{"report_id":"a6c529fa-0bdd-4e9c-838d-408dcd8c5ca8","version":0,"status":"done","tags":[],"date":"2026-10-13T16:08:39Z","url":{"schema":"http","addr":"rhdq.cc/","fqdn":"rhdq.cc","domain":"rhdq.cc","tld":"cc"},"ip":{"addr":"141.11.85.15","port":0,"asn":63902,"as":"SHINE TELECOM CO., LTD.","country":"United States","country_code":"US"},"final":{"url":{"schema":"https","addr":"rhdq.cc/log","fqdn":"rhdq.cc","domain":"rhdq.cc","tld":"cc"},"title":"RH","dom":{"size":2496,"mime_type":"text/html; charset=utf-8","magic":"HTML document, ASCII text, with very long lines (1880)","md5":"ddcca3553b50ab505dcd7799eab54f9d","sha1":"7873d9a8a42a1f5d4a0a05b1f49b83ee518baf91","sha256":"e45f11d41037605d08b697fa063737fd6f06e5e7035cbc8dd4efa2a5d040acae","sha512":"583902fcbe5f96e8a82af9f3d9479c679dcb796bd9cf8eaf3bd566a128ca534ed08efd491b10e69903ad6d8d4ec1ad4d8200e9c9eeff2ef801295a16d02ba0b6","ssdeep":"","tlshash":"88517602200059fa2127c6c69492fe1ca48eeb07c5c444caf7a605b94ff3df6e4862b5","dom_hash":"domhash5ffee304a8b97457a2219f78d30c63b6","first_seen":"2026-10-13T15:53:19.597238Z","last_seen":"2026-10-13T16:08:47.462507Z","times_seen":2,"resource_available":false,"data":null}},"submit":{"url":{"schema":"http","addr":"rhdq.cc/","fqdn":"rhdq.cc","domain":"rhdq.cc","tld":"cc"},"ip":{"addr":"141.11.85.15","port":0,"asn":63902,"as":"SHINE TELECOM CO., LTD.","country":"United States","country_code":"US"},"tags":null,"meta":null},"settings":{"access":"public","device_type":"desktop","expires_at":"2027-11-17T16:08:39Z","useragent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0","referer":"","cookies":null,"exit_node":"qguvgzjxzsgb3vs"},"stats":{"alert_count":{"ids":0,"urlquery":0,"analyzer":2}},"detection":{"ids":null,"analyzer":[{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-10-13","alert":"Phishing Block","trigger":"rhdq.cc","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-10-13","alert":"Sinkholed","trigger":"rhdq.cc","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null},"summary":[{"fqdn":"rhdq.cc","ip":{"addr":"141.11.85.15","port":443,"asn":397630,"as":"AS-BLAZINGSEO","country":"Brazil","country_code":"BR"},"domain_registered":"2026-10-08","domain_rank":0,"first_seen":"2026-10-13T15:53:13.293765Z","last_seen":"2026-10-13T15:53:13.293765Z","alert_count":12,"request_count":6,"received_data":9958225,"sent_data":2868,"comment":"","tags":null,"fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}]}],"files":null,"artifacts":{"windows_shortcuts":null,"files":null,"telegram":null,"pdfs":null,"clipboard":null},"sensors":{"ids":null,"analyzer":null,"urlquery":null},"javascript":{"script":[{"url":{"schema":"https","addr":"rhdq.cc/assets/index-BuTmGux5.js","fqdn":"rhdq.cc","domain":"rhdq.cc","tld":"cc"},"ip":{"addr":"141.11.85.15","port":443,"asn":397630,"as":"AS-BLAZINGSEO","country":"Brazil","country_code":"BR"},"introduction_type":"scriptElement","is_inline":false,"md5":"4937355cdda999b4282627d5266b8a4d","sha1":"8af61ef443879e89d854dc7a3136f227d47173eb","sha256":"eb67ba800f77e2a29846b3145efa7187beb474e0c127802244d78ce528ae69f7","sha512":"4e634f3f237dd0c99a2692a3734128106eb1780eeb1ef1e5fc2a17b95b1b3a510bd91194e1c5484324bd9c6d66352273a16b31a1d84f5a19189acc624862e196","ssdeep":"49152:2yMer5GDQdv+2WrNWYxTCO3yZh1F2Y8c5VJfCfkupFCpGk9BzQJVc2EnqdwnFXka:rZlzQ5dwlkrrfGL1","tlshash":"0a066cc8b2a5b06543a655e4107f0007f33d7a5d640884a8f2addcfa3ab9d49927bf7c","size":3922093,"data":"","first_seen":"2026-10-13T15:53:19.618607Z","last_seen":"2026-10-13T16:08:47.46933Z","times_seen":2,"alerts":{"ids":null,"analyzer":null,"urlquery":null}}],"eval":null,"write":null,"console":[{"level":"info","text":"Download the React DevTools for a better development experience: https://reactjs.org/link/react-devtools","filename":"https://rhdq.cc/assets/index-BuTmGux5.js","line_number":291,"column_number":10508},{"level":"warn","text":"MetaMaskSDK: No active provider found","filename":"https://rhdq.cc/assets/index-BuTmGux5.js","line_number":299,"column_number":87233},{"level":"error","text":"JSON.parse: unexpected end of data at line 1 column 1 of the JSON data","filename":"https://rhdq.cc/assets/index-BuTmGux5.js","line_number":368,"column_number":100628},{"level":"error","text":"JSON.parse: unexpected end of data at line 1 column 1 of the JSON data","filename":"https://rhdq.cc/assets/index-BuTmGux5.js","line_number":368,"column_number":100956},{"level":"log","text":"map[actor:server1.conn0.watcher17.process7//obj22 class:Object extensible:true frozen:false isError:false ownPropertyLength:25 preview:map[kind:Object ownProperties:map[_events:map[configurable:true enumerable:true value:map[actor:server1.conn0.watcher17.process7//obj23 class:Object extensible:true frozen:false isError:false ownPropertyLength:2 sealed:false type:object] writable:true] _eventsCount:map[configurable:true enumerable:true value:2 writable:true] _handleAccountsChanged:map[configurable:true enumerable:true value:map[actor:server1.conn0.watcher17.process7//obj26 class:BoundFunctionObject extensible:true frozen:false isError:false ownPropertyLength:2 sealed:false type:object] writable:true] _handleChainChanged:map[configurable:true enumerable:true value:map[actor:server1.conn0.watcher17.process7//obj28 class:BoundFunctionObject extensible:true frozen:false isError:false ownPropertyLength:2 sealed:false type:object] writable:true] _handleConnect:map[configurable:true enumerable:true value:map[actor:server1.conn0.watcher17.process7//obj27 class:BoundFunctionObject extensible:true frozen:false isError:false ownPropertyLength:2 sealed:false type:object] writable:true] _handleDisconnect:map[configurable:true enumerable:true value:map[actor:server1.conn0.watcher17.process7//obj29 class:BoundFunctionObject extensible:true frozen:false isError:false ownPropertyLength:2 sealed:false type:object] writable:true] _log:map[configurable:true enumerable:true value:map[actor:server1.conn0.watcher17.process7//obj24 class:Console extensible:true frozen:false isError:false ownPropertyLength:23 sealed:false type:object] writable:true] _maxListeners:map[configurable:true enumerable:true value:100 writable:true] _state:map[configurable:true enumerable:true value:map[actor:server1.conn0.watcher17.process7//obj25 class:Object extensible:true frozen:false isError:false ownPropertyLength:5 sealed:false type:object] writable:true] domain:map[configurable:true enumerable:true value:map[type:null] writable:true]] ownPropertiesLength:25] sealed:false type:object]","filename":"https://rhdq.cc/assets/index-BuTmGux5.js","line_number":314,"column_number":26072},{"level":"error","text":"JSON.parse: unexpected end of data at line 1 column 1 of the JSON data","filename":"https://rhdq.cc/assets/index-BuTmGux5.js","line_number":368,"column_number":100628},{"level":"error","text":"JSON.parse: unexpected end of data at line 1 column 1 of the JSON data","filename":"https://rhdq.cc/assets/index-BuTmGux5.js","line_number":368,"column_number":100956}]},"http":[{"url":{"schema":"https","addr":"rhdq.cc/assets/header_logo-BUvlJa5m.png","fqdn":"rhdq.cc","domain":"rhdq.cc","tld":"cc"},"ip":{"addr":"141.11.85.15","port":443,"asn":397630,"as":"AS-BLAZINGSEO","country":"Brazil","country_code":"BR"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://rhdq.cc/","date":"2026-10-13T16:08:02.814Z","timestamp":1791907682814,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"rhdq.cc","organization":""},"issuer":{"commonName":"YR1","organization":"Let's Encrypt"},"validity":{"start":"Thu, 08 Oct 2026 11:40:59 GMT","end":"Wed, 06 Jan 2027 11:40:58 GMT"},"fingerprint":{"sha1":"BF:46:C8:02:A5:81:73:CF:54:6A:21:75:EF:A0:8A:C0:55:04:40:C6","sha256":"E2:E4:29:F9:C8:71:45:F9:3A:13:C0:40:C5:75:CD:C1:51:BC:52:03:13:21:1B:4F:EC:34:7C:AB:FC:70:57:61"}}},"request":{"raw":"GET /assets/header_logo-BUvlJa5m.png HTTP/1.1\r\nHost: rhdq.cc\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://rhdq.cc/log\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=4, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nserver: nginx\r\ndate: Tue, 13 Oct 2026 16:08:02 GMT\r\ncontent-type: image/png\r\nlast-modified: Fri, 09 Oct 2026 03:11:38 GMT\r\nvary: Accept-Encoding\r\netag: W/\"6ac85b6a-122b\"\r\nexpires: Thu, 12 Nov 2026 16:08:02 GMT\r\ncache-control: max-age=2592000\r\nstrict-transport-security: max-age=31536000\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":4651,"size_decoded":4825,"mime_type":"image/png","magic":"PNG image data, 292 x 76, 8-bit/color RGBA, non-interlaced","md5":"92a20d1d502939c93ae7d6d32503043b","sha1":"a7b68ed2bf2ac21be68e7739ae7fdca146c419a7","sha256":"b62c7cb334fdfb52482668b69e9d54e87fcba11a8b1d3ee2eaa203e8ef5164f4","sha512":"586872510f42fd2585befea809698fbbb3f940a3e919a222a83c0ed5ae86b5fd2a78e09d76d710e0f2f325aaf6090c77d2e772bd6ffd14d006c90fb80dfc6473","ssdeep":"96:SjPxzRk6UH1nRcEg9i+akdKHEKqWvyzVuk9vXAo9ru6GXrS:SjPde6UH1Y4kDWPkNA8rHGX+","tlshash":"21a18d535e56c37383a7fc600075648b57e804fe27e686442e6ad898cf1e349cd1d539","first_seen":"2026-10-13T15:53:19.599889Z","last_seen":"2026-10-13T16:08:47.463368Z","times_seen":2,"resource_available":false,"data":null}},"time_used":2321,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":2321,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-10-13","alert":"Phishing Block","trigger":"rhdq.cc","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-10-13","alert":"Sinkholed","trigger":"rhdq.cc","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"rhdq.cc/","fqdn":"rhdq.cc","domain":"rhdq.cc","tld":"cc"},"ip":{"addr":"141.11.85.15","port":443,"asn":397630,"as":"AS-BLAZINGSEO","country":"Brazil","country_code":"BR"},"is_navigation_request":true,"resource_type":"document","requested_by":"","date":"2026-10-13T16:07:57.986Z","timestamp":1791907677986,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"rhdq.cc","organization":""},"issuer":{"commonName":"YR1","organization":"Let's Encrypt"},"validity":{"start":"Thu, 08 Oct 2026 11:40:59 GMT","end":"Wed, 06 Jan 2027 11:40:58 GMT"},"fingerprint":{"sha1":"BF:46:C8:02:A5:81:73:CF:54:6A:21:75:EF:A0:8A:C0:55:04:40:C6","sha256":"E2:E4:29:F9:C8:71:45:F9:3A:13:C0:40:C5:75:CD:C1:51:BC:52:03:13:21:1B:4F:EC:34:7C:AB:FC:70:57:61"}}},"request":{"raw":"GET / HTTP/1.1\r\nHost: rhdq.cc\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nUpgrade-Insecure-Requests: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: document\r\nSec-Fetch-Mode: navigate\r\nSec-Fetch-Site: none\r\nPriority: u=0, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nserver: nginx\r\ndate: Tue, 13 Oct 2026 16:07:58 GMT\r\ncontent-type: text/html\r\ncontent-length: 681\r\nlast-modified: Fri, 09 Oct 2026 03:11:38 GMT\r\netag: \"6ac85b6a-2a9\"\r\nstrict-transport-security: max-age=31536000\r\naccept-ranges: bytes\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":681,"size_decoded":949,"mime_type":"text/html","magic":"HTML document, ASCII text","md5":"b4d2c2584c01fb904f2e1c48f607273c","sha1":"20b8a05e806acf21aee200a855786eb0900e4a07","sha256":"7a2fcedf5fd45b61dcccad7d829237e9402955f507bd67de56463377c2538fba","sha512":"78ad3457445a2bef6af7c0ce9870d237d75cbaa856c144f7a135c38981e590cc831238a6af1baa5a5930b98142aa7630160093fee72440893687173848a85b72","ssdeep":"","tlshash":"7801494358a0cd08532482246dc1f5088a67e7978719a8487aef51ad4fc0e85caef1a4","first_seen":"2026-10-13T15:53:19.602108Z","last_seen":"2026-10-13T16:08:47.464081Z","times_seen":2,"resource_available":true,"data":null}},"time_used":935,"timings":{"blocked":-1,"dns":89,"connect":210,"send":0,"wait":210,"receive":0,"ssl":426},"alerts":{"ids":null,"analyzer":[{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-10-13","alert":"Phishing Block","trigger":"rhdq.cc","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-10-13","alert":"Sinkholed","trigger":"rhdq.cc","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"rhdq.cc/assets/index-BuTmGux5.js","fqdn":"rhdq.cc","domain":"rhdq.cc","tld":"cc"},"ip":{"addr":"141.11.85.15","port":443,"asn":397630,"as":"AS-BLAZINGSEO","country":"Brazil","country_code":"BR"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://rhdq.cc/","date":"2026-10-13T16:07:59.133Z","timestamp":1791907679133,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"rhdq.cc","organization":""},"issuer":{"commonName":"YR1","organization":"Let's Encrypt"},"validity":{"start":"Thu, 08 Oct 2026 11:40:59 GMT","end":"Wed, 06 Jan 2027 11:40:58 GMT"},"fingerprint":{"sha1":"BF:46:C8:02:A5:81:73:CF:54:6A:21:75:EF:A0:8A:C0:55:04:40:C6","sha256":"E2:E4:29:F9:C8:71:45:F9:3A:13:C0:40:C5:75:CD:C1:51:BC:52:03:13:21:1B:4F:EC:34:7C:AB:FC:70:57:61"}}},"request":{"raw":"GET /assets/index-BuTmGux5.js HTTP/1.1\r\nHost: rhdq.cc\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://rhdq.cc/\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nserver: nginx\r\ndate: Tue, 13 Oct 2026 16:07:59 GMT\r\ncontent-type: application/javascript\r\nlast-modified: Fri, 09 Oct 2026 03:11:38 GMT\r\nvary: Accept-Encoding\r\netag: W/\"6ac85b6a-3bd8ad\"\r\nexpires: Wed, 14 Oct 2026 04:07:59 GMT\r\ncache-control: max-age=43200\r\nstrict-transport-security: max-age=31536000\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":3922093,"size_decoded":1247953,"mime_type":"application/javascript","magic":"JavaScript source, ASCII text, with very long lines (44125)","md5":"cc813dfd5b8d65e83d21a15d71bb284b","sha1":"140fa7db377437b6f8fefc28e4a3339086e214bd","sha256":"6ec1762b0458eb1a8f791390fd86b36f3ce66d8077e4e9c61ed7932d018c66a9","sha512":"91a43d02d408664ee029b1b25e36d1a4794002a88f8531cf57f0cde1608bb18a9219c127ef696afc76096f1820d40cd4e759090725411b6a05aa888b9f8b1332","ssdeep":"24576:2yMer5GDQdzT+2WrNWYxTCod3yZh1F2Y8Xs00VJfC7xxku/bV:2yMer5GDQdv+2WrNWYxTCO3yZh1F2Y8T","tlshash":"1e253aa4b595b47d83ba85c4546a0401b32d1bccb40988f0f5becd69266bd21e2bff7c","first_seen":"2026-10-13T15:53:19.604587Z","last_seen":"2026-10-13T16:08:47.464744Z","times_seen":2,"resource_available":true,"data":null}},"time_used":429,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":429,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-10-13","alert":"Phishing Block","trigger":"rhdq.cc","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-10-13","alert":"Sinkholed","trigger":"rhdq.cc","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"rhdq.cc/assets/index--PnRigvv.css","fqdn":"rhdq.cc","domain":"rhdq.cc","tld":"cc"},"ip":{"addr":"141.11.85.15","port":443,"asn":397630,"as":"AS-BLAZINGSEO","country":"Brazil","country_code":"BR"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://rhdq.cc/","date":"2026-10-13T16:07:59.135Z","timestamp":1791907679135,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"rhdq.cc","organization":""},"issuer":{"commonName":"YR1","organization":"Let's Encrypt"},"validity":{"start":"Thu, 08 Oct 2026 11:40:59 GMT","end":"Wed, 06 Jan 2027 11:40:58 GMT"},"fingerprint":{"sha1":"BF:46:C8:02:A5:81:73:CF:54:6A:21:75:EF:A0:8A:C0:55:04:40:C6","sha256":"E2:E4:29:F9:C8:71:45:F9:3A:13:C0:40:C5:75:CD:C1:51:BC:52:03:13:21:1B:4F:EC:34:7C:AB:FC:70:57:61"}}},"request":{"raw":"GET /assets/index--PnRigvv.css HTTP/1.1\r\nHost: rhdq.cc\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://rhdq.cc/\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=2\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nserver: nginx\r\ndate: Tue, 13 Oct 2026 16:07:59 GMT\r\ncontent-type: text/css\r\nlast-modified: Fri, 09 Oct 2026 03:11:38 GMT\r\nvary: Accept-Encoding\r\netag: W/\"6ac85b6a-5fdef\"\r\nexpires: Wed, 14 Oct 2026 04:07:59 GMT\r\ncache-control: max-age=43200\r\nstrict-transport-security: max-age=31536000\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":392687,"size_decoded":58112,"mime_type":"text/css","magic":"Unicode text, UTF-8 text, with very long lines (65528), with no line terminators","md5":"45eaae91644f451eb4ea798eff1971d8","sha1":"dec9984246fe346cd395246eeba50a9a42fcfac4","sha256":"c5c5f1ee4c5dcb26b72bf3e055b2a45732d64bcea45c72378e726e0ac1ddb741","sha512":"58b8f3e09453e062d9846e1b2336d3e62943f09483148a62f3c584fac7ca9fa6d37ef1fd4d9fff03e0c84f807787d51399c47176895a06e73d13be2b935a9306","ssdeep":"6144:gSI0MGuhT7M8EcH7pTVkad36fFhsSIcO3jVMa/4uta78+B36JL7u1A+wMif/x0rU:749b","tlshash":"8284d655fb13253b2827d67d79c0e9986f14df92c9228bb6fa40a40495c3de212e3d2f","first_seen":"2026-10-13T15:53:19.607039Z","last_seen":"2026-10-13T16:08:47.465414Z","times_seen":2,"resource_available":true,"data":null}},"time_used":901,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":901,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-10-13","alert":"Phishing Block","trigger":"rhdq.cc","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-10-13","alert":"Sinkholed","trigger":"rhdq.cc","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"rhdq.cc/favicon.ico","fqdn":"rhdq.cc","domain":"rhdq.cc","tld":"cc"},"ip":{"addr":"141.11.85.15","port":443,"asn":397630,"as":"AS-BLAZINGSEO","country":"Brazil","country_code":"BR"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://rhdq.cc/","date":"2026-10-13T16:08:01.439Z","timestamp":1791907681439,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"rhdq.cc","organization":""},"issuer":{"commonName":"YR1","organization":"Let's Encrypt"},"validity":{"start":"Thu, 08 Oct 2026 11:40:59 GMT","end":"Wed, 06 Jan 2027 11:40:58 GMT"},"fingerprint":{"sha1":"BF:46:C8:02:A5:81:73:CF:54:6A:21:75:EF:A0:8A:C0:55:04:40:C6","sha256":"E2:E4:29:F9:C8:71:45:F9:3A:13:C0:40:C5:75:CD:C1:51:BC:52:03:13:21:1B:4F:EC:34:7C:AB:FC:70:57:61"}}},"request":{"raw":"GET /favicon.ico HTTP/1.1\r\nHost: rhdq.cc\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://rhdq.cc/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=6\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nserver: nginx\r\ndate: Tue, 13 Oct 2026 16:08:01 GMT\r\ncontent-type: image/x-icon\r\ncontent-length: 1231\r\nlast-modified: Sat, 16 Nov 2024 18:28:46 GMT\r\netag: \"6738e45e-4cf\"\r\nstrict-transport-security: max-age=31536000\r\naccept-ranges: bytes\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":1231,"size_decoded":1503,"mime_type":"image/x-icon","magic":"MS Windows icon resource - 1 icon, 32x32 with PNG image data, 32 x 32, 8-bit/color RGBA, non-interlaced, 32 bits/pixel","md5":"ca432992b2392637cec5e1b2d71afbd4","sha1":"e78df093388592b7f6149f0206923418fcb8b9ee","sha256":"ff79c620b09f774d6a5a7058b1e76dfbb04fa6cc88061362f1ff4ce56f89a833","sha512":"737cc074270bbba53c3a383d31b3e17c8321a0c8429e3e10c2101d14617caec4c58eaf12e2bd9dcad77a53ed830b2e899a9b879de0f20751e4b03527fc532098","ssdeep":"","tlshash":"eb21b7b9891eca36b9592e22b70946a79a5a2dd321112854e357f8d3840a041fd943ed","first_seen":"2025-06-23T17:21:59.747094Z","last_seen":"2026-10-13T16:08:47.466174Z","times_seen":3,"resource_available":false,"data":null}},"time_used":619,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":619,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-10-13","alert":"Sinkholed","trigger":"rhdq.cc","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-10-13","alert":"Phishing Block","trigger":"rhdq.cc","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"rhdq.cc/assets/logo_yuan-CvXRjEF6.gif","fqdn":"rhdq.cc","domain":"rhdq.cc","tld":"cc"},"ip":{"addr":"141.11.85.15","port":443,"asn":397630,"as":"AS-BLAZINGSEO","country":"Brazil","country_code":"BR"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://rhdq.cc/","date":"2026-10-13T16:08:02.798Z","timestamp":1791907682798,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"rhdq.cc","organization":""},"issuer":{"commonName":"YR1","organization":"Let's Encrypt"},"validity":{"start":"Thu, 08 Oct 2026 11:40:59 GMT","end":"Wed, 06 Jan 2027 11:40:58 GMT"},"fingerprint":{"sha1":"BF:46:C8:02:A5:81:73:CF:54:6A:21:75:EF:A0:8A:C0:55:04:40:C6","sha256":"E2:E4:29:F9:C8:71:45:F9:3A:13:C0:40:C5:75:CD:C1:51:BC:52:03:13:21:1B:4F:EC:34:7C:AB:FC:70:57:61"}}},"request":{"raw":"GET /assets/logo_yuan-CvXRjEF6.gif HTTP/1.1\r\nHost: rhdq.cc\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://rhdq.cc/login\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nserver: nginx\r\ndate: Tue, 13 Oct 2026 16:08:02 GMT\r\ncontent-type: image/gif\r\nlast-modified: Fri, 09 Oct 2026 03:11:38 GMT\r\nvary: Accept-Encoding\r\netag: W/\"6ac85b6a-55fb7d\"\r\nexpires: Thu, 12 Nov 2026 16:08:02 GMT\r\ncache-control: max-age=2592000\r\nstrict-transport-security: max-age=31536000\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":5634941,"size_decoded":5591890,"mime_type":"image/gif","magic":"GIF image data, version 89a, 1280 x 1280","md5":"cb597f7176dd999284f1d6322804405c","sha1":"3f03b2a9f85688b412bc562138021fe457320021","sha256":"8ac29c909f937e4cc7d347539a8e0cc5e680455630fa2ed6797f88d6b63d7854","sha512":"376c8edffbc7df74867d2f487a953e5e019d75667a90a9d8733ac525657941d5a3b9cdbb63a0b980610f4280bc372caeea736409d8f6585b06ec025bee0134be","ssdeep":"24576:mzPUBqutBjUegSaAFSH+ou3UVIq/+DJH5dMu/dT:gUBnvLFa5H+3EVIqUbB","tlshash":"11252372cc7ac0c26e3a786c45e272604f61d4ed35e57a34239cefac98d752ea4f4885","first_seen":"2026-10-13T15:53:19.614209Z","last_seen":"2026-10-13T16:08:47.466724Z","times_seen":2,"resource_available":false,"data":null}},"time_used":236,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":236,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-10-13","alert":"Phishing Block","trigger":"rhdq.cc","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-10-13","alert":"Sinkholed","trigger":"rhdq.cc","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}}]}