time_used":27,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":27,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-10-09","alert":"Sinkholed","trigger":"walletupdate.us","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-10-09","alert":"Sinkholed","trigger":"walletupdate.us","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"walletupdate.us/wp-includes/js/wp-emoji-release.min.js?ver=7.1.3","fqdn":"walletupdate.us","domain":"walletupdate.us","tld":"us"},"ip":{"addr":"216.252.233.9","port":443,"asn":40676,"as":"AS40676","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://walletupdate.us/","date":"2026-10-09T16:23:29.667Z","timestamp":1791563009667,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"walletupdate.us","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Wed, 07 Oct 2026 15:25:00 GMT","end":"Tue, 05 Jan 2027 15:24:59 GMT"},"fingerprint":{"sha1":"27:FB:C4:9B:B5:D9:B8:4E:6F:0B:89:35:79:FC:3E:86:6F:AF:CF:23","sha256":"F6:92:4B:4B:59:0B:3D:51:D9:20:AF:99:3D:70:E3:73:00:A9:CB:F8:11:07:A3:C4:EF:B4:D1:1E:AE:BA:44:8C"}}},"request":{"raw":"GET /wp-includes/js/wp-emoji-release.min.js?ver=7.1.3 HTTP/1.1\r\nHost: walletupdate.us\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://walletupdate.us/\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Fri, 09 Oct 2026 16:23:29 GMT\r\nServer: Apache\r\nLast-Modified: Thu, 04 Jun 2026 12:07:44 GMT\r\nAccept-Ranges: bytes\r\nContent-Length: 22752\r\nKeep-Alive: timeout=5, max=96\r\nConnection: Keep-Alive\r\nContent-Type: text/javascript\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Apache HTTP Server","description":"Apache is a free and open-source cross-platform web server software.","website":"https://httpd.apache.org/","common_platform_enumeration":"cpe:2.3:a:apache:http_server:*:*:*:*:*:*:*:*","icon":"Apache.svg","categories":["Web servers"]}],"data":{"size":22752,"size_decoded":23001,"mime_type":"text/javascript","magic":"JavaScript source, ASCII text, with very long lines (19813)","md5":"7dcb0bb1f67bc5cd9aa86bc0577108e3","sha1":"c90b1ed149a278c322a63f3a79443ccce5592382","sha256":"063840b4b3f5869e0f0d078bab8bd29cfb3a59ee85e8e3edbbec35a8fe846fd3","sha512":"d09c60fc702e1d3fb839685770b2626a64cbc6373ac4bf3a63c3536caef34f4f6caf76adfbd5c2d15bed6e1396ed4f3ca80f6673e3421b2ae2f9e7aa5ccf16f2","ssdeep":"384:WzevzApRZTbbUL3px/bEg1XgA5OOkpJTX:Wsk9bUL3px/YqXgAP+hX","tlshash":"79a2949ba33a4e8f343e3bd78d968f4dc9da555321c0e079dbefb6c169a00568274c90","first_seen":"2026-06-05T05:27:24.795617Z","last_seen":"2026-10-09T19:24:20.496932Z","times_seen":78050,"resource_available":true,"data":null}},"time_used":28,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":28,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-10-09","alert":"Sinkholed","trigger":"walletupdate.us","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-10-09","alert":"Sinkholed","trigger":"walletupdate.us","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}}]}