{"report_id":"8ee21231-a39f-4710-bd52-4fd9698ef3f4","version":6,"status":"done","tags":[],"date":"2026-04-03T00:10:19Z","url":{"schema":"http","addr":"americanexpress-de27.ink/de","fqdn":"americanexpress-de27.ink","domain":"americanexpress-de27.ink","tld":"ink"},"ip":{"addr":"43.159.168.186","port":0,"asn":132203,"as":"Tencent Building, Kejizhongyi Avenue","country":"United States","country_code":"US"},"final":{"url":{"schema":"https","addr":"americanexpress-de27.ink/de#/","fqdn":"americanexpress-de27.ink","domain":"americanexpress-de27.ink","tld":"ink"},"title":"Kreditkarten, Reisen, Prämien | American Express Deutschland","dom":{"size":102994,"mime_type":"text/html; charset=utf-8","magic":"HTML document, Unicode text, UTF-8 text, with very long lines (64334)","md5":"7fe2e50266840cb620ec1af35ff8c2b2","sha1":"0005f6548fa494b73b052989c69ac01601f159f2","sha256":"695fa1b75d1e9cd9a1e7aaaded167354019c9c1df098519a3b2a7e0cb8a005e8","sha512":"6fdccb40b8c772a1aaab701c152a6f874945d12997d1123a368916a502d49d4d068c4f025567985aaae0f4f5ff08c312881fb195e7e4d4999288d8db88e1b492","ssdeep":"1536:8Pm4IGDbFiXktLhvvWWd6NRfE3SZ7qUQt2:8PgM3SZW9w","tlshash":"e2a372e897b5b12f527971cffa065d5be4c280bf801f2c63fb5c851e2ec2a9696d1408","dom_hash":"domhash6d78cdbc905f9a9dd4c7f47363a95100","first_seen":"2026-04-03T00:10:26.325302Z","last_seen":"2026-04-03T06:13:42.102044Z","times_seen":2,"resource_available":false,"data":null}},"submit":{"url":{"schema":"http","addr":"americanexpress-de27.ink/de","fqdn":"americanexpress-de27.ink","domain":"americanexpress-de27.ink","tld":"ink"},"ip":{"addr":"43.159.168.186","port":0,"asn":132203,"as":"Tencent Building, Kejizhongyi Avenue","country":"United States","country_code":"US"},"tags":null,"meta":null},"settings":{"access":"public","device_type":"desktop","expires_at":"2027-05-08T00:10:19Z","useragent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0","referer":"","cookies":null,"exit_node":"z0yflva4pidy47h"},"stats":{"alert_count":{"ids":0,"urlquery":0,"analyzer":1}},"detection":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-04-03","alert":"Sinkholed","trigger":"americanexpress-de27.ink","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null},"summary":[{"fqdn":"fonts-api.wp.com","ip":{"addr":"192.0.77.32","port":443,"asn":2635,"as":"AUTOMATTIC","country":"United States","country_code":"US"},"domain_registered":"1997-03-28","domain_rank":166248,"first_seen":"2022-11-28T22:42:34Z","last_seen":"2026-04-01T22:27:36.554948Z","alert_count":0,"request_count":1,"received_data":4522,"sent_data":501,"comment":"","tags":null,"fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}]},{"fqdn":"ipapi.co","ip":{"addr":"104.26.8.44","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"domain_registered":"2016-04-19","domain_rank":7936,"first_seen":"2017-01-31T09:07:01Z","last_seen":"2026-04-01T15:52:12.468501Z","alert_count":0,"request_count":1,"received_data":2511,"sent_data":449,"comment":"","tags":null,"fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}]},{"fqdn":"americanexpress-de27.ink","ip":{"addr":"43.159.168.186","port":443,"asn":132203,"as":"Tencent Building, Kejizhongyi Avenue","country":"United States","country_code":"US"},"domain_registered":"2026-03-31","domain_rank":0,"first_seen":"2026-04-03T00:10:21.407272Z","last_seen":"2026-04-03T00:10:21.407272Z","alert_count":15,"request_count":15,"received_data":2630809,"sent_data":8334,"comment":"","tags":null,"fingerprints":[{"name":"Caddy","description":"","website":"https://caddyserver.com","common_platform_enumeration":"cpe:2.3:a:caddyserver:caddy:*:*:*:*:*:*:*:*","icon":"caddy.svg","categories":["Web servers"]}]},{"fqdn":"maxcdn.bootstrapcdn.com","ip":{"addr":"104.18.11.207","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"domain_registered":"2012-05-25","domain_rank":6807,"first_seen":"2014-06-18T00:37:31Z","last_seen":"2026-03-30T02:31:39.707096Z","alert_count":0,"request_count":1,"received_data":28410,"sent_data":478,"comment":"","tags":null,"fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}]},{"fqdn":"cdn.jsdelivr.net","ip":{"addr":"151.101.65.229","port":443,"asn":54113,"as":"FASTLY","country":"United States","country_code":"US"},"domain_registered":"2012-05-16","domain_rank":1678,"first_seen":"2012-09-30T00:15:09Z","last_seen":"2026-03-29T22:35:00.993215Z","alert_count":0,"request_count":1,"received_data":711,"sent_data":476,"comment":"","tags":null,"fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}]}],"files":null,"artifacts":{"windows_shortcuts":null,"files":null,"telegram":null,"pdfs":null,"clipboard":null},"sensors":{"ids":null,"analyzer":null,"urlquery":null},"javascript":{"script":[{"url":{"schema":"https","addr":"americanexpress-de27.ink/apps/DE_PT_06/assets/index-Dc_eNAqt.js","fqdn":"americanexpress-de27.ink","domain":"americanexpress-de27.ink","tld":"ink"},"ip":{"addr":"43.159.168.186","port":443,"asn":132203,"as":"Tencent Building, Kejizhongyi Avenue","country":"United States","country_code":"US"},"introduction_type":"scriptElement","is_inline":false,"md5":"23e8264eb00b4a2f815565d528df6e86","sha1":"c43aad7aa2c1c3b29e597c2dab511e15e0394181","sha256":"52a4fd8e6ae2e7900e454a8be49db55aa7c096ec228d9e06e67912dbbe76ba86","sha512":"e1b8250780df17cc36bc5b4f6aeb28f202b51b9a37b8a959a937ed40fbfe66a947adaac060cd870e94c163750a4a007c1656af8676ddf6ffea30bc3ca7065d74","ssdeep":"24576:IymrboGZrh9P23PK+hmK4pFV81NL0VuCA9NYsUCHqfvFtI4CfTGMDSi7iAFZEflB:IymrboGZrh9P23PK+hmK4pFV81NL0VtT","tlshash":"46658ddd39e4e73109a2058ef2c7334af269d829a109d2f5b59c89463bcbc45d237a3d","size":1520394,"data":"","first_seen":"2026-04-03T00:10:26.356268Z","last_seen":"2026-04-18T17:33:18.116871Z","times_seen":5,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"americanexpress-de27.ink/apps/DE_PT_06/assets/HP-175-Year-Banner-1280x400-CNKEqp5j.js","fqdn":"americanexpress-de27.ink","domain":"americanexpress-de27.ink","tld":"ink"},"ip":{"addr":"43.159.168.186","port":443,"asn":132203,"as":"Tencent Building, Kejizhongyi Avenue","country":"United States","country_code":"US"},"introduction_type":"importedModule","is_inline":false,"md5":"19c80aa3ed425e1719f54ecfef114053","sha1":"575cf9b9fd0ae4f39d4220eeb4a2d08230374cc4","sha256":"fc2602654bfe5b3e6cc29d599f76bd6b63c4a6694e107528b349c37e0fe41369","sha512":"5a51f695148ca8c7ad7e0446cc2be0731d3132dcf90606c63bdf7cee13cb9678ebd900d454cb0728cdf9b767f5fb2e6b119ff4c196fa0dd315df9fc43cdbf742","ssdeep":"","tlshash":"a3b01203490f21b8023401be0b057fb0111125ccba5087b8374d4ae9875bf521d0a601","size":100,"data":"","first_seen":"2026-03-19T13:43:02.846995Z","last_seen":"2026-04-18T17:33:18.10208Z","times_seen":75,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"americanexpress-de27.ink/apps/DE_PT_06/assets/index-YHEXECQb.js","fqdn":"americanexpress-de27.ink","domain":"americanexpress-de27.ink","tld":"ink"},"ip":{"addr":"43.159.168.186","port":443,"asn":132203,"as":"Tencent Building, Kejizhongyi Avenue","country":"United States","country_code":"US"},"introduction_type":"scriptElement","is_inline":false,"md5":"fdd59267ed186c093169aefaad3e697a","sha1":"bd9f118ca86d023aa4d14bd9a45d49329bea9a2d","sha256":"96324952dc459daf0bf3bad12b6cbd883ce99bddfdc8525fd8b9af520573e149","sha512":"7a858c436727c7f19c116f17d010bb69aae9ea82bd0a9b315db2cbb13e8021c3304b4cd65ec8aee84ee1cc3d27abd39ace025f4b1c3a51826c8a253fb66c8a86","ssdeep":"192:BilN1Hun8a6Cgyyagug1b5wh64D5ITwXDf/2DfOVD1DfopyY64:BilXHu8/DrJuhvIT+f/kfOVxfGH","tlshash":"0ee1b5086af4e1bca0cb04b5e521e4e0b0b6bc6ee065c5d17ff50a1d97aeb4ca741538","size":6932,"data":"","first_seen":"2026-04-03T00:10:26.337278Z","last_seen":"2026-04-18T17:33:18.108931Z","times_seen":5,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"americanexpress-de27.ink/apps/DE_PT_06/assets/de-C4D51E0Z.js","fqdn":"americanexpress-de27.ink","domain":"americanexpress-de27.ink","tld":"ink"},"ip":{"addr":"43.159.168.186","port":443,"asn":132203,"as":"Tencent Building, Kejizhongyi Avenue","country":"United States","country_code":"US"},"introduction_type":"scriptElement","is_inline":false,"md5":"0cf70b59adc0d43993c5fcf6bc52c753","sha1":"54cfbad5d584b038ecac40ffdfac4dbfc7ce0d73","sha256":"aa221c2b52b178e319e0961826ed0e01710ae936818ab39d2f88f9a182997052","sha512":"f9210edf86ecbd2ee525887faafafbf9f70ad7a18ebdc0a45a5067b473b68b6f67ff7c4ddbec4a6180ab2fe040cbd0516e309e05b621f7a0077851b91304e90f","ssdeep":"","tlshash":"4ae0c28d68131e4388a085760f2a5e6ad8c276c97fecf59f54b2d85c328009bad5c6fd","size":334,"data":"","first_seen":"2026-03-31T15:15:49.543007Z","last_seen":"2026-04-18T17:33:18.099914Z","times_seen":9,"alerts":{"ids":null,"analyzer":null,"urlquery":null}}],"eval":null,"write":null,"console":null},"http":[{"url":{"schema":"https","addr":"americanexpress-de27.ink/apps/DE_PT_06/assets/ws-bg-light-grey-LTdop1CE.jpeg","fqdn":"americanexpress-de27.ink","domain":"americanexpress-de27.ink","tld":"ink"},"ip":{"addr":"43.159.168.186","port":443,"asn":132203,"as":"Tencent Building, Kejizhongyi Avenue","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://americanexpress-de27.ink/de","date":"2026-04-03T00:10:00.597Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"americanexpress-de27.ink","organization":""},"issuer":{"commonName":"E8","organization":"Let's Encrypt"},"validity":{"start":"Tue, 31 Mar 2026 10:35:56 GMT","end":"Mon, 29 Jun 2026 10:35:55 GMT"},"fingerprint":{"sha1":"46:EF:44:88:83:E9:F7:A3:56:56:7B:5B:49:1B:52:92:58:6A:F2:D3","sha256":"DD:F2:6A:D6:08:80:C2:8C:3B:11:57:96:A0:6F:06:31:6B:23:63:15:BA:88:E6:6B:94:5E:5F:17:E6:BB:8B:59"}}},"request":{"raw":"GET /apps/DE_PT_06/assets/ws-bg-light-grey-LTdop1CE.jpeg HTTP/1.1\r\nHost: americanexpress-de27.ink\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://americanexpress-de27.ink/apps/DE_PT_06/assets/index-C9rZNGTp.css\r\nDNT: 1\r\nConnection: keep-alive\r\nCookie: PHPSID=26aa9155c173da41a37054ab0fe83670; uuid=26aa9155c173da41a37054ab0fe83670\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\naccept-ranges: bytes\r\nalt-svc: h3=\":443\"; ma=2592000\r\ncache-control: public, max-age=2592000\r\ncontent-type: image/jpeg\r\netag: \"dhj0y5z6iosgdaf\"\r\nlast-modified: Thu, 02 Apr 2026 22:32:40 GMT\r\nreferrer-policy: strict-origin-when-cross-origin\r\nserver: Caddy\r\nvary: Accept-Encoding\r\nx-content-type-options: nosniff\r\nx-frame-options: SAMEORIGIN\r\ncontent-length: 17223\r\ndate: Fri, 03 Apr 2026 00:10:00 GMT\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Caddy","description":"","website":"https://caddyserver.com","common_platform_enumeration":"cpe:2.3:a:caddyserver:caddy:*:*:*:*:*:*:*:*","icon":"caddy.svg","categories":["Web servers"]}],"data":{"size":17223,"size_decoded":0,"mime_type":"image/jpeg","magic":"JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 320x305, components 3","md5":"6b79c0f0a9d869ac00812bb798b34b66","sha1":"fcaea21dd095d7ae4837b1e07a84594093bedf1d","sha256":"4a018578b6c0438c92ce376df95a7fefd9bc6eb122968fe511d72da79131bb42","sha512":"baa39686be7ff8c6e73f7425f010dc0ed963190da7b4090794ba34153ed891bede034cafc83e68580b17409b57058ba8563795b274f5d466017c022ba2e28598","ssdeep":"384:IVSMZQzhElxLBLjmlWwBhEv7J63Hu1GYtlfKK4cVX9XcagWIqsGQk:IVGWlhBLqgahE911tli/iX9sagWIrGb","tlshash":"3872c0f00465871cd8d1b53b5db3d310e2121a66956f88da62a3a676c72a7e03f490cf","first_seen":"2026-03-19T13:43:02.875892Z","last_seen":"2026-04-18T17:33:18.11041Z","times_seen":75,"resource_available":false,"data":null}},"time_used":285,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":284,"receive":1,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-04-03","alert":"Sinkholed","trigger":"americanexpress-de27.ink","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"americanexpress-de27.ink/apps/DE_PT_06/assets/HP-175-Year-Banner-1280x400-CNKEqp5j.js","fqdn":"americanexpress-de27.ink","domain":"americanexpress-de27.ink","tld":"ink"},"ip":{"addr":"43.159.168.186","port":443,"asn":132203,"as":"Tencent Building, Kejizhongyi Avenue","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://americanexpress-de27.ink/de","date":"2026-04-03T00:10:00.405Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"americanexpress-de27.ink","organization":""},"issuer":{"commonName":"E8","organization":"Let's Encrypt"},"validity":{"start":"Tue, 31 Mar 2026 10:35:56 GMT","end":"Mon, 29 Jun 2026 10:35:55 GMT"},"fingerprint":{"sha1":"46:EF:44:88:83:E9:F7:A3:56:56:7B:5B:49:1B:52:92:58:6A:F2:D3","sha256":"DD:F2:6A:D6:08:80:C2:8C:3B:11:57:96:A0:6F:06:31:6B:23:63:15:BA:88:E6:6B:94:5E:5F:17:E6:BB:8B:59"}}},"request":{"raw":"GET /apps/DE_PT_06/assets/HP-175-Year-Banner-1280x400-CNKEqp5j.js HTTP/1.1\r\nHost: americanexpress-de27.ink\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://americanexpress-de27.ink/apps/DE_PT_06/assets/index-YHEXECQb.js\r\nDNT: 1\r\nConnection: keep-alive\r\nCookie: PHPSID=26aa9155c173da41a37054ab0fe83670; uuid=26aa9155c173da41a37054ab0fe83670\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\naccept-ranges: bytes\r\nalt-svc: h3=\":443\"; ma=2592000\r\ncache-control: public, max-age=2592000\r\ncontent-type: text/javascript; charset=utf-8\r\netag: \"dhj0y5z6iosg2s\"\r\nlast-modified: Thu, 02 Apr 2026 22:32:40 GMT\r\nreferrer-policy: strict-origin-when-cross-origin\r\nserver: Caddy\r\nvary: Accept-Encoding\r\nx-content-type-options: nosniff\r\nx-frame-options: SAMEORIGIN\r\ncontent-length: 100\r\ndate: Fri, 03 Apr 2026 00:10:00 GMT\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Caddy","description":"","website":"https://caddyserver.com","common_platform_enumeration":"cpe:2.3:a:caddyserver:caddy:*:*:*:*:*:*:*:*","icon":"caddy.svg","categories":["Web servers"]}],"data":{"size":100,"size_decoded":0,"mime_type":"text/javascript; charset=utf-8","magic":"ASCII text","md5":"19c80aa3ed425e1719f54ecfef114053","sha1":"575cf9b9fd0ae4f39d4220eeb4a2d08230374cc4","sha256":"fc2602654bfe5b3e6cc29d599f76bd6b63c4a6694e107528b349c37e0fe41369","sha512":"5a51f695148ca8c7ad7e0446cc2be0731d3132dcf90606c63bdf7cee13cb9678ebd900d454cb0728cdf9b767f5fb2e6b119ff4c196fa0dd315df9fc43cdbf742","ssdeep":"","tlshash":"a3b01203490f21b8023401be0b057fb0111125ccba5087b8374d4ae9875bf521d0a601","first_seen":"2026-03-19T13:43:02.846995Z","last_seen":"2026-04-18T17:33:18.10208Z","times_seen":75,"resource_available":true,"data":null}},"time_used":153,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":153,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-04-03","alert":"Sinkholed","trigger":"americanexpress-de27.ink","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"americanexpress-de27.ink/apps/DE_PT_06/assets/index-Dc_eNAqt.js","fqdn":"americanexpress-de27.ink","domain":"americanexpress-de27.ink","tld":"ink"},"ip":{"addr":"43.159.168.186","port":443,"asn":132203,"as":"Tencent Building, Kejizhongyi Avenue","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://americanexpress-de27.ink/de","date":"2026-04-03T00:09:58.527Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"americanexpress-de27.ink","organization":""},"issuer":{"commonName":"E8","organization":"Let's Encrypt"},"validity":{"start":"Tue, 31 Mar 2026 10:35:56 GMT","end":"Mon, 29 Jun 2026 10:35:55 GMT"},"fingerprint":{"sha1":"46:EF:44:88:83:E9:F7:A3:56:56:7B:5B:49:1B:52:92:58:6A:F2:D3","sha256":"DD:F2:6A:D6:08:80:C2:8C:3B:11:57:96:A0:6F:06:31:6B:23:63:15:BA:88:E6:6B:94:5E:5F:17:E6:BB:8B:59"}}},"request":{"raw":"GET /apps/DE_PT_06/assets/index-Dc_eNAqt.js HTTP/1.1\r\nHost: americanexpress-de27.ink\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://americanexpress-de27.ink/de\r\nDNT: 1\r\nConnection: keep-alive\r\nCookie: PHPSID=26aa9155c173da41a37054ab0fe83670\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nalt-svc: h3=\":443\"; ma=2592000\r\ncache-control: public, max-age=2592000\r\ncontent-encoding: gzip\r\ncontent-type: text/javascript; charset=utf-8\r\netag: \"dhj0y5z6iosgwl56-gzip\"\r\nlast-modified: Thu, 02 Apr 2026 22:32:40 GMT\r\nreferrer-policy: strict-origin-when-cross-origin\r\nserver: Caddy\r\nvary: Accept-Encoding\r\nx-content-type-options: nosniff\r\nx-frame-options: SAMEORIGIN\r\ndate: Fri, 03 Apr 2026 00:09:58 GMT\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Caddy","description":"","website":"https://caddyserver.com","common_platform_enumeration":"cpe:2.3:a:caddyserver:caddy:*:*:*:*:*:*:*:*","icon":"caddy.svg","categories":["Web servers"]}],"data":{"size":1520394,"size_decoded":0,"mime_type":"text/javascript; charset=utf-8","magic":"JavaScript source, ASCII text, with very long lines (65124)","md5":"978694eeeae65ceaeb4039b7bbeb6a0f","sha1":"d8056dbf20e740443385bf2a2d854a2e8e29289b","sha256":"dfffdf87419fd3dbca5860e684c0cb2228cd91d2a6e699d5ff31bc1b14b2de74","sha512":"23cee722b34967e9eff93f43607dd82f558c69076f1737119ebdf23179499eed1e51bb9c47dfd0d861f254d6eee54849b22db0e67cac10b792d5e123e1e3d07a","ssdeep":"24576:IymrboGZrh9P23PK+hmK4pFV81NL0V9CA9NYsUCHqfvFtI4CfTGMDSin:IymrboGZrh9P23PK+hmK4pFV81NL0VAE","tlshash":"72458dcc39d4d72108920acda6c2374fa36dd829e10ad7f5b59cc8063bc6995d237a7e","first_seen":"2026-04-03T00:10:26.33186Z","last_seen":"2026-04-03T00:10:26.33186Z","times_seen":1,"resource_available":false,"data":null}},"time_used":154,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":154,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-04-03","alert":"Sinkholed","trigger":"americanexpress-de27.ink","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"maxcdn.bootstrapcdn.com/font-awesome/4.5.0/css/font-awesome.min.css","fqdn":"maxcdn.bootstrapcdn.com","domain":"bootstrapcdn.com","tld":"com"},"ip":{"addr":"104.18.11.207","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://americanexpress-de27.ink/de","date":"2026-04-03T00:09:59.305Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"bootstrapcdn.com","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Thu, 05 Mar 2026 05:27:05 GMT","end":"Wed, 03 Jun 2026 06:27:01 GMT"},"fingerprint":{"sha1":"04:A8:A2:DB:A5:D9:6E:A1:96:19:8E:E4:20:63:9D:DD:4B:05:E5:4A","sha256":"86:F0:31:59:6F:27:50:6B:1C:65:39:9A:BF:6D:0C:A8:82:D5:B2:A6:36:4B:9C:0A:EB:05:EE:13:0F:EE:25:EC"}}},"request":{"raw":"GET /font-awesome/4.5.0/css/font-awesome.min.css HTTP/1.1\r\nHost: maxcdn.bootstrapcdn.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://americanexpress-de27.ink/\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ndate: Fri, 03 Apr 2026 00:09:59 GMT\r\ncontent-type: text/css; charset=utf-8\r\nstrict-transport-security: max-age=31536000; includeSubDomains; preload\r\ncdn-pullzone: 252412\r\ncdn-uid: b1941f61-b576-4f40-80de-5677acb38f74\r\ncdn-requestcountrycode: DE\r\nvary: Accept-Encoding\r\naccess-control-allow-origin: *\r\ncache-control: public, max-age=31919000\r\ncontent-encoding: br\r\netag: \"4fbd15cb6047af93373f4f895639c8bf\"\r\nlast-modified: Mon, 25 Jan 2021 22:04:54 GMT\r\ncdn-cachedat: 12/09/2024 23:20:39\r\ncdn-proxyver: 1.06\r\ncdn-requestpullcode: 200\r\ncdn-requestpullsuccess: True\r\ncdn-edgestorageid: 1075\r\ntiming-allow-origin: *\r\ncross-origin-resource-policy: cross-origin\r\nx-content-type-options: nosniff\r\ncdn-status: 200\r\ncdn-requesttime: 0\r\ncdn-requestid: 4f338739bd75b634e7f3517bf2e1f433\r\ncdn-cache: HIT\r\nserver: cloudflare\r\nage: 3427091\r\ncf-cache-status: HIT\r\ncf-ray: 9e63d901ba9f8be6-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":27466,"size_decoded":0,"mime_type":"text/css; charset=utf-8","magic":"ASCII text, with very long lines (27303)","md5":"4fbd15cb6047af93373f4f895639c8bf","sha1":"12d6861075de8e293265ff6ff03b1f3adcb44c76","sha256":"ddd92f10ad162c7449eff0acaf40598c05b1111739587edb75e5326b6697c5d5","sha512":"f8be32cba15170319b5c9f663c6f0c4ffdd4083cf047d80f7b214d302b489eca25fbee66ddb9366d758a7598efc9b9a886b02c9f751ae71f207cb9db1356243a","ssdeep":"384:Qi5yWeTUKW+KlkJ5de2UYmydfwYUas8l8yQ/8c:Dlr+Klk3YlKfwYUf8l8yQ/T","tlshash":"3bc230f8e54c01d66731c48bff81b36862b6f73dd5814d99f01f690c29d22a522c5bba","first_seen":"2023-04-05T07:46:17Z","last_seen":"2026-08-14T05:09:32.915492Z","times_seen":41921,"resource_available":false,"data":null}},"time_used":32,"timings":{"blocked":13,"dns":1,"connect":1,"send":0,"wait":4,"receive":0,"ssl":11},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"cdn.jsdelivr.net/npm/@formkit/themes@1.6.9/dist/genesis/theme.css","fqdn":"cdn.jsdelivr.net","domain":"jsdelivr.net","tld":"net"},"ip":{"addr":"151.101.65.229","port":443,"asn":54113,"as":"FASTLY","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://americanexpress-de27.ink/de","date":"2026-04-03T00:09:59.612Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"jsdelivr.net","organization":""},"issuer":{"commonName":"GlobalSign Atlas R3 DV TLS CA 2025 Q2","organization":"GlobalSign nv-sa"},"validity":{"start":"Mon, 02 Jun 2025 15:43:52 GMT","end":"Sat, 04 Jul 2026 15:43:51 GMT"},"fingerprint":{"sha1":"21:17:81:78:41:C6:8F:86:D6:CF:8D:98:CC:74:A8:F1:03:F8:C9:D4","sha256":"D0:E6:8D:08:11:05:7E:0C:2A:0D:C7:E0:ED:AE:9E:18:C8:74:32:12:3D:56:43:98:62:CD:A2:08:6F:64:5B:B0"}}},"request":{"raw":"GET /npm/@formkit/themes@1.6.9/dist/genesis/theme.css HTTP/1.1\r\nHost: cdn.jsdelivr.net\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://americanexpress-de27.ink/\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 404 Not Found\r\naccess-control-allow-origin: *\r\naccess-control-expose-headers: *\r\ntiming-allow-origin: *\r\ncache-control: public, max-age=86400, s-maxage=86400\r\ncross-origin-resource-policy: cross-origin\r\nx-content-type-options: nosniff\r\nstrict-transport-security: max-age=31536000; includeSubDomains; preload\r\ncontent-type: text/plain; charset=utf-8\r\netag: W/\"4c-4MDUp7kfXiNqi5+TqygY6Z58cgc\"\r\ncontent-encoding: br\r\naccept-ranges: bytes\r\nage: 84297\r\ndate: Fri, 03 Apr 2026 00:09:59 GMT\r\nx-served-by: cache-fra-etou8220162-FRA, cache-hel1410034-HEL\r\nx-cache: HIT, HIT\r\nvary: Accept-Encoding\r\nalt-svc: h3=\":443\";ma=86400,h3-29=\":443\";ma=86400,h3-27=\":443\";ma=86400\r\ncontent-length: 72\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"404","status_text":"Not Found","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":0,"size_decoded":0,"mime_type":"text/plain; charset=utf-8","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-08-14T04:51:57.63231Z","times_seen":17880808,"resource_available":true,"data":null}},"time_used":163,"timings":{"blocked":68,"dns":1,"connect":26,"send":0,"wait":27,"receive":0,"ssl":36},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"americanexpress-de27.ink/apps/DE_PT_06/assets/index-YHEXECQb.js","fqdn":"americanexpress-de27.ink","domain":"americanexpress-de27.ink","tld":"ink"},"ip":{"addr":"43.159.168.186","port":443,"asn":132203,"as":"Tencent Building, Kejizhongyi Avenue","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://americanexpress-de27.ink/de","date":"2026-04-03T00:10:00.245Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"americanexpress-de27.ink","organization":""},"issuer":{"commonName":"E8","organization":"Let's Encrypt"},"validity":{"start":"Tue, 31 Mar 2026 10:35:56 GMT","end":"Mon, 29 Jun 2026 10:35:55 GMT"},"fingerprint":{"sha1":"46:EF:44:88:83:E9:F7:A3:56:56:7B:5B:49:1B:52:92:58:6A:F2:D3","sha256":"DD:F2:6A:D6:08:80:C2:8C:3B:11:57:96:A0:6F:06:31:6B:23:63:15:BA:88:E6:6B:94:5E:5F:17:E6:BB:8B:59"}}},"request":{"raw":"GET /apps/DE_PT_06/assets/index-YHEXECQb.js HTTP/1.1\r\nHost: americanexpress-de27.ink\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://americanexpress-de27.ink/apps/DE_PT_06/assets/index-Dc_eNAqt.js\r\nDNT: 1\r\nConnection: keep-alive\r\nCookie: PHPSID=26aa9155c173da41a37054ab0fe83670; uuid=26aa9155c173da41a37054ab0fe83670\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nalt-svc: h3=\":443\"; ma=2592000\r\ncache-control: public, max-age=2592000\r\ncontent-encoding: gzip\r\ncontent-type: text/javascript; charset=utf-8\r\netag: \"dhj0y5z6iosg5ck-gzip\"\r\nlast-modified: Thu, 02 Apr 2026 22:32:40 GMT\r\nreferrer-policy: strict-origin-when-cross-origin\r\nserver: Caddy\r\nvary: Accept-Encoding\r\nx-content-type-options: nosniff\r\nx-frame-options: SAMEORIGIN\r\ncontent-length: 3063\r\ndate: Fri, 03 Apr 2026 00:10:00 GMT\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Caddy","description":"","website":"https://caddyserver.com","common_platform_enumeration":"cpe:2.3:a:caddyserver:caddy:*:*:*:*:*:*:*:*","icon":"caddy.svg","categories":["Web servers"]}],"data":{"size":6932,"size_decoded":0,"mime_type":"text/javascript; charset=utf-8","magic":"JavaScript source, Unicode text, UTF-8 text, with very long lines (6915)","md5":"fdd59267ed186c093169aefaad3e697a","sha1":"bd9f118ca86d023aa4d14bd9a45d49329bea9a2d","sha256":"96324952dc459daf0bf3bad12b6cbd883ce99bddfdc8525fd8b9af520573e149","sha512":"7a858c436727c7f19c116f17d010bb69aae9ea82bd0a9b315db2cbb13e8021c3304b4cd65ec8aee84ee1cc3d27abd39ace025f4b1c3a51826c8a253fb66c8a86","ssdeep":"192:BilN1Hun8a6Cgyyagug1b5wh64D5ITwXDf/2DfOVD1DfopyY64:BilXHu8/DrJuhvIT+f/kfOVxfGH","tlshash":"0ee1b5086af4e1bca0cb04b5e521e4e0b0b6bc6ee065c5d17ff50a1d97aeb4ca741538","first_seen":"2026-04-03T00:10:26.337278Z","last_seen":"2026-04-18T17:33:18.108931Z","times_seen":5,"resource_available":true,"data":null}},"time_used":153,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":153,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-04-03","alert":"Sinkholed","trigger":"americanexpress-de27.ink","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"americanexpress-de27.ink/apps/DE_PT_06/assets/de-C4D51E0Z.js","fqdn":"americanexpress-de27.ink","domain":"americanexpress-de27.ink","tld":"ink"},"ip":{"addr":"43.159.168.186","port":443,"asn":132203,"as":"Tencent Building, Kejizhongyi Avenue","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://americanexpress-de27.ink/de","date":"2026-04-03T00:10:00.599Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"americanexpress-de27.ink","organization":""},"issuer":{"commonName":"E8","organization":"Let's Encrypt"},"validity":{"start":"Tue, 31 Mar 2026 10:35:56 GMT","end":"Mon, 29 Jun 2026 10:35:55 GMT"},"fingerprint":{"sha1":"46:EF:44:88:83:E9:F7:A3:56:56:7B:5B:49:1B:52:92:58:6A:F2:D3","sha256":"DD:F2:6A:D6:08:80:C2:8C:3B:11:57:96:A0:6F:06:31:6B:23:63:15:BA:88:E6:6B:94:5E:5F:17:E6:BB:8B:59"}}},"request":{"raw":"GET /apps/DE_PT_06/assets/de-C4D51E0Z.js HTTP/1.1\r\nHost: americanexpress-de27.ink\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://americanexpress-de27.ink/apps/DE_PT_06/assets/index-Dc_eNAqt.js\r\nDNT: 1\r\nConnection: keep-alive\r\nCookie: PHPSID=26aa9155c173da41a37054ab0fe83670; uuid=26aa9155c173da41a37054ab0fe83670\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\naccept-ranges: bytes\r\nalt-svc: h3=\":443\"; ma=2592000\r\ncache-control: public, max-age=2592000\r\ncontent-type: text/javascript; charset=utf-8\r\netag: \"dhj0y5z6iosg9a\"\r\nlast-modified: Thu, 02 Apr 2026 22:32:40 GMT\r\nreferrer-policy: strict-origin-when-cross-origin\r\nserver: Caddy\r\nvary: Accept-Encoding\r\nx-content-type-options: nosniff\r\nx-frame-options: SAMEORIGIN\r\ncontent-length: 334\r\ndate: Fri, 03 Apr 2026 00:10:00 GMT\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Caddy","description":"","website":"https://caddyserver.com","common_platform_enumeration":"cpe:2.3:a:caddyserver:caddy:*:*:*:*:*:*:*:*","icon":"caddy.svg","categories":["Web servers"]}],"data":{"size":334,"size_decoded":0,"mime_type":"text/javascript; charset=utf-8","magic":"ASCII text, with very long lines (333)","md5":"0cf70b59adc0d43993c5fcf6bc52c753","sha1":"54cfbad5d584b038ecac40ffdfac4dbfc7ce0d73","sha256":"aa221c2b52b178e319e0961826ed0e01710ae936818ab39d2f88f9a182997052","sha512":"f9210edf86ecbd2ee525887faafafbf9f70ad7a18ebdc0a45a5067b473b68b6f67ff7c4ddbec4a6180ab2fe040cbd0516e309e05b621f7a0077851b91304e90f","ssdeep":"","tlshash":"4ae0c28d68131e4388a085760f2a5e6ad8c276c97fecf59f54b2d85c328009bad5c6fd","first_seen":"2026-03-31T15:15:49.543007Z","last_seen":"2026-04-18T17:33:18.099914Z","times_seen":9,"resource_available":true,"data":null}},"time_used":282,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":282,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-04-03","alert":"Sinkholed","trigger":"americanexpress-de27.ink","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"americanexpress-de27.ink/apps/DE_PT_06/assets/index-C9rZNGTp.css","fqdn":"americanexpress-de27.ink","domain":"americanexpress-de27.ink","tld":"ink"},"ip":{"addr":"43.159.168.186","port":443,"asn":132203,"as":"Tencent Building, Kejizhongyi Avenue","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://americanexpress-de27.ink/de","date":"2026-04-03T00:09:58.529Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"americanexpress-de27.ink","organization":""},"issuer":{"commonName":"E8","organization":"Let's Encrypt"},"validity":{"start":"Tue, 31 Mar 2026 10:35:56 GMT","end":"Mon, 29 Jun 2026 10:35:55 GMT"},"fingerprint":{"sha1":"46:EF:44:88:83:E9:F7:A3:56:56:7B:5B:49:1B:52:92:58:6A:F2:D3","sha256":"DD:F2:6A:D6:08:80:C2:8C:3B:11:57:96:A0:6F:06:31:6B:23:63:15:BA:88:E6:6B:94:5E:5F:17:E6:BB:8B:59"}}},"request":{"raw":"GET /apps/DE_PT_06/assets/index-C9rZNGTp.css HTTP/1.1\r\nHost: americanexpress-de27.ink\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://americanexpress-de27.ink/de\r\nDNT: 1\r\nConnection: keep-alive\r\nCookie: PHPSID=26aa9155c173da41a37054ab0fe83670\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nalt-svc: h3=\":443\"; ma=2592000\r\ncache-control: public, max-age=2592000\r\ncontent-encoding: gzip\r\ncontent-type: text/css; charset=utf-8\r\netag: \"dhj0y5z6iosgbcgc-gzip\"\r\nlast-modified: Thu, 02 Apr 2026 22:32:40 GMT\r\nreferrer-policy: strict-origin-when-cross-origin\r\nserver: Caddy\r\nvary: Accept-Encoding\r\nx-content-type-options: nosniff\r\nx-frame-options: SAMEORIGIN\r\ndate: Fri, 03 Apr 2026 00:09:58 GMT\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Caddy","description":"","website":"https://caddyserver.com","common_platform_enumeration":"cpe:2.3:a:caddyserver:caddy:*:*:*:*:*:*:*:*","icon":"caddy.svg","categories":["Web servers"]}],"data":{"size":529356,"size_decoded":0,"mime_type":"text/css; charset=utf-8","magic":"Unicode text, UTF-8 text, with very long lines (65198), with no line terminators","md5":"cfbaeb26519315935fb7761a427e7564","sha1":"fd7ab417687f928dca1595d447017adbc6d3bc12","sha256":"b76e96742a6668b0e90e35adfda7e57d6209b8fa4a84cc1d6aa900ffdf36919e","sha512":"2cf46b2443d769abc4c952b4284b076dcb8e38ee2ac64cebfddedcc5759d1fa466e92563846dc29794d2b6d236b88c32a2d82cca3becbe724af66a8422eba913","ssdeep":"3072:7VXcBu03pAs8zdJHR4/ZDrvLUbemsDAw6Fa:7VXcBu03pL3vLUbemsDAwYa","tlshash":"67b4b7c9f6e0201dc226c60af2913ab8fb6b555de7152df7f11f7b5c9ac228702b2518","first_seen":"2026-04-03T00:10:26.3413Z","last_seen":"2026-04-18T17:33:17.655877Z","times_seen":3,"resource_available":false,"data":null}},"time_used":306,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":306,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-04-03","alert":"Sinkholed","trigger":"americanexpress-de27.ink","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"fonts-api.wp.com/css?family=Inter%3A500%2C%7CPoppins%3A500%2C\u0026display=fallback\u0026ver=4.11.16","fqdn":"fonts-api.wp.com","domain":"wp.com","tld":"com"},"ip":{"addr":"192.0.77.32","port":443,"asn":2635,"as":"AUTOMATTIC","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://americanexpress-de27.ink/de","date":"2026-04-03T00:09:59.307Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"wp.com","organization":""},"issuer":{"commonName":"E7","organization":"Let's Encrypt"},"validity":{"start":"Mon, 02 Feb 2026 19:44:49 GMT","end":"Sun, 03 May 2026 19:44:48 GMT"},"fingerprint":{"sha1":"74:16:DF:29:E8:C6:D5:FE:A5:36:94:0A:16:BE:D1:6C:47:5D:73:4E","sha256":"6B:F6:59:57:FF:CF:20:B1:02:F4:62:B9:0B:13:CF:BC:2A:97:53:23:B5:D3:82:11:79:85:81:64:BE:85:54:75"}}},"request":{"raw":"GET /css?family=Inter%3A500%2C%7CPoppins%3A500%2C\u0026display=fallback\u0026ver=4.11.16 HTTP/1.1\r\nHost: fonts-api.wp.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://americanexpress-de27.ink/\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Fri, 03 Apr 2026 00:09:59 GMT\r\ncontent-type: text/css; charset=utf-8\r\naccess-control-allow-origin: *\r\ntiming-allow-origin: *\r\nlink: \u003chttps://fonts.gstatic.com\u003e; rel=preconnect; crossorigin\r\nstrict-transport-security: max-age=31536000\r\ncache-control: private, max-age=86400\r\ncross-origin-opener-policy: same-origin-allow-popups\r\ncross-origin-resource-policy: cross-origin\r\nx-xss-protection: 0\r\nx-frame-options: SAMEORIGIN\r\nx-content-type-options: nosniff\r\nvary: Accept-Encoding, Sec-Fetch-Dest, Sec-Fetch-Mode, Sec-Fetch-Site,Accept-Encoding\r\nalt-svc: h3=\":443\"; ma=86400\r\nx-nc: BYPASS arn 10\r\nserver-timing: a8c-cdn, dc;desc=arn, cache;desc=BYPASS;dur=11.0\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":3782,"size_decoded":0,"mime_type":"text/css; charset=utf-8","magic":"ASCII text","md5":"20d3052e2ec2d6724ef6c901b7837b53","sha1":"03b668324779b05d0d08380aeb41e499f1443731","sha256":"6e6595f831c9645979d196d7a5672486e1c31607a883b52472bc6c5492a385ae","sha512":"9eb3303d234a784c73214627ae0c01a3471b6edb534179f960394dc7918eecbd545de181c71d91dba700b43ef73d5cb78e80d7c9da2e7c7dd93ad81379e0502a","ssdeep":"","tlshash":"9e710ea1042ba1009b835dc323cf7f36ee8e25482045d6a95bfd0d486cead3a5371b9e","first_seen":"2026-03-19T13:43:02.872759Z","last_seen":"2026-05-07T13:50:41.271814Z","times_seen":80,"resource_available":false,"data":null}},"time_used":94,"timings":{"blocked":36,"dns":11,"connect":8,"send":0,"wait":19,"receive":0,"ssl":17},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"wss","addr":"americanexpress-de27.ink/wss?uuid=26aa9155c173da41a37054ab0fe83670","fqdn":"americanexpress-de27.ink","domain":"americanexpress-de27.ink","tld":"ink"},"ip":{"addr":"43.159.168.186","port":443,"asn":132203,"as":"Tencent Building, Kejizhongyi Avenue","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"websocket","requested_by":"https://americanexpress-de27.ink/de","date":"2026-04-03T00:10:00.021Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"americanexpress-de27.ink","organization":""},"issuer":{"commonName":"E8","organization":"Let's Encrypt"},"validity":{"start":"Tue, 31 Mar 2026 10:35:56 GMT","end":"Mon, 29 Jun 2026 10:35:55 GMT"},"fingerprint":{"sha1":"46:EF:44:88:83:E9:F7:A3:56:56:7B:5B:49:1B:52:92:58:6A:F2:D3","sha256":"DD:F2:6A:D6:08:80:C2:8C:3B:11:57:96:A0:6F:06:31:6B:23:63:15:BA:88:E6:6B:94:5E:5F:17:E6:BB:8B:59"}}},"request":{"raw":"GET /wss?uuid=26aa9155c173da41a37054ab0fe83670 HTTP/1.1\r\nHost: americanexpress-de27.ink\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nSec-WebSocket-Version: 13\r\nOrigin: https://americanexpress-de27.ink\r\nSec-WebSocket-Extensions: permessage-deflate\r\nSec-WebSocket-Key: 3tme/ZLOSim0zOiIgDOTeg==\r\nDNT: 1\r\nConnection: keep-alive, Upgrade\r\nCookie: PHPSID=26aa9155c173da41a37054ab0fe83670; uuid=26aa9155c173da41a37054ab0fe83670\r\nSec-Fetch-Dest: websocket\r\nSec-Fetch-Mode: websocket\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\nUpgrade: websocket\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 101 Switching Protocols\r\nAlt-Svc: h3=\":443\"; ma=2592000\r\nConnection: Upgrade\r\nReferrer-Policy: strict-origin-when-cross-origin\r\nSec-WebSocket-Accept: 5dPFbVH8uPGoHAN/8kjoHk/WkWc=\r\nSec-WebSocket-Version: 13\r\nServer: Caddy, workerman\r\nUpgrade: websocket\r\nX-Content-Type-Options: nosniff\r\nX-Frame-Options: SAMEORIGIN\r\nDate: Fri, 03 Apr 2026 00:10:00 GMT\r\n\r\n","headers":null,"cookies":null,"status_code":"101","status_text":"Switching Protocols","fingerprints":null,"data":{"size":0,"size_decoded":0,"mime_type":"text/plain","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-08-14T04:51:57.63231Z","times_seen":17880808,"resource_available":true,"data":null}},"time_used":469,"timings":{"blocked":0,"dns":1,"connect":152,"send":0,"wait":153,"receive":0,"ssl":163},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-04-03","alert":"Sinkholed","trigger":"americanexpress-de27.ink","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"americanexpress-de27.ink/apps/DE_PT_06/assets/index-B7O3wHJn.css","fqdn":"americanexpress-de27.ink","domain":"americanexpress-de27.ink","tld":"ink"},"ip":{"addr":"43.159.168.186","port":443,"asn":132203,"as":"Tencent Building, Kejizhongyi Avenue","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://americanexpress-de27.ink/de","date":"2026-04-03T00:10:00.083Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"americanexpress-de27.ink","organization":""},"issuer":{"commonName":"E8","organization":"Let's Encrypt"},"validity":{"start":"Tue, 31 Mar 2026 10:35:56 GMT","end":"Mon, 29 Jun 2026 10:35:55 GMT"},"fingerprint":{"sha1":"46:EF:44:88:83:E9:F7:A3:56:56:7B:5B:49:1B:52:92:58:6A:F2:D3","sha256":"DD:F2:6A:D6:08:80:C2:8C:3B:11:57:96:A0:6F:06:31:6B:23:63:15:BA:88:E6:6B:94:5E:5F:17:E6:BB:8B:59"}}},"request":{"raw":"GET /apps/DE_PT_06/assets/index-B7O3wHJn.css HTTP/1.1\r\nHost: americanexpress-de27.ink\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://americanexpress-de27.ink/de\r\nDNT: 1\r\nConnection: keep-alive\r\nCookie: PHPSID=26aa9155c173da41a37054ab0fe83670; uuid=26aa9155c173da41a37054ab0fe83670\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nalt-svc: h3=\":443\"; ma=2592000\r\ncache-control: public, max-age=2592000\r\ncontent-encoding: gzip\r\ncontent-type: text/css; charset=utf-8\r\netag: \"dhj0y5z6iosgk4-gzip\"\r\nlast-modified: Thu, 02 Apr 2026 22:32:40 GMT\r\nreferrer-policy: strict-origin-when-cross-origin\r\nserver: Caddy\r\nvary: Accept-Encoding\r\nx-content-type-options: nosniff\r\nx-frame-options: SAMEORIGIN\r\ncontent-length: 378\r\ndate: Fri, 03 Apr 2026 00:10:00 GMT\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Caddy","description":"","website":"https://caddyserver.com","common_platform_enumeration":"cpe:2.3:a:caddyserver:caddy:*:*:*:*:*:*:*:*","icon":"caddy.svg","categories":["Web servers"]}],"data":{"size":724,"size_decoded":0,"mime_type":"text/css; charset=utf-8","magic":"ASCII text, with very long lines (723)","md5":"bf924c0e4fb700bd54e39df992eb692b","sha1":"b51aa1caf383137b710b77374fa66e5395ee2bf4","sha256":"e4909836f23e7d8d6a7101674aa2c0ea57b709c1726c13a809aea35a7b45f98f","sha512":"09b70f023ed6552095a7289c3336aa5f9e696d483eac0c1a94e5fa7bce442c4665f9d4a6315ca5d4c24331480abd697326673b495264145b431676369d702b7e","ssdeep":"","tlshash":"d7019c31f748e000b236d0a8f8c4f1ec32963b7348565466ac965520cd871a7af40f48","first_seen":"2026-03-31T15:15:49.542021Z","last_seen":"2026-04-18T17:33:18.101047Z","times_seen":9,"resource_available":false,"data":null}},"time_used":153,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":153,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-04-03","alert":"Sinkholed","trigger":"americanexpress-de27.ink","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"americanexpress-de27.ink/apps/DE_PT_06/assets/bg-CjBvNwF8.webp","fqdn":"americanexpress-de27.ink","domain":"americanexpress-de27.ink","tld":"ink"},"ip":{"addr":"43.159.168.186","port":443,"asn":132203,"as":"Tencent Building, Kejizhongyi Avenue","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://americanexpress-de27.ink/de","date":"2026-04-03T00:10:00.571Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"americanexpress-de27.ink","organization":""},"issuer":{"commonName":"E8","organization":"Let's Encrypt"},"validity":{"start":"Tue, 31 Mar 2026 10:35:56 GMT","end":"Mon, 29 Jun 2026 10:35:55 GMT"},"fingerprint":{"sha1":"46:EF:44:88:83:E9:F7:A3:56:56:7B:5B:49:1B:52:92:58:6A:F2:D3","sha256":"DD:F2:6A:D6:08:80:C2:8C:3B:11:57:96:A0:6F:06:31:6B:23:63:15:BA:88:E6:6B:94:5E:5F:17:E6:BB:8B:59"}}},"request":{"raw":"GET /apps/DE_PT_06/assets/bg-CjBvNwF8.webp HTTP/1.1\r\nHost: americanexpress-de27.ink\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://americanexpress-de27.ink/de\r\nDNT: 1\r\nConnection: keep-alive\r\nCookie: PHPSID=26aa9155c173da41a37054ab0fe83670; uuid=26aa9155c173da41a37054ab0fe83670\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\naccept-ranges: bytes\r\nalt-svc: h3=\":443\"; ma=2592000\r\ncontent-type: image/webp\r\nlast-modified: Thu, 02 Apr 2026 22:32:40 GMT\r\nreferrer-policy: strict-origin-when-cross-origin\r\nserver: workerman\r\nvia: 1.1 Caddy\r\nx-content-type-options: nosniff\r\nx-frame-options: SAMEORIGIN\r\ncontent-length: 435048\r\ndate: Fri, 03 Apr 2026 00:10:00 GMT\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":null,"data":{"size":435048,"size_decoded":0,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image, VP8 encoding, 1920x1080, Scaling: [none]x[none], YUV color, decoders should clamp","md5":"d06c06f717870a9cc7f45531645f6cdd","sha1":"ef29b938d9fceca9294f236166d05593c10bfd00","sha256":"f0e0e5123ad3951d18978d1a50c8a20e703d3fdc1e315fe127bc32353d4df047","sha512":"2ca8eaa02c7bd1b27b1a8d8fe87110cd8d7e3f3928160e232ca9941af45e0f546f4fa83ad05264a6556c27acf438551223539bedc57f0e6eec703017cf75a59d","ssdeep":"12288:sOrOxzKFxLj6wy4H6ZxNErNllPil/P08EvUxAUwACxSL+R:gByxLjc4aZxNEBll8H0Tv7px2+R","tlshash":"379423027b794a96e0444b1032c2f2e6abc5d1c9e787db7dc32857bddac0885c13ee69","first_seen":"2026-03-31T15:15:49.55053Z","last_seen":"2026-04-18T17:33:18.109892Z","times_seen":9,"resource_available":false,"data":null}},"time_used":169,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":154,"receive":15,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-04-03","alert":"Sinkholed","trigger":"americanexpress-de27.ink","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"americanexpress-de27.ink/de","fqdn":"americanexpress-de27.ink","domain":"americanexpress-de27.ink","tld":"ink"},"ip":{"addr":"43.159.168.186","port":443,"asn":132203,"as":"Tencent Building, Kejizhongyi Avenue","country":"United States","country_code":"US"},"is_navigation_request":true,"resource_type":"document","requested_by":"","date":"2026-04-03T00:09:57.346Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"americanexpress-de27.ink","organization":""},"issuer":{"commonName":"E8","organization":"Let's Encrypt"},"validity":{"start":"Tue, 31 Mar 2026 10:35:56 GMT","end":"Mon, 29 Jun 2026 10:35:55 GMT"},"fingerprint":{"sha1":"46:EF:44:88:83:E9:F7:A3:56:56:7B:5B:49:1B:52:92:58:6A:F2:D3","sha256":"DD:F2:6A:D6:08:80:C2:8C:3B:11:57:96:A0:6F:06:31:6B:23:63:15:BA:88:E6:6B:94:5E:5F:17:E6:BB:8B:59"}}},"request":{"raw":"GET /de HTTP/1.1\r\nHost: americanexpress-de27.ink\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nUpgrade-Insecure-Requests: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: document\r\nSec-Fetch-Mode: navigate\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\naccess-control-allow-credentials: true\r\naccess-control-allow-headers: *\r\naccess-control-allow-methods: *\r\naccess-control-allow-origin: *\r\nalt-svc: h3=\":443\"; ma=2592000\r\ncontent-encoding: gzip\r\ncontent-type: text/html;charset=utf-8\r\nreferrer-policy: strict-origin-when-cross-origin\r\nserver: workerman\r\nset-cookie: PHPSID=26aa9155c173da41a37054ab0fe83670; Max-Age=31536000; Path=/; HttpOnly\r\nvary: Accept-Encoding\r\nvia: 1.1 Caddy\r\nx-content-type-options: nosniff\r\nx-frame-options: SAMEORIGIN\r\ncontent-length: 352\r\ndate: Fri, 03 Apr 2026 00:09:58 GMT\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":null,"data":{"size":572,"size_decoded":0,"mime_type":"text/html; charset=utf-8","magic":"HTML document, ASCII text, with CRLF, CR, LF line terminators","md5":"875c9faad8276c1f617f15d6c7bb6bed","sha1":"0f2af306b69d8fb2ee5de8b92cf79d0154ff7bb3","sha256":"e4a13f54cc37e0b63110cbed71de36019f57a9c0f59c0d7fdfd5dd2ab5690df3","sha512":"1e58319642d03298fb79fa9b371df9f005a9020e9d3e9cbc9b440a66705c4c72f2171f6b490eb88a07fbd94313952d47659a30bc5aa645ea04b171ca2520d95b","ssdeep":"","tlshash":"5af0815108940c2d03b1173d3a80d00cf4d7fa4acb0659d076e6707f2be5e4989df649","first_seen":"2026-04-03T00:10:26.350213Z","last_seen":"2026-04-18T17:33:18.107192Z","times_seen":5,"resource_available":false,"data":null}},"time_used":1872,"timings":{"blocked":857,"dns":541,"connect":153,"send":0,"wait":158,"receive":0,"ssl":161},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-04-03","alert":"Sinkholed","trigger":"americanexpress-de27.ink","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"americanexpress-de27.ink/getApp?app_id=DE_PT_06","fqdn":"americanexpress-de27.ink","domain":"americanexpress-de27.ink","tld":"ink"},"ip":{"addr":"43.159.168.186","port":443,"asn":132203,"as":"Tencent Building, Kejizhongyi Avenue","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"https://americanexpress-de27.ink/de","date":"2026-04-03T00:09:59.616Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"americanexpress-de27.ink","organization":""},"issuer":{"commonName":"E8","organization":"Let's Encrypt"},"validity":{"start":"Tue, 31 Mar 2026 10:35:56 GMT","end":"Mon, 29 Jun 2026 10:35:55 GMT"},"fingerprint":{"sha1":"46:EF:44:88:83:E9:F7:A3:56:56:7B:5B:49:1B:52:92:58:6A:F2:D3","sha256":"DD:F2:6A:D6:08:80:C2:8C:3B:11:57:96:A0:6F:06:31:6B:23:63:15:BA:88:E6:6B:94:5E:5F:17:E6:BB:8B:59"}}},"request":{"raw":"GET /getApp?app_id=DE_PT_06 HTTP/1.1\r\nHost: americanexpress-de27.ink\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/json, text/plain, */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://americanexpress-de27.ink/de\r\nDNT: 1\r\nConnection: keep-alive\r\nCookie: PHPSID=26aa9155c173da41a37054ab0fe83670\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\naccess-control-allow-credentials: true\r\naccess-control-allow-headers: *\r\naccess-control-allow-methods: *\r\naccess-control-allow-origin: *\r\nalt-svc: h3=\":443\"; ma=2592000\r\ncontent-encoding: gzip\r\ncontent-type: application/json\r\nreferrer-policy: strict-origin-when-cross-origin\r\nserver: workerman\r\nvary: Accept-Encoding\r\nvia: 1.1 Caddy\r\nx-content-type-options: nosniff\r\nx-frame-options: SAMEORIGIN\r\ndate: Fri, 03 Apr 2026 00:09:59 GMT\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":null,"data":{"size":11695,"size_decoded":0,"mime_type":"application/json","magic":"JSON text data","md5":"59318b569679310a1823eedbd5bf1d44","sha1":"93db6143cb35d710a3ac73cf8027264c9eeee2ec","sha256":"0fd91615e3fe06a7d34e20c2aad18a30441e3cfcafba689261eaaf27061274a8","sha512":"85ec81ef50c863f4b9605578720e364a396fd03dcd186187b6e699f1d11d4c38b2ab99f49499854eae3afc870190fbb9266f40dd5782b6b5bd05bbc8f87f8257","ssdeep":"192:YWM6z7MR4KIiYm4UzUF7gxSh3Gvt9FlCw09GCkxdZHQm09CygHxNmvLTL1tzac:7zwRNHa7gk69Cw09GXvdQ3Cymvm5tzn","tlshash":"0f32bfcdb9488795ca1c3004a02fdada9fe42e9b689ff6510d6073cff6416c2859923b","first_seen":"2026-04-03T00:10:26.351816Z","last_seen":"2026-04-03T00:10:26.351816Z","times_seen":1,"resource_available":false,"data":null}},"time_used":232,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":232,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-04-03","alert":"Sinkholed","trigger":"americanexpress-de27.ink","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"americanexpress-de27.ink/apps/DE_PT_06/favicon.ico","fqdn":"americanexpress-de27.ink","domain":"americanexpress-de27.ink","tld":"ink"},"ip":{"addr":"43.159.168.186","port":443,"asn":132203,"as":"Tencent Building, Kejizhongyi Avenue","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://americanexpress-de27.ink/de","date":"2026-04-03T00:09:59.842Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"americanexpress-de27.ink","organization":""},"issuer":{"commonName":"E8","organization":"Let's Encrypt"},"validity":{"start":"Tue, 31 Mar 2026 10:35:56 GMT","end":"Mon, 29 Jun 2026 10:35:55 GMT"},"fingerprint":{"sha1":"46:EF:44:88:83:E9:F7:A3:56:56:7B:5B:49:1B:52:92:58:6A:F2:D3","sha256":"DD:F2:6A:D6:08:80:C2:8C:3B:11:57:96:A0:6F:06:31:6B:23:63:15:BA:88:E6:6B:94:5E:5F:17:E6:BB:8B:59"}}},"request":{"raw":"GET /apps/DE_PT_06/favicon.ico HTTP/1.1\r\nHost: americanexpress-de27.ink\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://americanexpress-de27.ink/de\r\nDNT: 1\r\nConnection: keep-alive\r\nCookie: PHPSID=26aa9155c173da41a37054ab0fe83670\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nalt-svc: h3=\":443\"; ma=2592000\r\ncache-control: public, max-age=2592000\r\ncontent-encoding: gzip\r\ncontent-type: image/vnd.microsoft.icon\r\netag: \"dh6d23ivwgsg12s-gzip\"\r\nlast-modified: Thu, 19 Mar 2026 01:17:22 GMT\r\nreferrer-policy: strict-origin-when-cross-origin\r\nserver: Caddy\r\nvary: Accept-Encoding\r\nx-content-type-options: nosniff\r\nx-frame-options: SAMEORIGIN\r\ncontent-length: 1421\r\ndate: Fri, 03 Apr 2026 00:09:59 GMT\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Caddy","description":"","website":"https://caddyserver.com","common_platform_enumeration":"cpe:2.3:a:caddyserver:caddy:*:*:*:*:*:*:*:*","icon":"caddy.svg","categories":["Web servers"]}],"data":{"size":1396,"size_decoded":0,"mime_type":"image/vnd.microsoft.icon","magic":"PNG image data, 32 x 32, 8-bit/color RGBA, non-interlaced","md5":"d4814ea76c5393efaf6c27e6632e67ed","sha1":"d3c5921add928ed4d86ef31b36887019645cc15e","sha256":"5cd0f23ccd8cdd237af364707b85c20893fe8abf41e6ca3b5640e01411cc55be","sha512":"02ac1dbb0e8b88bfd06466c092282de7563220e422f4763edbb20bc02aca0674f90d7ea32f637cc6014e9a088cbb21f3706094008b45b01a1bda605c8ffc7cf6","ssdeep":"","tlshash":"da21e9653bc3193e6d1057e36fd2802297c614ae5f590f99600558a3a1fb54068a46e0","first_seen":"2026-03-19T13:43:02.85755Z","last_seen":"2026-04-18T17:33:18.114339Z","times_seen":75,"resource_available":false,"data":null}},"time_used":153,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":153,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-04-03","alert":"Sinkholed","trigger":"americanexpress-de27.ink","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"americanexpress-de27.ink/apps/DE_PT_06/assets/HP-175-Year-Banner-1280x400-CNKEqp5j.js","fqdn":"americanexpress-de27.ink","domain":"americanexpress-de27.ink","tld":"ink"},"ip":{"addr":"43.159.168.186","port":443,"asn":132203,"as":"Tencent Building, Kejizhongyi Avenue","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"fetch","requested_by":"https://americanexpress-de27.ink/de","date":"2026-04-03T00:10:00.089Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"americanexpress-de27.ink","organization":""},"issuer":{"commonName":"E8","organization":"Let's Encrypt"},"validity":{"start":"Tue, 31 Mar 2026 10:35:56 GMT","end":"Mon, 29 Jun 2026 10:35:55 GMT"},"fingerprint":{"sha1":"46:EF:44:88:83:E9:F7:A3:56:56:7B:5B:49:1B:52:92:58:6A:F2:D3","sha256":"DD:F2:6A:D6:08:80:C2:8C:3B:11:57:96:A0:6F:06:31:6B:23:63:15:BA:88:E6:6B:94:5E:5F:17:E6:BB:8B:59"}}},"request":{"raw":"GET /apps/DE_PT_06/assets/HP-175-Year-Banner-1280x400-CNKEqp5j.js HTTP/1.1\r\nHost: americanexpress-de27.ink\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://americanexpress-de27.ink/de\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\naccept-ranges: bytes\r\nalt-svc: h3=\":443\"; ma=2592000\r\ncache-control: public, max-age=2592000\r\ncontent-type: text/javascript; charset=utf-8\r\netag: \"dhj0y5z6iosg2s\"\r\nlast-modified: Thu, 02 Apr 2026 22:32:40 GMT\r\nreferrer-policy: strict-origin-when-cross-origin\r\nserver: Caddy\r\nvary: Accept-Encoding\r\nx-content-type-options: nosniff\r\nx-frame-options: SAMEORIGIN\r\ncontent-length: 100\r\ndate: Fri, 03 Apr 2026 00:10:00 GMT\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Caddy","description":"","website":"https://caddyserver.com","common_platform_enumeration":"cpe:2.3:a:caddyserver:caddy:*:*:*:*:*:*:*:*","icon":"caddy.svg","categories":["Web servers"]}],"data":{"size":100,"size_decoded":0,"mime_type":"text/javascript; charset=utf-8","magic":"ASCII text","md5":"19c80aa3ed425e1719f54ecfef114053","sha1":"575cf9b9fd0ae4f39d4220eeb4a2d08230374cc4","sha256":"fc2602654bfe5b3e6cc29d599f76bd6b63c4a6694e107528b349c37e0fe41369","sha512":"5a51f695148ca8c7ad7e0446cc2be0731d3132dcf90606c63bdf7cee13cb9678ebd900d454cb0728cdf9b767f5fb2e6b119ff4c196fa0dd315df9fc43cdbf742","ssdeep":"","tlshash":"a3b01203490f21b8023401be0b057fb0111125ccba5087b8374d4ae9875bf521d0a601","first_seen":"2026-03-19T13:43:02.846995Z","last_seen":"2026-04-18T17:33:18.10208Z","times_seen":75,"resource_available":true,"data":null}},"time_used":153,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":153,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-04-03","alert":"Sinkholed","trigger":"americanexpress-de27.ink","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"americanexpress-de27.ink/apps/DE_PT_06/assets/HP-175-Year-Banner-1280x400-DWqgiJZK.jpg","fqdn":"americanexpress-de27.ink","domain":"americanexpress-de27.ink","tld":"ink"},"ip":{"addr":"43.159.168.186","port":443,"asn":132203,"as":"Tencent Building, Kejizhongyi Avenue","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://americanexpress-de27.ink/de","date":"2026-04-03T00:10:00.579Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"americanexpress-de27.ink","organization":""},"issuer":{"commonName":"E8","organization":"Let's Encrypt"},"validity":{"start":"Tue, 31 Mar 2026 10:35:56 GMT","end":"Mon, 29 Jun 2026 10:35:55 GMT"},"fingerprint":{"sha1":"46:EF:44:88:83:E9:F7:A3:56:56:7B:5B:49:1B:52:92:58:6A:F2:D3","sha256":"DD:F2:6A:D6:08:80:C2:8C:3B:11:57:96:A0:6F:06:31:6B:23:63:15:BA:88:E6:6B:94:5E:5F:17:E6:BB:8B:59"}}},"request":{"raw":"GET /apps/DE_PT_06/assets/HP-175-Year-Banner-1280x400-DWqgiJZK.jpg HTTP/1.1\r\nHost: americanexpress-de27.ink\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://americanexpress-de27.ink/de\r\nDNT: 1\r\nConnection: keep-alive\r\nCookie: PHPSID=26aa9155c173da41a37054ab0fe83670; uuid=26aa9155c173da41a37054ab0fe83670\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\naccept-ranges: bytes\r\nalt-svc: h3=\":443\"; ma=2592000\r\ncache-control: public, max-age=2592000\r\ncontent-type: image/jpeg\r\netag: \"dhj0y5z6iosg1zya\"\r\nlast-modified: Thu, 02 Apr 2026 22:32:40 GMT\r\nreferrer-policy: strict-origin-when-cross-origin\r\nserver: Caddy\r\nvary: Accept-Encoding\r\nx-content-type-options: nosniff\r\nx-frame-options: SAMEORIGIN\r\ncontent-length: 93250\r\ndate: Fri, 03 Apr 2026 00:10:00 GMT\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Caddy","description":"","website":"https://caddyserver.com","common_platform_enumeration":"cpe:2.3:a:caddyserver:caddy:*:*:*:*:*:*:*:*","icon":"caddy.svg","categories":["Web servers"]}],"data":{"size":93250,"size_decoded":0,"mime_type":"image/jpeg","magic":"JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 1280x400, components 3","md5":"c8d4768df9076ac1443c6207c86bd056","sha1":"924d8b4b963d209a7f2aa311f87ed2ef25cb5a6b","sha256":"e3ea017d0f19e27e01aaa5ee9a50bc3d0cf08d668101e4c5cfeea36c5312ad59","sha512":"bd65ecef06cf5b46f237c5dbcbde1010800c322809f9ea96e7a0959f6c57f32e9a4f3bd865b10164b43ce00ba100aab8dd2bd7c4ed6ad77b914748089e63f176","ssdeep":"1536:xsg+BPX8CvQsq6xNXD/JUY8wT87rE8RKxjxmK0jEXNStzm1ZXOOwl:e/tsEtQwT8UBxtXHSlu8Z","tlshash":"bb9312eb938345049526df3e33e52700871e890fefe13e7d089e9171ab2c7649a25d6b","first_seen":"2026-03-19T13:43:02.849525Z","last_seen":"2026-04-18T17:33:18.099084Z","times_seen":75,"resource_available":false,"data":null}},"time_used":301,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":162,"receive":139,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-04-03","alert":"Sinkholed","trigger":"americanexpress-de27.ink","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"ipapi.co/json/","fqdn":"ipapi.co","domain":"ipapi.co","tld":"co"},"ip":{"addr":"104.26.8.44","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"fetch","requested_by":"https://americanexpress-de27.ink/de","date":"2026-04-03T00:10:00.899Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.2","cert":{"subject":{"commonName":"ipapi.co","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Mon, 16 Feb 2026 15:59:25 GMT","end":"Sun, 17 May 2026 16:59:23 GMT"},"fingerprint":{"sha1":"37:8F:7A:B7:BF:60:24:8D:1C:83:4F:C2:59:C3:0A:0C:EE:B3:75:A5","sha256":"8D:E6:B5:3D:41:1D:D8:B2:FA:03:95:07:E2:54:7C:1F:A2:22:E9:05:05:5E:D2:99:7D:DF:46:3F:32:52:53:F9"}}},"request":{"raw":"GET /json/ HTTP/1.1\r\nHost: ipapi.co\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://americanexpress-de27.ink/\r\nOrigin: https://americanexpress-de27.ink\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ndate: Fri, 03 Apr 2026 00:10:01 GMT\r\ncontent-type: application/json\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nserver: cloudflare\r\nallow: OPTIONS, POST, OPTIONS, GET, HEAD\r\nx-frame-options: DENY\r\nvary: Host, origin\r\naccess-control-allow-origin: https://americanexpress-de27.ink\r\nx-content-type-options: nosniff\r\nreferrer-policy: same-origin\r\ncross-origin-opener-policy: same-origin\r\ncontent-security-policy-report-only: default-src 'self'; script-src 'self' 'unsafe-inline' 'unsafe-eval' https://*.stripe.com https://*.paddle.com https://www.google.com https://www.gstatic.com https://maps.gstatic.com https://maps.googleapis.com https://www.google.com/recaptcha/ https://www.gstatic.com/recaptcha/; style-src 'self' 'unsafe-inline' https://*.paddle.com https://fonts.gstatic.com https://fonts.googleapis.com; img-src 'self' data: https://ipapi.co https://maps.gstatic.com https://maps.googleapis.com https://*.stripe.com; font-src 'self' data: https://fonts.gstatic.com https://fonts.googleapis.com; frame-src 'self' https://www.google.com https://*.stripe.com https://*.paddle.com https://www.google.com/recaptcha/ https://recaptcha.google.com/recaptcha/; connect-src 'self' https://ipapi.co/ https://*.paddle.com https://*.stripe.com https://maps.googleapis.com https://www.google.com/recaptcha/; object-src 'none'; frame-ancestors 'none'; base-uri 'self'; form-action 'self';\r\ncf-cache-status: DYNAMIC\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=8eH3tnXkRmCpB9%2B3r%2FC3g7Ydl3CHI1%2B3axHT%2Bh2VcbBqNJQyUEFDwG3kmkOzcYjnMXGR%2F9zYcT9VoSXlq7MrQVD50nG9afoMWMfBNhQjT8amyyZAFOi030gN\"}]}\r\ncontent-encoding: br\r\ncf-ray: 9e63d90bbdeb56a3-OSL\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":744,"size_decoded":0,"mime_type":"application/json","magic":"JSON text data","md5":"8215cbff3bb6e3f77b55f4f0f961749d","sha1":"d0c2a5a1be293236326a4c5a59b5172fba74d19b","sha256":"2bc635d44b5ca6c38b73aa6021eaccf71239109e9cb17b2c11d16d1fc1020308","sha512":"1d64ba84e769e0e5105bb0a51b90978a8bc52b3cbd30f03cddf95933de6ede8eec31b677a44c517a801ae7a293b479def7c6a4d933b936b8878eaa27dea76bb0","ssdeep":"","tlshash":"7f01df68e4680e7bacb9135cb42869071274220b5e56758e7bd09b8d0f8e9bf30b534e","first_seen":"2026-03-29T01:09:24.875702Z","last_seen":"2026-04-08T08:47:27.106595Z","times_seen":464,"resource_available":false,"data":null}},"time_used":286,"timings":{"blocked":17,"dns":4,"connect":1,"send":0,"wait":248,"receive":0,"ssl":14},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"americanexpress-de27.ink/apps/DE_PT_06/assets/index-YHEXECQb.js","fqdn":"americanexpress-de27.ink","domain":"americanexpress-de27.ink","tld":"ink"},"ip":{"addr":"43.159.168.186","port":443,"asn":132203,"as":"Tencent Building, Kejizhongyi Avenue","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"fetch","requested_by":"https://americanexpress-de27.ink/de","date":"2026-04-03T00:10:00.086Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"americanexpress-de27.ink","organization":""},"issuer":{"commonName":"E8","organization":"Let's Encrypt"},"validity":{"start":"Tue, 31 Mar 2026 10:35:56 GMT","end":"Mon, 29 Jun 2026 10:35:55 GMT"},"fingerprint":{"sha1":"46:EF:44:88:83:E9:F7:A3:56:56:7B:5B:49:1B:52:92:58:6A:F2:D3","sha256":"DD:F2:6A:D6:08:80:C2:8C:3B:11:57:96:A0:6F:06:31:6B:23:63:15:BA:88:E6:6B:94:5E:5F:17:E6:BB:8B:59"}}},"request":{"raw":"GET /apps/DE_PT_06/assets/index-YHEXECQb.js HTTP/1.1\r\nHost: americanexpress-de27.ink\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://americanexpress-de27.ink/de\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nalt-svc: h3=\":443\"; ma=2592000\r\ncache-control: public, max-age=2592000\r\ncontent-encoding: gzip\r\ncontent-type: text/javascript; charset=utf-8\r\netag: \"dhj0y5z6iosg5ck-gzip\"\r\nlast-modified: Thu, 02 Apr 2026 22:32:40 GMT\r\nreferrer-policy: strict-origin-when-cross-origin\r\nserver: Caddy\r\nvary: Accept-Encoding\r\nx-content-type-options: nosniff\r\nx-frame-options: SAMEORIGIN\r\ncontent-length: 3063\r\ndate: Fri, 03 Apr 2026 00:10:00 GMT\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Caddy","description":"","website":"https://caddyserver.com","common_platform_enumeration":"cpe:2.3:a:caddyserver:caddy:*:*:*:*:*:*:*:*","icon":"caddy.svg","categories":["Web servers"]}],"data":{"size":6932,"size_decoded":0,"mime_type":"text/javascript; charset=utf-8","magic":"JavaScript source, Unicode text, UTF-8 text, with very long lines (6915)","md5":"fdd59267ed186c093169aefaad3e697a","sha1":"bd9f118ca86d023aa4d14bd9a45d49329bea9a2d","sha256":"96324952dc459daf0bf3bad12b6cbd883ce99bddfdc8525fd8b9af520573e149","sha512":"7a858c436727c7f19c116f17d010bb69aae9ea82bd0a9b315db2cbb13e8021c3304b4cd65ec8aee84ee1cc3d27abd39ace025f4b1c3a51826c8a253fb66c8a86","ssdeep":"192:BilN1Hun8a6Cgyyagug1b5wh64D5ITwXDf/2DfOVD1DfopyY64:BilXHu8/DrJuhvIT+f/kfOVxfGH","tlshash":"0ee1b5086af4e1bca0cb04b5e521e4e0b0b6bc6ee065c5d17ff50a1d97aeb4ca741538","first_seen":"2026-04-03T00:10:26.337278Z","last_seen":"2026-04-18T17:33:18.108931Z","times_seen":5,"resource_available":true,"data":null}},"time_used":153,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":153,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-04-03","alert":"Sinkholed","trigger":"americanexpress-de27.ink","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}}]}