{"report_id":"a046ba3c-20c9-4601-b177-603ea9f0f6dc","version":6,"status":"done","tags":[],"date":"2026-01-07T14:56:54Z","url":{"schema":"https","addr":"tronlinkhub.com/","fqdn":"tronlinkhub.com","domain":"tronlinkhub.com","tld":"com"},"ip":{"addr":"190.14.39.5","port":0,"asn":52469,"as":"Offshore Racks S.A","country":"Panama","country_code":"PA"},"final":{"url":{"schema":"https","addr":"tronlinkhub.com/","fqdn":"tronlinkhub.com","domain":"tronlinkhub.com","tld":"com"},"title":"TronLink Hub — Safe TRON (TRC20) Wallet Guide, Best Practices \u0026 Resources","dom":{"size":23882,"mime_type":"text/html; charset=utf-8","magic":"HTML document, Unicode text, UTF-8 text","md5":"03819d75f14300657660528850eb74cc","sha1":"c5dd26d3ef497a21e516ebaa4ae32f952eed1a27","sha256":"f3c5093578512780af1c5708be756fc606b73701b685f967545e925c378a700e","sha512":"e33d4d709b93f9dc4248dcc97eb38bb8ceb396c256a509ecf2a2f4b87705331dd5e3c1bbec80dadb5aea84d1689ae3a1fc011bb11a953f495e362482790b5021","ssdeep":"384:GqrkU1qEBBM11PrPXjtoFZANQr58b3FBfzozbZ4j3gLLsgXrQrL:j473tsZ55m3FBfsh42NO","tlshash":"4fb22a5392e13531151342952bf293aeaa71d00be2159d20fadd43ac5fcafc6abb370d","dom_hash":"domhashe7d2676f7908db97ad795af24044d42b","first_seen":"2026-01-07T14:56:02.03317Z","last_seen":"2026-01-07T14:56:59.001644Z","times_seen":2,"resource_available":false,"data":null}},"submit":{"url":{"schema":"https","addr":"tronlinkhub.com/","fqdn":"tronlinkhub.com","domain":"tronlinkhub.com","tld":"com"},"ip":{"addr":"190.14.39.5","port":0,"asn":52469,"as":"Offshore Racks S.A","country":"Panama","country_code":"PA"},"tags":null,"meta":null},"settings":{"access":"public","device_type":"desktop","expires_at":"2027-02-11T14:56:54Z","useragent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0","referer":"","cookies":null,"exit_node":"z0yflva4pidy47h"},"stats":{"alert_count":{"ids":1,"urlquery":0,"analyzer":3}},"detection":{"ids":[{"sensor_name":"suricata","title":"Suricata IDS","description":"Suricata /w Emerging Threats Pro","date":"2026-01-07T14:56:30Z","timestamp":1767797790,"ip_dst":{"addr":"Client IP","port":42208,"asn":0,"as":"","country":"","country_code":"zz"},"ip_src":{"addr":"59.36.212.72","port":443,"asn":4134,"as":"Chinanet","country":"China","country_code":"CN"},"severity":"low","alert":"ET INFO Observed ZeroSSL SSL/TLS Certificate","source":"{\"timestamp\":\"2026-01-07T14:56:30.232138+0000\",\"flow_id\":2215575854522921,\"in_iface\":\"br-31613a7ed13b\",\"event_type\":\"alert\",\"src_ip\":\"59.36.212.72\",\"src_port\":443,\"dest_ip\":\"172.18.0.29\",\"dest_port\":42208,\"proto\":\"TCP\",\"tx_id\":0,\"alert\":{\"action\":\"allowed\",\"gid\":1,\"signature_id\":2031231,\"rev\":3,\"signature\":\"ET INFO Observed ZeroSSL SSL/TLS Certificate\",\"category\":\"Misc activity\",\"severity\":3,\"metadata\":{\"confidence\":[\"High\"],\"created_at\":[\"2020_11_23\"],\"signature_severity\":[\"Informational\"],\"updated_at\":[\"2022_12_01\"]}},\"tls\":{\"subject\":\"CN=*.bestedm.net\",\"issuerdn\":\"C=AT, O=ZeroSSL, CN=ZeroSSL RSA Domain Secure Site CA\",\"serial\":\"33:B7:08:F1:F3:B9:8D:A2:70:FA:3B:AA:59:A8:87:66\",\"fingerprint\":\"32:88:ea:a9:61:41:03:5d:8f:00:0c:b8:46:02:7f:9a:d7:37:5c:ea\",\"sni\":\"api.bestedm.net\",\"version\":\"TLS 1.2\",\"notbefore\":\"2025-11-24T00:00:00\",\"notafter\":\"2026-02-22T23:59:59\",\"ja3\":{\"hash\":\"0faf2a91198d40dbd58b9308f3fca2fd\",\"string\":\"771,4865-4867-4866-49195-49199-52393-52392-49196-49200-49171-49172-156-157-47-53,0-23-65281-10-11-16-5-34-51-43-13-28-65037,29-23-24-25-256-257,0\"},\"ja3s\":{\"hash\":\"699a80bdb17efe157c861f92c5bf5d1d\",\"string\":\"771,49199,0-65281-11\"}},\"app_proto\":\"tls\",\"flow\":{\"pkts_toserver\":9,\"pkts_toclient\":6,\"bytes_toserver\":1207,\"bytes_toclient\":5668,\"start\":\"2026-01-07T14:55:04.729641+0000\"}}"}],"analyzer":[{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2026-01-07","alert":"Sinkholed","trigger":"tronlinkhub.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-01-07","alert":"Sinkholed","trigger":"tronlinkhub.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-01-07","alert":"Sinkholed","trigger":"tronlinkhub.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null},"summary":[{"fqdn":"tronlinkhub.com","ip":{"addr":"190.14.39.5","port":443,"asn":52469,"as":"Offshore Racks S.A","country":"Panama","country_code":"PA"},"domain_registered":"unknown","domain_rank":0,"first_seen":"No data","last_seen":"No data","alert_count":6,"request_count":2,"received_data":40717,"sent_data":925,"comment":"","tags":null,"fingerprints":[{"name":"LiteSpeed","description":"LiteSpeed is a high-scalability web server.","website":"https://litespeedtech.com","common_platform_enumeration":"cpe:2.3:a:litespeedtech:litespeed_web_server:*:*:*:*:*:*:*:*","icon":"LiteSpeed.svg","categories":["Web servers"]}]}],"files":null,"artifacts":{"windows_shortcuts":null,"files":null,"telegram":null,"pdfs":null,"clipboard":null},"sensors":{"ids":null,"analyzer":null,"urlquery":null},"javascript":{"script":[{"url":{"schema":"https","addr":"tronlinkhub.com/","fqdn":"tronlinkhub.com","domain":"tronlinkhub.com","tld":"com"},"ip":{"addr":"190.14.39.5","port":443,"asn":52469,"as":"Offshore Racks S.A","country":"Panama","country_code":"PA"},"introduction_type":"scriptElement","is_inline":true,"md5":"abd5928f16267f00cd825b66f3d3bdea","sha1":"2d3e68dfd10c970d602a2f8117da55daac419a70","sha256":"b3e2e31416e4543a350d5fbedcc74a53f33da323d7b1b79fdc10edb8f415dfa2","sha512":"a542e9c0ee07e9d63699fb0f7060338eace37bbd6fe76725289d713fd0655f10dfa1a3c43aed1e1a7e822600dc656e70552fd8a0cb40140e9b82513639ce595a","ssdeep":"","tlshash":"f141404c66f6143556bb00ca63b7d2707574251bb841c40b7e6dcb882f86d08aaff9cc","size":1961,"data":"","first_seen":"2026-01-07T14:56:02.044331Z","last_seen":"2026-01-07T14:56:59.014437Z","times_seen":2,"alerts":{"ids":null,"analyzer":null,"urlquery":null}}],"eval":null,"write":null,"console":null},"http":[{"url":{"schema":"https","addr":"tronlinkhub.com/","fqdn":"tronlinkhub.com","domain":"tronlinkhub.com","tld":"com"},"ip":{"addr":"190.14.39.5","port":443,"asn":52469,"as":"Offshore Racks S.A","country":"Panama","country_code":"PA"},"is_navigation_request":true,"resource_type":"document","requested_by":"","date":"2026-01-07T14:56:33.474Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.tronlinkhub.com","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Mon, 10 Nov 2025 20:49:42 GMT","end":"Sun, 08 Feb 2026 20:49:41 GMT"},"fingerprint":{"sha1":"61:E9:BA:21:F9:A8:A7:0F:17:7C:95:51:F4:8A:30:94:CF:D1:18:0C","sha256":"01:B0:D6:A0:98:07:0E:95:B0:D5:AB:A5:0F:8A:6E:49:2F:1F:C4:16:2B:3F:D6:C8:92:54:8F:91:A7:C8:57:C4"}}},"request":{"raw":"GET / HTTP/1.1\r\nHost: tronlinkhub.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nUpgrade-Insecure-Requests: 1\r\nSec-Fetch-Dest: document\r\nSec-Fetch-Mode: navigate\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ncontent-type: text/html\r\nlast-modified: Mon, 10 Nov 2025 22:07:35 GMT\r\naccept-ranges: bytes\r\ncontent-encoding: br\r\nvary: Accept-Encoding\r\ncontent-length: 7629\r\ndate: Wed, 07 Jan 2026 14:56:34 GMT\r\nserver: LiteSpeed\r\nalt-svc: h3=\":443\"; ma=2592000, h3-29=\":443\"; ma=2592000, h3-Q050=\":443\"; ma=2592000, h3-Q046=\":443\"; ma=2592000, h3-Q043=\":443\"; ma=2592000, quic=\":443\"; ma=2592000; v=\"43,46\"\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"LiteSpeed","description":"LiteSpeed is a high-scalability web server.","website":"https://litespeedtech.com","common_platform_enumeration":"cpe:2.3:a:litespeedtech:litespeed_web_server:*:*:*:*:*:*:*:*","icon":"LiteSpeed.svg","categories":["Web servers"]}],"data":{"size":24387,"size_decoded":0,"mime_type":"text/html","magic":"HTML document, Unicode text, UTF-8 text, with CRLF line terminators","md5":"5b7c08d36eb85b59cef986c29a847281","sha1":"7b3fde6bbc81e0e2c23cb8c0a418b94ffaa3c534","sha256":"d0bd3422e078efbc5df3e2aa0ec7fc1e275b7f9bd06323ebac927db70be762d7","sha512":"dd501bb10745b0783ed7fd762068d695e947bcf510358dd0d4d334917ec74974d291616b181c504e834a2583343cb94a5c37a030cd1afcba57ab1816cdc81a8e","ssdeep":"384:tZLcgRBijafs7NjJ983IHBvAO0mmyDamguLr+N8Koja:tZLWak7z9iIHBvAzYDBaim","tlshash":"f9b2c66392c03535153382856bf292aeff71c00bf2114e65b9ee539f1fb6e909763a48","first_seen":"2026-01-07T14:56:02.041752Z","last_seen":"2026-01-07T14:56:59.007747Z","times_seen":2,"resource_available":false,"data":null}},"time_used":1218,"timings":{"blocked":527,"dns":210,"connect":157,"send":0,"wait":157,"receive":1,"ssl":162},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2026-01-07","alert":"Sinkholed","trigger":"tronlinkhub.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-01-07","alert":"Sinkholed","trigger":"tronlinkhub.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-01-07","alert":"Sinkholed","trigger":"tronlinkhub.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"tronlinkhub.com/img/favicon.ico","fqdn":"tronlinkhub.com","domain":"tronlinkhub.com","tld":"com"},"ip":{"addr":"190.14.39.5","port":443,"asn":52469,"as":"Offshore Racks S.A","country":"Panama","country_code":"PA"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://tronlinkhub.com/","date":"2026-01-07T14:56:34.393Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.tronlinkhub.com","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Mon, 10 Nov 2025 20:49:42 GMT","end":"Sun, 08 Feb 2026 20:49:41 GMT"},"fingerprint":{"sha1":"61:E9:BA:21:F9:A8:A7:0F:17:7C:95:51:F4:8A:30:94:CF:D1:18:0C","sha256":"01:B0:D6:A0:98:07:0E:95:B0:D5:AB:A5:0F:8A:6E:49:2F:1F:C4:16:2B:3F:D6:C8:92:54:8F:91:A7:C8:57:C4"}}},"request":{"raw":"GET /img/favicon.ico HTTP/1.1\r\nHost: tronlinkhub.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://tronlinkhub.com/\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\ncache-control: public, max-age=604800\r\nexpires: Wed, 14 Jan 2026 14:56:34 GMT\r\ncontent-type: image/x-icon\r\nlast-modified: Mon, 10 Nov 2025 22:06:27 GMT\r\naccept-ranges: bytes\r\ncontent-encoding: br\r\nvary: Accept-Encoding\r\ncontent-length: 4034\r\ndate: Wed, 07 Jan 2026 14:56:34 GMT\r\nserver: LiteSpeed\r\nalt-svc: h3=\":443\"; ma=2592000, h3-29=\":443\"; ma=2592000, h3-Q050=\":443\"; ma=2592000, h3-Q046=\":443\"; ma=2592000, h3-Q043=\":443\"; ma=2592000, quic=\":443\"; ma=2592000; v=\"43,46\"\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"LiteSpeed","description":"LiteSpeed is a high-scalability web server.","website":"https://litespeedtech.com","common_platform_enumeration":"cpe:2.3:a:litespeedtech:litespeed_web_server:*:*:*:*:*:*:*:*","icon":"LiteSpeed.svg","categories":["Web servers"]}],"data":{"size":15406,"size_decoded":0,"mime_type":"image/x-icon","magic":"MS Windows icon resource - 3 icons, 16x16, 32 bits/pixel, 32x32, 32 bits/pixel","md5":"1c3aff24240699908e62372e994c8dd7","sha1":"3e30c4631131a66760777b685b330851531f87e7","sha256":"f24281dadde20d1abb2f241d23edb5cc8a9c32aadf08b0b687523060975621df","sha512":"8278f967dd2ae3e7e37f8c8a24aa0ac42880819d18fed0ae93af171bad201b98b3cc4bcde9df8a9c1137b0d75c5a5237c008dbab941cd0fbf4c658100b059206","ssdeep":"384:c/yQEcwnNGzJ3g2pHtAulj+NYKoEvnaPIzoQoRHY/:c/ZVwnOJ3g2pHQNracf/","tlshash":"5c62728a4f45e98fc71852fc31f124388b5ca768839dcc635ad0b628ff9ac8e585c319","first_seen":"2026-01-07T14:56:02.038379Z","last_seen":"2026-01-07T14:56:59.012093Z","times_seen":2,"resource_available":false,"data":null}},"time_used":175,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":174,"receive":1,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-01-07","alert":"Sinkholed","trigger":"tronlinkhub.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-01-07","alert":"Sinkholed","trigger":"tronlinkhub.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2026-01-07","alert":"Sinkholed","trigger":"tronlinkhub.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}}]}