{"report_id":"a3e6b1d6-ae7b-4604-8405-c515f41cebd6","version":0,"status":"done","tags":["suspicious"],"date":"2026-07-20T11:18:07Z","url":{"schema":"http","addr":"secured.quicktent.org","fqdn":"secured.quicktent.org","domain":"quicktent.org","tld":"org"},"ip":{"addr":"91.229.239.28","port":0,"asn":200019,"as":"Alexhost Srl","country":"Moldova","country_code":"MD"},"final":{"url":{"schema":"https","addr":"secured.quicktent.org/qr/?tenant=secured","fqdn":"secured.quicktent.org","domain":"quicktent.org","tld":"org"},"title":"Transfer Trust Wallet","dom":{"size":5520,"mime_type":"text/html; charset=utf-8","magic":"JavaScript source, Unicode text, UTF-8 text, with very long lines (392)","md5":"b68ec83d71d9dca44e74b75ec9572624","sha1":"7944aa48459ed8635dcbda93580b734f38a9a43a","sha256":"1f4cf5c8b8137b2bcae59d917a0afe5fd2d201f8d1fe2c78dd9d36fb26651135","sha512":"949e3218c13dbff01b8ed1d60647c754ca01ac170f13129cd69ba64814f847a8c627a29575c940de5d6f99f61fb4dd6a3fa0a95ed394de350cc334ef5eab0e88","ssdeep":"96:3dTkg7h9NqO3uuau9WCWaJ9mkow/LqA36R6LIfkgIfkmvEqVO4MPmZuk:3d77jNq8uuau9WCWaJAkow/LuEL5eO","tlshash":"a5b1b762f8e21f9da00386a66ae6b03f7a24e507c10f995cb5dc51a15fc7c999d63108","dom_hash":"domhash5c16fb52f53d60d611d7ac3bf435deb9","first_seen":"","last_seen":"","times_seen":0,"resource_available":false,"data":null}},"submit":{"url":{"schema":"http","addr":"secured.quicktent.org","fqdn":"secured.quicktent.org","domain":"quicktent.org","tld":"org"},"ip":{"addr":"91.229.239.28","port":0,"asn":200019,"as":"Alexhost Srl","country":"Moldova","country_code":"MD"},"tags":null,"meta":null},"settings":{"access":"public","device_type":"desktop","expires_at":"2027-08-24T11:18:07Z","useragent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0","referer":"","cookies":null,"exit_node":"qguvgzjxzsgb3vs"},"stats":{"alert_count":{"ids":0,"urlquery":2,"analyzer":3}},"detection":{"ids":null,"analyzer":[{"sensor_name":"infosec_yara","sensor_type":"yara","title":"YARAhub by abuse.ch","description":"YARAhub by abuse.ch","scan_date":"2026-07-20","alert":"Detects file containing Telegram Bot API","trigger":"secured.quicktent.org/qr/main.js","verdict":"malware","severity":"medium","comment":"","link":"https://yaraify.abuse.ch/yarahub/","meta":{"author":"rectifyq","date":"2024-09-07","description":"Detects file containing Telegram Bot API","rule":"telegram_bot_api","yarahub_author_twitter":"@_rectifyq","yarahub_license":"CC0 1.0","yarahub_reference_md5":"9DA48D34DC999B4E05E0C6716A3B3B83","yarahub_rule_matching_tlp":"TLP:WHITE","yarahub_rule_sharing_tlp":"TLP:WHITE","yarahub_uuid":"58c9e4fe-d1e9-46ed-913c-dba943ac16d6"}},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-07-20","alert":"Sinkholed","trigger":"secured.quicktent.org","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-07-20","alert":"Sinkholed","trigger":"secured.quicktent.org","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":[{"sensor_name":"urlquery","alert":"Suspicious - Suspicious Javascript code","verdict":"suspicious","severity":"medium","comment":"","tags":["suspicious"],"meta":null},{"sensor_name":"urlquery","alert":"Suspicious - Suspicious Javascript code","verdict":"suspicious","severity":"medium","comment":"","tags":["suspicious"],"meta":null}]},"summary":[{"fqdn":"secured.quicktent.org","ip":{"addr":"91.229.239.28","port":443,"asn":200019,"as":"Alexhost Srl","country":"Moldova","country_code":"MD"},"domain_registered":"2026-05-26","domain_rank":0,"first_seen":"2026-07-20T11:16:21.491402Z","last_seen":"2026-07-20T11:16:21.491402Z","alert_count":20,"request_count":9,"received_data":62093,"sent_data":4325,"comment":"","tags":null,"fingerprints":[{"name":"Caddy","description":"","website":"https://caddyserver.com","common_platform_enumeration":"cpe:2.3:a:caddyserver:caddy:*:*:*:*:*:*:*:*","icon":"caddy.svg","categories":["Web servers"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"Render","description":"Render is a cloud computing platform that provides a wide range of services, including web hosting, cloud computing, and application development. Render offers several hosting options, including static site hosting, web application hosting, and managed databases.","website":"https://render.com","common_platform_enumeration":"","icon":"Render.svg","categories":["PaaS"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}]}],"files":null,"artifacts":{"windows_shortcuts":null,"files":null,"telegram":null,"pdfs":null,"clipboard":null},"sensors":{"ids":null,"analyzer":null,"urlquery":[{"sensor_name":"urlquery","alert":"Suspicious - Suspicious Javascript code","verdict":"suspicious","severity":"medium","comment":"","tags":["suspicious"],"meta":null}]},"javascript":{"script":[{"url":{"schema":"https","addr":"secured.quicktent.org/qr/?tenant=secured","fqdn":"secured.quicktent.org","domain":"quicktent.org","tld":"org"},"ip":{"addr":"91.229.239.28","port":443,"asn":200019,"as":"Alexhost Srl","country":"Moldova","country_code":"MD"},"introduction_type":"scriptElement","is_inline":true,"md5":"76244d8526da359429886b03a7ada498","sha1":"90415cd87cc2f928fc8e16b7740dfb09f7e5bc10","sha256":"3f699786f5f750c5ee9696bce7941003b51f5e5628b55aa6ca59917195d8b490","sha512":"3ba24210155df81c4378587bf70fa4a66f8eb44e60d01deca3b32a8ccdd092d350a1fd870334d90469b750c2fc86822743811cba384e7baa95635291061c3adb","ssdeep":"","tlshash":"dcc0125970206966048e787d4ccf088ebe268412a20849c999dcd8547fb1e6c42e484c","size":184,"data":"","first_seen":"2023-09-20T06:28:52Z","last_seen":"2026-07-21T06:56:43.253067Z","times_seen":1900,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"secured.quicktent.org/api-config.js","fqdn":"secured.quicktent.org","domain":"quicktent.org","tld":"org"},"ip":{"addr":"91.229.239.28","port":443,"asn":200019,"as":"Alexhost Srl","country":"Moldova","country_code":"MD"},"introduction_type":"scriptElement","is_inline":false,"md5":"b004d6212a23fcca2aa8472d1755106a","sha1":"37e98b93dfc2186e405beae37b05f660215b26a3","sha256":"398a67fe3adae0fcdf575a2e9ae8cc1b148d11678a7b5795fb63cbb92ca4b25e","sha512":"300229e9680abdd0eac0046af7f0e3286f2165fe87d0f50af4a6f12724d9e21c0a87e16a0cff524fe6be3679dbafc343e9fb6d6dfbea7771d561d26d332aa1d2","ssdeep":"","tlshash":"672114af9882618609259361860f4d13256f956f112fca03bfac465a2f0c33f231a7f8","size":1240,"data":"","first_seen":"2026-05-30T00:07:31.161209Z","last_seen":"2026-07-20T11:18:08.348292Z","times_seen":28,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"secured.quicktent.org/qr/config.js","fqdn":"secured.quicktent.org","domain":"quicktent.org","tld":"org"},"ip":{"addr":"91.229.239.28","port":443,"asn":200019,"as":"Alexhost Srl","country":"Moldova","country_code":"MD"},"introduction_type":"scriptElement","is_inline":false,"md5":"1dd0dea023477f66456c09eb71c1d2e2","sha1":"e1896ffda97e5271ff467c3974d9cb407fdf52ee","sha256":"8928269a34fc6b6f87c30371c6f1be80a8e8e037e722f7e2aec42e572b734557","sha512":"ec3c0d13316e29fb950b832befc46f0d8e8e1d17766242cf62100052e176d8b5845e3d3b3e285a557bc5b99782a47b05b9ca4ae6fa5d7b872b2f2916adc29b11","ssdeep":"","tlshash":"8121ccfb0fb579620c090067cb897a25224255377a04f405fc1faa563feca72a670dc4","size":1373,"data":"","first_seen":"2026-05-30T00:07:31.175403Z","last_seen":"2026-07-20T11:18:08.353772Z","times_seen":16,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"secured.quicktent.org/ensure-ethers.js","fqdn":"secured.quicktent.org","domain":"quicktent.org","tld":"org"},"ip":{"addr":"91.229.239.28","port":443,"asn":200019,"as":"Alexhost Srl","country":"Moldova","country_code":"MD"},"introduction_type":"scriptElement","is_inline":false,"md5":"088a87f08ad6ce66752a733db27b43d4","sha1":"5319edfcb2bf0c7a7c7e2400148e3659d45e7139","sha256":"d0ffab8ba849ec6ff0b41bcf96bc7cd91b6d20e52334cfcf03a8094cc827f079","sha512":"fee5d426fe628b61d69ad0e583757c0d57f2136ce1b1e41be0600d6348f52b7062b78d6b9fefc9f65b6e07ad96488afdd934503e02808b11b90f891024ee8ed9","ssdeep":"","tlshash":"f021901c1de7e029522b3eaddf5fb048b0315817154cc5647e0c8ba2df627bc4ae1ac8","size":1329,"data":"","first_seen":"2026-07-19T05:14:47.201402Z","last_seen":"2026-07-20T11:18:08.349872Z","times_seen":4,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"secured.quicktent.org/qr/runtime-config.js","fqdn":"secured.quicktent.org","domain":"quicktent.org","tld":"org"},"ip":{"addr":"91.229.239.28","port":443,"asn":200019,"as":"Alexhost Srl","country":"Moldova","country_code":"MD"},"introduction_type":"scriptElement","is_inline":false,"md5":"78efc188c8f3eef19d5085d416f1d091","sha1":"e046d389663af9b5e512c3261403d9bb5655208b","sha256":"9eed7cc17417da470516554cc7ec7dd87ab243354de982628c0d68539877b092","sha512":"2dbd852d801726d1bd2a6dc3e3080973b83b37c46edbd24eeec1445916dbb876478fbc5b10f83a40816ac52c02b9912ff981417c01c8c20ec5ff6dddbc377308","ssdeep":"96:jeWTE8yxd5ED2E7ECfawzwk2w0swNOUy2sscBcfZYdH2jojwegS4c:dIZd5ED2eZokjgGAkccWBe9R","tlshash":"e7a196995ed37031493ba06d536fa654b8166213110bd80cbd8c9304ffb99678ebaee8","size":5006,"data":"","first_seen":"2026-05-30T00:07:31.165475Z","last_seen":"2026-07-20T11:18:08.352559Z","times_seen":19,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"secured.quicktent.org/qr/main.js","fqdn":"secured.quicktent.org","domain":"quicktent.org","tld":"org"},"ip":{"addr":"91.229.239.28","port":443,"asn":200019,"as":"Alexhost Srl","country":"Moldova","country_code":"MD"},"introduction_type":"scriptElement","is_inline":false,"md5":"79a5224cd61a4cf784dcbf20687ffa6b","sha1":"90616628764116e5d7e0e6db9bb2d76f837de86e","sha256":"abd013cbebbdc408aa9d300f7ec146e7763fbab66096f9e5e25baa533f677f60","sha512":"274337c734b1b3e8636f757c2ecf4ce6de08de2c17f52bc6312ee7e3d9e8f15f291c2867b538fee923f134c100b472b45d4316eac84ce3a63bf311e4eb7451ad","ssdeep":"192:YUPLkViUWgCGoCY7f4ycxmr1cgpXekB8fn9Dh5vwIAlQ3v0qBI5p6MxwShCXp13:jPLkVMrapn51zIdUz","tlshash":"bc82e96d16777020046760a96bcb3110307791273a15eca0769e83936f5ed2eadf3bdd","size":18859,"data":"","first_seen":"2026-07-19T05:14:47.203756Z","last_seen":"2026-07-20T11:18:08.365365Z","times_seen":4,"alerts":{"ids":null,"analyzer":[{"sensor_name":"infosec_yara","sensor_type":"yara","title":"YARAhub by abuse.ch","description":"YARAhub by abuse.ch","scan_date":"2026-07-20","alert":"Detects file containing Telegram Bot API","trigger":"secured.quicktent.org/qr/main.js","verdict":"malware","severity":"medium","comment":"","link":"https://yaraify.abuse.ch/yarahub/","meta":{"author":"rectifyq","date":"2024-09-07","description":"Detects file containing Telegram Bot API","rule":"telegram_bot_api","yarahub_author_twitter":"@_rectifyq","yarahub_license":"CC0 1.0","yarahub_reference_md5":"9DA48D34DC999B4E05E0C6716A3B3B83","yarahub_rule_matching_tlp":"TLP:WHITE","yarahub_rule_sharing_tlp":"TLP:WHITE","yarahub_uuid":"58c9e4fe-d1e9-46ed-913c-dba943ac16d6"}}],"urlquery":null}}],"eval":null,"write":null,"console":null},"http":[{"url":{"schema":"https","addr":"secured.quicktent.org/qr/?tenant=secured","fqdn":"secured.quicktent.org","domain":"quicktent.org","tld":"org"},"ip":{"addr":"91.229.239.28","port":443,"asn":200019,"as":"Alexhost Srl","country":"Moldova","country_code":"MD"},"is_navigation_request":true,"resource_type":"document","requested_by":"","date":"2026-07-20T11:17:41.349Z","timestamp":1784546261349,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_CHACHA20_POLY1305_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"secured.quicktent.org","organization":""},"issuer":{"commonName":"E8","organization":"Let's Encrypt"},"validity":{"start":"Wed, 27 May 2026 12:36:13 GMT","end":"Tue, 25 Aug 2026 12:36:12 GMT"},"fingerprint":{"sha1":"E9:2B:89:7D:76:01:92:60:93:7F:4B:03:D4:4E:10:0C:C0:72:79:2A","sha256":"55:6C:9E:C2:F2:99:90:6C:0B:94:65:55:00:F1:0D:88:44:6A:02:E7:CC:09:03:AA:D1:29:6D:9D:8C:B2:BA:14"}}},"request":{"raw":"GET /qr/?tenant=secured HTTP/1.1\r\nHost: secured.quicktent.org\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://secured.quicktent.org/\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nUpgrade-Insecure-Requests: 1\r\nSec-Fetch-Dest: document\r\nSec-Fetch-Mode: navigate\r\nSec-Fetch-Site: same-origin\r\nPriority: u=0, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\ncontent-type: text/html; charset=utf-8\r\nlast-modified: Mon, 13 Jul 2026 00:01:15 GMT\r\ncontent-length: 1864\r\ncontent-encoding: gzip\r\nreferrer-policy: strict-origin-when-cross-origin\r\ndate: Mon, 20 Jul 2026 11:17:41 GMT\r\nserver: Caddy\r\nx-content-type-options: nosniff\r\nvary: Accept-Encoding\r\netag: \"djx030vnz3kl47d-gzip\"\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Caddy","description":"","website":"https://caddyserver.com","common_platform_enumeration":"cpe:2.3:a:caddyserver:caddy:*:*:*:*:*:*:*:*","icon":"caddy.svg","categories":["Web servers"]}],"data":{"size":5449,"size_decoded":2199,"mime_type":"text/html; charset=utf-8","magic":"HTML document, Unicode text, UTF-8 text, with very long lines (392)","md5":"1c743f7fe2831b3a1aba52311f2d1c38","sha1":"573637d2ff15a6b878a443835c5e10286ba09365","sha256":"45566054571d74c0e7f62dd14b09a05f548723b5c904b646844b138c8c553b05","sha512":"ddb2de9f8e97b8848513c20f96714a4852a104ec63a632e88ffce26d4d962291b06c67e77d7406b3704d4ff97dc3900637ee075a056437b24a1ffcf7351fea2c","ssdeep":"96:pdFx7h9NqO3uuau9WCWaJ9mkow/LqA36R6LIfkgIfkmvEqVO6MPmZe:pdH7jNq8uuau9WCWaJAkow/LuEL5QB","tlshash":"57b1e862f8e21e5ea00383e66eeab03f7a24e507c20f995cb5dc51a15fc7c99dd63108","first_seen":"2026-07-19T05:14:47.210713Z","last_seen":"2026-07-20T11:18:08.344407Z","times_seen":4,"resource_available":true,"data":null}},"time_used":57,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":57,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-07-20","alert":"Sinkholed","trigger":"secured.quicktent.org","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-07-20","alert":"Sinkholed","trigger":"secured.quicktent.org","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"secured.quicktent.org/api-config.js","fqdn":"secured.quicktent.org","domain":"quicktent.org","tld":"org"},"ip":{"addr":"91.229.239.28","port":443,"asn":200019,"as":"Alexhost Srl","country":"Moldova","country_code":"MD"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://secured.quicktent.org/qr/?tenant=secured","date":"2026-07-20T11:17:41.436Z","timestamp":1784546261436,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_CHACHA20_POLY1305_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"secured.quicktent.org","organization":""},"issuer":{"commonName":"E8","organization":"Let's Encrypt"},"validity":{"start":"Wed, 27 May 2026 12:36:13 GMT","end":"Tue, 25 Aug 2026 12:36:12 GMT"},"fingerprint":{"sha1":"E9:2B:89:7D:76:01:92:60:93:7F:4B:03:D4:4E:10:0C:C0:72:79:2A","sha256":"55:6C:9E:C2:F2:99:90:6C:0B:94:65:55:00:F1:0D:88:44:6A:02:E7:CC:09:03:AA:D1:29:6D:9D:8C:B2:BA:14"}}},"request":{"raw":"GET /api-config.js HTTP/1.1\r\nHost: secured.quicktent.org\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://secured.quicktent.org/qr/?tenant=secured\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nvary: Accept-Encoding\r\netag: \"ditg80dopmnbyg-gzip\"\r\nlast-modified: Wed, 27 May 2026 12:13:26 GMT\r\ncontent-encoding: gzip\r\nserver: Caddy\r\nreferrer-policy: strict-origin-when-cross-origin\r\nx-content-type-options: nosniff\r\ncontent-type: text/javascript; charset=utf-8\r\ndate: Mon, 20 Jul 2026 11:17:41 GMT\r\ncontent-length: 632\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Caddy","description":"","website":"https://caddyserver.com","common_platform_enumeration":"cpe:2.3:a:caddyserver:caddy:*:*:*:*:*:*:*:*","icon":"caddy.svg","categories":["Web servers"]}],"data":{"size":1240,"size_decoded":971,"mime_type":"text/javascript; charset=utf-8","magic":"JavaScript source, Unicode text, UTF-8 text","md5":"b004d6212a23fcca2aa8472d1755106a","sha1":"37e98b93dfc2186e405beae37b05f660215b26a3","sha256":"398a67fe3adae0fcdf575a2e9ae8cc1b148d11678a7b5795fb63cbb92ca4b25e","sha512":"300229e9680abdd0eac0046af7f0e3286f2165fe87d0f50af4a6f12724d9e21c0a87e16a0cff524fe6be3679dbafc343e9fb6d6dfbea7771d561d26d332aa1d2","ssdeep":"","tlshash":"672114af9882618609259361860f4d13256f956f112fca03bfac465a2f0c33f231a7f8","first_seen":"2026-05-30T00:07:31.161209Z","last_seen":"2026-07-20T11:18:08.348292Z","times_seen":28,"resource_available":true,"data":null}},"time_used":55,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":55,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-07-20","alert":"Sinkholed","trigger":"secured.quicktent.org","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-07-20","alert":"Sinkholed","trigger":"secured.quicktent.org","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"secured.quicktent.org/ensure-ethers.js","fqdn":"secured.quicktent.org","domain":"quicktent.org","tld":"org"},"ip":{"addr":"91.229.239.28","port":443,"asn":200019,"as":"Alexhost Srl","country":"Moldova","country_code":"MD"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://secured.quicktent.org/qr/?tenant=secured","date":"2026-07-20T11:17:41.441Z","timestamp":1784546261441,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_CHACHA20_POLY1305_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"secured.quicktent.org","organization":""},"issuer":{"commonName":"E8","organization":"Let's Encrypt"},"validity":{"start":"Wed, 27 May 2026 12:36:13 GMT","end":"Tue, 25 Aug 2026 12:36:12 GMT"},"fingerprint":{"sha1":"E9:2B:89:7D:76:01:92:60:93:7F:4B:03:D4:4E:10:0C:C0:72:79:2A","sha256":"55:6C:9E:C2:F2:99:90:6C:0B:94:65:55:00:F1:0D:88:44:6A:02:E7:CC:09:03:AA:D1:29:6D:9D:8C:B2:BA:14"}}},"request":{"raw":"GET /ensure-ethers.js HTTP/1.1\r\nHost: secured.quicktent.org\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://secured.quicktent.org/qr/?tenant=secured\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nserver: Caddy\r\nx-content-type-options: nosniff\r\nreferrer-policy: strict-origin-when-cross-origin\r\nvary: Accept-Encoding\r\nlast-modified: Mon, 13 Jul 2026 00:01:15 GMT\r\ndate: Mon, 20 Jul 2026 11:17:41 GMT\r\netag: \"djx030vlld4r10x-gzip\"\r\ncontent-type: text/javascript; charset=utf-8\r\ncontent-encoding: gzip\r\ncontent-length: 593\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Caddy","description":"","website":"https://caddyserver.com","common_platform_enumeration":"cpe:2.3:a:caddyserver:caddy:*:*:*:*:*:*:*:*","icon":"caddy.svg","categories":["Web servers"]}],"data":{"size":1329,"size_decoded":933,"mime_type":"text/javascript; charset=utf-8","magic":"JavaScript source, Unicode text, UTF-8 text","md5":"088a87f08ad6ce66752a733db27b43d4","sha1":"5319edfcb2bf0c7a7c7e2400148e3659d45e7139","sha256":"d0ffab8ba849ec6ff0b41bcf96bc7cd91b6d20e52334cfcf03a8094cc827f079","sha512":"fee5d426fe628b61d69ad0e583757c0d57f2136ce1b1e41be0600d6348f52b7062b78d6b9fefc9f65b6e07ad96488afdd934503e02808b11b90f891024ee8ed9","ssdeep":"","tlshash":"f021901c1de7e029522b3eaddf5fb048b0315817154cc5647e0c8ba2df627bc4ae1ac8","first_seen":"2026-07-19T05:14:47.201402Z","last_seen":"2026-07-20T11:18:08.349872Z","times_seen":4,"resource_available":true,"data":null}},"time_used":55,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":55,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-07-20","alert":"Sinkholed","trigger":"secured.quicktent.org","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-07-20","alert":"Sinkholed","trigger":"secured.quicktent.org","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"secured.quicktent.org/qr/runtime-config.js","fqdn":"secured.quicktent.org","domain":"quicktent.org","tld":"org"},"ip":{"addr":"91.229.239.28","port":443,"asn":200019,"as":"Alexhost Srl","country":"Moldova","country_code":"MD"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://secured.quicktent.org/qr/?tenant=secured","date":"2026-07-20T11:17:41.443Z","timestamp":1784546261443,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_CHACHA20_POLY1305_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"secured.quicktent.org","organization":""},"issuer":{"commonName":"E8","organization":"Let's Encrypt"},"validity":{"start":"Wed, 27 May 2026 12:36:13 GMT","end":"Tue, 25 Aug 2026 12:36:12 GMT"},"fingerprint":{"sha1":"E9:2B:89:7D:76:01:92:60:93:7F:4B:03:D4:4E:10:0C:C0:72:79:2A","sha256":"55:6C:9E:C2:F2:99:90:6C:0B:94:65:55:00:F1:0D:88:44:6A:02:E7:CC:09:03:AA:D1:29:6D:9D:8C:B2:BA:14"}}},"request":{"raw":"GET /qr/runtime-config.js HTTP/1.1\r\nHost: secured.quicktent.org\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://secured.quicktent.org/qr/?tenant=secured\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nlast-modified: Tue, 26 May 2026 15:57:24 GMT\r\ndate: Mon, 20 Jul 2026 11:17:41 GMT\r\ncontent-encoding: gzip\r\ncontent-length: 1843\r\nvary: Accept-Encoding\r\ncontent-type: text/javascript; charset=utf-8\r\nserver: Caddy\r\nx-content-type-options: nosniff\r\nreferrer-policy: strict-origin-when-cross-origin\r\netag: \"disqcy6ectmp3v2-gzip\"\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Caddy","description":"","website":"https://caddyserver.com","common_platform_enumeration":"cpe:2.3:a:caddyserver:caddy:*:*:*:*:*:*:*:*","icon":"caddy.svg","categories":["Web servers"]}],"data":{"size":5006,"size_decoded":2184,"mime_type":"text/javascript; charset=utf-8","magic":"JavaScript source, ASCII text","md5":"78efc188c8f3eef19d5085d416f1d091","sha1":"e046d389663af9b5e512c3261403d9bb5655208b","sha256":"9eed7cc17417da470516554cc7ec7dd87ab243354de982628c0d68539877b092","sha512":"2dbd852d801726d1bd2a6dc3e3080973b83b37c46edbd24eeec1445916dbb876478fbc5b10f83a40816ac52c02b9912ff981417c01c8c20ec5ff6dddbc377308","ssdeep":"96:jeWTE8yxd5ED2E7ECfawzwk2w0swNOUy2sscBcfZYdH2jojwegS4c:dIZd5ED2eZokjgGAkccWBe9R","tlshash":"e7a196995ed37031493ba06d536fa654b8166213110bd80cbd8c9304ffb99678ebaee8","first_seen":"2026-05-30T00:07:31.165475Z","last_seen":"2026-07-20T11:18:08.352559Z","times_seen":19,"resource_available":true,"data":null}},"time_used":54,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":54,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-07-20","alert":"Sinkholed","trigger":"secured.quicktent.org","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-07-20","alert":"Sinkholed","trigger":"secured.quicktent.org","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"secured.quicktent.org/qr/config.js","fqdn":"secured.quicktent.org","domain":"quicktent.org","tld":"org"},"ip":{"addr":"91.229.239.28","port":443,"asn":200019,"as":"Alexhost Srl","country":"Moldova","country_code":"MD"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://secured.quicktent.org/qr/?tenant=secured","date":"2026-07-20T11:17:42.376Z","timestamp":1784546262376,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_CHACHA20_POLY1305_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"secured.quicktent.org","organization":""},"issuer":{"commonName":"E8","organization":"Let's Encrypt"},"validity":{"start":"Wed, 27 May 2026 12:36:13 GMT","end":"Tue, 25 Aug 2026 12:36:12 GMT"},"fingerprint":{"sha1":"E9:2B:89:7D:76:01:92:60:93:7F:4B:03:D4:4E:10:0C:C0:72:79:2A","sha256":"55:6C:9E:C2:F2:99:90:6C:0B:94:65:55:00:F1:0D:88:44:6A:02:E7:CC:09:03:AA:D1:29:6D:9D:8C:B2:BA:14"}}},"request":{"raw":"GET /qr/config.js HTTP/1.1\r\nHost: secured.quicktent.org\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://secured.quicktent.org/qr/?tenant=secured\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nreferrer-policy: strict-origin-when-cross-origin\r\nx-content-type-options: nosniff\r\netag: \"disqcy6ectmp125-gzip\"\r\ncontent-type: text/javascript; charset=utf-8\r\ndate: Mon, 20 Jul 2026 11:17:42 GMT\r\nserver: Caddy\r\nvary: Accept-Encoding\r\nlast-modified: Tue, 26 May 2026 15:57:24 GMT\r\ncontent-encoding: gzip\r\ncontent-length: 670\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Caddy","description":"","website":"https://caddyserver.com","common_platform_enumeration":"cpe:2.3:a:caddyserver:caddy:*:*:*:*:*:*:*:*","icon":"caddy.svg","categories":["Web servers"]}],"data":{"size":1373,"size_decoded":1010,"mime_type":"text/javascript; charset=utf-8","magic":"JavaScript source, ASCII text","md5":"1dd0dea023477f66456c09eb71c1d2e2","sha1":"e1896ffda97e5271ff467c3974d9cb407fdf52ee","sha256":"8928269a34fc6b6f87c30371c6f1be80a8e8e037e722f7e2aec42e572b734557","sha512":"ec3c0d13316e29fb950b832befc46f0d8e8e1d17766242cf62100052e176d8b5845e3d3b3e285a557bc5b99782a47b05b9ca4ae6fa5d7b872b2f2916adc29b11","ssdeep":"","tlshash":"8121ccfb0fb579620c090067cb897a25224255377a04f405fc1faa563feca72a670dc4","first_seen":"2026-05-30T00:07:31.175403Z","last_seen":"2026-07-20T11:18:08.353772Z","times_seen":16,"resource_available":true,"data":null}},"time_used":57,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":57,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-07-20","alert":"Sinkholed","trigger":"secured.quicktent.org","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-07-20","alert":"Sinkholed","trigger":"secured.quicktent.org","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"secured.quicktent.org/qr/style.css","fqdn":"secured.quicktent.org","domain":"quicktent.org","tld":"org"},"ip":{"addr":"91.229.239.28","port":443,"asn":200019,"as":"Alexhost Srl","country":"Moldova","country_code":"MD"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://secured.quicktent.org/qr/?tenant=secured","date":"2026-07-20T11:17:41.434Z","timestamp":1784546261434,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_CHACHA20_POLY1305_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"secured.quicktent.org","organization":""},"issuer":{"commonName":"E8","organization":"Let's Encrypt"},"validity":{"start":"Wed, 27 May 2026 12:36:13 GMT","end":"Tue, 25 Aug 2026 12:36:12 GMT"},"fingerprint":{"sha1":"E9:2B:89:7D:76:01:92:60:93:7F:4B:03:D4:4E:10:0C:C0:72:79:2A","sha256":"55:6C:9E:C2:F2:99:90:6C:0B:94:65:55:00:F1:0D:88:44:6A:02:E7:CC:09:03:AA:D1:29:6D:9D:8C:B2:BA:14"}}},"request":{"raw":"GET /qr/style.css HTTP/1.1\r\nHost: secured.quicktent.org\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://secured.quicktent.org/qr/?tenant=secured\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=2\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\ncontent-encoding: gzip\r\nserver: Caddy\r\netag: \"djx030vnz3klblq-gzip\"\r\ncontent-type: text/css; charset=utf-8\r\ncontent-length: 3700\r\nreferrer-policy: strict-origin-when-cross-origin\r\nx-content-type-options: nosniff\r\nvary: Accept-Encoding\r\nlast-modified: Mon, 13 Jul 2026 00:01:15 GMT\r\ndate: Mon, 20 Jul 2026 11:17:41 GMT\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Caddy","description":"","website":"https://caddyserver.com","common_platform_enumeration":"cpe:2.3:a:caddyserver:caddy:*:*:*:*:*:*:*:*","icon":"caddy.svg","categories":["Web servers"]}],"data":{"size":15038,"size_decoded":4034,"mime_type":"text/css; charset=utf-8","magic":"ASCII text","md5":"034b880b4fa182decbf438f1bd7526e3","sha1":"0e05f6961d6ee239bdc5c6478ca4df1bb0034c28","sha256":"d18dce3d0d7bec84427a31e274186d5fc4727463e60b994aea094b294605bce5","sha512":"813278d4003a86e5f90ff4dc86640dd248b64314901048bcea1de3ac00affd18237866cf40430a79d2b5d64a9b2a2a28deefb5a07a2a168dda03c9a138f525d4","ssdeep":"192:wDn4DUDn4D1ZgNHuECW1IJPLJvnCxvDRHsfHyzvBt2pPOOIjyxPhPLsXj2VE3Ior:J11WJQONyNts1","tlshash":"4662645956b34c112d2a44feb3deb747b23780cbde2eeda9bbc511008fc51a158c2b88","first_seen":"2026-07-19T05:14:47.205711Z","last_seen":"2026-07-20T11:18:08.3635Z","times_seen":4,"resource_available":false,"data":null}},"time_used":57,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":57,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-07-20","alert":"Sinkholed","trigger":"secured.quicktent.org","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-07-20","alert":"Sinkholed","trigger":"secured.quicktent.org","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"secured.quicktent.org/api/tenant-config","fqdn":"secured.quicktent.org","domain":"quicktent.org","tld":"org"},"ip":{"addr":"91.229.239.28","port":443,"asn":200019,"as":"Alexhost Srl","country":"Moldova","country_code":"MD"},"is_navigation_request":false,"resource_type":"fetch","requested_by":"https://secured.quicktent.org/qr/?tenant=secured","date":"2026-07-20T11:17:41.532Z","timestamp":1784546261532,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_CHACHA20_POLY1305_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"secured.quicktent.org","organization":""},"issuer":{"commonName":"E8","organization":"Let's Encrypt"},"validity":{"start":"Wed, 27 May 2026 12:36:13 GMT","end":"Tue, 25 Aug 2026 12:36:12 GMT"},"fingerprint":{"sha1":"E9:2B:89:7D:76:01:92:60:93:7F:4B:03:D4:4E:10:0C:C0:72:79:2A","sha256":"55:6C:9E:C2:F2:99:90:6C:0B:94:65:55:00:F1:0D:88:44:6A:02:E7:CC:09:03:AA:D1:29:6D:9D:8C:B2:BA:14"}}},"request":{"raw":"GET /api/tenant-config HTTP/1.1\r\nHost: secured.quicktent.org\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://secured.quicktent.org/qr/?tenant=secured\r\nX-Tenant-Slug: secured\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=4\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nx-ratelimit-reset: 60\r\nx-xss-protection: 0\r\nx-ratelimit-remaining: 119\r\nrndr-id: 28da18a0-a5e8-4ddc\r\ncontent-length: 284\r\nx-render-origin-server: Render\r\nx-content-type-options: nosniff, nosniff\r\nserver: cloudflare\r\naccess-control-allow-credentials: true\r\ncontent-type: application/json; charset=utf-8\r\nx-dns-prefetch-control: off\r\nvia: 2.0 Caddy\r\ndate: Mon, 20 Jul 2026 11:17:42 GMT\r\nx-permitted-cross-domain-policies: none\r\nx-ratelimit-limit: 120\r\naccess-control-allow-origin: *\r\norigin-agent-cluster: ?1\r\nx-download-options: noopen\r\ncontent-encoding: br\r\nreferrer-policy: strict-origin-when-cross-origin, no-referrer\r\ncross-origin-resource-policy: same-origin\r\ncf-ray: a1e18f96bda872c5-KIV\r\ncf-cache-status: DYNAMIC\r\ncross-origin-opener-policy: same-origin\r\nvary: Accept-Encoding\r\nx-frame-options: SAMEORIGIN\r\nstrict-transport-security: max-age=15552000; includeSubDomains\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"Render","description":"Render is a cloud computing platform that provides a wide range of services, including web hosting, cloud computing, and application development. Render offers several hosting options, including static site hosting, web application hosting, and managed databases.","website":"https://render.com","common_platform_enumeration":"","icon":"Render.svg","categories":["PaaS"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":405,"size_decoded":1176,"mime_type":"application/json; charset=utf-8","magic":"JSON text data","md5":"b2cfb73de05fa45ee3bca3e85e65a55c","sha1":"6268e1743fbf537dfe05855661b6b435b20a649b","sha256":"48c29f20bc1957def3fb722edf09d8f57fc34dbad0809c35ac1433e46b910db6","sha512":"89b438ea5c3c25f2cb4d71ce1e114f443e2ada3efc398a3d842617585497d5c7a20fa37ffedd40a632b6a0ef33d9cfc864ff75e4bcea164d4126cc1ebae3f44e","ssdeep":"","tlshash":"e4e0ab3b27d8a0265b4023c840aea9e880db5e91ce8ec422881f870582b8c73080306b","first_seen":"2026-07-20T11:16:43.625989Z","last_seen":"2026-07-20T11:18:08.364425Z","times_seen":2,"resource_available":false,"data":null}},"time_used":836,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":836,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-07-20","alert":"Sinkholed","trigger":"secured.quicktent.org","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-07-20","alert":"Sinkholed","trigger":"secured.quicktent.org","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"secured.quicktent.org/qr/main.js","fqdn":"secured.quicktent.org","domain":"quicktent.org","tld":"org"},"ip":{"addr":"91.229.239.28","port":443,"asn":200019,"as":"Alexhost Srl","country":"Moldova","country_code":"MD"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://secured.quicktent.org/qr/?tenant=secured","date":"2026-07-20T11:17:42.439Z","timestamp":1784546262439,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_CHACHA20_POLY1305_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"secured.quicktent.org","organization":""},"issuer":{"commonName":"E8","organization":"Let's Encrypt"},"validity":{"start":"Wed, 27 May 2026 12:36:13 GMT","end":"Tue, 25 Aug 2026 12:36:12 GMT"},"fingerprint":{"sha1":"E9:2B:89:7D:76:01:92:60:93:7F:4B:03:D4:4E:10:0C:C0:72:79:2A","sha256":"55:6C:9E:C2:F2:99:90:6C:0B:94:65:55:00:F1:0D:88:44:6A:02:E7:CC:09:03:AA:D1:29:6D:9D:8C:B2:BA:14"}}},"request":{"raw":"GET /qr/main.js HTTP/1.1\r\nHost: secured.quicktent.org\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://secured.quicktent.org/qr/?tenant=secured\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nreferrer-policy: strict-origin-when-cross-origin\r\netag: \"djx030vnz3klejv-gzip\"\r\ncontent-type: text/javascript; charset=utf-8\r\nserver: Caddy\r\nx-content-type-options: nosniff\r\nvary: Accept-Encoding\r\nlast-modified: Mon, 13 Jul 2026 00:01:15 GMT\r\ndate: Mon, 20 Jul 2026 11:17:42 GMT\r\ncontent-encoding: gzip\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Caddy","description":"","website":"https://caddyserver.com","common_platform_enumeration":"cpe:2.3:a:caddyserver:caddy:*:*:*:*:*:*:*:*","icon":"caddy.svg","categories":["Web servers"]}],"data":{"size":18859,"size_decoded":5264,"mime_type":"text/javascript; charset=utf-8","magic":"JavaScript source, Unicode text, UTF-8 text","md5":"79a5224cd61a4cf784dcbf20687ffa6b","sha1":"90616628764116e5d7e0e6db9bb2d76f837de86e","sha256":"abd013cbebbdc408aa9d300f7ec146e7763fbab66096f9e5e25baa533f677f60","sha512":"274337c734b1b3e8636f757c2ecf4ce6de08de2c17f52bc6312ee7e3d9e8f15f291c2867b538fee923f134c100b472b45d4316eac84ce3a63bf311e4eb7451ad","ssdeep":"192:YUPLkViUWgCGoCY7f4ycxmr1cgpXekB8fn9Dh5vwIAlQ3v0qBI5p6MxwShCXp13:jPLkVMrapn51zIdUz","tlshash":"bc82e96d16777020046760a96bcb3110307791273a15eca0769e83936f5ed2eadf3bdd","first_seen":"2026-07-19T05:14:47.203756Z","last_seen":"2026-07-20T11:18:08.365365Z","times_seen":4,"resource_available":true,"data":null}},"time_used":56,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":56,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"infosec_yara","sensor_type":"yara","title":"YARAhub by abuse.ch","description":"YARAhub by abuse.ch","scan_date":"2026-07-20","alert":"Detects file containing Telegram Bot API","trigger":"secured.quicktent.org/qr/main.js","verdict":"malware","severity":"medium","comment":"","link":"https://yaraify.abuse.ch/yarahub/","meta":{"author":"rectifyq","date":"2024-09-07","description":"Detects file containing Telegram Bot API","rule":"telegram_bot_api","yarahub_author_twitter":"@_rectifyq","yarahub_license":"CC0 1.0","yarahub_reference_md5":"9DA48D34DC999B4E05E0C6716A3B3B83","yarahub_rule_matching_tlp":"TLP:WHITE","yarahub_rule_sharing_tlp":"TLP:WHITE","yarahub_uuid":"58c9e4fe-d1e9-46ed-913c-dba943ac16d6"}},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-07-20","alert":"Sinkholed","trigger":"secured.quicktent.org","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-07-20","alert":"Sinkholed","trigger":"secured.quicktent.org","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":[{"sensor_name":"urlquery","alert":"Suspicious - Suspicious Javascript code","verdict":"suspicious","severity":"medium","comment":"","tags":["suspicious"],"meta":null}]}},{"url":{"schema":"https","addr":"secured.quicktent.org/","fqdn":"secured.quicktent.org","domain":"quicktent.org","tld":"org"},"ip":{"addr":"91.229.239.28","port":443,"asn":200019,"as":"Alexhost Srl","country":"Moldova","country_code":"MD"},"is_navigation_request":true,"resource_type":"document","requested_by":"","date":"2026-07-20T11:17:40.596Z","timestamp":1784546260596,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_CHACHA20_POLY1305_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"secured.quicktent.org","organization":""},"issuer":{"commonName":"E8","organization":"Let's Encrypt"},"validity":{"start":"Wed, 27 May 2026 12:36:13 GMT","end":"Tue, 25 Aug 2026 12:36:12 GMT"},"fingerprint":{"sha1":"E9:2B:89:7D:76:01:92:60:93:7F:4B:03:D4:4E:10:0C:C0:72:79:2A","sha256":"55:6C:9E:C2:F2:99:90:6C:0B:94:65:55:00:F1:0D:88:44:6A:02:E7:CC:09:03:AA:D1:29:6D:9D:8C:B2:BA:14"}}},"request":{"raw":"GET / HTTP/1.1\r\nHost: secured.quicktent.org\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nUpgrade-Insecure-Requests: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: document\r\nSec-Fetch-Mode: navigate\r\nSec-Fetch-Site: none\r\nPriority: u=0, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nalt-svc: h3=\":443\"; ma=2592000\r\ncontent-encoding: gzip\r\ncontent-type: text/html; charset=utf-8\r\netag: \"djx030vlld4r7jb-gzip\"\r\nlast-modified: Mon, 13 Jul 2026 00:01:15 GMT\r\nreferrer-policy: strict-origin-when-cross-origin\r\nserver: Caddy\r\nvary: Accept-Encoding\r\nx-content-type-options: nosniff\r\ncontent-length: 3207\r\ndate: Mon, 20 Jul 2026 11:17:40 GMT\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Caddy","description":"","website":"https://caddyserver.com","common_platform_enumeration":"cpe:2.3:a:caddyserver:caddy:*:*:*:*:*:*:*:*","icon":"caddy.svg","categories":["Web servers"]}],"data":{"size":9767,"size_decoded":3594,"mime_type":"text/html; charset=utf-8","magic":"HTML document, Unicode text, UTF-8 text","md5":"9146bb26b27380b77fde37c0857805f8","sha1":"e61bf7912397d9b19612e35040abb5fb6006c5b1","sha256":"670458db3010e0d16a5a79a00c20f7176686c55ed160db770204a593024562b8","sha512":"6651f6b0968c18f02f6e222c15f13f2a5d05763478925eb3b7ed69494f2d902c08cb87b646ead3bd838910240f11f8d9004fa5cf059213e43178bef33e553cd1","ssdeep":"192:vW0I4hYlvYqNApDaRfbDvvDT2cTZX3gTX30DWeNo2QoGQoApJDTbTZYRDfAHfYgF:vA4MqYf2ogTH+NQoGQoApZW2ggA4ccfx","tlshash":"d612e75a5cd351232937e23d5b9fa208793aea1b010bce257f4c8309afd512547b6bec","first_seen":"2026-07-19T05:14:47.204813Z","last_seen":"2026-07-20T11:18:08.366217Z","times_seen":4,"resource_available":true,"data":null}},"time_used":393,"timings":{"blocked":-1,"dns":223,"connect":52,"send":0,"wait":55,"receive":0,"ssl":62},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-07-20","alert":"Sinkholed","trigger":"secured.quicktent.org","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-07-20","alert":"Sinkholed","trigger":"secured.quicktent.org","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}}]}