{"report_id":"a6e49158-1e43-4cf2-a618-394969bb8b27","version":6,"status":"done","tags":["phishing","kali365","aitm"],"date":"2026-04-27T14:21:58Z","url":{"schema":"https","addr":"agrrements-contract.onrender.com/","fqdn":"agrrements-contract.onrender.com","domain":"agrrements-contract.onrender.com","tld":"onrender.com"},"ip":{"addr":"216.24.57.251","port":0,"asn":397273,"as":"RENDER","country":"United States","country_code":"US"},"final":{"url":{"schema":"https","addr":"flow-share-qlpw.inbox-share.workers.dev/l/_ERG-afRfu8","fqdn":"flow-share-qlpw.inbox-share.workers.dev","domain":"inbox-share.workers.dev","tld":"workers.dev"},"title":"Payment Receipt - OneDrive","dom":{"size":17960,"mime_type":"text/html; charset=utf-8","magic":"JavaScript source, Unicode text, UTF-8 text, with very long lines (7529)","md5":"be88567587a6e4a3d83706f321437adf","sha1":"f84c528c2a97c4251e0d1b2137b5b4ec56b63935","sha256":"d92c3cbb0cfe7fd3ad77f3ff181d83bf0f0d2e34bc36d2ed4cbad9c78bdc6f62","sha512":"b4db069579fc4f9778e3faadf54278796ff3bd4697d9ddc7f6581e501de8bcb30c5518ecfa915788795c5371702c5217ab22c3e114a5aee0148ed6511d0d9ff6","ssdeep":"384:hAUiFticNp+usxYnSdKIypdr0NbqPixuGbPcFej1mQs17sxGI:fiFticNp+uPn4CW9yguGbPcFejO17sx7","tlshash":"4a823b6ab0e8443fb353e283ec52178a75118e97ff5fae82469d409d05caeb9c377094","dom_hash":"domhashdae1396cb0d0f60d53777bd3dd233d6f","first_seen":"2026-04-27T14:22:02.167029Z","last_seen":"2026-04-27T14:22:02.167029Z","times_seen":1,"resource_available":false,"data":null}},"submit":{"url":{"schema":"https","addr":"agrrements-contract.onrender.com/","fqdn":"agrrements-contract.onrender.com","domain":"agrrements-contract.onrender.com","tld":"onrender.com"},"ip":{"addr":"216.24.57.251","port":0,"asn":397273,"as":"RENDER","country":"United States","country_code":"US"},"tags":["openphish"],"meta":null},"settings":{"access":"public","device_type":"desktop","expires_at":"2027-06-01T14:21:58Z","useragent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0","referer":"","cookies":null,"exit_node":"z0yflva4pidy47h"},"stats":{"alert_count":{"ids":2,"urlquery":2,"analyzer":5}},"detection":{"ids":[{"sensor_name":"suricata","title":"Suricata IDS","description":"Suricata /w Emerging Threats Pro","date":"2026-04-27T14:21:35Z","timestamp":1777299695,"ip_dst":{"addr":"216.24.57.7","port":443,"asn":397273,"as":"RENDER","country":"United States","country_code":"US"},"ip_src":{"addr":"Client IP","port":39168,"asn":0,"as":"","country":"","country_code":"zz"},"severity":"low","alert":"ET INFO Observed Online Application Hosting Domain (onrender .com in TLS SNI)","source":"{\"timestamp\":\"2026-04-27T14:21:35.785074+0000\",\"flow_id\":851015304734378,\"in_iface\":\"br-31613a7ed13b\",\"event_type\":\"alert\",\"src_ip\":\"172.18.0.11\",\"src_port\":39168,\"dest_ip\":\"216.24.57.7\",\"dest_port\":443,\"proto\":\"TCP\",\"tx_id\":0,\"alert\":{\"action\":\"allowed\",\"gid\":1,\"signature_id\":2050129,\"rev\":1,\"signature\":\"ET INFO Observed Online Application Hosting Domain (onrender .com in TLS SNI)\",\"category\":\"Misc activity\",\"severity\":3,\"metadata\":{\"attack_target\":[\"Client_Endpoint\"],\"confidence\":[\"High\"],\"created_at\":[\"2024_01_17\"],\"deployment\":[\"Perimeter\"],\"signature_severity\":[\"Informational\"],\"updated_at\":[\"2024_01_17\"]}},\"tls\":{\"sni\":\"agrrements-contract.onrender.com\",\"version\":\"TLS 1.3\",\"ja3\":{\"hash\":\"0faf2a91198d40dbd58b9308f3fca2fd\",\"string\":\"771,4865-4867-4866-49195-49199-52393-52392-49196-49200-49171-49172-156-157-47-53,0-23-65281-10-11-16-5-34-51-43-13-28-65037,29-23-24-25-256-257,0\"},\"ja3s\":{\"hash\":\"eb1d94daa7e0344597e756a1fb6e7054\",\"string\":\"771,4865,51-43\"}},\"app_proto\":\"tls\",\"flow\":{\"pkts_toserver\":4,\"pkts_toclient\":5,\"bytes_toserver\":934,\"bytes_toclient\":3523,\"start\":\"2026-04-27T14:21:35.779946+0000\"}}"},{"sensor_name":"suricata","title":"Suricata IDS","description":"Suricata /w Emerging Threats Pro","date":"2026-04-27T14:21:41Z","timestamp":1777299701,"ip_dst":{"addr":"104.21.26.231","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"ip_src":{"addr":"Client IP","port":40950,"asn":0,"as":"","country":"","country_code":"zz"},"severity":"low","alert":"ET INFO Observed Cloudflare workers.dev Domain in TLS SNI","source":"{\"timestamp\":\"2026-04-27T14:21:41.278412+0000\",\"flow_id\":416819881254623,\"in_iface\":\"br-31613a7ed13b\",\"event_type\":\"alert\",\"src_ip\":\"172.18.0.11\",\"src_port\":40950,\"dest_ip\":\"104.21.26.231\",\"dest_port\":443,\"proto\":\"TCP\",\"tx_id\":0,\"alert\":{\"action\":\"allowed\",\"gid\":1,\"signature_id\":2051768,\"rev\":1,\"signature\":\"ET INFO Observed Cloudflare workers.dev Domain in TLS SNI\",\"category\":\"Misc activity\",\"severity\":3,\"metadata\":{\"affected_product\":[\"Any\"],\"attack_target\":[\"Client_Endpoint\"],\"confidence\":[\"High\"],\"created_at\":[\"2024_03_22\"],\"deployment\":[\"Perimeter\"],\"malware_family\":[\"Cloudflare_Workers\"],\"performance_impact\":[\"Low\"],\"signature_severity\":[\"Informational\"],\"tag\":[\"Cloudflare_Workers\"],\"updated_at\":[\"2024_03_22\"]}},\"tls\":{\"sni\":\"flow-share-qlpw.inbox-share.workers.dev\",\"version\":\"TLS 1.3\",\"ja3\":{\"hash\":\"0faf2a91198d40dbd58b9308f3fca2fd\",\"string\":\"771,4865-4867-4866-49195-49199-52393-52392-49196-49200-49171-49172-156-157-47-53,0-23-65281-10-11-16-5-34-51-43-13-28-65037,29-23-24-25-256-257,0\"},\"ja3s\":{\"hash\":\"eb1d94daa7e0344597e756a1fb6e7054\",\"string\":\"771,4865,51-43\"}},\"app_proto\":\"tls\",\"flow\":{\"pkts_toserver\":4,\"pkts_toclient\":4,\"bytes_toserver\":941,\"bytes_toclient\":2723,\"start\":\"2026-04-27T14:21:41.270047+0000\"}}"}],"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-04-27","alert":"Sinkholed","trigger":"api.kali365.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-04-27","alert":"Sinkholed","trigger":"api.kali365.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-04-27","alert":"Sinkholed","trigger":"api.kali365.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-04-27","alert":"Sinkholed","trigger":"api.kali365.xyz","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"cira_dns","sensor_type":"DNS","title":"CIRA Canadian Shield DNS","description":"CIRA Canadian Shield DNS","scan_date":"2026-04-27","alert":"Sinkholed","trigger":"agrrements-contract.onrender.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cira.ca/en/canadian-shield/","meta":null}],"urlquery":[{"sensor_name":"urlquery","alert":"Phishing - Kali365 Phishing Kit","verdict":"phishing","severity":"high","comment":"","tags":["phishing","kali365","aitm"],"meta":null},{"sensor_name":"urlquery","alert":"Phishing - Kali365 Phishing Kit","verdict":"phishing","severity":"high","comment":"","tags":["phishing","kali365","aitm"],"meta":null}]},"summary":[{"fqdn":"flow-share-qlpw.inbox-share.workers.dev","ip":{"addr":"104.21.26.231","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"domain_registered":"unknown","domain_rank":0,"first_seen":"2026-04-24T08:02:21.82619Z","last_seen":"2026-04-24T08:02:21.82619Z","alert_count":3,"request_count":3,"received_data":23214,"sent_data":1501,"comment":"","tags":null,"fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}]},{"fqdn":"upload.wikimedia.org","ip":{"addr":"185.15.59.240","port":443,"asn":14907,"as":"WIKIMEDIA","country":"United States","country_code":"US"},"domain_registered":"2003-03-16","domain_rank":4329,"first_seen":"2012-05-21T09:39:45Z","last_seen":"2026-04-27T11:12:42.550128Z","alert_count":0,"request_count":1,"received_data":27105,"sent_data":528,"comment":"","tags":null,"fingerprints":[{"name":"Envoy","description":"Envoy is an open-source edge and service proxy, designed for cloud-native applications.","website":"https://www.envoyproxy.io/","common_platform_enumeration":"cpe:2.3:a:envoyproxy:envoy:*:*:*:*:*:*:*:*","icon":"Envoy.png","categories":["Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}]},{"fqdn":"img.icons8.com","ip":{"addr":"185.76.9.27","port":443,"asn":60068,"as":"Datacamp Limited","country":"Sweden","country_code":"SE"},"domain_registered":"2011-10-04","domain_rank":218854,"first_seen":"2017-05-26T09:10:54Z","last_seen":"2026-04-23T16:01:47.214999Z","alert_count":0,"request_count":1,"received_data":3396,"sent_data":427,"comment":"","tags":null,"fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"CDN77","description":"CDN77 is a content delivery network (CDN).","website":"https://www.cdn77.com","common_platform_enumeration":"","icon":"CDN77.png","categories":["CDN"]}]},{"fqdn":"api.kali365.xyz","ip":{"addr":"172.67.191.56","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"domain_registered":"2026-04-18","domain_rank":0,"first_seen":"2026-04-20T01:49:57.021198Z","last_seen":"2026-04-27T01:54:27.087104Z","alert_count":12,"request_count":3,"received_data":2670,"sent_data":1320,"comment":"","tags":null,"fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}]},{"fqdn":"agrrements-contract.onrender.com","ip":{"addr":"216.24.57.7","port":443,"asn":397273,"as":"RENDER","country":"United States","country_code":"US"},"domain_registered":"unknown","domain_rank":0,"first_seen":"No data","last_seen":"No data","alert_count":2,"request_count":2,"received_data":2957,"sent_data":972,"comment":"","tags":null,"fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}]}],"files":null,"artifacts":{"windows_shortcuts":null,"files":null,"telegram":null,"pdfs":null,"clipboard":null},"sensors":{"ids":null,"analyzer":null,"urlquery":[{"sensor_name":"urlquery","alert":"Phishing - Kali365 Phishing Kit","verdict":"phishing","severity":"high","comment":"","tags":["phishing","kali365","aitm"],"meta":null}]},"javascript":{"script":[{"url":{"schema":"https","addr":"flow-share-qlpw.inbox-share.workers.dev/l/_ERG-afRfu8","fqdn":"flow-share-qlpw.inbox-share.workers.dev","domain":"inbox-share.workers.dev","tld":"workers.dev"},"ip":{"addr":"104.21.26.231","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"scriptElement","is_inline":true,"md5":"8369a7aa2226cd690c218c23cf9c2394","sha1":"c2c5174097326422b9f856e57d9212fd9c098c2d","sha256":"20ef43f6438fcb23c18acef94d6aec6d03bca6104d751b14671fd67c5a92acdc","sha512":"ba1ca31c46c3fdf8ffe78c18712af0f56db75ae276a52d7ed3e9e242b9c79631c701a1c4a4edb7f8664f7f6f58064485f74404b9d8d5dfecff5ca0bce22312b1","ssdeep":"","tlshash":"46e068be37053018132754bab53fcb98383330736c0aee547129a8801faaa2ce017a8d","size":386,"data":"","first_seen":"2026-04-27T12:16:43.393876Z","last_seen":"2026-04-27T14:34:10.881386Z","times_seen":3,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"flow-share-qlpw.inbox-share.workers.dev/l/_ERG-afRfu8","fqdn":"flow-share-qlpw.inbox-share.workers.dev","domain":"inbox-share.workers.dev","tld":"workers.dev"},"ip":{"addr":"104.21.26.231","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"scriptElement","is_inline":false,"md5":"9fd6586e5193c3f8435daa994c2c554c","sha1":"ebfbed3507e2f1fb40185a21c1665fe59f8d845f","sha256":"603ad0e72201fb10dbd8a64b22862e7b82dcc076159f403ae8c56b89ee7b539e","sha512":"258b5708b2049b8ab125d03222a24a3b5545f412ac5e6aab643d37f9cab8f456d47a2f8425b127855adde11ff3865421ab67792ccc5b7c52af8329f294724c14","ssdeep":"","tlshash":"8a3172e2f2bb04398ac922f7a87957897c324a19fd47c006d53d0c2459a0f87613aed0","size":1731,"data":"","first_seen":"2026-04-27T14:22:02.199667Z","last_seen":"2026-04-27T14:22:02.199667Z","times_seen":1,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"flow-share-qlpw.inbox-share.workers.dev/l/_ERG-afRfu8","fqdn":"flow-share-qlpw.inbox-share.workers.dev","domain":"inbox-share.workers.dev","tld":"workers.dev"},"ip":{"addr":"104.21.26.231","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"scriptElement","is_inline":false,"md5":"355c55a9d2ee5f89deeb81db3b519451","sha1":"076d2a5b884e041f7995093cfed56265ce037ce5","sha256":"16974577ca60b3baa2cf2206095f5b576e276c2f418918ddf85110d0f9d28282","sha512":"c9c4f61a11ae72c9de361890435140a7396f1835cd2740f379dd379472971f9883303c8e423c6f56543628896973e22e27e65901928e340b98d481f04ba1394a","ssdeep":"192:YSMqKu1pypQer0NVVknIbQixufq9bPiUexFejbHJmQs1JI8vqwOYkDy1f:YSdKIypdr0NbqPixuGbPcFej1mQs17s8","tlshash":"1032d80ef8d88a6a7712b27bcc431285b5254ed6ff6dbdc5054d809c01aabbcc3bb465","size":10998,"data":"","first_seen":"2026-04-22T01:03:47.471909Z","last_seen":"2026-05-15T16:52:03.738307Z","times_seen":18,"alerts":{"ids":null,"analyzer":null,"urlquery":null}}],"eval":null,"write":[{"md5":"1acf2d2be8d3f7c49f157613dab73831","sha1":"96efcc8b560c1f4ebbd0384b3869b049d5b72c18","sha256":"678ca972a8f5402e335a92f8d7405ce7d76213c9c4681516f527c26a3fea8975","sha512":"0fc931117c71726a5de29ddad64a9999abcae9befe5f36cba7d28bb6d515eb6e63925bb90bab8f204660f7bc9b5d5b5ab1f06c44f9267d07252695bbb01ad5c8","ssdeep":"192:wclfxqR/6eAEMsmVKhticNp+SvsxYCYwr/7qYspQstjQR1eknIb/:dAUGFticNp+usxYCYS7ZspZtjQR8q6","tlshash":"5a32e976b1e8043ff363d1c3a4724f8f3580aa4bea8b9e4686ed105945c5ebdc767188","size":11849,"data":"","first_seen":"2026-04-27T14:22:02.205962Z","last_seen":"2026-04-27T14:22:02.205962Z","times_seen":1,"alerts":{"ids":null,"analyzer":null,"urlquery":null}}],"console":null},"http":[{"url":{"schema":"https","addr":"upload.wikimedia.org/wikipedia/commons/thumb/8/85/Microsoft_365_logo.png/1280px-Microsoft_365_logo.png","fqdn":"upload.wikimedia.org","domain":"wikimedia.org","tld":"org"},"ip":{"addr":"185.15.59.240","port":443,"asn":14907,"as":"WIKIMEDIA","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://agrrements-contract.onrender.com/","date":"2026-04-27T14:21:36.131Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"upload.wikimedia.org","organization":""},"issuer":{"commonName":"E7","organization":"Let's Encrypt"},"validity":{"start":"Mon, 13 Apr 2026 05:51:37 GMT","end":"Sun, 12 Jul 2026 05:51:36 GMT"},"fingerprint":{"sha1":"62:23:EE:89:97:A6:C1:A5:65:7A:8F:23:C2:68:CA:70:93:B3:AA:FF","sha256":"5A:21:64:0C:22:9B:01:A0:D2:BC:CA:02:4F:E8:51:ED:BA:CC:51:27:0E:87:6A:6E:E6:0D:88:64:AB:D1:3F:30"}}},"request":{"raw":"GET /wikipedia/commons/thumb/8/85/Microsoft_365_logo.png/1280px-Microsoft_365_logo.png HTTP/1.1\r\nHost: upload.wikimedia.org\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://agrrements-contract.onrender.com/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ncontent-type: image/png\r\ncontent-disposition: inline;filename*=UTF-8''Microsoft_365_logo.png\r\netag: 01b4c07cbfc3462ce05c676a5fd85baa\r\nlast-modified: Fri, 13 Feb 2026 13:47:39 GMT\r\ncontent-length: 25790\r\ndate: Mon, 27 Apr 2026 06:09:41 GMT\r\nserver: envoy\r\nage: 29514\r\naccept-ranges: bytes\r\nx-cache: cp3076 miss, cp3076 hit/17\r\nx-cache-status: hit-front\r\nserver-timing: cache;desc=\"hit-front\", host;desc=\"cp3076\"\r\nstrict-transport-security: max-age=106384710; includeSubDomains; preload\r\nreport-to: { \"group\": \"wm_nel\", \"max_age\": 604800, \"endpoints\": [{ \"url\": \"https://intake-logging.wikimedia.org/v1/events?stream=w3c.reportingapi.network_error\u0026schema_uri=/w3c/reportingapi/network_error/1.0.0\" }] }\r\nnel: { \"report_to\": \"wm_nel\", \"max_age\": 604800, \"failure_fraction\": 0.05, \"success_fraction\": 0.0}\r\nx-client-ip: 91.90.42.154\r\nx-content-type-options: nosniff\r\naccess-control-allow-origin: *\r\naccess-control-expose-headers: Age, Date, Content-Length, Content-Range, X-Content-Duration, X-Cache\r\ntiming-allow-origin: *\r\nset-cookie: WMF-Uniq=PkvHu0EEXAbPWAr4Xh2_NgNPAAAAAFvd8L7YlvZ5TVu-OOGP8gI2GeklUa-eCGjq;Domain=upload.wikimedia.org;Path=/;HttpOnly;secure;SameSite=None;Expires=Tue, 27 Apr 2027 00:00:00 GMT\r\nx-request-id: 06fd3ad9-ad60-4045-96a0-a3bfe9a6f003\r\nx-analytics: \r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Envoy","description":"Envoy is an open-source edge and service proxy, designed for cloud-native applications.","website":"https://www.envoyproxy.io/","common_platform_enumeration":"cpe:2.3:a:envoyproxy:envoy:*:*:*:*:*:*:*:*","icon":"Envoy.png","categories":["Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":25790,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 1280 x 211, 8-bit/color RGBA, non-interlaced","md5":"01b4c07cbfc3462ce05c676a5fd85baa","sha1":"d41d6d179e4c84b4e3cf99841d90d965806a686f","sha256":"c5c952f12d42459352a43047c554f4e4a772cbfe4a56ade5334e41cac6b8a383","sha512":"66be30cc9b0c53fe9925bfaab12a4ece9cfb4d3f3ff1edbe20d579b6949419453c4a378628bd1a923fb370ff436fc2de29ab30698a9dcb70006cc3e6d3f77cce","ssdeep":"384:hog2RN1wd15m16OzLc8DhSQ5h/BwlfATgvKs+IMIhK1hXbiV3Rh8kjBTU27TadcF:hq1wdbihLWpHG3p+V3X8/2PayNh9","tlshash":"abc2d0de2653ce89bd0d00f6500ade66b85e25c9550bab80367bb13ee3deb30b4c6514","first_seen":"2026-04-27T12:16:43.372906Z","last_seen":"2026-04-27T14:22:02.17085Z","times_seen":2,"resource_available":false,"data":null}},"time_used":138,"timings":{"blocked":48,"dns":3,"connect":17,"send":0,"wait":34,"receive":6,"ssl":26},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"img.icons8.com/fluency/96/microsoft-onedrive-2019.png","fqdn":"img.icons8.com","domain":"icons8.com","tld":"com"},"ip":{"addr":"185.76.9.27","port":443,"asn":60068,"as":"Datacamp Limited","country":"Sweden","country_code":"SE"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://flow-share-qlpw.inbox-share.workers.dev/l/_ERG-afRfu8","date":"2026-04-27T14:21:47.871Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"1004834818.rsc.cdn77.org","organization":""},"issuer":{"commonName":"E8","organization":"Let's Encrypt"},"validity":{"start":"Tue, 17 Mar 2026 10:28:54 GMT","end":"Mon, 15 Jun 2026 10:28:53 GMT"},"fingerprint":{"sha1":"FB:64:A2:47:3E:78:7C:2B:08:A4:67:CE:63:64:D8:05:DB:13:E1:97","sha256":"C1:67:9B:EC:6A:3F:76:AE:75:5D:0E:0F:46:34:13:71:3C:89:7C:17:5F:88:7D:0A:92:61:16:3F:C9:67:77:54"}}},"request":{"raw":"GET /fluency/96/microsoft-onedrive-2019.png HTTP/1.1\r\nHost: img.icons8.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ndate: Mon, 27 Apr 2026 14:21:47 GMT\r\ncontent-type: image/png\r\ncontent-length: 2657\r\naccess-control-allow-origin: *\r\naccess-control-expose-headers: icon-id, icon-size, icon-format\r\nicon-id: PnENrLMMW4eV\r\nicon-size: 96\r\nicon-format: png\r\nlast-modified: Mon, 20 Apr 2026 10:01:48\r\nversion: 0.0.29\r\nfrom-mongo-cache: false\r\nfrom-redis-cache: false\r\nnot-found-platform: false\r\ncache-control: public, max-age=302400\r\nstrict-transport-security: max-age=31536000; includeSubDomains\r\nx-77-nzt: kyBHhKFleYKJ/1pJiPbE50+ljAPqvABVL/jFdnymrfHp+AXx2RwVP/eVhARI1KPj3w\r\nx-77-nzt-ray: fdb541238fbd4d4dfb70ef69ed662937\r\nx-77-cache: HIT\r\nx-77-age: 242744\r\nserver: CDN77-Turbo\r\nx-77-pop: stockholmSE\r\naccept-ranges: bytes\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"CDN77","description":"CDN77 is a content delivery network (CDN).","website":"https://www.cdn77.com","common_platform_enumeration":"","icon":"CDN77.png","categories":["CDN"]}],"data":{"size":2657,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 96 x 96, 8-bit/color RGBA, non-interlaced","md5":"2df0e918b36c453e3d4e6c6117817180","sha1":"5314b7200aa95593d6a73bc47590d7e9cce54d6f","sha256":"7192b522b7f5b32dc9a50b34bc7b3e9ae56706d294fe29cec5d02cdd6279e5a3","sha512":"4a6a5ff5ad94507fbd4f172d4c078057aa05df8e779b9e905dd173ff16393ae427e23a9166f9faefb18d9437c26e8eab1dfbed4762290127fd3bd7b270fbcd47","ssdeep":"","tlshash":"a7514cbe9333885f5c45b0af95b113ed1f897e0b2947610611201da748e7845084f7be","first_seen":"2025-07-01T02:06:07.271842Z","last_seen":"2026-07-28T15:44:27.561063Z","times_seen":57,"resource_available":false,"data":null}},"time_used":146,"timings":{"blocked":51,"dns":34,"connect":7,"send":0,"wait":34,"receive":0,"ssl":16},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"api.kali365.xyz/api/status/1476589","fqdn":"api.kali365.xyz","domain":"kali365.xyz","tld":"xyz"},"ip":{"addr":"172.67.191.56","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"fetch","requested_by":"https://flow-share-qlpw.inbox-share.workers.dev/l/_ERG-afRfu8","date":"2026-04-27T14:21:47.874Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"kali365.xyz","organization":""},"issuer":{"commonName":"E7","organization":"Let's Encrypt"},"validity":{"start":"Sat, 18 Apr 2026 16:56:09 GMT","end":"Fri, 17 Jul 2026 16:56:08 GMT"},"fingerprint":{"sha1":"55:5B:31:11:3B:A6:35:92:CD:55:49:23:44:0C:05:5D:E6:B9:1F:C5","sha256":"9B:B5:F0:82:1C:72:5B:76:F0:66:19:CE:4F:28:2C:21:B1:C3:BC:FE:A2:D9:5C:F1:AC:FC:A9:AD:0E:D0:21:77"}}},"request":{"raw":"GET /api/status/1476589 HTTP/1.1\r\nHost: api.kali365.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nOrigin: https://flow-share-qlpw.inbox-share.workers.dev\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ndate: Mon, 27 Apr 2026 14:21:47 GMT\r\ncontent-type: application/json\r\ncontent-length: 21\r\nserver: cloudflare\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\naccess-control-allow-origin: https://flow-share-qlpw.inbox-share.workers.dev\r\nvary: Origin, Cookie\r\nstrict-transport-security: max-age=31536000; includeSubDomains\r\nx-robots-tag: noindex, nofollow, noarchive, nosnippet\r\nx-frame-options: DENY\r\nx-content-type-options: nosniff\r\nreferrer-policy: no-referrer\r\ncf-cache-status: DYNAMIC\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=DFs%2FkaFrF3H%2Fpz0DZXhml0uOW%2B%2BczBOxTWjLOwQ9R5o29DiE%2BE38FEg41PyXnBbuCu%2BfM5yVJQ4FHfTo8ch70SYwKX0k5I1ndFBhKCyxjQrDlTeF5YbDVDcyLIsO4PkfYr0%3D\"}]}\r\ncf-ray: 9f2e79c69820568f-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":21,"size_decoded":0,"mime_type":"application/json","magic":"JSON text data","md5":"1991b7c8ec390f5af45312fc0e09944c","sha1":"d61cf78973a9c26e718fb9fe1cb3c8533893d95f","sha256":"e83c12db5ee3c62282c295c521fa51a10e6cfff8e247c64f09838dbc134bd385","sha512":"80bed01bd6f8fecdcfe32308c4dc471907a48a7418c73be4874046c51c9bcf013cbc53bd0e4fc92afb3020d0c08fb675611712f81799a9a1bf593c4dfd8c8480","ssdeep":"","tlshash":"e9700022280800000ac80800e0000238baa0ca80002ba0c0280c80288820880e008000","first_seen":"2026-03-04T14:57:38.603599Z","last_seen":"2026-08-12T02:11:28.44303Z","times_seen":1692,"resource_available":false,"data":null}},"time_used":176,"timings":{"blocked":62,"dns":52,"connect":1,"send":0,"wait":44,"receive":0,"ssl":14},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-04-27","alert":"Sinkholed","trigger":"api.kali365.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-04-27","alert":"Sinkholed","trigger":"api.kali365.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-04-27","alert":"Sinkholed","trigger":"api.kali365.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-04-27","alert":"Sinkholed","trigger":"api.kali365.xyz","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"api.kali365.xyz/api/status/1476589","fqdn":"api.kali365.xyz","domain":"kali365.xyz","tld":"xyz"},"ip":{"addr":"172.67.191.56","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"fetch","requested_by":"https://flow-share-qlpw.inbox-share.workers.dev/l/_ERG-afRfu8","date":"2026-04-27T14:21:51.016Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"kali365.xyz","organization":""},"issuer":{"commonName":"E7","organization":"Let's Encrypt"},"validity":{"start":"Sat, 18 Apr 2026 16:56:09 GMT","end":"Fri, 17 Jul 2026 16:56:08 GMT"},"fingerprint":{"sha1":"55:5B:31:11:3B:A6:35:92:CD:55:49:23:44:0C:05:5D:E6:B9:1F:C5","sha256":"9B:B5:F0:82:1C:72:5B:76:F0:66:19:CE:4F:28:2C:21:B1:C3:BC:FE:A2:D9:5C:F1:AC:FC:A9:AD:0E:D0:21:77"}}},"request":{"raw":"GET /api/status/1476589 HTTP/1.1\r\nHost: api.kali365.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nOrigin: https://flow-share-qlpw.inbox-share.workers.dev\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ndate: Mon, 27 Apr 2026 14:21:51 GMT\r\ncontent-type: application/json\r\ncontent-length: 21\r\nserver: cloudflare\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\naccess-control-allow-origin: https://flow-share-qlpw.inbox-share.workers.dev\r\nvary: Origin, Cookie\r\nstrict-transport-security: max-age=31536000; includeSubDomains\r\nx-robots-tag: noindex, nofollow, noarchive, nosnippet\r\nx-frame-options: DENY\r\nx-content-type-options: nosniff\r\nreferrer-policy: no-referrer\r\ncf-cache-status: DYNAMIC\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=0IuPraxFN%2BcHElTiu3EZ04QUuAfCW5BgLDPQIsg8KdMMOAo69TRfiTe2VRI46kY0DKkymmxH4Q2JvHigWmNgPmHcvic8gMmq9bibe1q4l2xbth5QQyJLMT9i5XBPJx6Fzaw%3D\"}]}\r\ncf-ray: 9f2e79d9df69568f-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":21,"size_decoded":0,"mime_type":"application/json","magic":"JSON text data","md5":"1991b7c8ec390f5af45312fc0e09944c","sha1":"d61cf78973a9c26e718fb9fe1cb3c8533893d95f","sha256":"e83c12db5ee3c62282c295c521fa51a10e6cfff8e247c64f09838dbc134bd385","sha512":"80bed01bd6f8fecdcfe32308c4dc471907a48a7418c73be4874046c51c9bcf013cbc53bd0e4fc92afb3020d0c08fb675611712f81799a9a1bf593c4dfd8c8480","ssdeep":"","tlshash":"e9700022280800000ac80800e0000238baa0ca80002ba0c0280c80288820880e008000","first_seen":"2026-03-04T14:57:38.603599Z","last_seen":"2026-08-12T02:11:28.44303Z","times_seen":1692,"resource_available":false,"data":null}},"time_used":39,"timings":{"blocked":1,"dns":0,"connect":0,"send":0,"wait":38,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-04-27","alert":"Sinkholed","trigger":"api.kali365.xyz","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-04-27","alert":"Sinkholed","trigger":"api.kali365.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-04-27","alert":"Sinkholed","trigger":"api.kali365.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-04-27","alert":"Sinkholed","trigger":"api.kali365.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"agrrements-contract.onrender.com/favicon.ico","fqdn":"agrrements-contract.onrender.com","domain":"agrrements-contract.onrender.com","tld":"onrender.com"},"ip":{"addr":"216.24.57.7","port":443,"asn":397273,"as":"RENDER","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://agrrements-contract.onrender.com/","date":"2026-04-27T14:21:36.247Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"onrender.com","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Sat, 28 Mar 2026 21:00:26 GMT","end":"Fri, 26 Jun 2026 22:00:22 GMT"},"fingerprint":{"sha1":"25:FD:17:AB:EA:A8:4B:D3:AE:06:2E:26:55:DA:91:2C:8E:1F:0A:BB","sha256":"4E:60:2F:FB:2A:B3:D6:8F:7E:16:D7:C6:BB:62:3D:62:0C:9E:14:38:B7:13:A6:A9:5B:4B:04:D3:A8:70:4A:29"}}},"request":{"raw":"GET /favicon.ico HTTP/1.1\r\nHost: agrrements-contract.onrender.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://agrrements-contract.onrender.com/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 404 Not Found\r\ndate: Mon, 27 Apr 2026 14:21:36 GMT\r\ncontent-type: text/plain; charset=utf-8\r\ncontent-length: 14\r\ncontent-encoding: br\r\nrndr-id: d408bd9d-bdd7-4c43\r\nvary: Accept-Encoding\r\nx-content-type-options: nosniff\r\ncf-cache-status: BYPASS\r\npriority: u=6,i=?0\r\nserver: cloudflare\r\ncf-ray: 9f2e797d8f36568a-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"404","status_text":"Not Found","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":10,"size_decoded":0,"mime_type":"text/plain; charset=utf-8","magic":"ASCII text","md5":"ef81e41d11c9e7193ddd3d470dbb3eda","sha1":"0c15d12755a0be84e6403445c427231c274919c6","sha256":"7515bf959b73b956ceb967351c7e299cbb3668a53d35f9c770eb72e00d93ced6","sha512":"bf69c60fbb6d5ff50d81cd093cbabe59cd4eed439822e9ed02472245c3dae033cec143f1c4bbe6f702b7530f87c020442217ca1859da8f4b0f578a93b46cbdfa","ssdeep":"","tlshash":"6450000c0303c3cc0000003030c0000000000303300000300000c0000000c0000c000c","first_seen":"2023-04-05T06:57:17Z","last_seen":"2026-08-11T18:53:04.662794Z","times_seen":6453,"resource_available":true,"data":null}},"time_used":231,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":231,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"cira_dns","sensor_type":"DNS","title":"CIRA Canadian Shield DNS","description":"CIRA Canadian Shield DNS","scan_date":"2026-04-27","alert":"Sinkholed","trigger":"agrrements-contract.onrender.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cira.ca/en/canadian-shield/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"flow-share-qlpw.inbox-share.workers.dev/l/_ERG-afRfu8","fqdn":"flow-share-qlpw.inbox-share.workers.dev","domain":"inbox-share.workers.dev","tld":"workers.dev"},"ip":{"addr":"104.21.26.231","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":true,"resource_type":"document","requested_by":"","date":"2026-04-27T14:21:41.264Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"inbox-share.workers.dev","organization":""},"issuer":{"commonName":"E7","organization":"Let's Encrypt"},"validity":{"start":"Tue, 21 Apr 2026 15:48:27 GMT","end":"Mon, 20 Jul 2026 15:48:26 GMT"},"fingerprint":{"sha1":"9A:FD:1C:0A:5A:52:6E:76:2F:89:02:97:84:43:6F:02:F0:F1:E8:E5","sha256":"13:6D:48:94:9E:BF:CF:C9:88:FB:35:59:BF:8D:4E:28:2B:C8:0A:52:6C:98:2E:F5:9C:F5:2C:D0:17:C7:CC:35"}}},"request":{"raw":"GET /l/_ERG-afRfu8 HTTP/1.1\r\nHost: flow-share-qlpw.inbox-share.workers.dev\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nUpgrade-Insecure-Requests: 1\r\nSec-Fetch-Dest: document\r\nSec-Fetch-Mode: navigate\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ndate: Mon, 27 Apr 2026 14:21:42 GMT\r\ncontent-type: text/html; charset=utf-8\r\ncache-control: no-store, no-cache, must-revalidate, private\r\nreferrer-policy: same-origin\r\nx-content-type-options: nosniff\r\nx-frame-options: DENY\r\nx-robots-tag: noindex, nofollow, noarchive, nosnippet, noimageindex\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=glrw6sH0jFGVYU%2BcxVFFshAvzbxTnzVscz9XLjJBVcQ%2BA0yyP%2BTmgKLlNRVo%2Futowx6NQl5f2elZzli4OXlh7iWwc6nVtGl3q3DGlcqwm%2FdAxlpbr3r75wPl4VTWmNTRgPeIY5scf6%2BZ4fX9K1cr%2BZvo3tC5BWpg8uw%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncontent-encoding: br\r\nserver: cloudflare\r\ncf-ray: 9f2e799d1d2f76ef-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":1410,"size_decoded":0,"mime_type":"text/html; charset=utf-8","magic":"HTML document, ASCII text","md5":"ef0a482304f7cff2fac6b719197c8648","sha1":"5feb8fd07a5703fd16e5aa316cd8acaceabaca20","sha256":"dda73b9db58cc8c4c35fdb4e7517fd3ecc898351f1ec3d25111fde3cb67ee4f5","sha512":"e66f65b3b8c05fa4d7d06a7fc59470cc897946df0af956900b564a7e2a31ac7ef52ff0de0c2862ef5df00a92d9b5733e06d5011c6f5cfd3d0049f7f8cd10d462","ssdeep":"","tlshash":"e4219676ae812009662384b1f833e65c7cd25a62f547da4065d1b6a88fc5ad8496278c","first_seen":"2026-04-27T14:22:02.182201Z","last_seen":"2026-04-27T14:22:02.182201Z","times_seen":1,"resource_available":false,"data":null}},"time_used":1238,"timings":{"blocked":26,"dns":6,"connect":1,"send":0,"wait":1186,"receive":0,"ssl":16},"alerts":{"ids":null,"analyzer":null,"urlquery":[{"sensor_name":"urlquery","alert":"Phishing - Kali365 Phishing Kit","verdict":"phishing","severity":"high","comment":"","tags":["phishing","kali365","aitm"],"meta":null}]}},{"url":{"schema":"https","addr":"flow-share-qlpw.inbox-share.workers.dev/favicon.ico","fqdn":"flow-share-qlpw.inbox-share.workers.dev","domain":"inbox-share.workers.dev","tld":"workers.dev"},"ip":{"addr":"104.21.26.231","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://flow-share-qlpw.inbox-share.workers.dev/l/_ERG-afRfu8","date":"2026-04-27T14:21:42.609Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"inbox-share.workers.dev","organization":""},"issuer":{"commonName":"E7","organization":"Let's Encrypt"},"validity":{"start":"Tue, 21 Apr 2026 15:48:27 GMT","end":"Mon, 20 Jul 2026 15:48:26 GMT"},"fingerprint":{"sha1":"9A:FD:1C:0A:5A:52:6E:76:2F:89:02:97:84:43:6F:02:F0:F1:E8:E5","sha256":"13:6D:48:94:9E:BF:CF:C9:88:FB:35:59:BF:8D:4E:28:2B:C8:0A:52:6C:98:2E:F5:9C:F5:2C:D0:17:C7:CC:35"}}},"request":{"raw":"GET /favicon.ico HTTP/1.1\r\nHost: flow-share-qlpw.inbox-share.workers.dev\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://flow-share-qlpw.inbox-share.workers.dev/l/_ERG-afRfu8\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\ndate: Mon, 27 Apr 2026 14:21:42 GMT\r\npriority: u=6,i=?0\r\ncontent-type: text/html; charset=utf-8\r\nserver: cloudflare\r\ncache-control: no-store, no-cache, must-revalidate, private\r\nreferrer-policy: same-origin\r\nx-content-type-options: nosniff\r\nx-frame-options: DENY\r\nx-robots-tag: noindex, nofollow, noarchive, nosnippet, noimageindex\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=s2LUb7bDjbSmqQmnFP6xLorcnCb1rWh668zI3dgzXvVff3HyTIiTQzVIr0PoZXRFZjDG87TeE3hg%2FSDuk%2B37M5yA1MDqsafhpM8AfciOJLcy6njFVPWojHtqRD2ugSJU4WtZ5Hs0Q8qsQO4i5QyoL9zoPoeBpOQz6Wo%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncontent-encoding: br\r\ncf-ray: 9f2e79a55cef1a30-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":1412,"size_decoded":0,"mime_type":"text/html; charset=utf-8","magic":"HTML document, ASCII text","md5":"8bc36ad70a2b9c897febb6d0752851af","sha1":"bb765b290b654ff87d1f7dd9eac11ae106690db8","sha256":"7cf152ed9a313ee689b8a703ff0155d5e0d85d49ba903eba29693c8e23dff159","sha512":"42896838b28dfdc20e617df8f334935bfa56678a8d1553a4803e386e906829dd3f7a4239c61a016434452d7ab3c51f928a215faef769f94d33a68f5048171c0d","ssdeep":"","tlshash":"9b21c6776e81300a922384a1b933d78c7ce29a62e503ea0170d1b2a88fd1bc8491278c","first_seen":"2026-04-27T14:22:02.186494Z","last_seen":"2026-04-27T14:22:02.186494Z","times_seen":1,"resource_available":false,"data":null}},"time_used":10,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":10,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":[{"sensor_name":"urlquery","alert":"Phishing - Kali365 Phishing Kit","verdict":"phishing","severity":"high","comment":"","tags":["phishing","kali365","aitm"],"meta":null}]}},{"url":{"schema":"https","addr":"flow-share-qlpw.inbox-share.workers.dev/lp/_ERG-afRfu8","fqdn":"flow-share-qlpw.inbox-share.workers.dev","domain":"inbox-share.workers.dev","tld":"workers.dev"},"ip":{"addr":"104.21.26.231","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"fetch","requested_by":"https://flow-share-qlpw.inbox-share.workers.dev/l/_ERG-afRfu8","date":"2026-04-27T14:21:44.593Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"inbox-share.workers.dev","organization":""},"issuer":{"commonName":"E7","organization":"Let's Encrypt"},"validity":{"start":"Tue, 21 Apr 2026 15:48:27 GMT","end":"Mon, 20 Jul 2026 15:48:26 GMT"},"fingerprint":{"sha1":"9A:FD:1C:0A:5A:52:6E:76:2F:89:02:97:84:43:6F:02:F0:F1:E8:E5","sha256":"13:6D:48:94:9E:BF:CF:C9:88:FB:35:59:BF:8D:4E:28:2B:C8:0A:52:6C:98:2E:F5:9C:F5:2C:D0:17:C7:CC:35"}}},"request":{"raw":"GET /lp/_ERG-afRfu8 HTTP/1.1\r\nHost: flow-share-qlpw.inbox-share.workers.dev\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/html\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://flow-share-qlpw.inbox-share.workers.dev/l/_ERG-afRfu8\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\ndate: Mon, 27 Apr 2026 14:21:47 GMT\r\npriority: u=4,i=?0\r\ncontent-type: text/html; charset=utf-8\r\nserver: cloudflare\r\ncache-control: no-store, no-cache, must-revalidate, private\r\nreferrer-policy: no-referrer\r\nx-content-type-options: nosniff\r\nx-frame-options: DENY\r\nx-robots-tag: noindex, nofollow, noarchive, nosnippet, noimageindex\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=oxwGhDs21EZD97zWqXRdatlDUc9uoxssXRyOs99lpvwHIaZo09fapqXr5Qz2uwlRmzN%2FuzGIO9wtNvf4BE71IpjaFom9Tg3CLyBq8hTp%2FKWvAdZWwXDyhauF9lYlv%2FR%2BfGqSADP7CT9%2BhMIVx%2BfsVjqUv7GdvPbRQbE%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncontent-encoding: br\r\ncf-ray: 9f2e79b1bec81a30-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":17969,"size_decoded":0,"mime_type":"text/html; charset=utf-8","magic":"HTML document, Unicode text, UTF-8 text, with very long lines (7529)","md5":"41d7904a93e758dcc1e55d49fbf5ee11","sha1":"bb8133a35d32e976e8ae46eafb1e4017db583e41","sha256":"41d5c411a0796cd2a3fd757650bd46648c0bc1baa164112e4ab92804b96ecb33","sha512":"61c2cf173142126cbfc310f3e9d08ba190cbed101bfb8d7d004096b14d2d338e4b9a11e0e79477dd39a1cce0ffd9e6e1d61e59f5fc51d6c3b876ebe733b4238f","ssdeep":"384:dAUGFticNp+usxYnSdKIypdr0NbqPixuGbPcFej1mQs17sxGI:jGFticNp+uPn4CW9yguGbPcFejO17sx7","tlshash":"01823b6ab0e8443fb353e283ec52178a75118e97ff5fae82469d409d05caeb9c377094","first_seen":"2026-04-27T14:22:02.189748Z","last_seen":"2026-04-27T14:22:02.189748Z","times_seen":1,"resource_available":false,"data":null}},"time_used":3258,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":3256,"receive":2,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":[{"sensor_name":"urlquery","alert":"Phishing - Kali365 Phishing Kit","verdict":"phishing","severity":"high","comment":"","tags":["phishing","kali365","aitm"],"meta":null}]}},{"url":{"schema":"https","addr":"api.kali365.xyz/api/status/1476589","fqdn":"api.kali365.xyz","domain":"kali365.xyz","tld":"xyz"},"ip":{"addr":"172.67.191.56","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"fetch","requested_by":"https://flow-share-qlpw.inbox-share.workers.dev/l/_ERG-afRfu8","date":"2026-04-27T14:21:54.061Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"kali365.xyz","organization":""},"issuer":{"commonName":"E7","organization":"Let's Encrypt"},"validity":{"start":"Sat, 18 Apr 2026 16:56:09 GMT","end":"Fri, 17 Jul 2026 16:56:08 GMT"},"fingerprint":{"sha1":"55:5B:31:11:3B:A6:35:92:CD:55:49:23:44:0C:05:5D:E6:B9:1F:C5","sha256":"9B:B5:F0:82:1C:72:5B:76:F0:66:19:CE:4F:28:2C:21:B1:C3:BC:FE:A2:D9:5C:F1:AC:FC:A9:AD:0E:D0:21:77"}}},"request":{"raw":"GET /api/status/1476589 HTTP/1.1\r\nHost: api.kali365.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nOrigin: https://flow-share-qlpw.inbox-share.workers.dev\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\nserver: cloudflare\r\ndate: Mon, 27 Apr 2026 14:21:54 GMT\r\ncontent-type: application/json\r\ncontent-length: 21\r\npriority: u=4,i=?0\r\naccess-control-allow-origin: https://flow-share-qlpw.inbox-share.workers.dev\r\nvary: Origin, Cookie\r\nstrict-transport-security: max-age=31536000; includeSubDomains\r\nx-robots-tag: noindex, nofollow, noarchive, nosnippet\r\nx-frame-options: DENY\r\nx-content-type-options: nosniff\r\nreferrer-policy: no-referrer\r\ncf-cache-status: DYNAMIC\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=gqHFkKGVmF%2Fo4QhqkXX2TWClSqylM7BegymLWLKnUM8hPkfzBAZW6qF1vsFDwl7c54FZYcXlw7MszMU4iwsutdb9Eqcr4jT4u6DDqV8e1bJ9ns%2BZU7a%2FFEiEH57cXNquhJI%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncf-ray: 9f2e79ecebe7723c-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":21,"size_decoded":0,"mime_type":"application/json","magic":"JSON text data","md5":"1991b7c8ec390f5af45312fc0e09944c","sha1":"d61cf78973a9c26e718fb9fe1cb3c8533893d95f","sha256":"e83c12db5ee3c62282c295c521fa51a10e6cfff8e247c64f09838dbc134bd385","sha512":"80bed01bd6f8fecdcfe32308c4dc471907a48a7418c73be4874046c51c9bcf013cbc53bd0e4fc92afb3020d0c08fb675611712f81799a9a1bf593c4dfd8c8480","ssdeep":"","tlshash":"e9700022280800000ac80800e0000238baa0ca80002ba0c0280c80288820880e008000","first_seen":"2026-03-04T14:57:38.603599Z","last_seen":"2026-08-12T02:11:28.44303Z","times_seen":1692,"resource_available":false,"data":null}},"time_used":33,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":33,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-04-27","alert":"Sinkholed","trigger":"api.kali365.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-04-27","alert":"Sinkholed","trigger":"api.kali365.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-04-27","alert":"Sinkholed","trigger":"api.kali365.xyz","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-04-27","alert":"Sinkholed","trigger":"api.kali365.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"agrrements-contract.onrender.com/","fqdn":"agrrements-contract.onrender.com","domain":"agrrements-contract.onrender.com","tld":"onrender.com"},"ip":{"addr":"216.24.57.7","port":443,"asn":397273,"as":"RENDER","country":"United States","country_code":"US"},"is_navigation_request":true,"resource_type":"document","requested_by":"","date":"2026-04-27T14:21:35.761Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"onrender.com","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Sat, 28 Mar 2026 21:00:26 GMT","end":"Fri, 26 Jun 2026 22:00:22 GMT"},"fingerprint":{"sha1":"25:FD:17:AB:EA:A8:4B:D3:AE:06:2E:26:55:DA:91:2C:8E:1F:0A:BB","sha256":"4E:60:2F:FB:2A:B3:D6:8F:7E:16:D7:C6:BB:62:3D:62:0C:9E:14:38:B7:13:A6:A9:5B:4B:04:D3:A8:70:4A:29"}}},"request":{"raw":"GET / HTTP/1.1\r\nHost: agrrements-contract.onrender.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nUpgrade-Insecure-Requests: 1\r\nSec-Fetch-Dest: document\r\nSec-Fetch-Mode: navigate\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ndate: Mon, 27 Apr 2026 14:21:35 GMT\r\ncontent-type: text/html; charset=utf-8\r\ncontent-length: 758\r\ncache-control: public, max-age=0, s-maxage=300\r\ncontent-encoding: br\r\netag: \"699f6e51425e39c3cb89423dc5f0514a\"\r\nlast-modified: Wed, 22 Apr 2026 15:32:15 UTC\r\nrndr-id: e22017ee-a390-4547\r\nstrict-transport-security: max-age=315360000; includeSubdomains; preload\r\nvary: Accept-Encoding, Accept-Encoding\r\nx-content-type-options: nosniff\r\ncf-cache-status: HIT\r\naccept-ranges: bytes\r\nserver: cloudflare\r\ncf-ray: 9f2e797ac9cbb28a-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":1975,"size_decoded":0,"mime_type":"text/html; charset=utf-8","magic":"HTML document, ASCII text","md5":"699f6e51425e39c3cb89423dc5f0514a","sha1":"94548d2dc02f1e59b97021274fa6b32e40e5c34c","sha256":"1a011d54656b60652947270e22ed0212c6a3be89747f73160a0b38c3cdfc36d9","sha512":"47422f4799bd61cf04b25e26d44fd190b5ef1cab92ad1464ebe3a60a5f2dfd5b938645e90ca8b06923424b472f93704283dff649fdd5ba9c678c5d5e73064b39","ssdeep":"","tlshash":"3241001b1ad7101a650390542fe1b7106aa5a553974fccaa3bde6388cfc6d88d9eb34c","first_seen":"2026-04-27T12:16:43.385085Z","last_seen":"2026-04-27T14:22:02.192766Z","times_seen":2,"resource_available":false,"data":null}},"time_used":273,"timings":{"blocked":37,"dns":23,"connect":1,"send":0,"wait":194,"receive":0,"ssl":15},"alerts":{"ids":null,"analyzer":[{"sensor_name":"cira_dns","sensor_type":"DNS","title":"CIRA Canadian Shield DNS","description":"CIRA Canadian Shield DNS","scan_date":"2026-04-27","alert":"Sinkholed","trigger":"agrrements-contract.onrender.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cira.ca/en/canadian-shield/","meta":null}],"urlquery":null}}]}