{"report_id":"a970b3a1-68e3-45ac-9e55-b7b854e047ef","version":0,"status":"done","tags":["phishing"],"date":"2026-08-02T00:31:15Z","url":{"schema":"http","addr":"redwinezoonma.12hp.ch/wp-includes/theme-compat/dfr1mxl/vglorbt/dxvcagm/Netease/neteasyes/neteasyest/900/index.php","fqdn":"redwinezoonma.12hp.ch","domain":"redwinezoonma.12hp.ch","tld":"12hp.ch"},"ip":{"addr":"91.216.248.22","port":0,"asn":47447,"as":"23M GmbH","country":"Germany","country_code":"DE"},"final":{"url":{"schema":"https","addr":"redwinezoonma.12hp.ch/wp-includes/theme-compat/dfr1mxl/vglorbt/dxvcagm/Netease/neteasyes/neteasyest/900/index.php","fqdn":"redwinezoonma.12hp.ch","domain":"redwinezoonma.12hp.ch","tld":"12hp.ch"},"title":"Excel 受保护的文件","dom":{"size":7916,"mime_type":"text/html; charset=utf-8","magic":"JavaScript source, Unicode text, UTF-8 text","md5":"cad14da0b4ccbd8d4b0681723102f99d","sha1":"ecd5395cfdc5c541bc90da7c2182ff06747dde0c","sha256":"336f1e26a65e4ab767584d84e80a478c040a1cde11cccbfd6beaf795aa53bdae","sha512":"3892c22b421d209c77a767bd60c477e7e7973c03c8d4878f68c259bdf61994029f63715e0b2b3c128f537a80c966a358f5473e413294e1f3be136e4c57b4822d","ssdeep":"192:WcuScUBr5s+ltvdEf02I9yfXBArJHHLS255B:WMcSrq+/vd5D3","tlshash":"eef1a600b8fa55a6013360ed3bbfa1093aa5c40b9609de047afd7bd01f95e1b78775c6","dom_hash":"domhash2afc6b991eb3e41a01890efc7682d897","first_seen":"2025-11-17T01:45:36.022262Z","last_seen":"2026-08-02T03:10:53.292634Z","times_seen":9,"resource_available":false,"data":null}},"submit":{"url":{"schema":"http","addr":"redwinezoonma.12hp.ch/wp-includes/theme-compat/dfr1mxl/vglorbt/dxvcagm/Netease/neteasyes/neteasyest/900/index.php","fqdn":"redwinezoonma.12hp.ch","domain":"redwinezoonma.12hp.ch","tld":"12hp.ch"},"ip":{"addr":"91.216.248.22","port":0,"asn":47447,"as":"23M GmbH","country":"Germany","country_code":"DE"},"tags":null,"meta":null},"settings":{"access":"public","device_type":"desktop","expires_at":"2027-09-06T00:31:15Z","useragent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0","referer":"","cookies":null,"exit_node":"qguvgzjxzsgb3vs"},"stats":{"alert_count":{"ids":0,"urlquery":2,"analyzer":2}},"detection":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-08-02","alert":"Sinkholed","trigger":"redwinezoonma.12hp.ch","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-08-02","alert":"Sinkholed","trigger":"redwinezoonma.12hp.ch","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":[{"sensor_name":"urlquery","alert":"Phishing - Generic phishing","verdict":"phishing","severity":"medium","comment":"","tags":["phishing"],"meta":null},{"sensor_name":"urlquery","alert":"Phishing - Generic phishing","verdict":"phishing","severity":"medium","comment":"","tags":["phishing"],"meta":null}]},"summary":[{"fqdn":"redwinezoonma.12hp.ch","ip":{"addr":"91.216.248.22","port":443,"asn":47447,"as":"23M GmbH","country":"Germany","country_code":"DE"},"domain_registered":"unknown","domain_rank":0,"first_seen":"2026-08-02T00:31:07.033188Z","last_seen":"2026-08-02T00:31:07.033188Z","alert_count":21,"request_count":10,"received_data":871144,"sent_data":6523,"comment":"","tags":null,"fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"OpenResty","description":"OpenResty is a web platform based on nginx which can run Lua scripts using its LuaJIT engine.","website":"https://openresty.org","common_platform_enumeration":"","icon":"OpenResty.svg","categories":["Web servers"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"PHP:8.3.32","description":"PHP is a general-purpose scripting language used for web development.","website":"https://php.net","common_platform_enumeration":"cpe:2.3:a:php:php:*:*:*:*:*:*:*:*","icon":"PHP.svg","categories":["Programming languages"]},{"name":"BootstrapCDN:4.0.0","description":"BootstrapCDN is a powerful and reliable Content Delivery Network (CDN) that delivers static resources, including CSS, JavaScript, and font files, for the widely-used Bootstrap framework. By leveraging multiple server locations worldwide, BootstrapCDN accelerates website loading times, ensuring a smooth and visually appealing user experience. Additionally, it ensures website compatibility with various devices and browsers. The service reduces bandwidth usage and server load, improving web performance for developers and end-users alike.","website":"https://www.bootstrapcdn.com/","common_platform_enumeration":"","icon":"BootstrapCDN.png","categories":["CDN"]},{"name":"Font Awesome","description":"Font Awesome is a font and icon toolkit based on CSS and Less.","website":"https://fontawesome.com/","common_platform_enumeration":"","icon":"Font Awesome.svg","categories":["Font scripts"]},{"name":"Bootstrap:4.0.0","description":"Bootstrap is a free and open-source CSS framework directed at responsive, mobile-first front-end web development. It contains CSS and JavaScript-based design templates for typography, forms, buttons, navigation, and other interface components.","website":"https://getbootstrap.com","common_platform_enumeration":"cpe:2.3:a:getbootstrap:bootstrap:*:*:*:*:*:*:*:*","icon":"Bootstrap.svg","categories":["UI frameworks"]},{"name":"Popper","description":"Popper is a positioning engine, its purpose is to calculate the position of an element to make it possible to position it near a given reference element.","website":"https://popper.js.org","common_platform_enumeration":"","icon":"Popper.svg","categories":["Miscellaneous"]},{"name":"jQuery:3.1.1","description":"jQuery is a JavaScript library which is a free, open-source software designed to simplify HTML DOM tree traversal and manipulation, as well as event handling, CSS animation, and Ajax.","website":"https://jquery.com","common_platform_enumeration":"cpe:2.3:a:jquery:jquery:*:*:*:*:*:*:*:*","icon":"jQuery.svg","categories":["JavaScript libraries"]}]},{"fqdn":"maxcdn.bootstrapcdn.com","ip":{"addr":"104.18.11.207","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"domain_registered":"2012-05-25","domain_rank":6807,"first_seen":"2014-06-18T00:37:31Z","last_seen":"2026-07-27T08:16:23.24002Z","alert_count":0,"request_count":2,"received_data":195675,"sent_data":1021,"comment":"","tags":null,"fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}]},{"fqdn":"stackpath.bootstrapcdn.com","ip":{"addr":"104.18.10.207","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"domain_registered":"2012-05-25","domain_rank":21970,"first_seen":"2018-04-05T04:41:29Z","last_seen":"2026-07-27T10:51:56.203431Z","alert_count":0,"request_count":1,"received_data":51973,"sent_data":498,"comment":"","tags":null,"fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}]},{"fqdn":"kit.fontawesome.com","ip":{"addr":"104.18.40.68","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"domain_registered":"2012-10-18","domain_rank":16651,"first_seen":"2019-03-29T02:12:52Z","last_seen":"2026-07-27T13:00:37.858842Z","alert_count":0,"request_count":1,"received_data":470,"sent_data":488,"comment":"","tags":null,"fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}]}],"files":null,"artifacts":{"windows_shortcuts":null,"files":null,"telegram":null,"pdfs":null,"clipboard":null},"sensors":{"ids":null,"analyzer":null,"urlquery":[{"sensor_name":"urlquery","alert":"Phishing - Generic phishing","verdict":"phishing","severity":"medium","comment":"","tags":["phishing"],"meta":null}]},"javascript":{"script":[{"url":{"schema":"https","addr":"stackpath.bootstrapcdn.com/bootstrap/4.1.3/js/bootstrap.min.js","fqdn":"stackpath.bootstrapcdn.com","domain":"bootstrapcdn.com","tld":"com"},"ip":{"addr":"104.18.10.207","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"scriptElement","is_inline":false,"md5":"67176c242e1bdc20603c878dee836df3","sha1":"27a71b00383d61ef3c489326b3564d698fc1227c","sha256":"56c12a125b021d21a69e61d7190cefa168d6c28ce715265cea1b3b0112d169c4","sha512":"9fa75814e1b9f7db38fe61a503a13e60b82d83db8f4ce30351bd08a6b48c0d854baf472d891af23c443c8293380c2325c7b3361b708af9971aa0ea09a25cdd0a","ssdeep":"768:E9Yw7GuJM+HV0cen/7Kh5rM7V4RxCKg8FW/xsXQUd+FiID65r48Hgp5HRl+:E9X7PMIM7V4R5LFAxTWyuHHgp5HRl+","tlshash":"3533b649725078b201df9176913f460bb736788ea907816cb95d98ed2e7cd89322bf3c","size":51039,"data":"","first_seen":"2023-03-07T01:02:44Z","last_seen":"2026-08-13T19:56:55.176491Z","times_seen":126152,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"redwinezoonma.12hp.ch/wp-includes/theme-compat/dfr1mxl/vglorbt/dxvcagm/Netease/neteasyes/neteasyest/900/index.php","fqdn":"redwinezoonma.12hp.ch","domain":"redwinezoonma.12hp.ch","tld":"12hp.ch"},"ip":{"addr":"91.216.248.22","port":443,"asn":47447,"as":"23M GmbH","country":"Germany","country_code":"DE"},"introduction_type":"scriptElement","is_inline":true,"md5":"373bee28541d7210df36c8dd49133ed3","sha1":"ec184125c85614e37fd6bac2e29ec285d5bca6ac","sha256":"253d90a7f2a0e228222b2a150613622156b8b9fe55389b2a688d7f722b328343","sha512":"8df6831b97f012a4d9e44be5b6eccf33cffc2f8a87f2c4679851005642c6eddf96ec130366855bbfcd5530e188bd90e42e5b56daab0c6aceb62b9f3f3931f3c5","ssdeep":"","tlshash":"aa81e105f8ab21a51a3370bd2f7f5144336a444b150cef547c5dba80ef68a2bb5ba9c3","size":3927,"data":"","first_seen":"2026-08-02T00:31:16.610892Z","last_seen":"2026-08-02T03:10:53.318899Z","times_seen":2,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"redwinezoonma.12hp.ch/wp-includes/theme-compat/dfr1mxl/vglorbt/dxvcagm/Netease/neteasyes/neteasyest/900/js/jquery.min.js","fqdn":"redwinezoonma.12hp.ch","domain":"redwinezoonma.12hp.ch","tld":"12hp.ch"},"ip":{"addr":"91.216.248.22","port":443,"asn":47447,"as":"23M GmbH","country":"Germany","country_code":"DE"},"introduction_type":"scriptElement","is_inline":false,"md5":"adb784ef9dc257b32965a5da7ee82a8b","sha1":"7a41c488d820ea08231d1d393e5f4daed4d25041","sha256":"8e09aa31f396ea41d698f437dc5fc7125e931d400eb2873f5b68ef78c1e6f3a6","sha512":"bc8fcdf5a4645443c394b0d1b7222b2e2321a4558cd39cfac18c88aa1abc44d4317a94a26b0f8444f6700197fe2a90d2812c42fb1f85fc5ae33069343579d4df","ssdeep":"1536:fYE1JVoiB9JqZdXXe2pD3PgoIiulrUn6Z6a4tfOR7WpfWBZPBJda4w9W3qG9a98Q:u4J+rlfOhWpgCW6G9a98HrU","tlshash":"1383c6d9b2d6706297b734b850bf410bb17a98dab44c8c60f059d4e47eb4a8e507bf2c","size":85580,"data":"","first_seen":"2023-03-07T01:20:21Z","last_seen":"2026-08-12T15:05:52.4124Z","times_seen":2203,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"redwinezoonma.12hp.ch/wp-includes/theme-compat/dfr1mxl/vglorbt/dxvcagm/Netease/neteasyes/neteasyest/900/js/jquery-3.1.1.min.js","fqdn":"redwinezoonma.12hp.ch","domain":"redwinezoonma.12hp.ch","tld":"12hp.ch"},"ip":{"addr":"91.216.248.22","port":443,"asn":47447,"as":"23M GmbH","country":"Germany","country_code":"DE"},"introduction_type":"scriptElement","is_inline":false,"md5":"81ed7a494e1943be2844e95f9770844c","sha1":"b063d0aa57f0c50d9bfb9895b76a9467155df7f1","sha256":"70dae469f94f214b589d53521b903830a08b4fb589d47a4c269a83c79116886a","sha512":"f6733a930c491ecd70c6fe981e73386054b0c5256d0437cb4998556dbb1e0e5167f266a0595f3d7af3f211c717b7a848517e7dbcf47b8d96d3738af1b800d91d","ssdeep":"1536:sNhEyjjTikEJO4edXXe9J578go6MWXqcVhkLyB4Lw13sh2bzrlk+iuH7U3gBORDj:qxcq0hkLZwpsYbbzORDU8Cuh","tlshash":"f183d5d9b2c670529b7730b850bf450bb17a98dab44c8d60f068c5d57eb8a8e507bf2c","size":86711,"data":"","first_seen":"2023-03-07T01:20:21Z","last_seen":"2026-08-12T09:42:15.503601Z","times_seen":1009,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"redwinezoonma.12hp.ch/wp-includes/theme-compat/dfr1mxl/vglorbt/dxvcagm/Netease/neteasyes/neteasyest/900/js/jquery-3.2.1.slim.min.js","fqdn":"redwinezoonma.12hp.ch","domain":"redwinezoonma.12hp.ch","tld":"12hp.ch"},"ip":{"addr":"91.216.248.22","port":443,"asn":47447,"as":"23M GmbH","country":"Germany","country_code":"DE"},"introduction_type":"scriptElement","is_inline":false,"md5":"e4f60e36fb624b3b4dd616ce75a0bf3c","sha1":"8856754bdf9b102d046b16f91feb203c606b32bd","sha256":"91a04a5dfe501d54af8a59b942495bd7ab26bb811ab34f460115fc0267f825f1","sha512":"ab0f9123b45bec874ff48f769eee0a019cce50c6fc6da66f059ccf6b92f007677dfefd7ff77e54c4e8a0c9a0b1d539fc3ad3be9474103942306e87abb40dab8c","ssdeep":"1536:qNhEyjjTikEJO4edXXe9J578go6MWX2xkjVe4c4j2ll2Ac7pK3F71QDU8Cuj:Exc2yjq4j2uYnQDU8Cuj","tlshash":"ae63d5d9b2c67062db7730b950bf410bf07a98dab44c8c60e198d8d47d78a99817bf2d","size":69596,"data":"","first_seen":"2023-03-07T01:20:21Z","last_seen":"2026-08-12T09:42:15.496781Z","times_seen":515,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"redwinezoonma.12hp.ch/wp-includes/theme-compat/dfr1mxl/vglorbt/dxvcagm/Netease/neteasyes/neteasyest/900/js/popper.min.js","fqdn":"redwinezoonma.12hp.ch","domain":"redwinezoonma.12hp.ch","tld":"12hp.ch"},"ip":{"addr":"91.216.248.22","port":443,"asn":47447,"as":"23M GmbH","country":"Germany","country_code":"DE"},"introduction_type":"scriptElement","is_inline":false,"md5":"124bf4d1a7db31dd60d4642dce268035","sha1":"d3745247363d9cb016aaef057bbf2a363796cc01","sha256":"5614d21225b2e012e3765c1b32fba0b8762bcecd8863c8705c1bcc0d03ec19de","sha512":"2d9f8b89336c39da4aface69209c016e2edc4449f134129e3c6453240bb90e7b81e6386a4a0a430892eb131faa4b6f45882f3c5b9e53b89443c66b589d5158e2","ssdeep":"384:+CbuG4xGNoDic2UjKPafxwC5b/4xQviOJU7QzxzivDdE3pcGdjkd/9jt3B+Kb96G:zb4xGmiJfaf7gxQvVU7eziv+cSjknZ33","tlshash":"4882a3cc3291b06643a79167a06f960fb2339979614e9410f199f2d87c70ef9913fc7a","size":19187,"data":"","first_seen":"2023-03-07T01:20:21Z","last_seen":"2026-08-12T09:42:15.472183Z","times_seen":1874,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"maxcdn.bootstrapcdn.com/bootstrap/4.0.0/js/bootstrap.min.js","fqdn":"maxcdn.bootstrapcdn.com","domain":"bootstrapcdn.com","tld":"com"},"ip":{"addr":"104.18.11.207","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"scriptElement","is_inline":false,"md5":"14d449eb8876fa55e1ef3c2cc52b0c17","sha1":"a9545831803b1359cfeed47e3b4d6bae68e40e99","sha256":"e7ed36ceee5450b4243bbc35188afabdfb4280c7c57597001de0ed167299b01b","sha512":"00d9069b9bd29ad0daa0503f341d67549cce28e888e1affd1a2a45b64a4c1bc460d81cfc4751857f991f2f4fb3d2572fd97fca651ba0c2b0255530209b182f22","ssdeep":"768:9VG5R15WbHVKZrycEHSYro34CrSLB6WU/6DqBf4l1B:9VIRuo53XiwWTvl1B","tlshash":"7523c84a7254b4a202dfa476913f450bb73b389aa60bc16cb95994ed1d7cd8c3227f3c","size":48944,"data":"","first_seen":"2023-03-07T01:02:44Z","last_seen":"2026-08-13T19:30:16.578876Z","times_seen":110817,"alerts":{"ids":null,"analyzer":null,"urlquery":null}}],"eval":null,"write":null,"console":null},"http":[{"url":{"schema":"https","addr":"kit.fontawesome.com/585b051251.js","fqdn":"kit.fontawesome.com","domain":"fontawesome.com","tld":"com"},"ip":{"addr":"104.18.40.68","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://redwinezoonma.12hp.ch/wp-includes/theme-compat/dfr1mxl/vglorbt/dxvcagm/Netease/neteasyes/neteasyest/900/index.php","date":"2026-08-02T00:30:48.336Z","timestamp":1785630648336,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"fontawesome.com","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Sun, 14 Jun 2026 22:11:17 GMT","end":"Sat, 12 Sep 2026 23:11:14 GMT"},"fingerprint":{"sha1":"5F:59:20:85:C5:A0:F2:76:30:C4:8D:DA:FB:31:7C:05:93:3C:16:93","sha256":"C0:AB:A6:29:FC:00:73:C0:2F:17:52:AA:D7:E8:27:80:98:13:B4:AB:F6:09:35:46:3E:53:8E:61:E3:6F:47:67"}}},"request":{"raw":"GET /585b051251.js HTTP/1.1\r\nHost: kit.fontawesome.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nOrigin: https://redwinezoonma.12hp.ch\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://redwinezoonma.12hp.ch/\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPriority: u=2\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 403 \r\ndate: Sun, 02 Aug 2026 00:30:48 GMT\r\ncontent-length: 9\r\naccess-control-allow-headers: accept, accept-langauge, content-language, content-type, fa-kit-token\r\naccess-control-allow-methods: GET, OPTIONS\r\naccess-control-allow-origin: *\r\naccess-control-max-age: 3000\r\ncache-control: max-age=0, private, must-revalidate\r\nserver: cloudflare\r\nx-request-id: GMfVnTOLbpuKykbuQKNB\r\ncf-cache-status: BYPASS\r\ncf-ray: a248f9e03f720daa-OSL\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"403","status_text":"","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":9,"size_decoded":470,"mime_type":"text/plain","magic":"ASCII text, with no line terminators","md5":"722969577a96ca3953e84e3d949dee81","sha1":"3dab5f6012e3e149b5a939b9cebba4a0b84dc8f5","sha256":"78342a0905a72ce44da083dcb5d23b8ea0c16992ba2a82eece97e033d76ba3d3","sha512":"54b2b4596cd1769e46a12a0ca6ede70468985cf8771c2b11e75b3f52567a64418bc24c067d96d52037e0e135e7a7ff828ad0241d55b827506e1c67de1caee8bc","ssdeep":"","tlshash":"26500000000c000c33c3030000000f000003030000030000cf000003000000c00c000c","first_seen":"2023-04-05T07:39:32Z","last_seen":"2026-08-13T21:22:48.891416Z","times_seen":32339,"resource_available":true,"data":null}},"time_used":164,"timings":{"blocked":-1,"dns":3,"connect":1,"send":0,"wait":144,"receive":0,"ssl":15},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"redwinezoonma.12hp.ch/wp-includes/theme-compat/dfr1mxl/vglorbt/dxvcagm/Netease/neteasyes/neteasyest/900/js/popper.min.js","fqdn":"redwinezoonma.12hp.ch","domain":"redwinezoonma.12hp.ch","tld":"12hp.ch"},"ip":{"addr":"91.216.248.22","port":443,"asn":47447,"as":"23M GmbH","country":"Germany","country_code":"DE"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://redwinezoonma.12hp.ch/wp-includes/theme-compat/dfr1mxl/vglorbt/dxvcagm/Netease/neteasyes/neteasyest/900/index.php","date":"2026-08-02T00:30:48.339Z","timestamp":1785630648339,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"12hp.ch","organization":""},"issuer":{"commonName":"YE2","organization":"Let's Encrypt"},"validity":{"start":"Thu, 09 Jul 2026 01:21:02 GMT","end":"Wed, 07 Oct 2026 01:21:01 GMT"},"fingerprint":{"sha1":"82:58:D1:30:C5:80:DA:F2:E1:64:92:35:08:9F:E3:9F:4D:31:90:01","sha256":"30:6F:E9:D1:4C:AD:14:EE:1D:1C:D9:C2:44:1C:C2:97:EE:C0:27:E8:82:0D:99:49:79:EB:09:7D:5F:AE:31:92"}}},"request":{"raw":"GET /wp-includes/theme-compat/dfr1mxl/vglorbt/dxvcagm/Netease/neteasyes/neteasyest/900/js/popper.min.js HTTP/1.1\r\nHost: redwinezoonma.12hp.ch\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://redwinezoonma.12hp.ch/wp-includes/theme-compat/dfr1mxl/vglorbt/dxvcagm/Netease/neteasyes/neteasyest/900/index.php\r\nCookie: _lcp=a\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nserver: openresty\r\ndate: Sun, 02 Aug 2026 00:30:48 GMT\r\ncontent-type: text/javascript\r\ncontent-length: 6910\r\nx-lima-id: gaG6gGJWLpCTRLiwE9\r\nset-cookie: _lcp2=a; Path=/; Expires=Mon, 20 Mar 2034 13:02:58 GMT; SameSite=Lax; HttpOnly\r\nlast-modified: Thu, 29 Oct 2020 06:35:26 GMT\r\netag: \"4af3-5b2c97c3b8780-gzip\"\r\naccept-ranges: bytes\r\ncache-control: max-age=604800\r\nexpires: Sun, 09 Aug 2026 00:30:48 GMT\r\nvary: Accept-Encoding\r\ncontent-encoding: gzip\r\ncontent-security-policy: upgrade-insecure-requests\r\nstrict-transport-security: max-age=31536000; includeSubDomains; preload\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"OpenResty","description":"OpenResty is a web platform based on nginx which can run Lua scripts using its LuaJIT engine.","website":"https://openresty.org","common_platform_enumeration":"","icon":"OpenResty.svg","categories":["Web servers"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":19187,"size_decoded":7521,"mime_type":"text/javascript","magic":"JavaScript source, ASCII text, with very long lines (19015)","md5":"124bf4d1a7db31dd60d4642dce268035","sha1":"d3745247363d9cb016aaef057bbf2a363796cc01","sha256":"5614d21225b2e012e3765c1b32fba0b8762bcecd8863c8705c1bcc0d03ec19de","sha512":"2d9f8b89336c39da4aface69209c016e2edc4449f134129e3c6453240bb90e7b81e6386a4a0a430892eb131faa4b6f45882f3c5b9e53b89443c66b589d5158e2","ssdeep":"384:+CbuG4xGNoDic2UjKPafxwC5b/4xQviOJU7QzxzivDdE3pcGdjkd/9jt3B+Kb96G:zb4xGmiJfaf7gxQvVU7eziv+cSjknZ33","tlshash":"4882a3cc3291b06643a79167a06f960fb2339979614e9410f199f2d87c70ef9913fc7a","first_seen":"2023-03-07T01:20:21Z","last_seen":"2026-08-12T09:42:15.472183Z","times_seen":1874,"resource_available":true,"data":null}},"time_used":39,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":39,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-08-02","alert":"Sinkholed","trigger":"redwinezoonma.12hp.ch","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-08-02","alert":"Sinkholed","trigger":"redwinezoonma.12hp.ch","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"maxcdn.bootstrapcdn.com/bootstrap/4.0.0/js/bootstrap.min.js","fqdn":"maxcdn.bootstrapcdn.com","domain":"bootstrapcdn.com","tld":"com"},"ip":{"addr":"104.18.11.207","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://redwinezoonma.12hp.ch/wp-includes/theme-compat/dfr1mxl/vglorbt/dxvcagm/Netease/neteasyes/neteasyest/900/index.php","date":"2026-08-02T00:30:48.341Z","timestamp":1785630648341,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"bootstrapcdn.com","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Wed, 01 Jul 2026 06:33:56 GMT","end":"Tue, 29 Sep 2026 07:33:46 GMT"},"fingerprint":{"sha1":"95:C5:B1:CC:FD:2D:A2:1D:9E:F8:29:11:70:8F:C2:32:DB:0A:16:D8","sha256":"67:23:C0:55:AC:EE:9D:BF:1F:32:F6:C6:31:3A:5A:3F:85:B5:50:88:71:96:38:D1:BB:37:21:B0:0C:CF:B9:EA"}}},"request":{"raw":"GET /bootstrap/4.0.0/js/bootstrap.min.js HTTP/1.1\r\nHost: maxcdn.bootstrapcdn.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-Fetch-Storage-Access: none\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://redwinezoonma.12hp.ch/\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\ndate: Sun, 02 Aug 2026 00:30:48 GMT\r\ncontent-type: application/javascript; charset=utf-8\r\npriority: u=3,i=?0\r\nserver: cloudflare\r\ncdn-pullzone: 252412\r\ncdn-requestcountrycode: DE\r\nvary: Accept-Encoding\r\naccess-control-allow-origin: *\r\ncache-control: public, max-age=31919000\r\ncontent-encoding: br\r\netag: \"14d449eb8876fa55e1ef3c2cc52b0c17\"\r\nlast-modified: Mon, 25 Jan 2021 22:04:04 GMT\r\ncdn-cachedat: 03/22/2025 12:19:15\r\ncdn-proxyver: 1.22\r\ncdn-requestpullcode: 200\r\ncdn-requestpullsuccess: True\r\ncdn-edgestorageid: 1048\r\ntiming-allow-origin: *\r\ncross-origin-resource-policy: cross-origin\r\nx-content-type-options: nosniff\r\ncdn-status: 200\r\ncdn-requesttime: 0\r\ncdn-requestid: aa18ff3ef6b20a9742247cfaa006fdc6\r\ncdn-cache: HIT\r\nage: 4658811\r\ncf-cache-status: HIT\r\nstrict-transport-security: max-age=31536000; includeSubDomains; preload\r\ncf-ray: a248f9e03ab64c11-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":48944,"size_decoded":14463,"mime_type":"application/javascript; charset=utf-8","magic":"JavaScript source, ASCII text, with very long lines (48664)","md5":"14d449eb8876fa55e1ef3c2cc52b0c17","sha1":"a9545831803b1359cfeed47e3b4d6bae68e40e99","sha256":"e7ed36ceee5450b4243bbc35188afabdfb4280c7c57597001de0ed167299b01b","sha512":"00d9069b9bd29ad0daa0503f341d67549cce28e888e1affd1a2a45b64a4c1bc460d81cfc4751857f991f2f4fb3d2572fd97fca651ba0c2b0255530209b182f22","ssdeep":"768:9VG5R15WbHVKZrycEHSYro34CrSLB6WU/6DqBf4l1B:9VIRuo53XiwWTvl1B","tlshash":"7523c84a7254b4a202dfa476913f450bb73b389aa60bc16cb95994ed1d7cd8c3227f3c","first_seen":"2023-03-07T01:02:44Z","last_seen":"2026-08-13T19:30:16.578876Z","times_seen":110817,"resource_available":true,"data":null}},"time_used":7,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":6,"receive":1,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"stackpath.bootstrapcdn.com/bootstrap/4.1.3/js/bootstrap.min.js","fqdn":"stackpath.bootstrapcdn.com","domain":"bootstrapcdn.com","tld":"com"},"ip":{"addr":"104.18.10.207","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://redwinezoonma.12hp.ch/wp-includes/theme-compat/dfr1mxl/vglorbt/dxvcagm/Netease/neteasyes/neteasyest/900/index.php","date":"2026-08-02T00:30:48.343Z","timestamp":1785630648343,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"bootstrapcdn.com","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Wed, 01 Jul 2026 06:33:56 GMT","end":"Tue, 29 Sep 2026 07:33:46 GMT"},"fingerprint":{"sha1":"95:C5:B1:CC:FD:2D:A2:1D:9E:F8:29:11:70:8F:C2:32:DB:0A:16:D8","sha256":"67:23:C0:55:AC:EE:9D:BF:1F:32:F6:C6:31:3A:5A:3F:85:B5:50:88:71:96:38:D1:BB:37:21:B0:0C:CF:B9:EA"}}},"request":{"raw":"GET /bootstrap/4.1.3/js/bootstrap.min.js HTTP/1.1\r\nHost: stackpath.bootstrapcdn.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-Fetch-Storage-Access: none\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://redwinezoonma.12hp.ch/\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\ndate: Sun, 02 Aug 2026 00:30:48 GMT\r\ncontent-type: application/javascript; charset=utf-8\r\npriority: u=3,i=?0\r\nserver: cloudflare\r\ncdn-pullzone: 252412\r\ncdn-requestcountrycode: DE\r\nvary: Accept-Encoding\r\naccess-control-allow-origin: *\r\ncache-control: public, max-age=31919000\r\ncontent-encoding: br\r\netag: \"67176c242e1bdc20603c878dee836df3\"\r\nlast-modified: Mon, 25 Jan 2021 22:04:06 GMT\r\ncdn-cachedat: 08/01/2025 15:36:25\r\ncdn-proxyver: 1.33\r\ncdn-requestpullcode: 200\r\ncdn-requestpullsuccess: True\r\ncdn-edgestorageid: 1078\r\ntiming-allow-origin: *\r\ncross-origin-resource-policy: cross-origin\r\nx-content-type-options: nosniff\r\ncdn-status: 200\r\ncdn-requesttime: 0\r\ncdn-requestid: a78b5a25cfaf2df533c60a6d4fa388d4\r\ncdn-cache: HIT\r\nage: 1879864\r\ncf-cache-status: HIT\r\nstrict-transport-security: max-age=31536000; includeSubDomains; preload\r\ncf-ray: a248f9e03cdf56a2-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":51039,"size_decoded":15426,"mime_type":"application/javascript; charset=utf-8","magic":"JavaScript source, ASCII text, with very long lines (50758)","md5":"67176c242e1bdc20603c878dee836df3","sha1":"27a71b00383d61ef3c489326b3564d698fc1227c","sha256":"56c12a125b021d21a69e61d7190cefa168d6c28ce715265cea1b3b0112d169c4","sha512":"9fa75814e1b9f7db38fe61a503a13e60b82d83db8f4ce30351bd08a6b48c0d854baf472d891af23c443c8293380c2325c7b3361b708af9971aa0ea09a25cdd0a","ssdeep":"768:E9Yw7GuJM+HV0cen/7Kh5rM7V4RxCKg8FW/xsXQUd+FiID65r48Hgp5HRl+:E9X7PMIM7V4R5LFAxTWyuHHgp5HRl+","tlshash":"3533b649725078b201df9176913f460bb736788ea907816cb95d98ed2e7cd89322bf3c","first_seen":"2023-03-07T01:02:44Z","last_seen":"2026-08-13T19:56:55.176491Z","times_seen":126152,"resource_available":true,"data":null}},"time_used":21,"timings":{"blocked":-1,"dns":3,"connect":10,"send":0,"wait":7,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"redwinezoonma.12hp.ch/wp-includes/theme-compat/dfr1mxl/vglorbt/dxvcagm/Netease/neteasyes/neteasyest/900/js/jquery-3.3.1.js","fqdn":"redwinezoonma.12hp.ch","domain":"redwinezoonma.12hp.ch","tld":"12hp.ch"},"ip":{"addr":"91.216.248.22","port":443,"asn":47447,"as":"23M GmbH","country":"Germany","country_code":"DE"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://redwinezoonma.12hp.ch/wp-includes/theme-compat/dfr1mxl/vglorbt/dxvcagm/Netease/neteasyes/neteasyest/900/index.php","date":"2026-08-02T00:30:48.414Z","timestamp":1785630648414,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"12hp.ch","organization":""},"issuer":{"commonName":"YE2","organization":"Let's Encrypt"},"validity":{"start":"Thu, 09 Jul 2026 01:21:02 GMT","end":"Wed, 07 Oct 2026 01:21:01 GMT"},"fingerprint":{"sha1":"82:58:D1:30:C5:80:DA:F2:E1:64:92:35:08:9F:E3:9F:4D:31:90:01","sha256":"30:6F:E9:D1:4C:AD:14:EE:1D:1C:D9:C2:44:1C:C2:97:EE:C0:27:E8:82:0D:99:49:79:EB:09:7D:5F:AE:31:92"}}},"request":{"raw":"GET /wp-includes/theme-compat/dfr1mxl/vglorbt/dxvcagm/Netease/neteasyes/neteasyest/900/js/jquery-3.3.1.js HTTP/1.1\r\nHost: redwinezoonma.12hp.ch\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://redwinezoonma.12hp.ch/wp-includes/theme-compat/dfr1mxl/vglorbt/dxvcagm/Netease/neteasyes/neteasyest/900/index.php\r\nCookie: _lcp=a; _lcp2=a\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 503 \r\nserver: openresty\r\ndate: Sun, 02 Aug 2026 00:30:48 GMT\r\ncontent-type: text/html; charset=utf-8\r\nx-lima-id: gaHCZloa26ls5GbCtm\r\nx-powered-by: PHP/8.3.32\r\nretry-after: 3600\r\ncache-control: no-store, no-cache, must-revalidate, max-age=0\r\npragma: no-cache\r\nexpires: 0\r\ncontent-security-policy: upgrade-insecure-requests\r\nstrict-transport-security: max-age=31536000; includeSubDomains; preload\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"503","status_text":"","fingerprints":[{"name":"PHP:8.3.32","description":"PHP is a general-purpose scripting language used for web development.","website":"https://php.net","common_platform_enumeration":"cpe:2.3:a:php:php:*:*:*:*:*:*:*:*","icon":"PHP.svg","categories":["Programming languages"]},{"name":"OpenResty","description":"OpenResty is a web platform based on nginx which can run Lua scripts using its LuaJIT engine.","website":"https://openresty.org","common_platform_enumeration":"","icon":"OpenResty.svg","categories":["Web servers"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":1823,"size_decoded":2248,"mime_type":"text/html; charset=utf-8","magic":"HTML document, ASCII text","md5":"081ddeb32e5f08c1c9d1ff157aa70f70","sha1":"a1bd8e7fb7eab3f7f0e3f5e64aa2de9097b5cd6b","sha256":"ccc140face129de5ee94b2a0c6ece068e1beec8f8dde1fbeeb064d97b154d54c","sha512":"2d676e5f4e6fff11003ae509c2306e1db349210c7f6d7355133f1c39e7a011ee6ce308522df32c1a7b43bf2c45ade199206c279f82517143f87b821b14a9073f","ssdeep":"","tlshash":"c83172679685080b7477d8386bd6165835c85827a11b84e4bfceb78ccfc2a8ac5a1f0c","first_seen":"2026-08-02T00:31:16.604318Z","last_seen":"2026-08-02T00:31:16.604318Z","times_seen":1,"resource_available":false,"data":null}},"time_used":37,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":37,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-08-02","alert":"Sinkholed","trigger":"redwinezoonma.12hp.ch","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-08-02","alert":"Sinkholed","trigger":"redwinezoonma.12hp.ch","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"redwinezoonma.12hp.ch/wp-includes/theme-compat/dfr1mxl/vglorbt/dxvcagm/Netease/neteasyes/neteasyest/900/js/jquery.min.js","fqdn":"redwinezoonma.12hp.ch","domain":"redwinezoonma.12hp.ch","tld":"12hp.ch"},"ip":{"addr":"91.216.248.22","port":443,"asn":47447,"as":"23M GmbH","country":"Germany","country_code":"DE"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://redwinezoonma.12hp.ch/wp-includes/theme-compat/dfr1mxl/vglorbt/dxvcagm/Netease/neteasyes/neteasyest/900/index.php","date":"2026-08-02T00:30:48.153Z","timestamp":1785630648153,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"12hp.ch","organization":""},"issuer":{"commonName":"YE2","organization":"Let's Encrypt"},"validity":{"start":"Thu, 09 Jul 2026 01:21:02 GMT","end":"Wed, 07 Oct 2026 01:21:01 GMT"},"fingerprint":{"sha1":"82:58:D1:30:C5:80:DA:F2:E1:64:92:35:08:9F:E3:9F:4D:31:90:01","sha256":"30:6F:E9:D1:4C:AD:14:EE:1D:1C:D9:C2:44:1C:C2:97:EE:C0:27:E8:82:0D:99:49:79:EB:09:7D:5F:AE:31:92"}}},"request":{"raw":"GET /wp-includes/theme-compat/dfr1mxl/vglorbt/dxvcagm/Netease/neteasyes/neteasyest/900/js/jquery.min.js HTTP/1.1\r\nHost: redwinezoonma.12hp.ch\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://redwinezoonma.12hp.ch/wp-includes/theme-compat/dfr1mxl/vglorbt/dxvcagm/Netease/neteasyes/neteasyest/900/index.php\r\nCookie: _lcp=a\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=2\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nserver: openresty\r\ndate: Sun, 02 Aug 2026 00:30:48 GMT\r\ncontent-type: text/javascript\r\ncontent-length: 29827\r\nx-lima-id: gasUcOFLG9QPt0Df1f\r\nset-cookie: _lcp2=a; Path=/; Expires=Mon, 20 Mar 2034 13:02:58 GMT; SameSite=Lax; HttpOnly\r\nlast-modified: Thu, 29 Oct 2020 06:28:00 GMT\r\netag: \"14e4c-5b2c961a61c00-gzip\"\r\naccept-ranges: bytes\r\ncache-control: max-age=604800\r\nexpires: Sun, 09 Aug 2026 00:30:48 GMT\r\nvary: Accept-Encoding\r\ncontent-encoding: gzip\r\ncontent-security-policy: upgrade-insecure-requests\r\nstrict-transport-security: max-age=31536000; includeSubDomains; preload\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"OpenResty","description":"OpenResty is a web platform based on nginx which can run Lua scripts using its LuaJIT engine.","website":"https://openresty.org","common_platform_enumeration":"","icon":"OpenResty.svg","categories":["Web servers"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":85580,"size_decoded":30440,"mime_type":"text/javascript","magic":"JavaScript source, ASCII text, with very long lines (32065), with CRLF line terminators","md5":"adb784ef9dc257b32965a5da7ee82a8b","sha1":"7a41c488d820ea08231d1d393e5f4daed4d25041","sha256":"8e09aa31f396ea41d698f437dc5fc7125e931d400eb2873f5b68ef78c1e6f3a6","sha512":"bc8fcdf5a4645443c394b0d1b7222b2e2321a4558cd39cfac18c88aa1abc44d4317a94a26b0f8444f6700197fe2a90d2812c42fb1f85fc5ae33069343579d4df","ssdeep":"1536:fYE1JVoiB9JqZdXXe2pD3PgoIiulrUn6Z6a4tfOR7WpfWBZPBJda4w9W3qG9a98Q:u4J+rlfOhWpgCW6G9a98HrU","tlshash":"1383c6d9b2d6706297b734b850bf410bb17a98dab44c8c60f059d4e47eb4a8e507bf2c","first_seen":"2023-03-07T01:20:21Z","last_seen":"2026-08-12T15:05:52.4124Z","times_seen":2203,"resource_available":true,"data":null}},"time_used":65,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":60,"receive":5,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-08-02","alert":"Sinkholed","trigger":"redwinezoonma.12hp.ch","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-08-02","alert":"Sinkholed","trigger":"redwinezoonma.12hp.ch","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"redwinezoonma.12hp.ch/wp-includes/theme-compat/dfr1mxl/vglorbt/dxvcagm/Netease/neteasyes/neteasyest/900/js/jquery-3.1.1.min.js","fqdn":"redwinezoonma.12hp.ch","domain":"redwinezoonma.12hp.ch","tld":"12hp.ch"},"ip":{"addr":"91.216.248.22","port":443,"asn":47447,"as":"23M GmbH","country":"Germany","country_code":"DE"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://redwinezoonma.12hp.ch/wp-includes/theme-compat/dfr1mxl/vglorbt/dxvcagm/Netease/neteasyes/neteasyest/900/index.php","date":"2026-08-02T00:30:48.156Z","timestamp":1785630648156,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"12hp.ch","organization":""},"issuer":{"commonName":"YE2","organization":"Let's Encrypt"},"validity":{"start":"Thu, 09 Jul 2026 01:21:02 GMT","end":"Wed, 07 Oct 2026 01:21:01 GMT"},"fingerprint":{"sha1":"82:58:D1:30:C5:80:DA:F2:E1:64:92:35:08:9F:E3:9F:4D:31:90:01","sha256":"30:6F:E9:D1:4C:AD:14:EE:1D:1C:D9:C2:44:1C:C2:97:EE:C0:27:E8:82:0D:99:49:79:EB:09:7D:5F:AE:31:92"}}},"request":{"raw":"GET /wp-includes/theme-compat/dfr1mxl/vglorbt/dxvcagm/Netease/neteasyes/neteasyest/900/js/jquery-3.1.1.min.js HTTP/1.1\r\nHost: redwinezoonma.12hp.ch\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://redwinezoonma.12hp.ch/wp-includes/theme-compat/dfr1mxl/vglorbt/dxvcagm/Netease/neteasyes/neteasyest/900/index.php\r\nCookie: _lcp=a\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=2\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nserver: openresty\r\ndate: Sun, 02 Aug 2026 00:30:48 GMT\r\ncontent-type: text/javascript\r\ncontent-length: 30086\r\nx-lima-id: gagnpXjFossaUe4fgI\r\nset-cookie: _lcp2=a; Path=/; Expires=Mon, 20 Mar 2034 13:02:58 GMT; SameSite=Lax; HttpOnly\r\nlast-modified: Thu, 29 Oct 2020 06:28:00 GMT\r\netag: \"152b7-5b2c961a61c00-gzip\"\r\naccept-ranges: bytes\r\ncache-control: max-age=604800\r\nexpires: Sun, 09 Aug 2026 00:30:48 GMT\r\nvary: Accept-Encoding\r\ncontent-encoding: gzip\r\ncontent-security-policy: upgrade-insecure-requests\r\nstrict-transport-security: max-age=31536000; includeSubDomains; preload\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"OpenResty","description":"OpenResty is a web platform based on nginx which can run Lua scripts using its LuaJIT engine.","website":"https://openresty.org","common_platform_enumeration":"","icon":"OpenResty.svg","categories":["Web servers"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":86711,"size_decoded":30699,"mime_type":"text/javascript","magic":"JavaScript source, ASCII text, with very long lines (32030), with CRLF line terminators","md5":"81ed7a494e1943be2844e95f9770844c","sha1":"b063d0aa57f0c50d9bfb9895b76a9467155df7f1","sha256":"70dae469f94f214b589d53521b903830a08b4fb589d47a4c269a83c79116886a","sha512":"f6733a930c491ecd70c6fe981e73386054b0c5256d0437cb4998556dbb1e0e5167f266a0595f3d7af3f211c717b7a848517e7dbcf47b8d96d3738af1b800d91d","ssdeep":"1536:sNhEyjjTikEJO4edXXe9J578go6MWXqcVhkLyB4Lw13sh2bzrlk+iuH7U3gBORDj:qxcq0hkLZwpsYbbzORDU8Cuh","tlshash":"f183d5d9b2c670529b7730b850bf450bb17a98dab44c8d60f068c5d57eb8a8e507bf2c","first_seen":"2023-03-07T01:20:21Z","last_seen":"2026-08-12T09:42:15.503601Z","times_seen":1009,"resource_available":true,"data":null}},"time_used":77,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":57,"receive":20,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-08-02","alert":"Sinkholed","trigger":"redwinezoonma.12hp.ch","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-08-02","alert":"Sinkholed","trigger":"redwinezoonma.12hp.ch","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"redwinezoonma.12hp.ch/wp-includes/theme-compat/dfr1mxl/vglorbt/dxvcagm/Netease/neteasyes/neteasyest/900/js/jquery-3.2.1.slim.min.js","fqdn":"redwinezoonma.12hp.ch","domain":"redwinezoonma.12hp.ch","tld":"12hp.ch"},"ip":{"addr":"91.216.248.22","port":443,"asn":47447,"as":"23M GmbH","country":"Germany","country_code":"DE"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://redwinezoonma.12hp.ch/wp-includes/theme-compat/dfr1mxl/vglorbt/dxvcagm/Netease/neteasyes/neteasyest/900/index.php","date":"2026-08-02T00:30:48.337Z","timestamp":1785630648337,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"12hp.ch","organization":""},"issuer":{"commonName":"YE2","organization":"Let's Encrypt"},"validity":{"start":"Thu, 09 Jul 2026 01:21:02 GMT","end":"Wed, 07 Oct 2026 01:21:01 GMT"},"fingerprint":{"sha1":"82:58:D1:30:C5:80:DA:F2:E1:64:92:35:08:9F:E3:9F:4D:31:90:01","sha256":"30:6F:E9:D1:4C:AD:14:EE:1D:1C:D9:C2:44:1C:C2:97:EE:C0:27:E8:82:0D:99:49:79:EB:09:7D:5F:AE:31:92"}}},"request":{"raw":"GET /wp-includes/theme-compat/dfr1mxl/vglorbt/dxvcagm/Netease/neteasyes/neteasyest/900/js/jquery-3.2.1.slim.min.js HTTP/1.1\r\nHost: redwinezoonma.12hp.ch\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://redwinezoonma.12hp.ch/wp-includes/theme-compat/dfr1mxl/vglorbt/dxvcagm/Netease/neteasyes/neteasyest/900/index.php\r\nCookie: _lcp=a\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nserver: openresty\r\ndate: Sun, 02 Aug 2026 00:30:48 GMT\r\ncontent-type: text/javascript\r\ncontent-length: 23897\r\nx-lima-id: gaFHyGO9V5fBcw0jgM\r\nset-cookie: _lcp2=a; Path=/; Expires=Mon, 20 Mar 2034 13:02:58 GMT; SameSite=Lax; HttpOnly\r\nlast-modified: Thu, 29 Oct 2020 06:33:16 GMT\r\netag: \"10fdc-5b2c9747be300-gzip\"\r\naccept-ranges: bytes\r\ncache-control: max-age=604800\r\nexpires: Sun, 09 Aug 2026 00:30:48 GMT\r\nvary: Accept-Encoding\r\ncontent-encoding: gzip\r\ncontent-security-policy: upgrade-insecure-requests\r\nstrict-transport-security: max-age=31536000; includeSubDomains; preload\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"OpenResty","description":"OpenResty is a web platform based on nginx which can run Lua scripts using its LuaJIT engine.","website":"https://openresty.org","common_platform_enumeration":"","icon":"OpenResty.svg","categories":["Web servers"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":69596,"size_decoded":24510,"mime_type":"text/javascript","magic":"JavaScript source, ASCII text, with very long lines (32012)","md5":"e4f60e36fb624b3b4dd616ce75a0bf3c","sha1":"8856754bdf9b102d046b16f91feb203c606b32bd","sha256":"91a04a5dfe501d54af8a59b942495bd7ab26bb811ab34f460115fc0267f825f1","sha512":"ab0f9123b45bec874ff48f769eee0a019cce50c6fc6da66f059ccf6b92f007677dfefd7ff77e54c4e8a0c9a0b1d539fc3ad3be9474103942306e87abb40dab8c","ssdeep":"1536:qNhEyjjTikEJO4edXXe9J578go6MWX2xkjVe4c4j2ll2Ac7pK3F71QDU8Cuj:Exc2yjq4j2uYnQDU8Cuj","tlshash":"ae63d5d9b2c67062db7730b950bf410bf07a98dab44c8c60e198d8d47d78a99817bf2d","first_seen":"2023-03-07T01:20:21Z","last_seen":"2026-08-12T09:42:15.496781Z","times_seen":515,"resource_available":true,"data":null}},"time_used":43,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":43,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-08-02","alert":"Sinkholed","trigger":"redwinezoonma.12hp.ch","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-08-02","alert":"Sinkholed","trigger":"redwinezoonma.12hp.ch","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"redwinezoonma.12hp.ch/wp-includes/theme-compat/dfr1mxl/vglorbt/dxvcagm/Netease/neteasyes/neteasyest/900/images/bg.png","fqdn":"redwinezoonma.12hp.ch","domain":"redwinezoonma.12hp.ch","tld":"12hp.ch"},"ip":{"addr":"91.216.248.22","port":443,"asn":47447,"as":"23M GmbH","country":"Germany","country_code":"DE"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://redwinezoonma.12hp.ch/wp-includes/theme-compat/dfr1mxl/vglorbt/dxvcagm/Netease/neteasyes/neteasyest/900/index.php","date":"2026-08-02T00:30:48.514Z","timestamp":1785630648514,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"12hp.ch","organization":""},"issuer":{"commonName":"YE2","organization":"Let's Encrypt"},"validity":{"start":"Thu, 09 Jul 2026 01:21:02 GMT","end":"Wed, 07 Oct 2026 01:21:01 GMT"},"fingerprint":{"sha1":"82:58:D1:30:C5:80:DA:F2:E1:64:92:35:08:9F:E3:9F:4D:31:90:01","sha256":"30:6F:E9:D1:4C:AD:14:EE:1D:1C:D9:C2:44:1C:C2:97:EE:C0:27:E8:82:0D:99:49:79:EB:09:7D:5F:AE:31:92"}}},"request":{"raw":"GET /wp-includes/theme-compat/dfr1mxl/vglorbt/dxvcagm/Netease/neteasyes/neteasyest/900/images/bg.png HTTP/1.1\r\nHost: redwinezoonma.12hp.ch\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://redwinezoonma.12hp.ch/wp-includes/theme-compat/dfr1mxl/vglorbt/dxvcagm/Netease/neteasyes/neteasyest/900/index.php\r\nCookie: _lcp=a; _lcp2=a\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=4, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nserver: openresty\r\ndate: Sun, 02 Aug 2026 00:30:48 GMT\r\ncontent-type: image/png\r\ncontent-length: 342575\r\nx-lima-id: gawI2JWzrZcLaUff6n\r\nlast-modified: Sat, 30 Jul 2022 12:24:02 GMT\r\netag: \"53a2f-5e504d784fc80\"\r\naccept-ranges: bytes\r\ncache-control: max-age=2592000\r\nexpires: Tue, 01 Sep 2026 00:30:48 GMT\r\ncontent-security-policy: upgrade-insecure-requests\r\nstrict-transport-security: max-age=31536000; includeSubDomains; preload\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"OpenResty","description":"OpenResty is a web platform based on nginx which can run Lua scripts using its LuaJIT engine.","website":"https://openresty.org","common_platform_enumeration":"","icon":"OpenResty.svg","categories":["Web servers"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":342575,"size_decoded":343040,"mime_type":"image/png","magic":"PNG image data, 1440 x 756, 8-bit/color RGBA, non-interlaced","md5":"75edc15f3146b40ed6ab2de7c0b0c18a","sha1":"88c3e78b960670e4dbc07f28b78c485be325bc0c","sha256":"bd622cede46ca7fc8302b92f9875d25661cbc1139b78892ebe8fe875279522a6","sha512":"fa03e2135ca86d9d879fdc82347eed293303c298827fac09a90462ae5a4fe970134741540f501663047e7154e8b655dbaadd188a5d55590786e454d84ee64461","ssdeep":"6144:MDNZC4Jw3Tg7brR8dtb59bbaoDg9Y/bX32WW1Agc8VPfDJbi7d:CZC4JGgWOy32zZVPfDJmB","tlshash":"297422b2585a81fe2f250463d2ce5af8b95f09d4d1e20c4a93a3db313419d1bace25f7","first_seen":"2023-04-05T05:11:08Z","last_seen":"2026-08-02T03:10:53.308009Z","times_seen":164,"resource_available":false,"data":null}},"time_used":90,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":49,"receive":41,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-08-02","alert":"Sinkholed","trigger":"redwinezoonma.12hp.ch","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-08-02","alert":"Sinkholed","trigger":"redwinezoonma.12hp.ch","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"redwinezoonma.12hp.ch/wp-includes/theme-compat/dfr1mxl/vglorbt/dxvcagm/Netease/neteasyes/neteasyest/900/js/jquery.min.js","fqdn":"redwinezoonma.12hp.ch","domain":"redwinezoonma.12hp.ch","tld":"12hp.ch"},"ip":{"addr":"91.216.248.22","port":443,"asn":47447,"as":"23M GmbH","country":"Germany","country_code":"DE"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://redwinezoonma.12hp.ch/wp-includes/theme-compat/dfr1mxl/vglorbt/dxvcagm/Netease/neteasyes/neteasyest/900/index.php","date":"2026-08-02T00:30:48.522Z","timestamp":1785630648522,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"12hp.ch","organization":""},"issuer":{"commonName":"YE2","organization":"Let's Encrypt"},"validity":{"start":"Thu, 09 Jul 2026 01:21:02 GMT","end":"Wed, 07 Oct 2026 01:21:01 GMT"},"fingerprint":{"sha1":"82:58:D1:30:C5:80:DA:F2:E1:64:92:35:08:9F:E3:9F:4D:31:90:01","sha256":"30:6F:E9:D1:4C:AD:14:EE:1D:1C:D9:C2:44:1C:C2:97:EE:C0:27:E8:82:0D:99:49:79:EB:09:7D:5F:AE:31:92"}}},"request":{"raw":"GET /wp-includes/theme-compat/dfr1mxl/vglorbt/dxvcagm/Netease/neteasyes/neteasyest/900/js/jquery.min.js HTTP/1.1\r\nHost: redwinezoonma.12hp.ch\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://redwinezoonma.12hp.ch/wp-includes/theme-compat/dfr1mxl/vglorbt/dxvcagm/Netease/neteasyes/neteasyest/900/index.php\r\nCookie: _lcp=a; _lcp2=a\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nserver: openresty\r\ndate: Sun, 02 Aug 2026 00:30:48 GMT\r\ncontent-type: text/javascript\r\ncontent-length: 29827\r\nx-lima-id: gaWRhtVrFgOVlXWuMV\r\nlast-modified: Thu, 29 Oct 2020 06:28:00 GMT\r\netag: \"14e4c-5b2c961a61c00-gzip\"\r\naccept-ranges: bytes\r\ncache-control: max-age=604800\r\nexpires: Sun, 09 Aug 2026 00:30:48 GMT\r\nvary: Accept-Encoding\r\ncontent-encoding: gzip\r\ncontent-security-policy: upgrade-insecure-requests\r\nstrict-transport-security: max-age=31536000; includeSubDomains; preload\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"OpenResty","description":"OpenResty is a web platform based on nginx which can run Lua scripts using its LuaJIT engine.","website":"https://openresty.org","common_platform_enumeration":"","icon":"OpenResty.svg","categories":["Web servers"]}],"data":{"size":85580,"size_decoded":30348,"mime_type":"text/javascript","magic":"JavaScript source, ASCII text, with very long lines (32065), with CRLF line terminators","md5":"adb784ef9dc257b32965a5da7ee82a8b","sha1":"7a41c488d820ea08231d1d393e5f4daed4d25041","sha256":"8e09aa31f396ea41d698f437dc5fc7125e931d400eb2873f5b68ef78c1e6f3a6","sha512":"bc8fcdf5a4645443c394b0d1b7222b2e2321a4558cd39cfac18c88aa1abc44d4317a94a26b0f8444f6700197fe2a90d2812c42fb1f85fc5ae33069343579d4df","ssdeep":"1536:fYE1JVoiB9JqZdXXe2pD3PgoIiulrUn6Z6a4tfOR7WpfWBZPBJda4w9W3qG9a98Q:u4J+rlfOhWpgCW6G9a98HrU","tlshash":"1383c6d9b2d6706297b734b850bf410bb17a98dab44c8c60f059d4e47eb4a8e507bf2c","first_seen":"2023-03-07T01:20:21Z","last_seen":"2026-08-12T15:05:52.4124Z","times_seen":2203,"resource_available":true,"data":null}},"time_used":60,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":43,"receive":17,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-08-02","alert":"Sinkholed","trigger":"redwinezoonma.12hp.ch","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-08-02","alert":"Sinkholed","trigger":"redwinezoonma.12hp.ch","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"redwinezoonma.12hp.ch/wp-includes/theme-compat/dfr1mxl/vglorbt/dxvcagm/Netease/neteasyes/neteasyest/900/images/lin.ico","fqdn":"redwinezoonma.12hp.ch","domain":"redwinezoonma.12hp.ch","tld":"12hp.ch"},"ip":{"addr":"91.216.248.22","port":443,"asn":47447,"as":"23M GmbH","country":"Germany","country_code":"DE"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://redwinezoonma.12hp.ch/wp-includes/theme-compat/dfr1mxl/vglorbt/dxvcagm/Netease/neteasyes/neteasyest/900/index.php","date":"2026-08-02T00:30:48.611Z","timestamp":1785630648611,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"12hp.ch","organization":""},"issuer":{"commonName":"YE2","organization":"Let's Encrypt"},"validity":{"start":"Thu, 09 Jul 2026 01:21:02 GMT","end":"Wed, 07 Oct 2026 01:21:01 GMT"},"fingerprint":{"sha1":"82:58:D1:30:C5:80:DA:F2:E1:64:92:35:08:9F:E3:9F:4D:31:90:01","sha256":"30:6F:E9:D1:4C:AD:14:EE:1D:1C:D9:C2:44:1C:C2:97:EE:C0:27:E8:82:0D:99:49:79:EB:09:7D:5F:AE:31:92"}}},"request":{"raw":"GET /wp-includes/theme-compat/dfr1mxl/vglorbt/dxvcagm/Netease/neteasyes/neteasyest/900/images/lin.ico HTTP/1.1\r\nHost: redwinezoonma.12hp.ch\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://redwinezoonma.12hp.ch/wp-includes/theme-compat/dfr1mxl/vglorbt/dxvcagm/Netease/neteasyes/neteasyest/900/index.php\r\nCookie: _lcp=a; _lcp2=a\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=6\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nserver: openresty\r\ndate: Sun, 02 Aug 2026 00:30:48 GMT\r\ncontent-type: image/vnd.microsoft.icon\r\nvary: Accept-Encoding\r\nx-lima-id: gaj3TnPCk6QB1ATNYp\r\nlast-modified: Thu, 22 Jun 2023 00:38:26 GMT\r\netag: W/\"2848b-5fead1a348480\"\r\ncontent-security-policy: upgrade-insecure-requests\r\nstrict-transport-security: max-age=31536000; includeSubDomains; preload\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"OpenResty","description":"OpenResty is a web platform based on nginx which can run Lua scripts using its LuaJIT engine.","website":"https://openresty.org","common_platform_enumeration":"","icon":"OpenResty.svg","categories":["Web servers"]}],"data":{"size":165003,"size_decoded":8959,"mime_type":"image/vnd.microsoft.icon","magic":"MS Windows icon resource - 9 icons, 256x256 with PNG image data, 256 x 256, 8-bit/color RGBA, non-interlaced, 32 bits/pixel, -128x-128, 32 bits/pixel","md5":"6288e3bafe5576eaac15893ce3ed9359","sha1":"1f5b46cbde606da717ed6c912a407608b6b2e384","sha256":"89e8a0214f242e7a5321dd5bb0f6c11279edc545a994c6633938d1a5ca72bae4","sha512":"3e4121b6df2f812628fc945c5635e869d71ffc12dcd801a8bd5432ba38ea6bbb34766a0db7a6f3a29a4cf3536970366077c9c057f57d2fd226740f823c3858a2","ssdeep":"384:v0cvejVBjN4IXQxxkSlSlSlSlSlKlfalfalfalfalfalfalfalfalfalKlSlSDKg:vbvuvFZtj","tlshash":"c8f3c823b07cd5e6f89c3df45a0897256ab52e924238f097e91fbed6e8b3623c1041d5","first_seen":"2023-06-30T02:34:50Z","last_seen":"2026-08-02T03:10:53.311925Z","times_seen":73,"resource_available":false,"data":null}},"time_used":64,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":64,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-08-02","alert":"Sinkholed","trigger":"redwinezoonma.12hp.ch","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-08-02","alert":"Sinkholed","trigger":"redwinezoonma.12hp.ch","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"redwinezoonma.12hp.ch/wp-includes/theme-compat/dfr1mxl/vglorbt/dxvcagm/Netease/neteasyes/neteasyest/900/index.php","fqdn":"redwinezoonma.12hp.ch","domain":"redwinezoonma.12hp.ch","tld":"12hp.ch"},"ip":{"addr":"91.216.248.22","port":443,"asn":47447,"as":"23M GmbH","country":"Germany","country_code":"DE"},"is_navigation_request":true,"resource_type":"document","requested_by":"","date":"2026-08-02T00:30:47.862Z","timestamp":1785630647862,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"12hp.ch","organization":""},"issuer":{"commonName":"YE2","organization":"Let's Encrypt"},"validity":{"start":"Thu, 09 Jul 2026 01:21:02 GMT","end":"Wed, 07 Oct 2026 01:21:01 GMT"},"fingerprint":{"sha1":"82:58:D1:30:C5:80:DA:F2:E1:64:92:35:08:9F:E3:9F:4D:31:90:01","sha256":"30:6F:E9:D1:4C:AD:14:EE:1D:1C:D9:C2:44:1C:C2:97:EE:C0:27:E8:82:0D:99:49:79:EB:09:7D:5F:AE:31:92"}}},"request":{"raw":"GET /wp-includes/theme-compat/dfr1mxl/vglorbt/dxvcagm/Netease/neteasyes/neteasyest/900/index.php HTTP/1.1\r\nHost: redwinezoonma.12hp.ch\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nUpgrade-Insecure-Requests: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: document\r\nSec-Fetch-Mode: navigate\r\nSec-Fetch-Site: none\r\nPriority: u=0, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nserver: openresty\r\ndate: Sun, 02 Aug 2026 00:30:47 GMT\r\ncontent-type: text/html; charset=UTF-8\r\nx-lima-id: gaCZ2OM2WLY0c6PDEC\r\nset-cookie: _lcp=a; Path=/; Expires=Mon, 20 Mar 2034 13:02:58 GMT; SameSite=Lax; HttpOnly\r\nx-powered-by: PHP/8.3.32\r\nvary: Accept-Encoding\r\ncontent-encoding: gzip\r\ncontent-security-policy: upgrade-insecure-requests\r\nstrict-transport-security: max-age=31536000; includeSubDomains; preload\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"BootstrapCDN:4.0.0","description":"BootstrapCDN is a powerful and reliable Content Delivery Network (CDN) that delivers static resources, including CSS, JavaScript, and font files, for the widely-used Bootstrap framework. By leveraging multiple server locations worldwide, BootstrapCDN accelerates website loading times, ensuring a smooth and visually appealing user experience. Additionally, it ensures website compatibility with various devices and browsers. The service reduces bandwidth usage and server load, improving web performance for developers and end-users alike.","website":"https://www.bootstrapcdn.com/","common_platform_enumeration":"","icon":"BootstrapCDN.png","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Font Awesome","description":"Font Awesome is a font and icon toolkit based on CSS and Less.","website":"https://fontawesome.com/","common_platform_enumeration":"","icon":"Font Awesome.svg","categories":["Font scripts"]},{"name":"PHP:8.3.32","description":"PHP is a general-purpose scripting language used for web development.","website":"https://php.net","common_platform_enumeration":"cpe:2.3:a:php:php:*:*:*:*:*:*:*:*","icon":"PHP.svg","categories":["Programming languages"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"Bootstrap:4.0.0","description":"Bootstrap is a free and open-source CSS framework directed at responsive, mobile-first front-end web development. It contains CSS and JavaScript-based design templates for typography, forms, buttons, navigation, and other interface components.","website":"https://getbootstrap.com","common_platform_enumeration":"cpe:2.3:a:getbootstrap:bootstrap:*:*:*:*:*:*:*:*","icon":"Bootstrap.svg","categories":["UI frameworks"]},{"name":"OpenResty","description":"OpenResty is a web platform based on nginx which can run Lua scripts using its LuaJIT engine.","website":"https://openresty.org","common_platform_enumeration":"","icon":"OpenResty.svg","categories":["Web servers"]},{"name":"Popper","description":"Popper is a positioning engine, its purpose is to calculate the position of an element to make it possible to position it near a given reference element.","website":"https://popper.js.org","common_platform_enumeration":"","icon":"Popper.svg","categories":["Miscellaneous"]},{"name":"jQuery:3.1.1","description":"jQuery is a JavaScript library which is a free, open-source software designed to simplify HTML DOM tree traversal and manipulation, as well as event handling, CSS animation, and Ajax.","website":"https://jquery.com","common_platform_enumeration":"cpe:2.3:a:jquery:jquery:*:*:*:*:*:*:*:*","icon":"jQuery.svg","categories":["JavaScript libraries"]}],"data":{"size":7857,"size_decoded":2912,"mime_type":"text/html; charset=UTF-8","magic":"HTML document, Unicode text, UTF-8 text","md5":"e61f60d17faeb9fd85faf0bde1401bae","sha1":"d5824a23c639ec0c7629d93e75a697e50ed7ece1","sha256":"1448c6c406690ad3a0e1ff4b6c8e74246e61c800097a9fb6c99f222cd04fe019","sha512":"63f9f0ca9c60786845f66116b4f2a3792d8011e28d4f8f4704b30b46dd27e036dd543aeffbda6ed939d78379dcb070cfa40d0747fd53d02e05c624cb56c92c69","ssdeep":"192:mrhXu9ccBrus+lqvdEf02I9yfXBArJHHLS255A:mF+c6r5+Evd5D6","tlshash":"50f1b500b8fa55a6013360dd3bbfa1053b95840b9608de047aedbbd05f95e1b78776c6","first_seen":"2025-04-21T13:03:45.881928Z","last_seen":"2026-08-02T03:10:53.317717Z","times_seen":18,"resource_available":false,"data":null}},"time_used":113,"timings":{"blocked":-1,"dns":4,"connect":20,"send":0,"wait":37,"receive":0,"ssl":52},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-08-02","alert":"Sinkholed","trigger":"redwinezoonma.12hp.ch","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-08-02","alert":"Sinkholed","trigger":"redwinezoonma.12hp.ch","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":[{"sensor_name":"urlquery","alert":"Phishing - Generic phishing","verdict":"phishing","severity":"medium","comment":"","tags":["phishing"],"meta":null}]}},{"url":{"schema":"https","addr":"redwinezoonma.12hp.ch/wp-includes/theme-compat/dfr1mxl/vglorbt/dxvcagm/Netease/neteasyes/neteasyest/900/js/jquery-3.3.1.js","fqdn":"redwinezoonma.12hp.ch","domain":"redwinezoonma.12hp.ch","tld":"12hp.ch"},"ip":{"addr":"91.216.248.22","port":443,"asn":47447,"as":"23M GmbH","country":"Germany","country_code":"DE"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://redwinezoonma.12hp.ch/wp-includes/theme-compat/dfr1mxl/vglorbt/dxvcagm/Netease/neteasyes/neteasyest/900/index.php","date":"2026-08-02T00:30:48.158Z","timestamp":1785630648158,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"12hp.ch","organization":""},"issuer":{"commonName":"YE2","organization":"Let's Encrypt"},"validity":{"start":"Thu, 09 Jul 2026 01:21:02 GMT","end":"Wed, 07 Oct 2026 01:21:01 GMT"},"fingerprint":{"sha1":"82:58:D1:30:C5:80:DA:F2:E1:64:92:35:08:9F:E3:9F:4D:31:90:01","sha256":"30:6F:E9:D1:4C:AD:14:EE:1D:1C:D9:C2:44:1C:C2:97:EE:C0:27:E8:82:0D:99:49:79:EB:09:7D:5F:AE:31:92"}}},"request":{"raw":"GET /wp-includes/theme-compat/dfr1mxl/vglorbt/dxvcagm/Netease/neteasyes/neteasyest/900/js/jquery-3.3.1.js HTTP/1.1\r\nHost: redwinezoonma.12hp.ch\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://redwinezoonma.12hp.ch/wp-includes/theme-compat/dfr1mxl/vglorbt/dxvcagm/Netease/neteasyes/neteasyest/900/index.php\r\nCookie: _lcp=a\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=2\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 503 \r\nserver: openresty\r\ndate: Sun, 02 Aug 2026 00:30:48 GMT\r\ncontent-type: text/html; charset=utf-8\r\nx-lima-id: gaoRkXdWP5GMsEW3lR\r\nset-cookie: _lcp2=a; Path=/; Expires=Mon, 20 Mar 2034 13:02:58 GMT; SameSite=Lax; HttpOnly\r\nx-powered-by: PHP/8.3.32\r\nretry-after: 3600\r\ncache-control: no-store, no-cache, must-revalidate, max-age=0\r\npragma: no-cache\r\nexpires: 0\r\ncontent-security-policy: upgrade-insecure-requests\r\nstrict-transport-security: max-age=31536000; includeSubDomains; preload\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"503","status_text":"","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"PHP:8.3.32","description":"PHP is a general-purpose scripting language used for web development.","website":"https://php.net","common_platform_enumeration":"cpe:2.3:a:php:php:*:*:*:*:*:*:*:*","icon":"PHP.svg","categories":["Programming languages"]},{"name":"OpenResty","description":"OpenResty is a web platform based on nginx which can run Lua scripts using its LuaJIT engine.","website":"https://openresty.org","common_platform_enumeration":"","icon":"OpenResty.svg","categories":["Web servers"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":1992,"size_decoded":2509,"mime_type":"text/html; charset=utf-8","magic":"HTML document, ASCII text","md5":"8c9bcfba3f2f7c15bf7beb028044bc5e","sha1":"c56cd71af85b8da2be7ed2303f794c44d13b5359","sha256":"6b62008b86b53de50451ee060a1475755ebc422b57bbca3cbc48205cd8db0e4a","sha512":"06feda3ff4a386ae371676f7d4dff0ab80756400e5d16e9f8eb092057e1a38e3b06c16c7a785696ed96e16787b919184a61e2371a29cad4a46bccc5ec5be2d9e","ssdeep":"","tlshash":"9d4182278a95480b7473e4346be7174835c85427a11bc4e4bfceb28cdfc2a8ac9a1f4c","first_seen":"2026-08-02T00:31:10.683386Z","last_seen":"2026-08-02T00:31:16.609828Z","times_seen":2,"resource_available":false,"data":null}},"time_used":36,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":36,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-08-02","alert":"Sinkholed","trigger":"redwinezoonma.12hp.ch","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-08-02","alert":"Sinkholed","trigger":"redwinezoonma.12hp.ch","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"maxcdn.bootstrapcdn.com/bootstrap/4.0.0/css/bootstrap.min.css","fqdn":"maxcdn.bootstrapcdn.com","domain":"bootstrapcdn.com","tld":"com"},"ip":{"addr":"104.18.11.207","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://redwinezoonma.12hp.ch/wp-includes/theme-compat/dfr1mxl/vglorbt/dxvcagm/Netease/neteasyes/neteasyest/900/index.php","date":"2026-08-02T00:30:48.334Z","timestamp":1785630648334,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"bootstrapcdn.com","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Wed, 01 Jul 2026 06:33:56 GMT","end":"Tue, 29 Sep 2026 07:33:46 GMT"},"fingerprint":{"sha1":"95:C5:B1:CC:FD:2D:A2:1D:9E:F8:29:11:70:8F:C2:32:DB:0A:16:D8","sha256":"67:23:C0:55:AC:EE:9D:BF:1F:32:F6:C6:31:3A:5A:3F:85:B5:50:88:71:96:38:D1:BB:37:21:B0:0C:CF:B9:EA"}}},"request":{"raw":"GET /bootstrap/4.0.0/css/bootstrap.min.css HTTP/1.1\r\nHost: maxcdn.bootstrapcdn.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-Fetch-Storage-Access: none\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://redwinezoonma.12hp.ch/\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPriority: u=2\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\ndate: Sun, 02 Aug 2026 00:30:48 GMT\r\ncontent-type: text/css; charset=utf-8\r\npriority: u=2,i=?0\r\nserver: cloudflare\r\ncdn-pullzone: 252412\r\ncdn-requestcountrycode: DE\r\nvary: Accept-Encoding\r\naccess-control-allow-origin: *\r\ncache-control: public, max-age=31919000\r\ncontent-encoding: br\r\netag: \"450fc463b8b1a349df717056fbb3e078\"\r\nlast-modified: Mon, 25 Jan 2021 22:04:04 GMT\r\ncdn-cachedat: 07/21/2025 22:36:56\r\ncdn-proxyver: 1.32\r\ncdn-requestpullcode: 200\r\ncdn-requestpullsuccess: True\r\ncdn-edgestorageid: 1048\r\ntiming-allow-origin: *\r\ncross-origin-resource-policy: cross-origin\r\nx-content-type-options: nosniff\r\ncdn-status: 200\r\ncdn-requesttime: 0\r\ncdn-requestid: cb13468981fccbdcc332f3c032716519\r\ncdn-cache: HIT\r\nage: 4485279\r\ncf-cache-status: HIT\r\nstrict-transport-security: max-age=31536000; includeSubDomains; preload\r\ncf-ray: a248f9e02ab34c11-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":144877,"size_decoded":22731,"mime_type":"text/css; charset=utf-8","magic":"ASCII text, with very long lines (65325)","md5":"450fc463b8b1a349df717056fbb3e078","sha1":"895125a4522a3b10ee7ada06ee6503587cbf95c5","sha256":"2c0f3dcfe93d7e380c290fe4ab838ed8cadff1596d62697f5444be460d1f876d","sha512":"93bf1ed5f6d8b34f53413a86efd4a925d578c97abc757ea871f3f46f340745e4126c48219d2e8040713605b64a9ecf7ad986aa8102f5ea5ecf9228801d962f5d","ssdeep":"1536:GcoqwrUPyDHU7c7TcDEBi82NcuSELL4d/+oENM6HN26Q:VoPgPard2oENM6HN26Q","tlshash":"f6e37667f591322da097ca1851c0bbfa466f8156d6221ffbf4273b604b8a6c70a73d0d","first_seen":"2023-04-05T03:09:34Z","last_seen":"2026-08-13T20:31:59.499258Z","times_seen":59705,"resource_available":false,"data":null}},"time_used":26,"timings":{"blocked":-1,"dns":3,"connect":15,"send":0,"wait":7,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}}]}