{"report_id":"90725791-59d9-4268-9489-bcd042ab42c9","version":6,"status":"done","tags":[],"date":"2025-11-30T17:34:57Z","url":{"schema":"http","addr":"tthj-wahtsapp.com/","fqdn":"tthj-wahtsapp.com","domain":"tthj-wahtsapp.com","tld":"com"},"ip":{"addr":"103.80.133.40","port":0,"asn":205960,"as":"Hdtidc Limited","country":"South Korea","country_code":"KR"},"final":{"url":{"schema":"https","addr":"tthj-wahtsapp.com/","fqdn":"tthj-wahtsapp.com","domain":"tthj-wahtsapp.com","tld":"com"},"title":"403","dom":{"size":2296,"mime_type":"text/html; charset=utf-8","magic":"HTML document, Unicode text, UTF-8 text","md5":"0bb9ce5973a1448ba64fd892219c4278","sha1":"05ae7f97f409e310dac9fea68df434869435665c","sha256":"8b74e4c50dc02832a120e0f8a8c46d6d6e392ae2a0c9a579c1a89118ab958d8a","sha512":"c0246a21f62342b612935cfce3f5146e553c3cd60c33b6aeafee838855590c7e892f45d48d031586539fb47312b041b5afddc62edb44278ed85cbdc76e5fce07","ssdeep":"","tlshash":"4b41335984e300010af6e22d2bb6f54838b8a417e617e80a798c3e95cf41f5c96e7fc5","dom_hash":"domhash75cdc2b0dacddf6e3bb7ccac022f0681","first_seen":"2025-11-30T15:12:23.109265Z","last_seen":"2025-12-01T05:08:35.090952Z","times_seen":4,"resource_available":false,"data":null}},"submit":{"url":{"schema":"http","addr":"tthj-wahtsapp.com/","fqdn":"tthj-wahtsapp.com","domain":"tthj-wahtsapp.com","tld":"com"},"ip":{"addr":"103.80.133.40","port":0,"asn":205960,"as":"Hdtidc Limited","country":"South Korea","country_code":"KR"},"tags":null,"meta":null},"settings":{"access":"public","device_type":"desktop","expires_at":"2027-01-04T17:34:57Z","useragent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0","referer":"","cookies":null,"exit_node":"z0yflva4pidy47h"},"stats":{"alert_count":{"ids":1,"urlquery":0,"analyzer":6}},"detection":{"ids":[{"sensor_name":"suricata","title":"Suricata IDS","description":"Suricata /w Emerging Threats Pro","date":"2025-11-30T17:34:35Z","timestamp":1764524075,"ip_dst":{"addr":"172.18.0.61","port":58488,"asn":0,"as":"","country":"","country_code":"zz"},"ip_src":{"addr":"103.80.133.40","port":443,"asn":205960,"as":"Hdtidc Limited","country":"South Korea","country_code":"KR"},"severity":"medium","alert":"ET DROP Spamhaus DROP Listed Traffic Inbound group 19","source":"{\"timestamp\":\"2025-11-30T17:34:35.522750+0000\",\"flow_id\":860692121597259,\"in_iface\":\"br-31613a7ed13b\",\"event_type\":\"alert\",\"src_ip\":\"103.80.133.40\",\"src_port\":443,\"dest_ip\":\"172.18.0.61\",\"dest_port\":58488,\"proto\":\"TCP\",\"metadata\":{\"flowbits\":[\"ET.Evil\",\"ET.DROPIP\"]},\"alert\":{\"action\":\"allowed\",\"gid\":1,\"signature_id\":2400018,\"rev\":4421,\"signature\":\"ET DROP Spamhaus DROP Listed Traffic Inbound group 19\",\"category\":\"Misc Attack\",\"severity\":2,\"metadata\":{\"affected_product\":[\"Any\"],\"attack_target\":[\"Any\"],\"created_at\":[\"2010_12_30\"],\"deployment\":[\"Perimeter\"],\"signature_severity\":[\"Minor\"],\"tag\":[\"Dshield\"],\"updated_at\":[\"2025_08_01\"]}},\"flow\":{\"pkts_toserver\":1,\"pkts_toclient\":1,\"bytes_toserver\":74,\"bytes_toclient\":74,\"start\":\"2025-11-30T17:34:35.275787+0000\"}}"}],"analyzer":[{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2025-11-30","alert":"Sinkholed","trigger":"tthj-wahtsapp.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2025-11-30","alert":"Phishing Block","trigger":"tthj-wahtsapp.com","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2025-11-30","alert":"Sinkholed","trigger":"tthj-wahtsapp.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-11-30","alert":"Sinkholed","trigger":"tthj-wahtsapp.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2025-11-30","alert":"Sinkholed","trigger":"tthj-wahtsapp.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2025-11-30","alert":"Sinkholed","trigger":"tthj-wahtsapp.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null},"summary":[{"fqdn":"tthj-wahtsapp.com","ip":{"addr":"103.80.133.40","port":443,"asn":205960,"as":"Hdtidc Limited","country":"South Korea","country_code":"KR"},"domain_registered":"2025-09-28","domain_rank":0,"first_seen":"2025-10-24T01:15:18.722802Z","last_seen":"2025-10-24T01:15:18.722802Z","alert_count":30,"request_count":5,"received_data":10044,"sent_data":2229,"comment":"","tags":null,"fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}]},{"fqdn":"hm.baidu.com","ip":{"addr":"14.215.182.140","port":443,"asn":4134,"as":"Chinanet","country":"China","country_code":"CN"},"domain_registered":"1999-10-11","domain_rank":54491,"first_seen":"2012-05-26T08:38:45Z","last_seen":"2025-11-24T00:18:37.797758Z","alert_count":0,"request_count":2,"received_data":30877,"sent_data":1086,"comment":"","tags":null,"fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Apache HTTP Server","description":"Apache is a free and open-source cross-platform web server software.","website":"https://httpd.apache.org/","common_platform_enumeration":"cpe:2.3:a:apache:http_server:*:*:*:*:*:*:*:*","icon":"Apache.svg","categories":["Web servers"]}]}],"files":null,"artifacts":{"windows_shortcuts":null,"files":null,"telegram":null,"pdfs":null,"clipboard":null},"sensors":{"ids":null,"analyzer":null,"urlquery":null},"javascript":{"script":[{"url":{"schema":"https","addr":"tthj-wahtsapp.com/","fqdn":"tthj-wahtsapp.com","domain":"tthj-wahtsapp.com","tld":"com"},"ip":{"addr":"103.80.133.40","port":443,"asn":205960,"as":"Hdtidc Limited","country":"South Korea","country_code":"KR"},"introduction_type":"scriptElement","is_inline":true,"md5":"530b0a5417fe117c413b71716e175700","sha1":"7a5b31284a4a017cef8fa86ef677d1af65f2e2db","sha256":"4067dc1753c1d80f75322d0d44155dabaa200edd48867f89abadfa264d248dd8","sha512":"ee43a9f192e381109e5d2666fac7fc38946a6d810bab8d1da0d20fc5121e163f6bc512f8de785051fd1bed599a11ece5746173618ecad6b0c075355e4272f4ea","ssdeep":"","tlshash":"00f0e5a4c0e148d189af725e276bfcd53e3114c3e015a0023d1c0f5ddfc026c83a5b42","size":530,"data":"","first_seen":"2025-10-19T14:14:10.924441Z","last_seen":"2025-12-06T03:12:34.907396Z","times_seen":190,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"tthj-wahtsapp.com/","fqdn":"tthj-wahtsapp.com","domain":"tthj-wahtsapp.com","tld":"com"},"ip":{"addr":"103.80.133.40","port":443,"asn":205960,"as":"Hdtidc Limited","country":"South Korea","country_code":"KR"},"introduction_type":"Function","is_inline":false,"md5":"1c5c9160600df2d96d69a4ea16cec7ed","sha1":"3cf678c9135cc952ba6970ef545035bb757a443f","sha256":"a3520fe88e248d2b6c9c6db93309a037ef969fe297208e5bd7e49a55bb32c808","sha512":"2a298a8c2552c6a6c6f8d3f7327d2e9abfa87a0dbb27e9e528a8539b416155c0860f54f46464dfe7e5d49c7906a9eacdac7e5181b86ef15a83276a8f4fee0546","ssdeep":"","tlshash":"078004d531c35040475331d400571cd4503444f014444d544040d4511c55030d1154dc","size":37,"data":"","first_seen":"2023-04-11T21:49:14Z","last_seen":"2026-08-12T13:40:47.828388Z","times_seen":121774,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"tthj-wahtsapp.com/","fqdn":"tthj-wahtsapp.com","domain":"tthj-wahtsapp.com","tld":"com"},"ip":{"addr":"103.80.133.40","port":443,"asn":205960,"as":"Hdtidc Limited","country":"South Korea","country_code":"KR"},"introduction_type":"Function","is_inline":false,"md5":"1c5c9160600df2d96d69a4ea16cec7ed","sha1":"3cf678c9135cc952ba6970ef545035bb757a443f","sha256":"a3520fe88e248d2b6c9c6db93309a037ef969fe297208e5bd7e49a55bb32c808","sha512":"2a298a8c2552c6a6c6f8d3f7327d2e9abfa87a0dbb27e9e528a8539b416155c0860f54f46464dfe7e5d49c7906a9eacdac7e5181b86ef15a83276a8f4fee0546","ssdeep":"","tlshash":"078004d531c35040475331d400571cd4503444f014444d544040d4511c55030d1154dc","size":37,"data":"","first_seen":"2023-04-11T21:49:14Z","last_seen":"2026-08-12T13:40:47.828388Z","times_seen":121774,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"hm.baidu.com/hm.js?d9bb8c3e0a8ddf6347b7d9d99b109ee0","fqdn":"hm.baidu.com","domain":"baidu.com","tld":"com"},"ip":{"addr":"14.215.182.140","port":443,"asn":4134,"as":"Chinanet","country":"China","country_code":"CN"},"introduction_type":"scriptElement","is_inline":false,"md5":"3e6908d777464d4ae76e4815215efa0e","sha1":"e9767bf8acc178d27c811faa82270b9665ddaa65","sha256":"7de1d54eb0a8b78b4d2e73bee87d51b7a374e555f8422f7df37e5b971e2e6afa","sha512":"ec9ff715b1012e724e15f72cbd028c0c47b03a7039eebd7ddaed6919c5e5ecbfbbf53ffef809f5d7678e404694c414ab33b2e68aef02ba658ac52f32198cc209","ssdeep":"384:e8JSoLMJJTRl6s1JXFVCFI/TayvuodsZPIGm8XaR1JRwvutq1tGdc7M04gRw6:e84VJfHgMdvussZPIx82Rwvutcto07v","tlshash":"e6d2d9a9b282713293a324a5153f724ef07b5a54bd4968a4f11894c07d38fbb027bfdd","size":29895,"data":"","first_seen":"2025-11-30T17:34:58.531875Z","last_seen":"2025-11-30T17:34:58.531875Z","times_seen":1,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"tthj-wahtsapp.com/","fqdn":"tthj-wahtsapp.com","domain":"tthj-wahtsapp.com","tld":"com"},"ip":{"addr":"103.80.133.40","port":443,"asn":205960,"as":"Hdtidc Limited","country":"South Korea","country_code":"KR"},"introduction_type":"Function","is_inline":false,"md5":"af6d8f97fd23d4aa006bb3f6c2784154","sha1":"6d4c668c9e0f8e13afe2ad586d4f243b77f71c85","sha256":"f0abbf7ebeeb102ea613dbaa1ce8b1736a549a32568680a3e2f9a85a99c6b42d","sha512":"e1ce0bebd90b77d299c58cb9cf4937628e5c0822f2cd75c4b056842ab1ce1686a2a5de176fb42a53185861bb0317f4ff7f6c78aaffe2f182656986ec013e4f8c","ssdeep":"","tlshash":"e6d095ccb4d3c8c837e76c822597a00cc99e4d3122c8ac004c0918133c9ef3759b15dd","size":273,"data":"","first_seen":"2025-11-30T17:34:58.535636Z","last_seen":"2025-11-30T17:34:58.535636Z","times_seen":1,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"tthj-wahtsapp.com/","fqdn":"tthj-wahtsapp.com","domain":"tthj-wahtsapp.com","tld":"com"},"ip":{"addr":"103.80.133.40","port":443,"asn":205960,"as":"Hdtidc Limited","country":"South Korea","country_code":"KR"},"introduction_type":"scriptElement","is_inline":true,"md5":"b4a818754d2768a6bb8aed5f0487c1dd","sha1":"2e19e360218295804902a9131ce20323c662071a","sha256":"2b738bbd1010d4811075dac0a35aaf984b979193508dd04ba801f93e01fbb4f8","sha512":"71449ed6955a33c1fb118acde3f5c4b319e8cbc6d3075e8f8c1fcb60d8be770685ea2139275f777eb0d4b8643d7de4998c07c027f82b53772bc5fc9b4b893c94","ssdeep":"","tlshash":"9811163d655720000be5d229bb96751474acb017bb63d90eb20d72515f16f1cf0f6eca","size":1084,"data":"","first_seen":"2025-11-30T15:12:23.115986Z","last_seen":"2025-12-01T05:08:35.103037Z","times_seen":7,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"tthj-wahtsapp.com/tj.js","fqdn":"tthj-wahtsapp.com","domain":"tthj-wahtsapp.com","tld":"com"},"ip":{"addr":"103.80.133.40","port":443,"asn":205960,"as":"Hdtidc Limited","country":"South Korea","country_code":"KR"},"introduction_type":"scriptElement","is_inline":false,"md5":"613791a5a916b495ab9f29cf170362fd","sha1":"e0a2847de1f94e2da4e6b8ff33297f7f9329683a","sha256":"ed9a078418e9dd1e4dd1a38464df766dbeb7161d4f17429fefa43b4c7f00f74e","sha512":"8e68e70ad39f838e489d2ad78136ae601f091d956386444d4982e3c351ee764606210fc47b61078e00c75e1b18bf948833b12aa3415fa44337a9d347c13b534c","ssdeep":"","tlshash":"24d02e0f2c9458382375082910fbe94cb6a2546d403da40180dce890a9a0fc2082eb88","size":252,"data":"","first_seen":"2025-11-05T15:43:16.692057Z","last_seen":"2026-07-12T13:54:11.067192Z","times_seen":668,"alerts":{"ids":null,"analyzer":null,"urlquery":null}}],"eval":null,"write":[{"md5":"d97623d172f087d9640da9acd38830ff","sha1":"515bd358bb7d990930f0e2b3de399db1787a2567","sha256":"fe04a9dc88d3f3be8d4f6bc63a9a80f45a4c6d8460e7551dab849457c091920a","sha512":"ce6a1969f698a616663f1a19ccfa12a37a4f6d782432d8a08aeb7879efd3e2becf168422ea66bc47e74f6ba865efaae6eabe3c4faba280d7a21f3a94d7c55da1","ssdeep":"","tlshash":"f0400000000000000000000000300000000000000003000c000000c0c0000000300000","size":7,"data":"","first_seen":"2023-03-12T20:41:17Z","last_seen":"2026-08-05T21:33:10.000859Z","times_seen":9187,"alerts":{"ids":null,"analyzer":null,"urlquery":null}}],"console":null},"http":[{"url":{"schema":"https","addr":"tthj-wahtsapp.com/","fqdn":"tthj-wahtsapp.com","domain":"tthj-wahtsapp.com","tld":"com"},"ip":{"addr":"103.80.133.40","port":443,"asn":205960,"as":"Hdtidc Limited","country":"South Korea","country_code":"KR"},"is_navigation_request":true,"resource_type":"document","requested_by":"","date":"2025-11-30T17:34:34.999Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"bbj-wahst5pp.com","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Thu, 16 Oct 2025 04:40:07 GMT","end":"Wed, 14 Jan 2026 04:40:06 GMT"},"fingerprint":{"sha1":"AA:8F:92:60:F6:B7:D4:D4:6B:18:55:56:3E:C8:27:5E:2D:62:12:9C","sha256":"4F:8B:FB:15:9A:EF:86:12:EC:67:2F:E0:E5:FD:79:20:57:B0:C6:F2:E4:B3:97:BF:DC:95:22:A9:9D:D8:BC:68"}}},"request":{"raw":"GET / HTTP/1.1\r\nHost: tthj-wahtsapp.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nUpgrade-Insecure-Requests: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: document\r\nSec-Fetch-Mode: navigate\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 403 Forbidden\r\nserver: nginx\r\ndate: Sun, 30 Nov 2025 17:34:35 GMT\r\ncontent-type: text/html; charset=UTF-8\r\nvary: Accept-Encoding\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"403","status_text":"Forbidden","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":2224,"size_decoded":0,"mime_type":"text/html; charset=UTF-8","magic":"HTML document, Unicode text, UTF-8 text","md5":"83be15f9aa6004fcbdf9cdafdd8621e3","sha1":"d7df3bf54bf2877b4920750c85ce52f031164977","sha256":"ea85adcaaddd7556f0f97545d9cbd61d88e5a957e7612fb8b2355aac8cd39ccc","sha512":"ee93a37712daa3a6bca04ccbe901166e4ba599739e60e99a7bb94116fc7c08e748679d8592d6de0c1b3f655cf768b931a15ec1cbded45674a232442e04111f62","ssdeep":"","tlshash":"a441535884e300010ae6e22d2ba6f54438b8a047e217d806798c3f55cf42f1c96e7fc9","first_seen":"2025-11-30T15:12:23.110626Z","last_seen":"2025-12-01T05:08:35.093493Z","times_seen":4,"resource_available":false,"data":null}},"time_used":1814,"timings":{"blocked":781,"dns":278,"connect":247,"send":0,"wait":251,"receive":0,"ssl":253},"alerts":{"ids":null,"analyzer":[{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2025-11-30","alert":"Sinkholed","trigger":"tthj-wahtsapp.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2025-11-30","alert":"Phishing Block","trigger":"tthj-wahtsapp.com","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2025-11-30","alert":"Sinkholed","trigger":"tthj-wahtsapp.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-11-30","alert":"Sinkholed","trigger":"tthj-wahtsapp.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2025-11-30","alert":"Sinkholed","trigger":"tthj-wahtsapp.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2025-11-30","alert":"Sinkholed","trigger":"tthj-wahtsapp.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"http","addr":"tthj-wahtsapp.com/","fqdn":"tthj-wahtsapp.com","domain":"tthj-wahtsapp.com","tld":"com"},"ip":{"addr":"103.80.133.40","port":80,"asn":205960,"as":"Hdtidc Limited","country":"South Korea","country_code":"KR"},"is_navigation_request":true,"resource_type":"document","requested_by":"","date":"2025-11-30T17:34:36.225Z","timestamp":0,"http_version":"","security_state":"insecure","security_info":null,"request":{"raw":"GET / HTTP/1.1\r\nHost: tthj-wahtsapp.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate\r\nDNT: 1\r\nConnection: keep-alive\r\nUpgrade-Insecure-Requests: 1\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 301 Moved Permanently\r\nServer: nginx\r\nDate: Sun, 30 Nov 2025 17:34:36 GMT\r\nContent-Type: text/html\r\nContent-Length: 162\r\nConnection: keep-alive\r\nLocation: https://tthj-wahtsapp.com/\r\nStrict-Transport-Security: max-age=31536000\r\nAlt-Svc: quic=\":443\"; h3=\":443\"; h3-29=\":443\"; h3-27=\":443\";h3-25=\":443\"; h3-T050=\":443\"; h3-Q050=\":443\";h3-Q049=\":443\";h3-Q048=\":443\"; h3-Q046=\":443\"; h3-Q043=\":443\"\r\n\r\n","headers":null,"cookies":null,"status_code":"301","status_text":"Moved Permanently","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":2224,"size_decoded":0,"mime_type":"text/html; charset=UTF-8","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-08-12T18:53:52.295863Z","times_seen":17859444,"resource_available":true,"data":null}},"time_used":731,"timings":{"blocked":241,"dns":1,"connect":244,"send":0,"wait":244,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2025-11-30","alert":"Sinkholed","trigger":"tthj-wahtsapp.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2025-11-30","alert":"Sinkholed","trigger":"tthj-wahtsapp.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2025-11-30","alert":"Sinkholed","trigger":"tthj-wahtsapp.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2025-11-30","alert":"Phishing Block","trigger":"tthj-wahtsapp.com","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2025-11-30","alert":"Sinkholed","trigger":"tthj-wahtsapp.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-11-30","alert":"Sinkholed","trigger":"tthj-wahtsapp.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"tthj-wahtsapp.com/","fqdn":"tthj-wahtsapp.com","domain":"tthj-wahtsapp.com","tld":"com"},"ip":{"addr":"103.80.133.40","port":443,"asn":205960,"as":"Hdtidc Limited","country":"South Korea","country_code":"KR"},"is_navigation_request":true,"resource_type":"document","requested_by":"","date":"2025-11-30T17:34:36.715Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"bbj-wahst5pp.com","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Thu, 16 Oct 2025 04:40:07 GMT","end":"Wed, 14 Jan 2026 04:40:06 GMT"},"fingerprint":{"sha1":"AA:8F:92:60:F6:B7:D4:D4:6B:18:55:56:3E:C8:27:5E:2D:62:12:9C","sha256":"4F:8B:FB:15:9A:EF:86:12:EC:67:2F:E0:E5:FD:79:20:57:B0:C6:F2:E4:B3:97:BF:DC:95:22:A9:9D:D8:BC:68"}}},"request":{"raw":"GET / HTTP/1.1\r\nHost: tthj-wahtsapp.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nUpgrade-Insecure-Requests: 1\r\nSec-Fetch-Dest: document\r\nSec-Fetch-Mode: navigate\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 403 Forbidden\r\nserver: nginx\r\ndate: Sun, 30 Nov 2025 17:34:36 GMT\r\ncontent-type: text/html; charset=UTF-8\r\nvary: Accept-Encoding\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"403","status_text":"Forbidden","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":2224,"size_decoded":0,"mime_type":"text/html; charset=UTF-8","magic":"HTML document, Unicode text, UTF-8 text","md5":"83be15f9aa6004fcbdf9cdafdd8621e3","sha1":"d7df3bf54bf2877b4920750c85ce52f031164977","sha256":"ea85adcaaddd7556f0f97545d9cbd61d88e5a957e7612fb8b2355aac8cd39ccc","sha512":"ee93a37712daa3a6bca04ccbe901166e4ba599739e60e99a7bb94116fc7c08e748679d8592d6de0c1b3f655cf768b931a15ec1cbded45674a232442e04111f62","ssdeep":"","tlshash":"a441535884e300010ae6e22d2ba6f54438b8a047e217d806798c3f55cf42f1c96e7fc9","first_seen":"2025-11-30T15:12:23.110626Z","last_seen":"2025-12-01T05:08:35.093493Z","times_seen":4,"resource_available":false,"data":null}},"time_used":251,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":251,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2025-11-30","alert":"Sinkholed","trigger":"tthj-wahtsapp.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2025-11-30","alert":"Sinkholed","trigger":"tthj-wahtsapp.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2025-11-30","alert":"Phishing Block","trigger":"tthj-wahtsapp.com","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2025-11-30","alert":"Sinkholed","trigger":"tthj-wahtsapp.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2025-11-30","alert":"Sinkholed","trigger":"tthj-wahtsapp.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-11-30","alert":"Sinkholed","trigger":"tthj-wahtsapp.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"tthj-wahtsapp.com/tj.js","fqdn":"tthj-wahtsapp.com","domain":"tthj-wahtsapp.com","tld":"com"},"ip":{"addr":"103.80.133.40","port":443,"asn":205960,"as":"Hdtidc Limited","country":"South Korea","country_code":"KR"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://tthj-wahtsapp.com/","date":"2025-11-30T17:34:37.155Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"bbj-wahst5pp.com","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Thu, 16 Oct 2025 04:40:07 GMT","end":"Wed, 14 Jan 2026 04:40:06 GMT"},"fingerprint":{"sha1":"AA:8F:92:60:F6:B7:D4:D4:6B:18:55:56:3E:C8:27:5E:2D:62:12:9C","sha256":"4F:8B:FB:15:9A:EF:86:12:EC:67:2F:E0:E5:FD:79:20:57:B0:C6:F2:E4:B3:97:BF:DC:95:22:A9:9D:D8:BC:68"}}},"request":{"raw":"GET /tj.js HTTP/1.1\r\nHost: tthj-wahtsapp.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://tthj-wahtsapp.com/\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Sun, 30 Nov 2025 17:34:37 GMT\r\ncontent-type: application/javascript\r\ncontent-length: 252\r\nlast-modified: Tue, 04 Nov 2025 14:43:42 GMT\r\netag: \"690a111e-fc\"\r\nexpires: Mon, 01 Dec 2025 05:34:37 GMT\r\ncache-control: max-age=43200\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: quic=\":443\"; h3=\":443\"; h3-29=\":443\"; h3-27=\":443\";h3-25=\":443\"; h3-T050=\":443\"; h3-Q050=\":443\";h3-Q049=\":443\";h3-Q048=\":443\"; h3-Q046=\":443\"; h3-Q043=\":443\"\r\naccept-ranges: bytes\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":252,"size_decoded":0,"mime_type":"application/javascript","magic":"JavaScript source, ASCII text","md5":"613791a5a916b495ab9f29cf170362fd","sha1":"e0a2847de1f94e2da4e6b8ff33297f7f9329683a","sha256":"ed9a078418e9dd1e4dd1a38464df766dbeb7161d4f17429fefa43b4c7f00f74e","sha512":"8e68e70ad39f838e489d2ad78136ae601f091d956386444d4982e3c351ee764606210fc47b61078e00c75e1b18bf948833b12aa3415fa44337a9d347c13b534c","ssdeep":"","tlshash":"24d02e0f2c9458382375082910fbe94cb6a2546d403da40180dce890a9a0fc2082eb88","first_seen":"2025-11-05T15:43:16.692057Z","last_seen":"2026-07-12T13:54:11.067192Z","times_seen":668,"resource_available":true,"data":null}},"time_used":247,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":247,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2025-11-30","alert":"Sinkholed","trigger":"tthj-wahtsapp.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2025-11-30","alert":"Sinkholed","trigger":"tthj-wahtsapp.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2025-11-30","alert":"Sinkholed","trigger":"tthj-wahtsapp.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2025-11-30","alert":"Sinkholed","trigger":"tthj-wahtsapp.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2025-11-30","alert":"Phishing Block","trigger":"tthj-wahtsapp.com","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-11-30","alert":"Sinkholed","trigger":"tthj-wahtsapp.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"hm.baidu.com/hm.js?d9bb8c3e0a8ddf6347b7d9d99b109ee0","fqdn":"hm.baidu.com","domain":"baidu.com","tld":"com"},"ip":{"addr":"14.215.182.140","port":443,"asn":4134,"as":"Chinanet","country":"China","country_code":"CN"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://tthj-wahtsapp.com/","date":"2025-11-30T17:34:37.415Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.2","cert":{"subject":{"commonName":"baidu.com","organization":"Beijing Baidu Netcom Science Technology Co., Ltd"},"issuer":{"commonName":"GlobalSign RSA OV SSL CA 2018","organization":"GlobalSign nv-sa"},"validity":{"start":"Wed, 09 Jul 2025 07:01:02 GMT","end":"Mon, 10 Aug 2026 07:01:01 GMT"},"fingerprint":{"sha1":"21:BF:66:0D:67:BE:7A:7F:49:48:05:30:F4:7F:09:F2:30:36:CA:63","sha256":"0D:82:2C:9A:90:5A:EF:E9:8F:37:12:C0:E0:26:30:EE:95:33:2C:45:5F:E7:74:5D:F0:8D:BC:79:F4:B0:A1:49"}}},"request":{"raw":"GET /hm.js?d9bb8c3e0a8ddf6347b7d9d99b109ee0 HTTP/1.1\r\nHost: hm.baidu.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://tthj-wahtsapp.com/\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nCache-Control: max-age=0, must-revalidate\r\nContent-Encoding: gzip\r\nContent-Length: 11289\r\nContent-Type: application/javascript\r\nDate: Sun, 30 Nov 2025 17:34:38 GMT\r\nEtag: 23e09c7b8af3ae960dc2e86e9856263c\r\nP3p: CP=\"CURa ADMa DEVa PSAo PSDo OUR BUS UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR\"\r\nServer: apache\r\nSet-Cookie: HMACCOUNT=9BE36A25D6ACE077; Path=/; Domain=hm.baidu.com; Expires=Sun, 18 Jan 2038 00:00:00 GMT\r\nStrict-Transport-Security: max-age=172800\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Apache HTTP Server","description":"Apache is a free and open-source cross-platform web server software.","website":"https://httpd.apache.org/","common_platform_enumeration":"cpe:2.3:a:apache:http_server:*:*:*:*:*:*:*:*","icon":"Apache.svg","categories":["Web servers"]}],"data":{"size":29895,"size_decoded":0,"mime_type":"application/javascript","magic":"JavaScript source, ASCII text, with very long lines (619)","md5":"3e6908d777464d4ae76e4815215efa0e","sha1":"e9767bf8acc178d27c811faa82270b9665ddaa65","sha256":"7de1d54eb0a8b78b4d2e73bee87d51b7a374e555f8422f7df37e5b971e2e6afa","sha512":"ec9ff715b1012e724e15f72cbd028c0c47b03a7039eebd7ddaed6919c5e5ecbfbbf53ffef809f5d7678e404694c414ab33b2e68aef02ba658ac52f32198cc209","ssdeep":"384:e8JSoLMJJTRl6s1JXFVCFI/TayvuodsZPIGm8XaR1JRwvutq1tGdc7M04gRw6:e84VJfHgMdvussZPIx82Rwvutcto07v","tlshash":"e6d2d9a9b282713293a324a5153f724ef07b5a54bd4968a4f11894c07d38fbb027bfdd","first_seen":"2025-11-30T17:34:58.531875Z","last_seen":"2025-11-30T17:34:58.531875Z","times_seen":1,"resource_available":true,"data":null}},"time_used":2015,"timings":{"blocked":830,"dns":1,"connect":275,"send":0,"wait":353,"receive":1,"ssl":552},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"tthj-wahtsapp.com/favicon.ico","fqdn":"tthj-wahtsapp.com","domain":"tthj-wahtsapp.com","tld":"com"},"ip":{"addr":"103.80.133.40","port":443,"asn":205960,"as":"Hdtidc Limited","country":"South Korea","country_code":"KR"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://tthj-wahtsapp.com/","date":"2025-11-30T17:34:37.514Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"bbj-wahst5pp.com","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Thu, 16 Oct 2025 04:40:07 GMT","end":"Wed, 14 Jan 2026 04:40:06 GMT"},"fingerprint":{"sha1":"AA:8F:92:60:F6:B7:D4:D4:6B:18:55:56:3E:C8:27:5E:2D:62:12:9C","sha256":"4F:8B:FB:15:9A:EF:86:12:EC:67:2F:E0:E5:FD:79:20:57:B0:C6:F2:E4:B3:97:BF:DC:95:22:A9:9D:D8:BC:68"}}},"request":{"raw":"GET /favicon.ico HTTP/1.1\r\nHost: tthj-wahtsapp.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://tthj-wahtsapp.com/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Sun, 30 Nov 2025 17:34:37 GMT\r\ncontent-type: image/x-icon\r\ncontent-length: 1385\r\nlast-modified: Fri, 24 Oct 2025 13:20:10 GMT\r\netag: \"68fb7d0a-569\"\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: quic=\":443\"; h3=\":443\"; h3-29=\":443\"; h3-27=\":443\";h3-25=\":443\"; h3-T050=\":443\"; h3-Q050=\":443\";h3-Q049=\":443\";h3-Q048=\":443\"; h3-Q046=\":443\"; h3-Q043=\":443\"\r\naccept-ranges: bytes\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":1385,"size_decoded":0,"mime_type":"image/x-icon","magic":"PNG image data, 32 x 32, 8-bit/color RGBA, non-interlaced","md5":"b70e6078004aeb5146c635cc4c8af761","sha1":"08361cabab0812baeb8ecf4dfbdddd10a9104423","sha256":"20ce7e373448ca2a51d95f60fc906f57cc27d103a6bba4e33be3453f7b23b98e","sha512":"76e0a9f494998151ab5f5d1ef2f1e2cd826135537e6b3e77e6653997d6e073696880a1ab5100c6a85aea926edcfe036c31513d08f58c0bcc02db0a4c8b6bec09","ssdeep":"","tlshash":"bf210bf3e36020e90841d4310333621b57fa4f7b6d909371f071509112b944845a1e97","first_seen":"2024-12-25T11:23:49.33594Z","last_seen":"2026-08-01T18:23:46.596239Z","times_seen":1965,"resource_available":false,"data":null}},"time_used":248,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":247,"receive":1,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2025-11-30","alert":"Sinkholed","trigger":"tthj-wahtsapp.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2025-11-30","alert":"Phishing Block","trigger":"tthj-wahtsapp.com","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2025-11-30","alert":"Sinkholed","trigger":"tthj-wahtsapp.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2025-11-30","alert":"Sinkholed","trigger":"tthj-wahtsapp.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2025-11-30","alert":"Sinkholed","trigger":"tthj-wahtsapp.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-11-30","alert":"Sinkholed","trigger":"tthj-wahtsapp.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"hm.baidu.com/hm.gif?hca=9BE36A25D6ACE077\u0026cc=1\u0026ck=1\u0026cl=24-bit\u0026ds=1280x1024\u0026vl=1024\u0026et=0\u0026ja=0\u0026ln=en-us\u0026lo=0\u0026rnd=1530060028\u0026si=d9bb8c3e0a8ddf6347b7d9d99b109ee0\u0026v=1.3.2\u0026lv=1\u0026sn=59739\u0026r=0\u0026ww=1280\u0026u=https%3A%2F%2Ftthj-wahtsapp.com%2F\u0026tt=403","fqdn":"hm.baidu.com","domain":"baidu.com","tld":"com"},"ip":{"addr":"14.215.182.140","port":443,"asn":4134,"as":"Chinanet","country":"China","country_code":"CN"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://tthj-wahtsapp.com/","date":"2025-11-30T17:34:38.698Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.2","cert":{"subject":{"commonName":"baidu.com","organization":"Beijing Baidu Netcom Science Technology Co., Ltd"},"issuer":{"commonName":"GlobalSign RSA OV SSL CA 2018","organization":"GlobalSign nv-sa"},"validity":{"start":"Wed, 09 Jul 2025 07:01:02 GMT","end":"Mon, 10 Aug 2026 07:01:01 GMT"},"fingerprint":{"sha1":"21:BF:66:0D:67:BE:7A:7F:49:48:05:30:F4:7F:09:F2:30:36:CA:63","sha256":"0D:82:2C:9A:90:5A:EF:E9:8F:37:12:C0:E0:26:30:EE:95:33:2C:45:5F:E7:74:5D:F0:8D:BC:79:F4:B0:A1:49"}}},"request":{"raw":"GET /hm.gif?hca=9BE36A25D6ACE077\u0026cc=1\u0026ck=1\u0026cl=24-bit\u0026ds=1280x1024\u0026vl=1024\u0026et=0\u0026ja=0\u0026ln=en-us\u0026lo=0\u0026rnd=1530060028\u0026si=d9bb8c3e0a8ddf6347b7d9d99b109ee0\u0026v=1.3.2\u0026lv=1\u0026sn=59739\u0026r=0\u0026ww=1280\u0026u=https%3A%2F%2Ftthj-wahtsapp.com%2F\u0026tt=403 HTTP/1.1\r\nHost: hm.baidu.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://tthj-wahtsapp.com/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nCache-Control: private, max-age=0, no-cache\r\nContent-Length: 43\r\nContent-Type: image/gif\r\nDate: Sun, 30 Nov 2025 17:34:38 GMT\r\nP3p: CP=\"CURa ADMa DEVa PSAo PSDo OUR BUS UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR\"\r\nPragma: no-cache\r\nServer: apache\r\nSet-Cookie: HMACCOUNT=1DA8DE856AF13523; Path=/; Domain=hm.baidu.com; Expires=Sun, 18 Jan 2038 00:00:00 GMT\r\nStrict-Transport-Security: max-age=172800\r\nX-Content-Type-Options: nosniff\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Apache HTTP Server","description":"Apache is a free and open-source cross-platform web server software.","website":"https://httpd.apache.org/","common_platform_enumeration":"cpe:2.3:a:apache:http_server:*:*:*:*:*:*:*:*","icon":"Apache.svg","categories":["Web servers"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":43,"size_decoded":0,"mime_type":"image/gif","magic":"GIF image data, version 89a, 1 x 1","md5":"ad4b0f606e0f8465bc4c4c170b37e1a3","sha1":"50b30fd5f87c85fe5cba2635cb83316ca71250d7","sha256":"cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda","sha512":"ebfe0c0df4bcc167d5cb6ebdd379f9083df62bef63a23818e1c6adf0f64b65467ea58b7cd4d03cf0a1b1a2b07fb7b969bf35f25f1f8538cc65cf3eebdf8a0910","ssdeep":"","tlshash":"15900003fbc08002c2b2e0300b3b0380238ce2200aa8030b80aeb0acecaa3a20c03020","first_seen":"2023-04-05T02:54:03Z","last_seen":"2026-08-12T18:40:54.088235Z","times_seen":376660,"resource_available":true,"data":null}},"time_used":334,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":334,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}}]}