{"report_id":"9647f1c5-3a1f-4a03-a5eb-209b253be3de","version":0,"status":"done","tags":[],"date":"2026-08-09T10:06:24Z","url":{"schema":"http","addr":"malvex.club/Rftrans/re.php","fqdn":"malvex.club","domain":"malvex.club","tld":"club"},"ip":{"addr":"185.221.216.121","port":0,"asn":393960,"as":"HOST4GEEKS-LLC","country":"United Kingdom","country_code":"GB"},"final":{"url":{"schema":"https","addr":"malvex.club/Rftrans/re.php","fqdn":"malvex.club","domain":"malvex.club","tld":"club"},"title":"Wetransfer - Partage de document.","dom":{"size":12143,"mime_type":"text/html; charset=utf-8","magic":"HTML document, Unicode text, UTF-8 text, with very long lines (6643)","md5":"da64ea9825f27aea2e84ceb1772dd9a9","sha1":"027a7261f710b0289300a0c4bc42516e299b3ecb","sha256":"ddf8dbd5a91ce6af16b0aa95af791baf8dc54622b70bb65d6628a2387f4e1e56","sha512":"45b467dea8a7738503c8c5c1c0058dd658bfcbe9257b86bf4ef3175c61c1f2dd7ac74474336abe2fdfb5b77ffd412959a506dc320e2b5be19f0e30cf6c0bedb7","ssdeep":"192:c4wMhiy1C+no0iN6DD7JXeS7JXex/27xLl8N9TCFan1:cpM75hL76T8c","tlshash":"7342e86d72b0003a5d63c4d7fbd7b608391590c3da2aea6a769dc6047fcbd8158e3389","dom_hash":"domhashf195e8e68f5cd15d295953633c15ce9f","first_seen":"2026-08-09T01:28:26.030321Z","last_seen":"2026-08-09T10:06:25.485553Z","times_seen":2,"resource_available":false,"data":null}},"submit":{"url":{"schema":"http","addr":"malvex.club/Rftrans/re.php","fqdn":"malvex.club","domain":"malvex.club","tld":"club"},"ip":{"addr":"185.221.216.121","port":0,"asn":393960,"as":"HOST4GEEKS-LLC","country":"United Kingdom","country_code":"GB"},"tags":null,"meta":null},"settings":{"access":"public","device_type":"desktop","expires_at":"2027-09-13T10:06:24Z","useragent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0","referer":"","cookies":null,"exit_node":"qguvgzjxzsgb3vs"},"stats":{"alert_count":{"ids":0,"urlquery":0,"analyzer":2}},"detection":{"ids":null,"analyzer":[{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-08-09","alert":"Phishing Block","trigger":"malvex.club","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-08-09","alert":"Sinkholed","trigger":"malvex.club","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null},"summary":[{"fqdn":"cdn.tailwindcss.com","ip":{"addr":"104.26.3.143","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"domain_registered":"2017-07-20","domain_rank":117330,"first_seen":"2018-07-09T05:46:13Z","last_seen":"2026-08-03T08:56:14.863554Z","alert_count":0,"request_count":2,"received_data":408711,"sent_data":928,"comment":"","tags":null,"fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Vercel","description":"Vercel is a cloud platform for static frontends and serverless functions.","website":"https://vercel.com","common_platform_enumeration":"","icon":"vercel.svg","categories":["PaaS"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}]},{"fqdn":"malvex.club","ip":{"addr":"185.221.216.121","port":443,"asn":393960,"as":"HOST4GEEKS-LLC","country":"United Kingdom","country_code":"GB"},"domain_registered":"2026-02-18","domain_rank":0,"first_seen":"2026-08-09T01:26:08.405241Z","last_seen":"2026-08-09T01:26:08.405241Z","alert_count":10,"request_count":5,"received_data":80115,"sent_data":2584,"comment":"","tags":null,"fingerprints":[{"name":"Apache HTTP Server","description":"Apache is a free and open-source cross-platform web server software.","website":"https://httpd.apache.org/","common_platform_enumeration":"cpe:2.3:a:apache:http_server:*:*:*:*:*:*:*:*","icon":"Apache.svg","categories":["Web servers"]},{"name":"Tailwind CSS","description":"Tailwind is a utility-first CSS framework.","website":"https://tailwindcss.com/","common_platform_enumeration":"","icon":"tailwindcss.svg","categories":["UI frameworks"]}]}],"files":null,"artifacts":{"windows_shortcuts":null,"files":null,"telegram":null,"pdfs":null,"clipboard":null},"sensors":{"ids":null,"analyzer":null,"urlquery":null},"javascript":{"script":[{"url":{"schema":"https","addr":"malvex.club/Rftrans/re.php","fqdn":"malvex.club","domain":"malvex.club","tld":"club"},"ip":{"addr":"185.221.216.121","port":443,"asn":393960,"as":"HOST4GEEKS-LLC","country":"United Kingdom","country_code":"GB"},"introduction_type":"scriptElement","is_inline":true,"md5":"21b1f8800abd430177d3efdd7a72aeea","sha1":"810985ecdcd0915b65ae52ead3dd859d2a8ccda4","sha256":"ba45ca8171908ce3df26db04ae303faba3c2cb1dd85565440a8923843e0da4d0","sha512":"e54fbd5cf7f3d5a537a2c2630e5af8864412532041ac591becbdde7c27be8c2cc5c82541885aa0b3544f275d2db01c5b6d5961571e358d91a9042a02b9cccac5","ssdeep":"","tlshash":"13b0123a19a0457001a7f119174fd91016320047b0889e10390c0c450f9485c21d1a46","size":106,"data":"","first_seen":"2026-06-30T19:45:34.959011Z","last_seen":"2026-08-09T10:06:25.502574Z","times_seen":9,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"malvex.club/Rftrans/re.php","fqdn":"malvex.club","domain":"malvex.club","tld":"club"},"ip":{"addr":"185.221.216.121","port":443,"asn":393960,"as":"HOST4GEEKS-LLC","country":"United Kingdom","country_code":"GB"},"introduction_type":"scriptElement","is_inline":true,"md5":"365818cc0ab040f163169093f3f7428e","sha1":"29c1dd43c90662d59ba96817ad22f94152738515","sha256":"161b695ed107a4b0c49c08e98e2276c1f8c696551d4c073e5dbad80afc19b6cd","sha512":"c3693adaa4177013d2e36fd30e657f1a7335c7d07b5ee8f2636f86888dcfee10710a46cdc8a7dd457abca006b9d07fc361094b3912378bce62bb299b1948cabe","ssdeep":"","tlshash":"f951bb7975f6383516633c9127db654839204453e492fe193a6cc78c1f8ba40ed23aef","size":2792,"data":"","first_seen":"2026-08-09T01:26:11.882643Z","last_seen":"2026-08-09T10:06:25.503548Z","times_seen":3,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"cdn.tailwindcss.com/","fqdn":"cdn.tailwindcss.com","domain":"tailwindcss.com","tld":"com"},"ip":{"addr":"104.26.3.143","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"scriptElement","is_inline":false,"md5":"7a614b9a197e532c00d09a23b0996b5f","sha1":"1ff1738a40f3716e30e9031b181b0955ae578955","sha256":"176e894661aa9cdc9a5cba6c720044cbbf7b8bd80d1c9a142a7c24b1b6c50d15","sha512":"a67bc26f52d938358471be5671ff4b79e11af4e68b486aaf73a35a4c9bf3777aab51101af81563b4e5b7ba4b04dd8971fcfa9ee2c41fb10a0c1ee5604a99abd6","ssdeep":"12288:fpgrZxSAoNbJb0Wie75aUXGuyQZhK4O0s:RCVoNB0Wie75aUWmnO0s","tlshash":"e8844aa57396702647eb51e850ea1042f2beaa38840c44bcf7edd4da39e5e4440fbf79","size":407279,"data":"","first_seen":"2025-07-28T16:58:08.903462Z","last_seen":"2026-08-13T18:41:22.858536Z","times_seen":49022,"alerts":{"ids":null,"analyzer":null,"urlquery":null}}],"eval":null,"write":null,"console":[{"level":"warn","text":"cdn.tailwindcss.com should not be used in production. To use Tailwind CSS in production, install it as a PostCSS plugin or use the Tailwind CLI: https://tailwindcss.com/docs/installation","filename":"https://cdn.tailwindcss.com/","line_number":64,"column_number":1711}]},"http":[{"url":{"schema":"https","addr":"cdn.tailwindcss.com/3.4.17","fqdn":"cdn.tailwindcss.com","domain":"tailwindcss.com","tld":"com"},"ip":{"addr":"104.26.3.143","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://malvex.club/Rftrans/re.php","date":"2026-08-09T10:05:58.057Z","timestamp":1786269958057,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"tailwindcss.com","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Fri, 17 Jul 2026 20:38:38 GMT","end":"Thu, 15 Oct 2026 21:38:35 GMT"},"fingerprint":{"sha1":"AF:4F:AD:59:FA:ED:77:04:0D:32:56:48:B0:E5:1B:38:67:6D:7D:02","sha256":"E7:FC:CF:2D:6A:CC:F5:3C:4C:1E:9D:CD:21:8A:72:A3:DB:7C:B1:50:0F:83:D1:DC:E4:AD:25:90:8F:98:37:0F"}}},"request":{"raw":"GET /3.4.17 HTTP/1.1\r\nHost: cdn.tailwindcss.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://malvex.club/\r\nSec-Fetch-Storage-Access: none\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPriority: u=2\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\ndate: Sun, 09 Aug 2026 10:05:58 GMT\r\ncontent-type: text/javascript\r\ncache-control: max-age=31536000\r\ncontent-encoding: br\r\nserver: cloudflare\r\nstrict-transport-security: max-age=63072000\r\nx-vercel-cache: MISS\r\nx-vercel-id: fra1::iad1::kcph7-1785159739950-b8e36432cd95\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nvary: accept-encoding\r\nage: 1110217\r\nlast-modified: Thu, 30 Jul 2026 09:47:27 GMT\r\ncf-cache-status: HIT\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=LkBMm0wj9O4%2BB4WGU6QUw%2B02fPGPHbIhkBYjN273M4NWdZtRabp%2FqMrLIkgEOz7CI31os9RSPvHrlAEv3zpTBfwQaGh2IcZWnLejPTnidaWrDZdh16ti2aOCg%2BgB0is%2BW7n%2FehM%3D\"}]}\r\ncf-ray: a285f205dba9b4f7-OSL\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Vercel","description":"Vercel is a cloud platform for static frontends and serverless functions.","website":"https://vercel.com","common_platform_enumeration":"","icon":"vercel.svg","categories":["PaaS"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":407279,"size_decoded":127126,"mime_type":"text/javascript","magic":"JavaScript source, ASCII text, with very long lines (52853)","md5":"7a614b9a197e532c00d09a23b0996b5f","sha1":"1ff1738a40f3716e30e9031b181b0955ae578955","sha256":"176e894661aa9cdc9a5cba6c720044cbbf7b8bd80d1c9a142a7c24b1b6c50d15","sha512":"a67bc26f52d938358471be5671ff4b79e11af4e68b486aaf73a35a4c9bf3777aab51101af81563b4e5b7ba4b04dd8971fcfa9ee2c41fb10a0c1ee5604a99abd6","ssdeep":"12288:fpgrZxSAoNbJb0Wie75aUXGuyQZhK4O0s:RCVoNB0Wie75aUWmnO0s","tlshash":"e8844aa57396702647eb51e850ea1042f2beaa38840c44bcf7edd4da39e5e4440fbf79","first_seen":"2025-07-28T16:58:08.903462Z","last_seen":"2026-08-13T18:41:22.858536Z","times_seen":49022,"resource_available":true,"data":null}},"time_used":8,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":8,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"cdn.tailwindcss.com/","fqdn":"cdn.tailwindcss.com","domain":"tailwindcss.com","tld":"com"},"ip":{"addr":"104.26.3.143","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://malvex.club/Rftrans/re.php","date":"2026-08-09T10:05:58.021Z","timestamp":1786269958021,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"tailwindcss.com","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Fri, 17 Jul 2026 20:38:38 GMT","end":"Thu, 15 Oct 2026 21:38:35 GMT"},"fingerprint":{"sha1":"AF:4F:AD:59:FA:ED:77:04:0D:32:56:48:B0:E5:1B:38:67:6D:7D:02","sha256":"E7:FC:CF:2D:6A:CC:F5:3C:4C:1E:9D:CD:21:8A:72:A3:DB:7C:B1:50:0F:83:D1:DC:E4:AD:25:90:8F:98:37:0F"}}},"request":{"raw":"GET / HTTP/1.1\r\nHost: cdn.tailwindcss.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-Fetch-Storage-Access: none\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://malvex.club/\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPriority: u=2\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 302 \r\ndate: Sun, 09 Aug 2026 10:05:58 GMT\r\ncache-control: max-age=14400\r\nlocation: /3.4.17\r\nserver: cloudflare\r\nstrict-transport-security: max-age=63072000\r\nx-vercel-cache: MISS\r\nx-vercel-id: fra1::iad1::k85k4-1786269178853-49571fbe1b8b\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nage: 779\r\ncf-cache-status: HIT\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=Aq%2F1I5l0xjwI7hqGr%2BmXcp2wJjLwfCXDqpCC6vDtAtl8cAMwPtKkTm9zfgHdSfhLp6BpTA2dHC%2BbdkIc3edEjPfcIvf%2FTo9v0laxUpzhlNmXkU1%2BJry3wpHcqJWpn4lj0djDirE%3D\"}]}\r\ncf-ray: a285f205bb94b4f7-OSL\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"302","status_text":"","fingerprints":[{"name":"Vercel","description":"Vercel is a cloud platform for static frontends and serverless functions.","website":"https://vercel.com","common_platform_enumeration":"","icon":"vercel.svg","categories":["PaaS"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":0,"size_decoded":0,"mime_type":"text/javascript","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-08-13T18:51:39.072062Z","times_seen":17874979,"resource_available":true,"data":null}},"time_used":27,"timings":{"blocked":-1,"dns":4,"connect":1,"send":0,"wait":7,"receive":0,"ssl":15},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"malvex.club/Rftrans/image/doc.png","fqdn":"malvex.club","domain":"malvex.club","tld":"club"},"ip":{"addr":"185.221.216.121","port":443,"asn":393960,"as":"HOST4GEEKS-LLC","country":"United Kingdom","country_code":"GB"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://malvex.club/Rftrans/re.php","date":"2026-08-09T10:05:58.028Z","timestamp":1786269958028,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"malvex.club","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Sun, 05 Jul 2026 08:33:38 GMT","end":"Sat, 03 Oct 2026 08:33:37 GMT"},"fingerprint":{"sha1":"AB:C0:88:17:EE:94:31:AD:3A:F0:BA:35:2B:6A:8E:5B:0A:D4:68:55","sha256":"30:AA:CC:2D:15:7F:3B:32:E8:E9:32:8C:E8:AA:11:E1:A5:B4:17:40:2C:2C:6F:AD:F9:C4:02:D2:2A:AF:BE:3C"}}},"request":{"raw":"GET /Rftrans/image/doc.png HTTP/1.1\r\nHost: malvex.club\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://malvex.club/Rftrans/re.php\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Sun, 09 Aug 2026 10:05:58 GMT\r\nServer: Apache\r\nLast-Modified: Fri, 24 Jul 2026 10:11:21 GMT\r\nAccept-Ranges: bytes\r\nContent-Length: 6830\r\nKeep-Alive: timeout=5, max=100\r\nConnection: Keep-Alive\r\nContent-Type: image/png\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Apache HTTP Server","description":"Apache is a free and open-source cross-platform web server software.","website":"https://httpd.apache.org/","common_platform_enumeration":"cpe:2.3:a:apache:http_server:*:*:*:*:*:*:*:*","icon":"Apache.svg","categories":["Web servers"]}],"data":{"size":6830,"size_decoded":7073,"mime_type":"image/png","magic":"PNG image data, 256 x 256, 8-bit/color RGBA, non-interlaced","md5":"f1e3f187f7c23fa8d1555004f3800356","sha1":"e71e52a142e754399ae39ef38584789b66e9ea00","sha256":"db307fcef7f95139689007d7a623b340ec21282bd421c4e4b2ba09078f230545","sha512":"bd568b1c92d7c3b586e2ea7e9c47b08fd1171ff6615fa4f670f12950dc62315b58e6bb5336f50b111ff42b27558398dff9715054a8e44f0a8b9cd1541f0bc07d","ssdeep":"192:n6ND9AxRGozwHD0Ksf+GQUAU6Z0WoYGoKUcsgYRU:6xWRXwHmtfYGLUYIU","tlshash":"a4e1af16230d1d75df8fbf7f1d859081c388473ba8558c4ac9cfe4656eaf41468eb840","first_seen":"2023-05-09T01:31:36Z","last_seen":"2026-08-10T20:37:59.130981Z","times_seen":99,"resource_available":false,"data":null}},"time_used":88,"timings":{"blocked":17,"dns":0,"connect":21,"send":0,"wait":22,"receive":0,"ssl":28},"alerts":{"ids":null,"analyzer":[{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-08-09","alert":"Phishing Block","trigger":"malvex.club","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-08-09","alert":"Sinkholed","trigger":"malvex.club","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"malvex.club/Rftrans/image/orang.png","fqdn":"malvex.club","domain":"malvex.club","tld":"club"},"ip":{"addr":"185.221.216.121","port":443,"asn":393960,"as":"HOST4GEEKS-LLC","country":"United Kingdom","country_code":"GB"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://malvex.club/Rftrans/re.php","date":"2026-08-09T10:05:58.029Z","timestamp":1786269958029,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"malvex.club","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Sun, 05 Jul 2026 08:33:38 GMT","end":"Sat, 03 Oct 2026 08:33:37 GMT"},"fingerprint":{"sha1":"AB:C0:88:17:EE:94:31:AD:3A:F0:BA:35:2B:6A:8E:5B:0A:D4:68:55","sha256":"30:AA:CC:2D:15:7F:3B:32:E8:E9:32:8C:E8:AA:11:E1:A5:B4:17:40:2C:2C:6F:AD:F9:C4:02:D2:2A:AF:BE:3C"}}},"request":{"raw":"GET /Rftrans/image/orang.png HTTP/1.1\r\nHost: malvex.club\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://malvex.club/Rftrans/re.php\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Sun, 09 Aug 2026 10:05:58 GMT\r\nServer: Apache\r\nLast-Modified: Fri, 24 Jul 2026 10:11:21 GMT\r\nAccept-Ranges: bytes\r\nContent-Length: 39346\r\nKeep-Alive: timeout=5, max=100\r\nConnection: Keep-Alive\r\nContent-Type: image/png\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Apache HTTP Server","description":"Apache is a free and open-source cross-platform web server software.","website":"https://httpd.apache.org/","common_platform_enumeration":"cpe:2.3:a:apache:http_server:*:*:*:*:*:*:*:*","icon":"Apache.svg","categories":["Web servers"]}],"data":{"size":39346,"size_decoded":39590,"mime_type":"image/png","magic":"PNG image data, 600 x 284, 8-bit/color RGBA, non-interlaced","md5":"6af91cb95161348ffabd07e778ad073e","sha1":"76938298df11ba3caf90d37b19ae9dbfa19f9f3e","sha256":"471bf9c3edfa3627f722b076363b0ca2df07a06b6672a334714f6d6d0f9df1d1","sha512":"2186a9e943189c3b3f4e1538c15a202f221c5586d6ba3b5577295806954cb409e8f795cb22ab71b686383020fe959162fd63b4bb4faca833b43b904511f087d7","ssdeep":"768:EmSKcR6U4n18iBFjnqR7E+z3v4DI3j6RtQsv/CN6nmH4/:rcRp7yFjn64QfLuRj/mVY/","tlshash":"4603ce9b7473042f06e19c604cc5bb2fd49be507ccbbb1a3d946c6e42be71768b2254a","first_seen":"2024-12-11T06:34:31.169303Z","last_seen":"2026-08-09T10:06:25.493984Z","times_seen":6,"resource_available":false,"data":null}},"time_used":131,"timings":{"blocked":17,"dns":0,"connect":22,"send":0,"wait":22,"receive":43,"ssl":26},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-08-09","alert":"Sinkholed","trigger":"malvex.club","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-08-09","alert":"Phishing Block","trigger":"malvex.club","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"malvex.club/favicon.ico","fqdn":"malvex.club","domain":"malvex.club","tld":"club"},"ip":{"addr":"185.221.216.121","port":443,"asn":393960,"as":"HOST4GEEKS-LLC","country":"United Kingdom","country_code":"GB"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://malvex.club/Rftrans/re.php","date":"2026-08-09T10:05:58.357Z","timestamp":1786269958357,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"malvex.club","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Sun, 05 Jul 2026 08:33:38 GMT","end":"Sat, 03 Oct 2026 08:33:37 GMT"},"fingerprint":{"sha1":"AB:C0:88:17:EE:94:31:AD:3A:F0:BA:35:2B:6A:8E:5B:0A:D4:68:55","sha256":"30:AA:CC:2D:15:7F:3B:32:E8:E9:32:8C:E8:AA:11:E1:A5:B4:17:40:2C:2C:6F:AD:F9:C4:02:D2:2A:AF:BE:3C"}}},"request":{"raw":"GET /favicon.ico HTTP/1.1\r\nHost: malvex.club\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://malvex.club/Rftrans/re.php\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=6\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 404 Not Found\r\nDate: Sun, 09 Aug 2026 10:05:58 GMT\r\nServer: Apache\r\nContent-Length: 355\r\nKeep-Alive: timeout=5, max=99\r\nConnection: Keep-Alive\r\nContent-Type: text/html; charset=iso-8859-1\r\n\r\n","headers":null,"cookies":null,"status_code":"404","status_text":"Not Found","fingerprints":[{"name":"Apache HTTP Server","description":"Apache is a free and open-source cross-platform web server software.","website":"https://httpd.apache.org/","common_platform_enumeration":"cpe:2.3:a:apache:http_server:*:*:*:*:*:*:*:*","icon":"Apache.svg","categories":["Web servers"]}],"data":{"size":355,"size_decoded":555,"mime_type":"text/html; charset=iso-8859-1","magic":"HTML document, ASCII text","md5":"4525b2d648f7c457a689fd96421783a5","sha1":"11bfe30ce44585a15a38e86bc094224ddfe2c08e","sha256":"cc0b4e42510d49c6decd464123ecf3b14ae9b47f9b4ed2ee64893e2d6520a264","sha512":"94e3e8246cf38ff7740e51aa115c8c455b14f78e672c2686b782c0ce30b6fa2dbd91a78b29b3964d9c0414aabd4b9391fd5db326665e25b4b8e73dae60ffe979","ssdeep":"","tlshash":"71e0c04f4057b3474011a2907dc01291e505236b38a152f93ac09467500897dc4aa2dd","first_seen":"2025-12-09T03:51:58.5943Z","last_seen":"2026-08-13T18:46:48.035841Z","times_seen":57465,"resource_available":true,"data":null}},"time_used":22,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":22,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-08-09","alert":"Sinkholed","trigger":"malvex.club","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-08-09","alert":"Phishing Block","trigger":"malvex.club","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"malvex.club/Rftrans/re.php","fqdn":"malvex.club","domain":"malvex.club","tld":"club"},"ip":{"addr":"185.221.216.121","port":443,"asn":393960,"as":"HOST4GEEKS-LLC","country":"United Kingdom","country_code":"GB"},"is_navigation_request":true,"resource_type":"document","requested_by":"","date":"2026-08-09T10:05:57.445Z","timestamp":1786269957445,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"malvex.club","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Sun, 05 Jul 2026 08:33:38 GMT","end":"Sat, 03 Oct 2026 08:33:37 GMT"},"fingerprint":{"sha1":"AB:C0:88:17:EE:94:31:AD:3A:F0:BA:35:2B:6A:8E:5B:0A:D4:68:55","sha256":"30:AA:CC:2D:15:7F:3B:32:E8:E9:32:8C:E8:AA:11:E1:A5:B4:17:40:2C:2C:6F:AD:F9:C4:02:D2:2A:AF:BE:3C"}}},"request":{"raw":"GET /Rftrans/re.php HTTP/1.1\r\nHost: malvex.club\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nUpgrade-Insecure-Requests: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: document\r\nSec-Fetch-Mode: navigate\r\nSec-Fetch-Site: none\r\nPriority: u=0, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Sun, 09 Aug 2026 10:05:57 GMT\r\nServer: Apache\r\nKeep-Alive: timeout=5, max=100\r\nConnection: Keep-Alive\r\nTransfer-Encoding: chunked\r\nContent-Type: text/html; charset=UTF-8\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Tailwind CSS","description":"Tailwind is a utility-first CSS framework.","website":"https://tailwindcss.com/","common_platform_enumeration":"","icon":"tailwindcss.svg","categories":["UI frameworks"]},{"name":"Apache HTTP Server","description":"Apache is a free and open-source cross-platform web server software.","website":"https://httpd.apache.org/","common_platform_enumeration":"cpe:2.3:a:apache:http_server:*:*:*:*:*:*:*:*","icon":"Apache.svg","categories":["Web servers"]}],"data":{"size":5531,"size_decoded":5727,"mime_type":"text/html; charset=UTF-8","magic":"HTML document, Unicode text, UTF-8 text","md5":"d5625d79b4c6a4f4dd2c805cda6c34b1","sha1":"891e5d51a3773b7ed491c1467936a340b860188d","sha256":"61a9c718ad9e5f16ae67e0ff910a62fac5cd99f7139c6930d205d0f9daf06aba","sha512":"303d23d38e5ac638dc876c6b46ca9c804b8329bf0ead473e21eeb7ba8bc5858c8fc30f9d7a0216b566a94782243727e58aa6085b7f15f0647ad3f3c44b7ca7f2","ssdeep":"96:cvMReTGuqimuq1C+n4v0i396hT5XFGultKStn3kgzBw:cvMhiy1C+no0iN6hTdFbnY","tlshash":"cbb11eb875f628361293a85537dbe9093e54c443d457fa053b6cc78c0f8bd809ca36ea","first_seen":"2026-08-09T01:28:26.031423Z","last_seen":"2026-08-09T10:06:25.496356Z","times_seen":2,"resource_available":false,"data":null}},"time_used":204,"timings":{"blocked":-1,"dns":21,"connect":21,"send":0,"wait":135,"receive":0,"ssl":27},"alerts":{"ids":null,"analyzer":[{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-08-09","alert":"Phishing Block","trigger":"malvex.club","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-08-09","alert":"Sinkholed","trigger":"malvex.club","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"malvex.club/Rftrans/image/logo.png","fqdn":"malvex.club","domain":"malvex.club","tld":"club"},"ip":{"addr":"185.221.216.121","port":443,"asn":393960,"as":"HOST4GEEKS-LLC","country":"United Kingdom","country_code":"GB"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://malvex.club/Rftrans/re.php","date":"2026-08-09T10:05:58.027Z","timestamp":1786269958027,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"malvex.club","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Sun, 05 Jul 2026 08:33:38 GMT","end":"Sat, 03 Oct 2026 08:33:37 GMT"},"fingerprint":{"sha1":"AB:C0:88:17:EE:94:31:AD:3A:F0:BA:35:2B:6A:8E:5B:0A:D4:68:55","sha256":"30:AA:CC:2D:15:7F:3B:32:E8:E9:32:8C:E8:AA:11:E1:A5:B4:17:40:2C:2C:6F:AD:F9:C4:02:D2:2A:AF:BE:3C"}}},"request":{"raw":"GET /Rftrans/image/logo.png HTTP/1.1\r\nHost: malvex.club\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://malvex.club/Rftrans/re.php\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Sun, 09 Aug 2026 10:05:58 GMT\r\nServer: Apache\r\nLast-Modified: Fri, 24 Jul 2026 10:11:21 GMT\r\nAccept-Ranges: bytes\r\nContent-Length: 26927\r\nKeep-Alive: timeout=5, max=99\r\nConnection: Keep-Alive\r\nContent-Type: image/png\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Apache HTTP Server","description":"Apache is a free and open-source cross-platform web server software.","website":"https://httpd.apache.org/","common_platform_enumeration":"cpe:2.3:a:apache:http_server:*:*:*:*:*:*:*:*","icon":"Apache.svg","categories":["Web servers"]}],"data":{"size":26927,"size_decoded":27170,"mime_type":"image/png","magic":"PNG image data, 670 x 372, 8-bit/color RGBA, non-interlaced","md5":"ab9971a7da18935e8c0c374f0240c1c5","sha1":"77be762cdd4570f99685c058ca95a181eacdc1f3","sha256":"cd48f671930ab0900ed0ad0b62e2a68ad3a16e32b9b3d65d453724fabdd35a6d","sha512":"71dcb080a0aa86c09576a2b57fb6dd57ad00a80ef47a9001ac7ac3d568112d9437368ac2e3c27aa3129e64fcb8c291b8f84884a07a9026e611c76da550f8ce36","ssdeep":"384:zTESyHI1FHmQwHbWlt/8qbUgIa0X45pediSePY26cW9J3x2pyhYGOQtvHi8YzKo:zTiH6GdwETgIaReHdfB8QcgvYd","tlshash":"76c2be33e5b5a35be5352737d1162b58a8308cdc687db40481e17f292bfc6ee741ac82","first_seen":"2024-12-11T06:34:31.173614Z","last_seen":"2026-08-09T10:06:25.499417Z","times_seen":50,"resource_available":false,"data":null}},"time_used":59,"timings":{"blocked":17,"dns":0,"connect":0,"send":0,"wait":21,"receive":21,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-08-09","alert":"Phishing Block","trigger":"malvex.club","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-08-09","alert":"Sinkholed","trigger":"malvex.club","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}}]}