{"report_id":"9b472900-c074-4433-a2d8-1ff219fa5eff","version":6,"status":"done","tags":[],"date":"2025-12-20T07:12:25Z","url":{"schema":"http","addr":"themetisfoundation.org","fqdn":"themetisfoundation.org","domain":"themetisfoundation.org","tld":"org"},"ip":{"addr":"108.167.173.246","port":0,"asn":19871,"as":"NETWORK-SOLUTIONS-HOSTING","country":"United States","country_code":"US"},"final":{"url":{"schema":"https","addr":"themetisfoundation.org/","fqdn":"themetisfoundation.org","domain":"themetisfoundation.org","tld":"org"},"title":"The Metis Foundation.Org — Coming Soon","dom":{"size":2722,"mime_type":"text/html; charset=utf-8","magic":"HTML document, Unicode text, UTF-8 text, with very long lines (559)","md5":"e31e5bd927f8a906464c55085c4ab2dd","sha1":"44388eca4423899794780a40a1e255b7e6cc66e7","sha256":"e70195fe6113033aafbee050e6e635c55ff30f68514d0f8c3e769c050ee5fac2","sha512":"39b8cf34da77a8267606e6484233f967f68088076d70d2b28ecc8cafee42c4cb6fd183b255570a37d2e37b74e5b6de9576ed0766a2af8848cf0a2b094c945205","ssdeep":"","tlshash":"485172a7e0478e1a2307e6501360a358a2670537c90bd8adb6a71346df4d6f841437d8","dom_hash":"domhash28cfc339db4be22c12c865dffd85b3f3","first_seen":"2025-12-20T07:12:29.153836Z","last_seen":"2025-12-20T07:12:29.153836Z","times_seen":1,"resource_available":false,"data":null}},"submit":{"url":{"schema":"http","addr":"themetisfoundation.org","fqdn":"themetisfoundation.org","domain":"themetisfoundation.org","tld":"org"},"ip":{"addr":"108.167.173.246","port":0,"asn":19871,"as":"NETWORK-SOLUTIONS-HOSTING","country":"United States","country_code":"US"},"tags":null,"meta":null,"user":{"user_id":"akbkyowd9geqr98"}},"settings":{"access":"public","device_type":"desktop","expires_at":"2027-01-24T07:12:25Z","useragent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0","referer":"","cookies":null,"exit_node":"z0yflva4pidy47h"},"stats":{"alert_count":{"ids":0,"urlquery":0,"analyzer":2}},"detection":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2025-12-20","alert":"Sinkholed","trigger":"themetisfoundation.org","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2025-12-20","alert":"Sinkholed","trigger":"themetisfoundation.org","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null},"summary":[{"fqdn":"themetisfoundation.org","ip":{"addr":"108.167.173.246","port":443,"asn":19871,"as":"NETWORK-SOLUTIONS-HOSTING","country":"United States","country_code":"US"},"domain_registered":"2025-12-08","domain_rank":0,"first_seen":"2025-12-20T07:12:25.759353Z","last_seen":"2025-12-20T07:12:25.759353Z","alert_count":12,"request_count":6,"received_data":303572,"sent_data":3097,"comment":"","tags":null,"fingerprints":[{"name":"jQuery","description":"jQuery is a JavaScript library which is a free, open-source software designed to simplify HTML DOM tree traversal and manipulation, as well as event handling, CSS animation, and Ajax.","website":"https://jquery.com","common_platform_enumeration":"cpe:2.3:a:jquery:jquery:*:*:*:*:*:*:*:*","icon":"jQuery.svg","categories":["JavaScript libraries"]},{"name":"Nginx:1.23.4","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"ZURB Foundation","description":"Zurb Foundation is used to prototype in the browser. Allows rapid creation of websites or applications while leveraging mobile and responsive technology. The front end framework is the collection of HTML, CSS, and Javascript containing design patterns.","website":"https://foundation.zurb.com","common_platform_enumeration":"","icon":"ZURB Foundation.png","categories":["UI frameworks"]},{"name":"WordPress","description":"WordPress is a free and open-source content management system written in PHP and paired with a MySQL or MariaDB database. Features include a plugin architecture and a template system.","website":"https://wordpress.org","common_platform_enumeration":"cpe:2.3:a:wordpress:wordpress:*:*:*:*:*:*:*:*","icon":"WordPress.svg","categories":["CMS","Blogs"]},{"name":"MySQL","description":"MySQL is an open-source relational database management system.","website":"https://mysql.com","common_platform_enumeration":"cpe:2.3:a:mysql:mysql:*:*:*:*:*:*:*:*","icon":"MySQL.svg","categories":["Databases"]},{"name":"PHP","description":"PHP is a general-purpose scripting language used for web development.","website":"https://php.net","common_platform_enumeration":"cpe:2.3:a:php:php:*:*:*:*:*:*:*:*","icon":"PHP.svg","categories":["Programming languages"]},{"name":"Apache HTTP Server","description":"Apache is a free and open-source cross-platform web server software.","website":"https://httpd.apache.org/","common_platform_enumeration":"cpe:2.3:a:apache:http_server:*:*:*:*:*:*:*:*","icon":"Apache.svg","categories":["Web servers"]}]}],"files":null,"artifacts":{"windows_shortcuts":null,"files":null,"telegram":null,"pdfs":null,"clipboard":null},"sensors":{"ids":null,"analyzer":null,"urlquery":null},"javascript":{"script":[{"url":{"schema":"https","addr":"themetisfoundation.org/wp-includes/js/jquery/jquery.js","fqdn":"themetisfoundation.org","domain":"themetisfoundation.org","tld":"org"},"ip":{"addr":"108.167.173.246","port":443,"asn":19871,"as":"NETWORK-SOLUTIONS-HOSTING","country":"United States","country_code":"US"},"introduction_type":"scriptElement","is_inline":false,"md5":"16623e9f7cd802cf093c325c511a739c","sha1":"b364dbd40e67076a03e9d7b061c9b2624d081e31","sha256":"1e7f83052e1e3442c4397ced9555033cd1d3f08444d85960683bcf91c8433cdb","sha512":"44b9d0ed3184fe5f19e650798e6fda22b71a6f316415e08c4ec88af3a4211e9fd335d5f9fc44a070f7b478d7060ae3b665c2d2620bbbce2ea6098bd6826b930c","ssdeep":"6144:gwsmYhct1SS+TC1lmhTzeKRYcYmD2zK8USJsdZQ/coLGVFyy/RgL/uiOgeNTIPf2:FuYcYmD4/cZQ/coLGVFyCJTiPf7AqqAk","tlshash":"8f54a3d8f78d112e423231aaad2e12cdbb7dd171561454aefd4d497c24a083c83baf7a","size":285334,"data":"","first_seen":"2023-09-10T20:41:57Z","last_seen":"2026-08-14T02:30:53.659152Z","times_seen":10334,"alerts":{"ids":null,"analyzer":null,"urlquery":null}}],"eval":null,"write":null,"console":null},"http":[{"url":{"schema":"https","addr":"themetisfoundation.org/","fqdn":"themetisfoundation.org","domain":"themetisfoundation.org","tld":"org"},"ip":{"addr":"108.167.173.246","port":443,"asn":19871,"as":"NETWORK-SOLUTIONS-HOSTING","country":"United States","country_code":"US"},"is_navigation_request":true,"resource_type":"document","requested_by":"","date":"2025-12-20T07:12:04.171Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"themetisfoundation.org","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Thu, 18 Dec 2025 23:05:02 GMT","end":"Wed, 18 Mar 2026 23:05:01 GMT"},"fingerprint":{"sha1":"C3:D4:F3:B4:D0:9A:7C:B9:4B:7D:58:EE:E6:8D:1A:40:FB:C3:19:6D","sha256":"86:39:EF:73:84:7D:7B:E7:2E:D8:91:5B:BD:E3:ED:5A:01:22:5E:19:C6:22:B2:48:CB:6A:A7:B3:9D:75:C1:72"}}},"request":{"raw":"GET / HTTP/1.1\r\nHost: themetisfoundation.org\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nUpgrade-Insecure-Requests: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: document\r\nSec-Fetch-Mode: navigate\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ndate: Sat, 20 Dec 2025 07:12:04 GMT\r\nserver: nginx/1.23.4\r\ncontent-type: text/html; charset=UTF-8\r\ncontent-length: 1181\r\npermissions-policy: private-state-token-redemption=(self \"https://www.google.com\" \"https://www.gstatic.com\" \"https://recaptcha.net\" \"https://challenges.cloudflare.com\" \"https://hcaptcha.com\"), private-state-token-issuance=(self \"https://www.google.com\" \"https://www.gstatic.com\" \"https://recaptcha.net\" \"https://challenges.cloudflare.com\" \"https://hcaptcha.com\")\r\ncache-control: no-store, no-cache, must-revalidate, max-age=7200\r\nexpires: Sat, 20 Dec 2025 09:12:04 GMT\r\nvary: Accept-Encoding\r\ncontent-encoding: gzip\r\nx-newfold-cache-level: 2\r\nx-server-cache: false\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"jQuery","description":"jQuery is a JavaScript library which is a free, open-source software designed to simplify HTML DOM tree traversal and manipulation, as well as event handling, CSS animation, and Ajax.","website":"https://jquery.com","common_platform_enumeration":"cpe:2.3:a:jquery:jquery:*:*:*:*:*:*:*:*","icon":"jQuery.svg","categories":["JavaScript libraries"]},{"name":"Nginx:1.23.4","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"ZURB Foundation","description":"Zurb Foundation is used to prototype in the browser. Allows rapid creation of websites or applications while leveraging mobile and responsive technology. The front end framework is the collection of HTML, CSS, and Javascript containing design patterns.","website":"https://foundation.zurb.com","common_platform_enumeration":"","icon":"ZURB Foundation.png","categories":["UI frameworks"]},{"name":"WordPress","description":"WordPress is a free and open-source content management system written in PHP and paired with a MySQL or MariaDB database. Features include a plugin architecture and a template system.","website":"https://wordpress.org","common_platform_enumeration":"cpe:2.3:a:wordpress:wordpress:*:*:*:*:*:*:*:*","icon":"WordPress.svg","categories":["CMS","Blogs"]},{"name":"MySQL","description":"MySQL is an open-source relational database management system.","website":"https://mysql.com","common_platform_enumeration":"cpe:2.3:a:mysql:mysql:*:*:*:*:*:*:*:*","icon":"MySQL.svg","categories":["Databases"]},{"name":"PHP","description":"PHP is a general-purpose scripting language used for web development.","website":"https://php.net","common_platform_enumeration":"cpe:2.3:a:php:php:*:*:*:*:*:*:*:*","icon":"PHP.svg","categories":["Programming languages"]}],"data":{"size":2754,"size_decoded":0,"mime_type":"text/html; charset=UTF-8","magic":"HTML document, ASCII text, with very long lines (565)","md5":"5b6962dafd350096a18b80c7e2120d43","sha1":"824a902bd79571f8d65155ab6db8b293ec616d68","sha256":"2ca11dfc1b1849e8b05ee6a377c10284e74e68853c12634d3000077c3ad5db3f","sha512":"b703e0da7071b92feeb6965b10904a21c74bffa2c48f09a816f97e605d612cb092c7e6d1ec6026a74b081b9c7b27454d46ee6f37f635c5111143d79c73f205b8","ssdeep":"","tlshash":"f05173b6e4478e1a2306e6601370a358a2570577c90be8bdb9a31386df8dbf881437d8","first_seen":"2025-12-20T07:12:29.155082Z","last_seen":"2025-12-20T07:12:29.155082Z","times_seen":1,"resource_available":false,"data":null}},"time_used":1183,"timings":{"blocked":427,"dns":172,"connect":118,"send":0,"wait":329,"receive":0,"ssl":133},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2025-12-20","alert":"Sinkholed","trigger":"themetisfoundation.org","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2025-12-20","alert":"Sinkholed","trigger":"themetisfoundation.org","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"themetisfoundation.org/wp-includes/js/jquery/jquery.js","fqdn":"themetisfoundation.org","domain":"themetisfoundation.org","tld":"org"},"ip":{"addr":"108.167.173.246","port":443,"asn":19871,"as":"NETWORK-SOLUTIONS-HOSTING","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://themetisfoundation.org/","date":"2025-12-20T07:12:05.165Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"themetisfoundation.org","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Thu, 18 Dec 2025 23:05:02 GMT","end":"Wed, 18 Mar 2026 23:05:01 GMT"},"fingerprint":{"sha1":"C3:D4:F3:B4:D0:9A:7C:B9:4B:7D:58:EE:E6:8D:1A:40:FB:C3:19:6D","sha256":"86:39:EF:73:84:7D:7B:E7:2E:D8:91:5B:BD:E3:ED:5A:01:22:5E:19:C6:22:B2:48:CB:6A:A7:B3:9D:75:C1:72"}}},"request":{"raw":"GET /wp-includes/js/jquery/jquery.js HTTP/1.1\r\nHost: themetisfoundation.org\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://themetisfoundation.org/\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nlast-modified: Fri, 19 Dec 2025 00:12:40 GMT\r\naccept-ranges: bytes\r\ncache-control: max-age=21600\r\nexpires: Sat, 20 Dec 2025 13:12:05 GMT\r\nvary: Accept-Encoding\r\ncontent-encoding: gzip\r\nx-newfold-cache-level: 2\r\ncontent-type: application/javascript\r\ndate: Sat, 20 Dec 2025 07:12:05 GMT\r\nserver: Apache\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Apache HTTP Server","description":"Apache is a free and open-source cross-platform web server software.","website":"https://httpd.apache.org/","common_platform_enumeration":"cpe:2.3:a:apache:http_server:*:*:*:*:*:*:*:*","icon":"Apache.svg","categories":["Web servers"]}],"data":{"size":285334,"size_decoded":0,"mime_type":"application/javascript","magic":"JavaScript source, ASCII text","md5":"16623e9f7cd802cf093c325c511a739c","sha1":"b364dbd40e67076a03e9d7b061c9b2624d081e31","sha256":"1e7f83052e1e3442c4397ced9555033cd1d3f08444d85960683bcf91c8433cdb","sha512":"44b9d0ed3184fe5f19e650798e6fda22b71a6f316415e08c4ec88af3a4211e9fd335d5f9fc44a070f7b478d7060ae3b665c2d2620bbbce2ea6098bd6826b930c","ssdeep":"6144:gwsmYhct1SS+TC1lmhTzeKRYcYmD2zK8USJsdZQ/coLGVFyy/RgL/uiOgeNTIPf2:FuYcYmD4/cZQ/coLGVFyCJTiPf7AqqAk","tlshash":"8f54a3d8f78d112e423231aaad2e12cdbb7dd171561454aefd4d497c24a083c83baf7a","first_seen":"2023-09-10T20:41:57Z","last_seen":"2026-08-14T02:30:53.659152Z","times_seen":10334,"resource_available":true,"data":null}},"time_used":254,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":254,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2025-12-20","alert":"Sinkholed","trigger":"themetisfoundation.org","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2025-12-20","alert":"Sinkholed","trigger":"themetisfoundation.org","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"themetisfoundation.org/wp-content/plugins/wp-plugin-hostgator/assets/styles/coming-soon.css?v=2.15.2","fqdn":"themetisfoundation.org","domain":"themetisfoundation.org","tld":"org"},"ip":{"addr":"108.167.173.246","port":443,"asn":19871,"as":"NETWORK-SOLUTIONS-HOSTING","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://themetisfoundation.org/","date":"2025-12-20T07:12:05.167Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"themetisfoundation.org","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Thu, 18 Dec 2025 23:05:02 GMT","end":"Wed, 18 Mar 2026 23:05:01 GMT"},"fingerprint":{"sha1":"C3:D4:F3:B4:D0:9A:7C:B9:4B:7D:58:EE:E6:8D:1A:40:FB:C3:19:6D","sha256":"86:39:EF:73:84:7D:7B:E7:2E:D8:91:5B:BD:E3:ED:5A:01:22:5E:19:C6:22:B2:48:CB:6A:A7:B3:9D:75:C1:72"}}},"request":{"raw":"GET /wp-content/plugins/wp-plugin-hostgator/assets/styles/coming-soon.css?v=2.15.2 HTTP/1.1\r\nHost: themetisfoundation.org\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://themetisfoundation.org/\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nlast-modified: Fri, 19 Dec 2025 00:12:49 GMT\r\naccept-ranges: bytes\r\ncache-control: max-age=2592000\r\nexpires: Mon, 19 Jan 2026 07:12:05 GMT\r\nvary: Accept-Encoding\r\ncontent-encoding: gzip\r\nx-newfold-cache-level: 2\r\ncontent-length: 895\r\ncontent-type: text/css\r\ndate: Sat, 20 Dec 2025 07:12:05 GMT\r\nserver: Apache\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Apache HTTP Server","description":"Apache is a free and open-source cross-platform web server software.","website":"https://httpd.apache.org/","common_platform_enumeration":"cpe:2.3:a:apache:http_server:*:*:*:*:*:*:*:*","icon":"Apache.svg","categories":["Web servers"]}],"data":{"size":2830,"size_decoded":0,"mime_type":"text/css","magic":"ASCII text","md5":"d702a453e5a3ce5e7f8b05bbf0688b56","sha1":"d9a19b178c2182b6c01482b8053509a6f3cfef7b","sha256":"3d6532d88e6d1e72cdcdfc6b2133d1e27a9fa3a733d8f0d917ef2e94788cda23","sha512":"15adde09b0960f45dea6463ba2c27565f5586108bec445bc6bf7a2313519f52661d786d8901235ebfc136ee676ae514f583b9202c88fcd073acafa0a7d48f7d7","ssdeep":"","tlshash":"20519a92eba39857b41f456877bad744233c5083d019cd3c7ed572a8afc52d86532f08","first_seen":"2024-05-23T21:10:00Z","last_seen":"2026-07-25T07:38:06.826828Z","times_seen":304,"resource_available":false,"data":null}},"time_used":134,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":134,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2025-12-20","alert":"Sinkholed","trigger":"themetisfoundation.org","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2025-12-20","alert":"Sinkholed","trigger":"themetisfoundation.org","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"themetisfoundation.org/wp-content/plugins/wp-plugin-hostgator/assets/svg/a-illustration__shape.svg","fqdn":"themetisfoundation.org","domain":"themetisfoundation.org","tld":"org"},"ip":{"addr":"108.167.173.246","port":443,"asn":19871,"as":"NETWORK-SOLUTIONS-HOSTING","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://themetisfoundation.org/","date":"2025-12-20T07:12:05.689Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"themetisfoundation.org","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Thu, 18 Dec 2025 23:05:02 GMT","end":"Wed, 18 Mar 2026 23:05:01 GMT"},"fingerprint":{"sha1":"C3:D4:F3:B4:D0:9A:7C:B9:4B:7D:58:EE:E6:8D:1A:40:FB:C3:19:6D","sha256":"86:39:EF:73:84:7D:7B:E7:2E:D8:91:5B:BD:E3:ED:5A:01:22:5E:19:C6:22:B2:48:CB:6A:A7:B3:9D:75:C1:72"}}},"request":{"raw":"GET /wp-content/plugins/wp-plugin-hostgator/assets/svg/a-illustration__shape.svg HTTP/1.1\r\nHost: themetisfoundation.org\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://themetisfoundation.org/wp-content/plugins/wp-plugin-hostgator/assets/styles/coming-soon.css?v=2.15.2\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nlast-modified: Fri, 19 Dec 2025 00:12:49 GMT\r\naccept-ranges: bytes\r\ncontent-length: 160\r\ncache-control: max-age=21600\r\nexpires: Sat, 20 Dec 2025 13:12:05 GMT\r\nx-newfold-cache-level: 2\r\ncontent-type: image/svg+xml\r\ndate: Sat, 20 Dec 2025 07:12:05 GMT\r\nserver: Apache\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Apache HTTP Server","description":"Apache is a free and open-source cross-platform web server software.","website":"https://httpd.apache.org/","common_platform_enumeration":"cpe:2.3:a:apache:http_server:*:*:*:*:*:*:*:*","icon":"Apache.svg","categories":["Web servers"]}],"data":{"size":160,"size_decoded":0,"mime_type":"image/svg+xml","magic":"SVG Scalable Vector Graphics image","md5":"5b44d8359a95abe3bf9558669918ce94","sha1":"c58d71e0af796b85369009ecca75e1268631fe4f","sha256":"7c3dfc154ed440dc30aa0054465f80127ff37bff4550d5c09a5861c3c5ee67ef","sha512":"557f72be373d075d12928df6b92c0ea351e6efc0032f3d808b0d8b4542f7b70db2e564a7163a871bb1873986dc7a85a4647353e24713eaab4957184b0a9f9435","ssdeep":"","tlshash":"90c08c7a90989e088a098322126c7a37167660de608440adc9882221b4966f36e22aec","first_seen":"2023-05-11T05:51:22Z","last_seen":"2026-07-25T07:38:06.829007Z","times_seen":297,"resource_available":false,"data":null}},"time_used":122,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":122,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2025-12-20","alert":"Sinkholed","trigger":"themetisfoundation.org","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2025-12-20","alert":"Sinkholed","trigger":"themetisfoundation.org","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"themetisfoundation.org/wp-content/plugins/wp-plugin-hostgator/assets/svg/a-illustration__wordpress-snappy.svg","fqdn":"themetisfoundation.org","domain":"themetisfoundation.org","tld":"org"},"ip":{"addr":"108.167.173.246","port":443,"asn":19871,"as":"NETWORK-SOLUTIONS-HOSTING","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://themetisfoundation.org/","date":"2025-12-20T07:12:05.691Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"themetisfoundation.org","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Thu, 18 Dec 2025 23:05:02 GMT","end":"Wed, 18 Mar 2026 23:05:01 GMT"},"fingerprint":{"sha1":"C3:D4:F3:B4:D0:9A:7C:B9:4B:7D:58:EE:E6:8D:1A:40:FB:C3:19:6D","sha256":"86:39:EF:73:84:7D:7B:E7:2E:D8:91:5B:BD:E3:ED:5A:01:22:5E:19:C6:22:B2:48:CB:6A:A7:B3:9D:75:C1:72"}}},"request":{"raw":"GET /wp-content/plugins/wp-plugin-hostgator/assets/svg/a-illustration__wordpress-snappy.svg HTTP/1.1\r\nHost: themetisfoundation.org\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://themetisfoundation.org/wp-content/plugins/wp-plugin-hostgator/assets/styles/coming-soon.css?v=2.15.2\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nlast-modified: Fri, 19 Dec 2025 00:12:49 GMT\r\naccept-ranges: bytes\r\ncontent-length: 6996\r\ncache-control: max-age=21600\r\nexpires: Sat, 20 Dec 2025 13:12:05 GMT\r\nx-newfold-cache-level: 2\r\ncontent-type: image/svg+xml\r\ndate: Sat, 20 Dec 2025 07:12:05 GMT\r\nserver: Apache\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Apache HTTP Server","description":"Apache is a free and open-source cross-platform web server software.","website":"https://httpd.apache.org/","common_platform_enumeration":"cpe:2.3:a:apache:http_server:*:*:*:*:*:*:*:*","icon":"Apache.svg","categories":["Web servers"]}],"data":{"size":6996,"size_decoded":0,"mime_type":"image/svg+xml","magic":"SVG Scalable Vector Graphics image","md5":"44a934f4d274486ee449774a92767634","sha1":"2b28b164a3ed442500b06c83ee53e300a573eb2d","sha256":"8d4c0baf8cc7cee25cf2003b3d79a401ade50eb1f836789843765e93cdbeb171","sha512":"bd1a61b1499fa8448a780a8e101224ff9cc7baf28512a2ed4046ee0c1735c35e33484e1f0b054cbfe22d2d870962f554dcf6f7286aa098dc73db1d93dc4b0f28","ssdeep":"96:7FUIpysTdd698Sp76YERCdgPpzLbreNrJBdfRWmiuMMFzneip65yC5LsR:B9pS98W6X/rerJzRc3M0iqL5QR","tlshash":"1de122ed1a644dd1dc8d92fbef2a15da302364be55c4cb64d3506e1c3c8497a8949fc2","first_seen":"2023-05-11T05:51:22Z","last_seen":"2026-07-25T07:38:06.814225Z","times_seen":309,"resource_available":false,"data":null}},"time_used":124,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":122,"receive":2,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2025-12-20","alert":"Sinkholed","trigger":"themetisfoundation.org","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2025-12-20","alert":"Sinkholed","trigger":"themetisfoundation.org","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"themetisfoundation.org/favicon.ico","fqdn":"themetisfoundation.org","domain":"themetisfoundation.org","tld":"org"},"ip":{"addr":"108.167.173.246","port":443,"asn":19871,"as":"NETWORK-SOLUTIONS-HOSTING","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://themetisfoundation.org/","date":"2025-12-20T07:12:05.818Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"themetisfoundation.org","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Thu, 18 Dec 2025 23:05:02 GMT","end":"Wed, 18 Mar 2026 23:05:01 GMT"},"fingerprint":{"sha1":"C3:D4:F3:B4:D0:9A:7C:B9:4B:7D:58:EE:E6:8D:1A:40:FB:C3:19:6D","sha256":"86:39:EF:73:84:7D:7B:E7:2E:D8:91:5B:BD:E3:ED:5A:01:22:5E:19:C6:22:B2:48:CB:6A:A7:B3:9D:75:C1:72"}}},"request":{"raw":"GET /favicon.ico HTTP/1.1\r\nHost: themetisfoundation.org\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://themetisfoundation.org/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ndate: Sat, 20 Dec 2025 07:12:06 GMT\r\nserver: nginx/1.23.4\r\ncontent-type: text/html; charset=UTF-8\r\ncontent-length: 1181\r\npermissions-policy: private-state-token-redemption=(self \"https://www.google.com\" \"https://www.gstatic.com\" \"https://recaptcha.net\" \"https://challenges.cloudflare.com\" \"https://hcaptcha.com\"), private-state-token-issuance=(self \"https://www.google.com\" \"https://www.gstatic.com\" \"https://recaptcha.net\" \"https://challenges.cloudflare.com\" \"https://hcaptcha.com\")\r\ncache-control: no-store, no-cache, must-revalidate, max-age=7200\r\nexpires: Sat, 20 Dec 2025 09:12:05 GMT\r\nvary: Accept-Encoding\r\ncontent-encoding: gzip\r\nx-newfold-cache-level: 2\r\nx-server-cache: false\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"ZURB Foundation","description":"Zurb Foundation is used to prototype in the browser. Allows rapid creation of websites or applications while leveraging mobile and responsive technology. The front end framework is the collection of HTML, CSS, and Javascript containing design patterns.","website":"https://foundation.zurb.com","common_platform_enumeration":"","icon":"ZURB Foundation.png","categories":["UI frameworks"]},{"name":"WordPress","description":"WordPress is a free and open-source content management system written in PHP and paired with a MySQL or MariaDB database. Features include a plugin architecture and a template system.","website":"https://wordpress.org","common_platform_enumeration":"cpe:2.3:a:wordpress:wordpress:*:*:*:*:*:*:*:*","icon":"WordPress.svg","categories":["CMS","Blogs"]},{"name":"MySQL","description":"MySQL is an open-source relational database management system.","website":"https://mysql.com","common_platform_enumeration":"cpe:2.3:a:mysql:mysql:*:*:*:*:*:*:*:*","icon":"MySQL.svg","categories":["Databases"]},{"name":"PHP","description":"PHP is a general-purpose scripting language used for web development.","website":"https://php.net","common_platform_enumeration":"cpe:2.3:a:php:php:*:*:*:*:*:*:*:*","icon":"PHP.svg","categories":["Programming languages"]},{"name":"jQuery","description":"jQuery is a JavaScript library which is a free, open-source software designed to simplify HTML DOM tree traversal and manipulation, as well as event handling, CSS animation, and Ajax.","website":"https://jquery.com","common_platform_enumeration":"cpe:2.3:a:jquery:jquery:*:*:*:*:*:*:*:*","icon":"jQuery.svg","categories":["JavaScript libraries"]},{"name":"Nginx:1.23.4","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":2754,"size_decoded":0,"mime_type":"text/html; charset=UTF-8","magic":"HTML document, ASCII text, with very long lines (565)","md5":"5b6962dafd350096a18b80c7e2120d43","sha1":"824a902bd79571f8d65155ab6db8b293ec616d68","sha256":"2ca11dfc1b1849e8b05ee6a377c10284e74e68853c12634d3000077c3ad5db3f","sha512":"b703e0da7071b92feeb6965b10904a21c74bffa2c48f09a816f97e605d612cb092c7e6d1ec6026a74b081b9c7b27454d46ee6f37f635c5111143d79c73f205b8","ssdeep":"","tlshash":"f05173b6e4478e1a2306e6601370a358a2570577c90be8bdb9a31386df8dbf881437d8","first_seen":"2025-12-20T07:12:29.155082Z","last_seen":"2025-12-20T07:12:29.155082Z","times_seen":1,"resource_available":false,"data":null}},"time_used":266,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":265,"receive":1,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2025-12-20","alert":"Sinkholed","trigger":"themetisfoundation.org","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2025-12-20","alert":"Sinkholed","trigger":"themetisfoundation.org","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}}]}