{"report_id":"a90ac99c-0e42-4570-aa1f-697a3bd74424","version":6,"status":"done","tags":[],"date":"2025-12-18T11:02:45Z","url":{"schema":"http","addr":"www.egrgrx.blogspot.sg/","fqdn":"www.egrgrx.blogspot.sg","domain":"egrgrx.blogspot.sg","tld":"blogspot.sg"},"ip":{"addr":"216.58.207.225","port":0,"asn":15169,"as":"GOOGLE","country":"United States","country_code":"US"},"final":{"url":{"schema":"about","addr":"about:neterror?e=connectionFailure\u0026u=https%3A//proxette.cc/payouts/%3Fb%3DYTo0OntzOjU6ImxhYmVsIjtzOjA6IiI7czozOiJ1c3IiO2k6ODM5O3M6NDoibm9wZCI7czo5OiJnb3Byb3guY2MiO3M6MToibyI7aToxO30%3D\u0026c=UTF-8\u0026d=Firefox%20can%E2%80%99t%20establish%20a%20connection%20to%20the%20server%20at%20proxette.cc.","fqdn":"","domain":"","tld":""},"title":"Problem loading page","dom":{"size":8057,"mime_type":"text/html; charset=utf-8","magic":"JavaScript source, Unicode text, UTF-8 text, with very long lines (488)","md5":"000a3d8c43bb6600fcc29149153d33d3","sha1":"daf5e9ca669e20ca21372b0b4ffc1971cc68487f","sha256":"2abf2476105529d210a51a280ecb6f24b78eecb5e442b053c4be6fe0ae9415c2","sha512":"5639f6ab56b7665c02605a934958f485a6584d9514ce04ca074f03c4eb5145d0729274c3a7b6bc801fdce80d39b32b1ccf649beb9f926930724031e09a650f4f","ssdeep":"96:rhfVK40tVfrp1LS8k45USz+45RaIkata89+RzydNAIl9+kex8KdRonI7B1g/M:r3Gvjp1LS8LUSZRa2b9wm7I98IT","tlshash":"f2f171a462fa192b818386ed38d77509bd01d257d36c28e5bf6d05e10fc7da19c0f19b","dom_hash":"domhash00ae9e3bca261b1ffff94c1aaedb777d","first_seen":"","last_seen":"","times_seen":0,"resource_available":false,"data":null}},"submit":{"url":{"schema":"http","addr":"www.egrgrx.blogspot.sg/","fqdn":"www.egrgrx.blogspot.sg","domain":"egrgrx.blogspot.sg","tld":"blogspot.sg"},"ip":{"addr":"216.58.207.225","port":0,"asn":15169,"as":"GOOGLE","country":"United States","country_code":"US"},"tags":null,"meta":null},"settings":{"access":"public","device_type":"desktop","expires_at":"2027-01-22T11:02:45Z","useragent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0","referer":"","cookies":null,"exit_node":"z0yflva4pidy47h"},"stats":{"alert_count":{"ids":0,"urlquery":0,"analyzer":21}},"detection":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2025-12-17","alert":"Sinkholed","trigger":"proxette.cc","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2025-12-18","alert":"Sinkholed","trigger":"proxette.cc","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2025-12-17","alert":"Sinkholed","trigger":"proxette.cc","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2025-12-17","alert":"Sinkholed","trigger":"proxette.cc","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2025-12-17","alert":"Sinkholed","trigger":"proxette.cc","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"openphish","sensor_type":"Blocklist","title":"OpenPhish","description":"OpenPhish","scan_date":"2025-12-18","alert":"Phishing - Generic/Spear Phishing","trigger":"proxette.cc","verdict":"phishing","severity":"medium","comment":"Generic/Spear Phishing","link":"https://openphish.com/","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-12-18","alert":"Sinkholed","trigger":"proxette.cc","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2025-12-18","alert":"Sinkholed","trigger":"dirtylk.cc","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2025-12-17","alert":"Sinkholed","trigger":"dirtylk.cc","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-12-18","alert":"Sinkholed","trigger":"dirtylk.cc","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2025-12-18","alert":"Sinkholed","trigger":"www.egrgrx.blogspot.sg","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2025-12-18","alert":"Sinkholed","trigger":"getk100.cc","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2025-12-18","alert":"Sinkholed","trigger":"getk100.cc","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-12-18","alert":"Sinkholed","trigger":"getk100.cc","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2025-12-18","alert":"Sinkholed","trigger":"goprox.cc","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2025-12-18","alert":"Sinkholed","trigger":"goprox.cc","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"openphish","sensor_type":"Blocklist","title":"OpenPhish","description":"OpenPhish","scan_date":"2025-12-18","alert":"Phishing - Generic/Spear Phishing","trigger":"goprox.cc","verdict":"phishing","severity":"medium","comment":"Generic/Spear Phishing","link":"https://openphish.com/","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-12-18","alert":"Sinkholed","trigger":"goprox.cc","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2025-12-17","alert":"Sinkholed","trigger":"sharkboss.top","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2025-12-18","alert":"Sinkholed","trigger":"sharkboss.top","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-12-18","alert":"Sinkholed","trigger":"sharkboss.top","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null},"summary":[{"fqdn":"egrgrx.blogspot.com","ip":{"addr":"142.251.142.225","port":443,"asn":15169,"as":"GOOGLE","country":"United States","country_code":"US"},"domain_registered":"2000-07-31","domain_rank":0,"first_seen":"2025-11-14T18:48:38.545148Z","last_seen":"2025-11-14T18:48:38.545148Z","alert_count":0,"request_count":1,"received_data":66021,"sent_data":488,"comment":"","tags":null,"fingerprints":[{"name":"Blogger","description":"Blogger is a blog-publishing service that allows multi-user blogs with time-stamped entries.","website":"https://www.blogger.com","common_platform_enumeration":"","icon":"Blogger.png","categories":["Blogs"]},{"name":"Python","description":"Python is an interpreted and general-purpose programming language.","website":"https://python.org","common_platform_enumeration":"cpe:2.3:a:python:python:*:*:*:*:*:*:*:*","icon":"Python.png","categories":["Programming languages"]},{"name":"Clipboard.js","description":"","website":"https://clipboardjs.com/","common_platform_enumeration":"","icon":"Clipboard.js.svg","categories":["JavaScript libraries"]},{"name":"OpenGSE","description":"OpenGSE is a test suite used for testing servlet compliance. It is deployed by using WAR files that are deployed on the server engine.","website":"https://code.google.com/p/opengse","common_platform_enumeration":"","icon":"Google.svg","categories":["Web servers"]},{"name":"Java","description":"Java is a class-based, object-oriented programming language that is designed to have as few implementation dependencies as possible.","website":"https://java.com","common_platform_enumeration":"cpe:2.3:a:oracle:jre:*:*:*:*:*:*:*:*","icon":"Java.svg","categories":["Programming languages"]}]},{"fqdn":"proxette.cc","ip":{"addr":"0.0.0.0","port":0,"asn":0,"as":"","country":"","country_code":"zz"},"domain_registered":"2025-10-27","domain_rank":0,"first_seen":"2025-10-28T04:19:49.326234Z","last_seen":"2025-12-17T11:54:04.711659Z","alert_count":7,"request_count":1,"received_data":0,"sent_data":629,"comment":"","tags":null,"fingerprints":null},{"fqdn":"dirtylk.cc","ip":{"addr":"185.208.156.66","port":443,"asn":42624,"as":"Global-Data System IT Corporation","country":"Seychelles","country_code":"SC"},"domain_registered":"2025-10-10","domain_rank":0,"first_seen":"2025-10-10T15:16:48.632367Z","last_seen":"2025-12-16T03:11:09.776964Z","alert_count":9,"request_count":3,"received_data":3317,"sent_data":1471,"comment":"","tags":null,"fingerprints":[{"name":"LiteSpeed","description":"LiteSpeed is a high-scalability web server.","website":"https://litespeedtech.com","common_platform_enumeration":"cpe:2.3:a:litespeedtech:litespeed_web_server:*:*:*:*:*:*:*:*","icon":"LiteSpeed.svg","categories":["Web servers"]}]},{"fqdn":"www.egrgrx.blogspot.sg","ip":{"addr":"0.0.0.0","port":0,"asn":0,"as":"","country":"","country_code":"zz"},"domain_registered":"2010-09-15","domain_rank":0,"first_seen":"2025-12-18T11:02:45.843715Z","last_seen":"2025-12-18T11:02:45.843715Z","alert_count":2,"request_count":2,"received_data":65954,"sent_data":898,"comment":"","tags":null,"fingerprints":[{"name":"Java","description":"Java is a class-based, object-oriented programming language that is designed to have as few implementation dependencies as possible.","website":"https://java.com","common_platform_enumeration":"cpe:2.3:a:oracle:jre:*:*:*:*:*:*:*:*","icon":"Java.svg","categories":["Programming languages"]},{"name":"OpenGSE","description":"OpenGSE is a test suite used for testing servlet compliance. It is deployed by using WAR files that are deployed on the server engine.","website":"https://code.google.com/p/opengse","common_platform_enumeration":"","icon":"Google.svg","categories":["Web servers"]}]},{"fqdn":"getk100.cc","ip":{"addr":"185.208.156.66","port":443,"asn":42624,"as":"Global-Data System IT Corporation","country":"Seychelles","country_code":"SC"},"domain_registered":"2025-06-04","domain_rank":3318541,"first_seen":"2025-06-04T22:00:32.39979Z","last_seen":"2025-12-16T03:11:12.166747Z","alert_count":3,"request_count":1,"received_data":720,"sent_data":524,"comment":"","tags":null,"fingerprints":[{"name":"LiteSpeed","description":"LiteSpeed is a high-scalability web server.","website":"https://litespeedtech.com","common_platform_enumeration":"cpe:2.3:a:litespeedtech:litespeed_web_server:*:*:*:*:*:*:*:*","icon":"LiteSpeed.svg","categories":["Web servers"]}]},{"fqdn":"goprox.cc","ip":{"addr":"194.87.237.143","port":443,"asn":48347,"as":"JSC Mediasoft ekspert","country":"Russia","country_code":"RU"},"domain_registered":"2025-02-19","domain_rank":3827104,"first_seen":"2025-04-29T02:35:45.965806Z","last_seen":"2025-12-18T08:56:47.691762Z","alert_count":4,"request_count":1,"received_data":839,"sent_data":520,"comment":"","tags":null,"fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"PHP","description":"PHP is a general-purpose scripting language used for web development.","website":"https://php.net","common_platform_enumeration":"cpe:2.3:a:php:php:*:*:*:*:*:*:*:*","icon":"PHP.svg","categories":["Programming languages"]}]},{"fqdn":"sharkboss.top","ip":{"addr":"104.21.2.198","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"domain_registered":"2023-09-07","domain_rank":3245438,"first_seen":"2023-11-08T09:35:58Z","last_seen":"2025-12-16T23:29:58.494947Z","alert_count":3,"request_count":1,"received_data":855,"sent_data":440,"comment":"","tags":null,"fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"PHP","description":"PHP is a general-purpose scripting language used for web development.","website":"https://php.net","common_platform_enumeration":"cpe:2.3:a:php:php:*:*:*:*:*:*:*:*","icon":"PHP.svg","categories":["Programming languages"]}]}],"files":null,"artifacts":{"windows_shortcuts":null,"files":null,"telegram":null,"pdfs":null,"clipboard":null},"sensors":{"ids":null,"analyzer":null,"urlquery":null},"javascript":{"script":[{"url":{"schema":"https","addr":"dirtylk.cc/clear.html","fqdn":"dirtylk.cc","domain":"dirtylk.cc","tld":"cc"},"ip":{"addr":"185.208.156.66","port":443,"asn":42624,"as":"Global-Data System IT Corporation","country":"Seychelles","country_code":"SC"},"introduction_type":"scriptElement","is_inline":true,"md5":"4a1d8fc043ed5855be68ff13d033383c","sha1":"4393af69118b66093bc405dfa0a49b6fc46a7b2d","sha256":"256b22e9652300ae9b1a56efc8b377cd6759a500339ef80bdc4ff76f2e7e07a7","sha512":"3c8b1cf8174df17a4a8582de96d1196c6caba2f345d54d5561073f98d2a8e3f18b5ef4295d7fdd689133c6bcad334b4ff3831cff3795440dae34c42f594ba4a6","ssdeep":"","tlshash":"8201d04f0477002557e3e26d239b7104b167509f298dcc583e5c43112f5036d9eb67c9","size":840,"data":"","first_seen":"2025-12-09T18:57:44.676037Z","last_seen":"2026-01-12T02:27:22.54432Z","times_seen":674,"alerts":{"ids":null,"analyzer":null,"urlquery":null}}],"eval":null,"write":null,"console":null},"http":[{"url":{"schema":"https","addr":"egrgrx.blogspot.com/","fqdn":"egrgrx.blogspot.com","domain":"egrgrx.blogspot.com","tld":"blogspot.com"},"ip":{"addr":"142.251.142.225","port":443,"asn":15169,"as":"GOOGLE","country":"United States","country_code":"US"},"is_navigation_request":true,"resource_type":"document","requested_by":"","date":"2025-12-18T11:02:23.692Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"misc-sni.blogspot.com","organization":""},"issuer":{"commonName":"WR2","organization":"Google Trust Services"},"validity":{"start":"Mon, 24 Nov 2025 08:39:53 GMT","end":"Mon, 16 Feb 2026 08:39:52 GMT"},"fingerprint":{"sha1":"3F:82:DC:44:84:68:F4:B2:2F:EF:70:07:8C:C9:76:06:40:BA:9F:E5","sha256":"6F:4A:B5:8F:2B:3C:09:FB:1C:76:9D:D2:E2:5F:70:C5:23:9E:5B:68:5A:2B:92:52:73:7C:2D:8C:22:6F:93:B7"}}},"request":{"raw":"GET / HTTP/1.1\r\nHost: egrgrx.blogspot.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nUpgrade-Insecure-Requests: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: document\r\nSec-Fetch-Mode: navigate\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ncontent-type: text/html; charset=UTF-8\r\nexpires: Thu, 18 Dec 2025 11:02:23 GMT\r\ndate: Thu, 18 Dec 2025 11:02:23 GMT\r\ncache-control: private, max-age=0\r\nlast-modified: Mon, 15 Sep 2025 01:07:26 GMT\r\netag: W/\"81f67514660f55072f66676d6f6e6797869ef26216bcc948cecae093d70d268c\"\r\ncontent-encoding: gzip\r\nx-content-type-options: nosniff\r\nx-xss-protection: 1; mode=block\r\ncontent-length: 14486\r\nserver: GSE\r\nalt-svc: h3=\":443\"; ma=2592000,h3-29=\":443\"; ma=2592000\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Blogger","description":"Blogger is a blog-publishing service that allows multi-user blogs with time-stamped entries.","website":"https://www.blogger.com","common_platform_enumeration":"","icon":"Blogger.png","categories":["Blogs"]},{"name":"Python","description":"Python is an interpreted and general-purpose programming language.","website":"https://python.org","common_platform_enumeration":"cpe:2.3:a:python:python:*:*:*:*:*:*:*:*","icon":"Python.png","categories":["Programming languages"]},{"name":"Clipboard.js","description":"","website":"https://clipboardjs.com/","common_platform_enumeration":"","icon":"Clipboard.js.svg","categories":["JavaScript libraries"]},{"name":"OpenGSE","description":"OpenGSE is a test suite used for testing servlet compliance. It is deployed by using WAR files that are deployed on the server engine.","website":"https://code.google.com/p/opengse","common_platform_enumeration":"","icon":"Google.svg","categories":["Web servers"]},{"name":"Java","description":"Java is a class-based, object-oriented programming language that is designed to have as few implementation dependencies as possible.","website":"https://java.com","common_platform_enumeration":"cpe:2.3:a:oracle:jre:*:*:*:*:*:*:*:*","icon":"Java.svg","categories":["Programming languages"]}],"data":{"size":65527,"size_decoded":0,"mime_type":"text/html; charset=UTF-8","magic":"HTML document, ASCII text, with very long lines (5241)","md5":"c554757da523f3bf74ec4a6aa2baf5dc","sha1":"4c641d7caf64128b6615b28882f3aeffeecc1a34","sha256":"f8215391b2cf0ac16219013a7d578173ecb725e2dc37d1312370d7f149da018c","sha512":"56b689c401deca538ffe8534455fbaa8cc36281aca2492c36cc846f29c47e80d7fe98c9a9ccbf18e05e9a2d16e42629911b4207680289c4f150a7bc11c28edb4","ssdeep":"768:9/hLz8bRNv+f5AfpUxnHeob4f1u0eJwO0H+UJFlUcoFvi0hq23oz:9/u6nj9Fvi0hCz","tlshash":"31531b7765623e0d9233480cb8c5b6d87718c463c40759ede9baa62cc3cbdc69172b6e","first_seen":"2025-12-18T11:02:48.042907Z","last_seen":"2025-12-18T11:02:48.042907Z","times_seen":1,"resource_available":false,"data":null}},"time_used":509,"timings":{"blocked":124,"dns":33,"connect":21,"send":0,"wait":222,"receive":38,"ssl":69},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"proxette.cc/payouts/?b=YTo0OntzOjU6ImxhYmVsIjtzOjA6IiI7czozOiJ1c3IiO2k6ODM5O3M6NDoibm9wZCI7czo5OiJnb3Byb3guY2MiO3M6MToibyI7aToxO30=","fqdn":"proxette.cc","domain":"proxette.cc","tld":"cc"},"ip":{"addr":"0.0.0.0","port":0,"asn":0,"as":"","country":"","country_code":"zz"},"is_navigation_request":true,"resource_type":"document","requested_by":"","date":"2025-12-18T11:02:25.238Z","timestamp":0,"http_version":"","security_state":"insecure","security_info":null,"request":{"raw":"GET /payouts/?b=YTo0OntzOjU6ImxhYmVsIjtzOjA6IiI7czozOiJ1c3IiO2k6ODM5O3M6NDoibm9wZCI7czo5OiJnb3Byb3guY2MiO3M6MToibyI7aToxO30= HTTP/1.1\r\nHost: proxette.cc\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://dirtylk.cc/\r\nDNT: 1\r\nConnection: keep-alive\r\nUpgrade-Insecure-Requests: 1\r\nSec-Fetch-Dest: document\r\nSec-Fetch-Mode: navigate\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"","headers":null,"cookies":null,"status_code":"","status_text":"","fingerprints":null,"data":{"size":0,"size_decoded":0,"mime_type":"","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-08-01T03:32:41.833207Z","times_seen":17645779,"resource_available":true,"data":null}},"time_used":534,"timings":{"blocked":534,"dns":0,"connect":0,"send":0,"wait":0,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2025-12-17","alert":"Sinkholed","trigger":"proxette.cc","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2025-12-18","alert":"Sinkholed","trigger":"proxette.cc","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2025-12-17","alert":"Sinkholed","trigger":"proxette.cc","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2025-12-17","alert":"Sinkholed","trigger":"proxette.cc","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2025-12-17","alert":"Sinkholed","trigger":"proxette.cc","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"openphish","sensor_type":"Blocklist","title":"OpenPhish","description":"OpenPhish","scan_date":"2025-12-18","alert":"Phishing - Generic/Spear Phishing","trigger":"proxette.cc","verdict":"phishing","severity":"medium","comment":"Generic/Spear Phishing","link":"https://openphish.com/","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-12-18","alert":"Sinkholed","trigger":"proxette.cc","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"dirtylk.cc/favicon.ico","fqdn":"dirtylk.cc","domain":"dirtylk.cc","tld":"cc"},"ip":{"addr":"185.208.156.66","port":443,"asn":42624,"as":"Global-Data System IT Corporation","country":"Seychelles","country_code":"SC"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://dirtylk.cc/clear.html","date":"2025-12-18T11:02:24.842Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.dirtylk.cc","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Tue, 16 Dec 2025 16:00:16 GMT","end":"Mon, 16 Mar 2026 16:00:15 GMT"},"fingerprint":{"sha1":"DF:9D:83:FC:17:35:A1:35:B8:8E:FA:F6:20:2C:0A:4A:D4:49:D1:2F","sha256":"14:A2:6B:6A:D6:0C:20:EB:78:33:C6:86:7F:C6:3D:94:9B:76:98:45:9B:55:6F:72:B5:1A:64:E7:2E:60:45:6E"}}},"request":{"raw":"GET /favicon.ico HTTP/1.1\r\nHost: dirtylk.cc\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://dirtylk.cc/clear.html\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 302 Found\r\ncontent-type: text/html\r\ncontent-length: 771\r\ndate: Thu, 18 Dec 2025 11:02:24 GMT\r\nserver: LiteSpeed\r\ncache-control: no-cache, no-store, must-revalidate, max-age=0\r\nlocation: https://www.google.com\r\nalt-svc: h3=\":443\"; ma=2592000, h3-29=\":443\"; ma=2592000, h3-Q050=\":443\"; ma=2592000, h3-Q046=\":443\"; ma=2592000, h3-Q043=\":443\"; ma=2592000, quic=\":443\"; ma=2592000; v=\"43,46\"\r\n\r\n","headers":null,"cookies":null,"status_code":"302","status_text":"Found","fingerprints":[{"name":"LiteSpeed","description":"LiteSpeed is a high-scalability web server.","website":"https://litespeedtech.com","common_platform_enumeration":"cpe:2.3:a:litespeedtech:litespeed_web_server:*:*:*:*:*:*:*:*","icon":"LiteSpeed.svg","categories":["Web servers"]}],"data":{"size":0,"size_decoded":0,"mime_type":"","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-08-01T03:32:41.833207Z","times_seen":17645779,"resource_available":true,"data":null}},"time_used":37,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":37,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2025-12-18","alert":"Sinkholed","trigger":"dirtylk.cc","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2025-12-17","alert":"Sinkholed","trigger":"dirtylk.cc","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-12-18","alert":"Sinkholed","trigger":"dirtylk.cc","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"www.egrgrx.blogspot.sg/","fqdn":"www.egrgrx.blogspot.sg","domain":"egrgrx.blogspot.sg","tld":"blogspot.sg"},"ip":{"addr":"0.0.0.0","port":0,"asn":0,"as":"","country":"","country_code":"zz"},"is_navigation_request":true,"resource_type":"document","requested_by":"","date":"2025-12-18T11:02:23.381Z","timestamp":0,"http_version":"","security_state":"broken","security_info":null,"request":{"raw":"GET / HTTP/1.1\r\nHost: www.egrgrx.blogspot.sg\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nUpgrade-Insecure-Requests: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: document\r\nSec-Fetch-Mode: navigate\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"","headers":null,"cookies":null,"status_code":"","status_text":"","fingerprints":null,"data":{"size":0,"size_decoded":0,"mime_type":"","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-08-01T03:32:41.833207Z","times_seen":17645779,"resource_available":true,"data":null}},"time_used":163,"timings":{"blocked":0,"dns":61,"connect":8,"send":0,"wait":0,"receive":0,"ssl":91},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2025-12-18","alert":"Sinkholed","trigger":"www.egrgrx.blogspot.sg","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"http","addr":"www.egrgrx.blogspot.sg/","fqdn":"www.egrgrx.blogspot.sg","domain":"egrgrx.blogspot.sg","tld":"blogspot.sg"},"ip":{"addr":"142.251.142.225","port":80,"asn":15169,"as":"GOOGLE","country":"United States","country_code":"US"},"is_navigation_request":true,"resource_type":"document","requested_by":"","date":"2025-12-18T11:02:23.561Z","timestamp":0,"http_version":"","security_state":"insecure","security_info":null,"request":{"raw":"GET / HTTP/1.1\r\nHost: www.egrgrx.blogspot.sg\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate\r\nDNT: 1\r\nConnection: keep-alive\r\nUpgrade-Insecure-Requests: 1\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 302 Moved Temporarily\r\nLocation: http://egrgrx.blogspot.com/\r\nContent-Type: text/html; charset=UTF-8\r\nContent-Encoding: gzip\r\nDate: Thu, 18 Dec 2025 11:02:23 GMT\r\nExpires: Thu, 18 Dec 2025 11:02:23 GMT\r\nCache-Control: private, max-age=0\r\nX-Content-Type-Options: nosniff\r\nX-Frame-Options: SAMEORIGIN\r\nContent-Security-Policy: frame-ancestors 'self'\r\nX-XSS-Protection: 1; mode=block\r\nContent-Length: 194\r\nServer: GSE\r\n\r\n","headers":null,"cookies":null,"status_code":"302","status_text":"Moved Temporarily","fingerprints":[{"name":"Java","description":"Java is a class-based, object-oriented programming language that is designed to have as few implementation dependencies as possible.","website":"https://java.com","common_platform_enumeration":"cpe:2.3:a:oracle:jre:*:*:*:*:*:*:*:*","icon":"Java.svg","categories":["Programming languages"]},{"name":"OpenGSE","description":"OpenGSE is a test suite used for testing servlet compliance. It is deployed by using WAR files that are deployed on the server engine.","website":"https://code.google.com/p/opengse","common_platform_enumeration":"","icon":"Google.svg","categories":["Web servers"]}],"data":{"size":65527,"size_decoded":0,"mime_type":"text/html; charset=UTF-8","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-08-01T03:32:41.833207Z","times_seen":17645779,"resource_available":true,"data":null}},"time_used":132,"timings":{"blocked":11,"dns":1,"connect":8,"send":0,"wait":112,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2025-12-18","alert":"Sinkholed","trigger":"www.egrgrx.blogspot.sg","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"getk100.cc/tt/811","fqdn":"getk100.cc","domain":"getk100.cc","tld":"cc"},"ip":{"addr":"185.208.156.66","port":443,"asn":42624,"as":"Global-Data System IT Corporation","country":"Seychelles","country_code":"SC"},"is_navigation_request":true,"resource_type":"document","requested_by":"","date":"2025-12-18T11:02:24.278Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"getk100.cc","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Tue, 16 Dec 2025 12:58:16 GMT","end":"Mon, 16 Mar 2026 12:58:15 GMT"},"fingerprint":{"sha1":"BF:50:95:73:77:2E:B4:90:15:5E:70:E0:94:84:CE:67:65:18:8F:99","sha256":"E2:B4:9F:17:13:41:92:CA:53:81:74:87:5F:DE:77:C0:36:8A:B2:D9:8E:B8:5D:DC:88:49:1F:F7:13:CC:A2:28"}}},"request":{"raw":"GET /tt/811 HTTP/1.1\r\nHost: getk100.cc\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://egrgrx.blogspot.com/\r\nUpgrade-Insecure-Requests: 1\r\nSec-Fetch-Dest: document\r\nSec-Fetch-Mode: navigate\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 301 Moved Permanently\r\ncontent-type: text/html\r\ncontent-length: 795\r\ndate: Thu, 18 Dec 2025 11:02:24 GMT\r\nserver: LiteSpeed\r\nlocation: https://getk100.cc/qwe.html\r\nalt-svc: h3=\":443\"; ma=2592000, h3-29=\":443\"; ma=2592000, h3-Q050=\":443\"; ma=2592000, h3-Q046=\":443\"; ma=2592000, h3-Q043=\":443\"; ma=2592000, quic=\":443\"; ma=2592000; v=\"43,46\"\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"301","status_text":"Moved Permanently","fingerprints":[{"name":"LiteSpeed","description":"LiteSpeed is a high-scalability web server.","website":"https://litespeedtech.com","common_platform_enumeration":"cpe:2.3:a:litespeedtech:litespeed_web_server:*:*:*:*:*:*:*:*","icon":"LiteSpeed.svg","categories":["Web servers"]}],"data":{"size":349,"size_decoded":0,"mime_type":"text/html","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-08-01T03:32:41.833207Z","times_seen":17645779,"resource_available":true,"data":null}},"time_used":192,"timings":{"blocked":77,"dns":1,"connect":36,"send":0,"wait":36,"receive":0,"ssl":40},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2025-12-18","alert":"Sinkholed","trigger":"getk100.cc","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2025-12-18","alert":"Sinkholed","trigger":"getk100.cc","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-12-18","alert":"Sinkholed","trigger":"getk100.cc","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"dirtylk.cc/ops/55","fqdn":"dirtylk.cc","domain":"dirtylk.cc","tld":"cc"},"ip":{"addr":"185.208.156.66","port":443,"asn":42624,"as":"Global-Data System IT Corporation","country":"Seychelles","country_code":"SC"},"is_navigation_request":true,"resource_type":"document","requested_by":"","date":"2025-12-18T11:02:24.548Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.dirtylk.cc","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Tue, 16 Dec 2025 16:00:16 GMT","end":"Mon, 16 Mar 2026 16:00:15 GMT"},"fingerprint":{"sha1":"DF:9D:83:FC:17:35:A1:35:B8:8E:FA:F6:20:2C:0A:4A:D4:49:D1:2F","sha256":"14:A2:6B:6A:D6:0C:20:EB:78:33:C6:86:7F:C6:3D:94:9B:76:98:45:9B:55:6F:72:B5:1A:64:E7:2E:60:45:6E"}}},"request":{"raw":"GET /ops/55 HTTP/1.1\r\nHost: dirtylk.cc\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://getk100.cc/\r\nUpgrade-Insecure-Requests: 1\r\nSec-Fetch-Dest: document\r\nSec-Fetch-Mode: navigate\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 302 Found\r\ncontent-type: text/html\r\ncontent-length: 771\r\ndate: Thu, 18 Dec 2025 11:02:24 GMT\r\nserver: LiteSpeed\r\ncache-control: no-cache, no-store, must-revalidate, max-age=0\r\nlocation: https://dirtylk.cc/clear.html\r\nalt-svc: h3=\":443\"; ma=2592000, h3-29=\":443\"; ma=2592000, h3-Q050=\":443\"; ma=2592000, h3-Q046=\":443\"; ma=2592000, h3-Q043=\":443\"; ma=2592000, quic=\":443\"; ma=2592000; v=\"43,46\"\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"302","status_text":"Found","fingerprints":[{"name":"LiteSpeed","description":"LiteSpeed is a high-scalability web server.","website":"https://litespeedtech.com","common_platform_enumeration":"cpe:2.3:a:litespeedtech:litespeed_web_server:*:*:*:*:*:*:*:*","icon":"LiteSpeed.svg","categories":["Web servers"]}],"data":{"size":1122,"size_decoded":0,"mime_type":"text/html","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-08-01T03:32:41.833207Z","times_seen":17645779,"resource_available":true,"data":null}},"time_used":198,"timings":{"blocked":80,"dns":1,"connect":36,"send":0,"wait":37,"receive":0,"ssl":41},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2025-12-17","alert":"Sinkholed","trigger":"dirtylk.cc","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2025-12-18","alert":"Sinkholed","trigger":"dirtylk.cc","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-12-18","alert":"Sinkholed","trigger":"dirtylk.cc","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"goprox.cc/go/539433/y2","fqdn":"goprox.cc","domain":"goprox.cc","tld":"cc"},"ip":{"addr":"194.87.237.143","port":443,"asn":48347,"as":"JSC Mediasoft ekspert","country":"Russia","country_code":"RU"},"is_navigation_request":true,"resource_type":"document","requested_by":"","date":"2025-12-18T11:02:24.956Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"goprox.cc","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Sun, 02 Nov 2025 00:51:53 GMT","end":"Sat, 31 Jan 2026 00:51:52 GMT"},"fingerprint":{"sha1":"5A:D1:58:7E:EE:77:72:EF:FE:A1:33:2C:4B:6B:C3:C2:4A:DA:67:39","sha256":"2A:64:AF:10:56:65:21:E5:AB:D9:A9:C5:A6:68:37:D3:87:BC:44:09:C7:F1:E5:FC:4D:7D:22:AA:F4:3B:69:B4"}}},"request":{"raw":"GET /go/539433/y2 HTTP/1.1\r\nHost: goprox.cc\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://dirtylk.cc/\r\nUpgrade-Insecure-Requests: 1\r\nSec-Fetch-Dest: document\r\nSec-Fetch-Mode: navigate\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 302 Found\r\nServer: nginx\r\nDate: Thu, 18 Dec 2025 11:02:25 GMT\r\nContent-Type: text/html; charset=UTF-8\r\nTransfer-Encoding: chunked\r\nConnection: keep-alive\r\nExpires: Sun, 01 Jan 2014 00:00:00 GMT\r\nCache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0\r\nPragma: no-cache\r\nSet-Cookie: PHPSESSID=95565a0612e1905f93910b693489d3e2; expires=Thu, 16-Feb-2045 11:02:25 GMT; Max-Age=604800000; path=/; domain=goprox.cc\nofr_1=a%3A4%3A%7Bs%3A5%3A%22label%22%3Bs%3A0%3A%22%22%3Bs%3A3%3A%22usr%22%3Bi%3A839%3Bs%3A4%3A%22nopd%22%3Bs%3A9%3A%22goprox.cc%22%3Bs%3A1%3A%22o%22%3Bi%3A1%3B%7D; expires=Sun, 18-Jan-2026 11:02:25 GMT; Max-Age=2678400; path=/; domain=goprox.cc\r\nLocation: https://proxette.cc/payouts/?b=YTo0OntzOjU6ImxhYmVsIjtzOjA6IiI7czozOiJ1c3IiO2k6ODM5O3M6NDoibm9wZCI7czo5OiJnb3Byb3guY2MiO3M6MToibyI7aToxO30=\r\n\r\n","headers":null,"cookies":null,"status_code":"302","status_text":"Found","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"PHP","description":"PHP is a general-purpose scripting language used for web development.","website":"https://php.net","common_platform_enumeration":"cpe:2.3:a:php:php:*:*:*:*:*:*:*:*","icon":"PHP.svg","categories":["Programming languages"]}],"data":{"size":0,"size_decoded":0,"mime_type":"","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-08-01T03:32:41.833207Z","times_seen":17645779,"resource_available":true,"data":null}},"time_used":446,"timings":{"blocked":169,"dns":1,"connect":31,"send":0,"wait":106,"receive":0,"ssl":135},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2025-12-18","alert":"Sinkholed","trigger":"goprox.cc","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2025-12-18","alert":"Sinkholed","trigger":"goprox.cc","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"openphish","sensor_type":"Blocklist","title":"OpenPhish","description":"OpenPhish","scan_date":"2025-12-18","alert":"Phishing - Generic/Spear Phishing","trigger":"goprox.cc","verdict":"phishing","severity":"medium","comment":"Generic/Spear Phishing","link":"https://openphish.com/","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-12-18","alert":"Sinkholed","trigger":"goprox.cc","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"dirtylk.cc/clear.html","fqdn":"dirtylk.cc","domain":"dirtylk.cc","tld":"cc"},"ip":{"addr":"185.208.156.66","port":443,"asn":42624,"as":"Global-Data System IT Corporation","country":"Seychelles","country_code":"SC"},"is_navigation_request":true,"resource_type":"document","requested_by":"","date":"2025-12-18T11:02:24.670Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.dirtylk.cc","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Tue, 16 Dec 2025 16:00:16 GMT","end":"Mon, 16 Mar 2026 16:00:15 GMT"},"fingerprint":{"sha1":"DF:9D:83:FC:17:35:A1:35:B8:8E:FA:F6:20:2C:0A:4A:D4:49:D1:2F","sha256":"14:A2:6B:6A:D6:0C:20:EB:78:33:C6:86:7F:C6:3D:94:9B:76:98:45:9B:55:6F:72:B5:1A:64:E7:2E:60:45:6E"}}},"request":{"raw":"GET /clear.html HTTP/1.1\r\nHost: dirtylk.cc\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://getk100.cc/\r\nDNT: 1\r\nConnection: keep-alive\r\nUpgrade-Insecure-Requests: 1\r\nSec-Fetch-Dest: document\r\nSec-Fetch-Mode: navigate\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ncontent-type: text/html\r\nlast-modified: Tue, 09 Dec 2025 14:29:56 GMT\r\naccept-ranges: bytes\r\ncontent-encoding: br\r\nvary: Accept-Encoding\r\ncontent-length: 526\r\ndate: Thu, 18 Dec 2025 11:02:24 GMT\r\nserver: LiteSpeed\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"LiteSpeed","description":"LiteSpeed is a high-scalability web server.","website":"https://litespeedtech.com","common_platform_enumeration":"cpe:2.3:a:litespeedtech:litespeed_web_server:*:*:*:*:*:*:*:*","icon":"LiteSpeed.svg","categories":["Web servers"]}],"data":{"size":1122,"size_decoded":0,"mime_type":"text/html","magic":"HTML document, Unicode text, UTF-8 text, with CRLF line terminators","md5":"78aa659b62ac1724d34ba2180abf36cf","sha1":"c24505747f56b0e658f87e9f165c78d5107f6ff4","sha256":"979e108523e208ec475263ad8f0f8ca44bacbf0bc893ed6dfa9e850712fdb750","sha512":"3a72b648297d37cd6728f758a8da9033174d0cc581dce83c99081924e1d2d38fa158d0318611c684d376c5767f75ac40993fd717121d68a4aabe8a5765d7e330","ssdeep":"","tlshash":"5c21ef9e041708148bf1e3786793b108f25751af1a8ed6657edc82237f703a98e92bcd","first_seen":"2025-12-09T18:57:44.654223Z","last_seen":"2026-01-12T02:27:22.542675Z","times_seen":750,"resource_available":false,"data":null}},"time_used":37,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":37,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2025-12-18","alert":"Sinkholed","trigger":"dirtylk.cc","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2025-12-17","alert":"Sinkholed","trigger":"dirtylk.cc","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-12-18","alert":"Sinkholed","trigger":"dirtylk.cc","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"sharkboss.top/share/get_redir.php","fqdn":"sharkboss.top","domain":"sharkboss.top","tld":"top"},"ip":{"addr":"104.21.2.198","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"fetch","requested_by":"https://dirtylk.cc/clear.html","date":"2025-12-18T11:02:24.858Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"sharkboss.top","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Sun, 14 Dec 2025 08:07:09 GMT","end":"Sat, 14 Mar 2026 09:05:44 GMT"},"fingerprint":{"sha1":"94:39:AE:2E:8A:5A:61:BD:56:04:CD:55:24:9B:8A:DA:F4:B9:F4:67","sha256":"86:C8:EC:D0:E2:C5:E3:F9:09:55:A1:30:28:C6:63:91:89:CE:2B:2B:53:C2:D1:C6:08:6C:DB:61:76:DA:77:98"}}},"request":{"raw":"GET /share/get_redir.php HTTP/1.1\r\nHost: sharkboss.top\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://dirtylk.cc/\r\nOrigin: https://dirtylk.cc\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ndate: Thu, 18 Dec 2025 11:02:24 GMT\r\ncontent-type: text/html; charset=UTF-8\r\nserver: cloudflare\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nset-cookie: PHPSESSID=6m8nds27eq2jnoq2ahtuj6eolq; expires=Thu, 16 Feb 2045 11:02:24 GMT; Max-Age=604800000; path=/; domain=sharkboss.top\r\nexpires: Thu, 19 Nov 1981 08:52:00 GMT\r\ncache-control: no-store, no-cache, must-revalidate\r\npragma: no-cache\r\naccess-control-allow-origin: *\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=sW1arjxmto3lpkmUpbMl0UUM3voxhXqQI89lNJE32pBqO3vmyAK2Q%2FY%2FU%2FnA%2FjgXJIcPWnPZmklJQ0ptdX1ptOLbEaKA1YY8SzF%2F\"}]}\r\ncf-cache-status: DYNAMIC\r\nvary: accept-encoding\r\ncontent-encoding: br\r\ncf-ray: 9afe2af57b6356bd-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"PHP","description":"PHP is a general-purpose scripting language used for web development.","website":"https://php.net","common_platform_enumeration":"cpe:2.3:a:php:php:*:*:*:*:*:*:*:*","icon":"PHP.svg","categories":["Programming languages"]}],"data":{"size":17,"size_decoded":0,"mime_type":"text/html; charset=UTF-8","magic":"ASCII text, with no line terminators","md5":"44918b3b018c62f7a363a2e16c1511cc","sha1":"a2d2037e3ef6bc7679ef082c3e089e7bcc03060e","sha256":"baeb14fdfeb2a2ad6f4b6beb052a893993909e0662b4a4409faf66cb6b3517b0","sha512":"9435e7ea5a7828164549d018deee0281baf62043b53f8c057b4b4fa392058522d1af01d37545a0c890e9a4789b2bc2df371953791b0d582d0731adf3546b6ac6","ssdeep":"","tlshash":"8f6000238000000e220800b0082a202c0082080a0c882c0c8020800000000280000220","first_seen":"2025-07-24T11:19:38.15304Z","last_seen":"2025-12-19T20:55:30.263669Z","times_seen":2844,"resource_available":false,"data":null}},"time_used":93,"timings":{"blocked":18,"dns":1,"connect":1,"send":0,"wait":56,"receive":0,"ssl":15},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2025-12-17","alert":"Sinkholed","trigger":"sharkboss.top","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2025-12-18","alert":"Sinkholed","trigger":"sharkboss.top","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-12-18","alert":"Sinkholed","trigger":"sharkboss.top","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}}]}