{"report_id":"afa0ca9e-9999-4b69-bc11-ecb71017b10f","version":6,"status":"done","tags":[],"date":"2026-01-26T05:51:19Z","url":{"schema":"http","addr":"whatrtsapp.us.cc","fqdn":"whatrtsapp.us.cc","domain":"us.cc","tld":"cc"},"ip":{"addr":"23.145.136.77","port":0,"asn":0,"as":"","country":"United States","country_code":"US"},"final":{"url":{"schema":"https","addr":"whatrtsapp.us.cc/","fqdn":"whatrtsapp.us.cc","domain":"us.cc","tld":"cc"},"title":"WhatsApp Web","dom":{"size":13057,"mime_type":"text/html; charset=utf-8","magic":"HTML document, ASCII text, with very long lines (6779)","md5":"79aaefd7f96e6bb2d16db37147ef20e1","sha1":"9b4904cb2b50fbdf5356427a3964b62d71b58b8b","sha256":"a6f4ffff0df72827d6f5c8c64f5d3e0194d266680d2583ea509d78a008427246","sha512":"e73603d7ea24da7a232523e71f24ae34562c27f08640a89ba049514ebfdacad56cd64699c6b587cf22f4c6ff8612fb2afa0396c009bfd43b7b9034cd516003a5","ssdeep":"192:qbfoF9BOEfP4KgqhJKE7M3zI4WXkOFH/LHgOXkOFH/LGthC8LF:qbfc1Mk4W02LHgO02LGthC8LF","tlshash":"de423b41159304193c33e1ea77da7b4622b1f00bc944f9197dfd6178cfc5fa4a827aa1","dom_hash":"domhashed72046542f81fe79d728fd625ed0f12","first_seen":"2026-01-03T19:49:36.852275Z","last_seen":"2026-04-18T00:23:15.474469Z","times_seen":23,"resource_available":false,"data":null}},"submit":{"url":{"schema":"http","addr":"whatrtsapp.us.cc","fqdn":"whatrtsapp.us.cc","domain":"us.cc","tld":"cc"},"ip":{"addr":"23.145.136.77","port":0,"asn":0,"as":"","country":"United States","country_code":"US"},"tags":null,"meta":null},"settings":{"access":"public","device_type":"desktop","expires_at":"2027-03-02T05:51:19Z","useragent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0","referer":"","cookies":null,"exit_node":"z0yflva4pidy47h"},"stats":{"alert_count":{"ids":1,"urlquery":0,"analyzer":3}},"detection":{"ids":[{"sensor_name":"suricata","title":"Suricata IDS","description":"Suricata /w Emerging Threats Pro","date":"2026-01-26T05:51:00Z","timestamp":1769406660,"ip_dst":{"addr":"172.67.75.172","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"ip_src":{"addr":"Client IP","port":58602,"asn":0,"as":"","country":"","country_code":"zz"},"severity":"medium","alert":"ETPRO POLICY Observed External IP Lookup Domain (api.ip .sb in TLS SNI)","source":"{\"timestamp\":\"2026-01-26T05:51:00.465226+0000\",\"flow_id\":153257330932205,\"in_iface\":\"br-31613a7ed13b\",\"event_type\":\"alert\",\"src_ip\":\"172.18.0.52\",\"src_port\":58602,\"dest_ip\":\"172.67.75.172\",\"dest_port\":443,\"proto\":\"TCP\",\"tx_id\":0,\"alert\":{\"action\":\"allowed\",\"gid\":1,\"signature_id\":2835930,\"rev\":4,\"signature\":\"ETPRO POLICY Observed External IP Lookup Domain (api.ip .sb in TLS SNI)\",\"category\":\"Device Retrieving External IP Address Detected\",\"severity\":2,\"metadata\":{\"attack_target\":[\"Client_Endpoint\"],\"confidence\":[\"High\"],\"created_at\":[\"2019_04_17\"],\"deployment\":[\"Perimeter\"],\"mitre_tactic_id\":[\"TA0043\"],\"mitre_tactic_name\":[\"Reconnaissance\"],\"mitre_technique_id\":[\"T1590\"],\"mitre_technique_name\":[\"Gather_Victim_Network_Information\"],\"performance_impact\":[\"Low\"],\"signature_severity\":[\"Informational\"],\"updated_at\":[\"2020_11_19\"]}},\"tls\":{\"sni\":\"api.ip.sb\",\"version\":\"TLS 1.3\",\"ja3\":{\"hash\":\"650c82854aed91a22996035b295a0c3e\",\"string\":\"771,4865-4867-4866-49195-49199-52393-52392-49196-49200-49171-49172-156-157-47-53,0-23-65281-10-11-16-5-34-51-43-13-28-21,29-23-24-25-256-257,0\"},\"ja3s\":{\"hash\":\"eb1d94daa7e0344597e756a1fb6e7054\",\"string\":\"771,4865,51-43\"}},\"app_proto\":\"tls\",\"flow\":{\"pkts_toserver\":4,\"pkts_toclient\":5,\"bytes_toserver\":789,\"bytes_toclient\":3422,\"start\":\"2026-01-26T05:51:00.457197+0000\"}}"}],"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-01-26","alert":"Sinkholed","trigger":"whatrtsapp.us.cc","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-01-26","alert":"Phishing Block","trigger":"whatrtsapp.us.cc","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-01-26","alert":"Sinkholed","trigger":"whatrtsapp.us.cc","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null}],"urlquery":null},"summary":[{"fqdn":"whatrtsapp.us.cc","ip":{"addr":"23.145.136.159","port":443,"asn":0,"as":"","country":"United States","country_code":"US"},"domain_registered":"2006-04-07","domain_rank":0,"first_seen":"2026-01-26T05:51:21.77535Z","last_seen":"2026-01-26T05:51:21.77535Z","alert_count":33,"request_count":11,"received_data":2874354,"sent_data":4865,"comment":"","tags":null,"fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}]},{"fqdn":"skp.it.com","ip":{"addr":"0.0.0.0","port":0,"asn":0,"as":"","country":"","country_code":"zz"},"domain_registered":"1992-10-23","domain_rank":0,"first_seen":"2026-01-03T19:49:30.288051Z","last_seen":"2026-01-24T17:46:48.649752Z","alert_count":0,"request_count":1,"received_data":0,"sent_data":533,"comment":"","tags":null,"fingerprints":null},{"fqdn":"api.ip.sb","ip":{"addr":"172.67.75.172","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"domain_registered":"2017-08-07","domain_rank":410938,"first_seen":"2018-03-13T12:36:01Z","last_seen":"2026-01-25T14:22:15.736465Z","alert_count":0,"request_count":2,"received_data":2940,"sent_data":898,"comment":"","tags":null,"fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}]}],"files":null,"artifacts":{"windows_shortcuts":null,"files":null,"telegram":null,"pdfs":null,"clipboard":null},"sensors":{"ids":null,"analyzer":null,"urlquery":null},"javascript":{"script":[{"url":{"schema":"https","addr":"whatrtsapp.us.cc/","fqdn":"whatrtsapp.us.cc","domain":"us.cc","tld":"cc"},"ip":{"addr":"23.145.136.159","port":443,"asn":0,"as":"","country":"United States","country_code":"US"},"introduction_type":"Function","is_inline":false,"md5":"ae05ef7a1a664db2bb83ba7d0f39801b","sha1":"66bbdb4acd98df6832e06c193ec7f4013affa296","sha256":"8c117493067641397e0de60b420f6e8713216da86a17c9fec8a3c6645d0cec42","sha512":"b9cc82720b3650ef64e4f2c8a8766dc0b31c897e198be17ef19565b2de584df13b62b19dee7465208757bab57470125bcb98345ea4f0cd8bf60510f0c638f4a9","ssdeep":"","tlshash":"d4c080c870c62d047515b41164bf34e45034401670489b46ccd4d8542d630f08233d98","size":156,"data":"","first_seen":"2026-01-03T19:49:36.871677Z","last_seen":"2026-04-18T00:23:15.489851Z","times_seen":23,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"whatrtsapp.us.cc/","fqdn":"whatrtsapp.us.cc","domain":"us.cc","tld":"cc"},"ip":{"addr":"23.145.136.159","port":443,"asn":0,"as":"","country":"United States","country_code":"US"},"introduction_type":"Function","is_inline":false,"md5":"bcc706613537267e40d19bf38aafa98f","sha1":"0fede3de3475c37cb00ffc1404751567a5305f8a","sha256":"c08f17f565473de3130a01cb0bce21a2dc7f4dddb415d559a7b1124b9b59e4a3","sha512":"f01bf85279353dce07e8da170a2aa7932178b56af847444d89b165dc0bf466cde23b53cbe20b2350c2be9719a652676223a8c2c1baa5667acfba5813cea897d5","ssdeep":"","tlshash":"a3c080c5e0c77e105652571151ff25d45134443674891f139dd4dc593e220f4d233edd","size":165,"data":"","first_seen":"2026-01-03T19:49:36.874809Z","last_seen":"2026-04-18T00:23:15.492795Z","times_seen":23,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"whatrtsapp.us.cc/","fqdn":"whatrtsapp.us.cc","domain":"us.cc","tld":"cc"},"ip":{"addr":"23.145.136.159","port":443,"asn":0,"as":"","country":"United States","country_code":"US"},"introduction_type":"Function","is_inline":false,"md5":"020831ae4e38f16b449db8e30ed17f6d","sha1":"769017db9a99c5436715f3960d699245e172dcce","sha256":"aa4501df9e19292bb747cd3b68a4727c30f6c461b0fe3100302f86ea081c0f48","sha512":"718b2fead353c5e1d2ea37ee5886ec3af76a13981d3bb9a676424155244057183baf74100b46661edd909a15c68e29d81b2b478a14bf83009844acfbb90daec9","ssdeep":"","tlshash":"11c08cc9b0c36d00160b6a1465bf34e49024886ab58c1f078de8e86a3fa30b49233e9c","size":158,"data":"","first_seen":"2024-10-04T11:00:33.210701Z","last_seen":"2026-08-08T05:00:07.314467Z","times_seen":283,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"whatrtsapp.us.cc/","fqdn":"whatrtsapp.us.cc","domain":"us.cc","tld":"cc"},"ip":{"addr":"23.145.136.159","port":443,"asn":0,"as":"","country":"United States","country_code":"US"},"introduction_type":"Function","is_inline":false,"md5":"ae05ef7a1a664db2bb83ba7d0f39801b","sha1":"66bbdb4acd98df6832e06c193ec7f4013affa296","sha256":"8c117493067641397e0de60b420f6e8713216da86a17c9fec8a3c6645d0cec42","sha512":"b9cc82720b3650ef64e4f2c8a8766dc0b31c897e198be17ef19565b2de584df13b62b19dee7465208757bab57470125bcb98345ea4f0cd8bf60510f0c638f4a9","ssdeep":"","tlshash":"d4c080c870c62d047515b41164bf34e45034401670489b46ccd4d8542d630f08233d98","size":156,"data":"","first_seen":"2026-01-03T19:49:36.871677Z","last_seen":"2026-04-18T00:23:15.489851Z","times_seen":23,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"whatrtsapp.us.cc/","fqdn":"whatrtsapp.us.cc","domain":"us.cc","tld":"cc"},"ip":{"addr":"23.145.136.159","port":443,"asn":0,"as":"","country":"United States","country_code":"US"},"introduction_type":"Function","is_inline":false,"md5":"52ea0c2df717a076bbb80fd37e5a52ae","sha1":"8ac8123a33dfd37470d4aae19482309c3265de83","sha256":"4802a6b789dfa8a456d1d88f410aa1a4358e35fd02dd6f3dd7a4a047273fec4c","sha512":"a7db19448edf9293bacde937948e9c4238c4f96bb1a71d6084bdf0fa2dc03240a04f5224825d77d42c1f9852ea00a13c4908f4b605e1e8731c364922330b0182","ssdeep":"","tlshash":"acc0c0c0b0c37c000203d600207f20e8603c881ab08807078cb4d8083f631b08333edc","size":172,"data":"","first_seen":"2026-01-03T19:49:36.873624Z","last_seen":"2026-04-18T00:23:15.493614Z","times_seen":23,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"whatrtsapp.us.cc/","fqdn":"whatrtsapp.us.cc","domain":"us.cc","tld":"cc"},"ip":{"addr":"23.145.136.159","port":443,"asn":0,"as":"","country":"United States","country_code":"US"},"introduction_type":"Function","is_inline":false,"md5":"1f55d83ef16b623d4d9bf7f055691235","sha1":"7536c531b6aaef1e11104f875c4b2e7b3c2d187e","sha256":"07bd4258825daff7bf15278ed04342d417e318d8e1e6396e082ff983c9fa187b","sha512":"6fa0e24e2fcbfe2f6e5d7494bdf415ba641f431d91f8975181fb0ba6cd7970814e4d9eebed0e9f36f338bc26fb2e50988a23ed819e572f0658acc4d3e8c098a8","ssdeep":"","tlshash":"9df0c06351df2760af5324803c9b2cf4b22070293638b5669cd8d0591bd5ef94439a98","size":503,"data":"","first_seen":"2026-01-03T19:49:36.872712Z","last_seen":"2026-04-18T00:23:15.49083Z","times_seen":23,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"whatrtsapp.us.cc/assets/index-BNCAkVth.js","fqdn":"whatrtsapp.us.cc","domain":"us.cc","tld":"cc"},"ip":{"addr":"23.145.136.160","port":443,"asn":0,"as":"","country":"United States","country_code":"US"},"introduction_type":"scriptElement","is_inline":false,"md5":"7bf21f450ea622f4350f557f943e55cb","sha1":"7bbacf34fb823757679bffdfc941fa55536bf7cc","sha256":"43e8d93b588dfc5b31234c14543e3b67e21e0e2f67b0db982fb28d7562fb5ba2","sha512":"52387f373aa0b90f9d04224787e12462e74a60735e6eb00702c7b8e5f46b3d932e50d465527663ea64cfb309543369fa16f85e5b82583f7866c4a587670e3502","ssdeep":"24576:aBmHiIc4ZPIM1B7/qf0UrymxfvyfF6mpRy2f2ZdNgcgWGWCXY2B+FsKELjAX5:aBmHiIc4ZPb1BC0UGmxfqfF6mpRyRNgG","tlshash":"02655a84b599b43583bb59d5506f0405b63d1b08f40884e4f0bdcea93abad94a2fbf7c","size":1523780,"data":"","first_seen":"2026-01-03T19:49:36.870374Z","last_seen":"2026-04-18T00:23:15.491965Z","times_seen":23,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"whatrtsapp.us.cc/assets/en-CUrTyJ4q.js","fqdn":"whatrtsapp.us.cc","domain":"us.cc","tld":"cc"},"ip":{"addr":"23.145.136.160","port":443,"asn":0,"as":"","country":"United States","country_code":"US"},"introduction_type":"scriptElement","is_inline":false,"md5":"af171249877475e1dc78cebb3977551a","sha1":"c709ddd3363e7210600dba56d6c3fa87177e47a3","sha256":"2218d9ddbf6cfad7f30ee4971cba4f083ca93a77974b6659637e9c96f2757e4f","sha512":"16505d2c0ac8958c5c15aa0ff77549cf06c3e63de90afb49d21678021cfef1e18e0176ff638ae6e7b4ac8d7aff7a2edbcf899b6b2c02115b213bb98372289b91","ssdeep":"192:hlK61hUrrfH9dXO4VC8LKrOk/7+9CUxV+/5zUuaRnuDRArqId:hlT1hUrrv9dXO4VC8LPkj+9CUxV+/5zI","tlshash":"d3e1b6de655a2a330e8347077cbf770daaec052d8e67282f58ff415a62d5791732218c","size":7147,"data":"","first_seen":"2026-01-03T19:49:36.854829Z","last_seen":"2026-04-18T00:23:15.485321Z","times_seen":23,"alerts":{"ids":null,"analyzer":null,"urlquery":null}}],"eval":null,"write":null,"console":null},"http":[{"url":{"schema":"https","addr":"whatrtsapp.us.cc/stylex.css","fqdn":"whatrtsapp.us.cc","domain":"us.cc","tld":"cc"},"ip":{"addr":"23.145.136.159","port":443,"asn":0,"as":"","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://whatrtsapp.us.cc/","date":"2026-01-26T05:50:58.073Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"whatleap.us.cc","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Fri, 23 Jan 2026 06:43:34 GMT","end":"Thu, 23 Apr 2026 06:43:33 GMT"},"fingerprint":{"sha1":"BD:33:AE:27:5A:28:CC:D6:23:20:92:5A:A6:8F:A7:6E:B3:AD:A7:58","sha256":"B0:5D:43:BE:E7:85:11:7C:0A:B6:A6:57:BC:3E:80:86:D8:6B:A2:8E:E5:BC:36:76:03:60:6F:9C:9A:8D:7A:3C"}}},"request":{"raw":"GET /stylex.css HTTP/1.1\r\nHost: whatrtsapp.us.cc\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://whatrtsapp.us.cc/\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Mon, 26 Jan 2026 05:50:58 GMT\r\nContent-Type: text/css\r\nTransfer-Encoding: chunked\r\nConnection: keep-alive\r\nLast-Modified: Wed, 31 Dec 2025 06:41:56 GMT\r\nVary: Accept-Encoding\r\nETag: W/\"6954c5b4-33f97\"\r\nExpires: Sun, 25 Jan 2026 23:12:34 GMT\r\nCache-Control: max-age=43200\r\nStrict-Transport-Security: max-age=31536000\r\nAlt-Svc: quic=\":443\"; h3=\":443\"; h3-29=\":443\"; h3-27=\":443\";h3-25=\":443\"; h3-T050=\":443\"; h3-Q050=\":443\";h3-Q049=\":443\";h3-Q048=\":443\"; h3-Q046=\":443\"; h3-Q043=\":443\"\r\nContent-Encoding: gzip\r\nServer: nginx\r\nX-Cache-Status: HIT\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":212887,"size_decoded":0,"mime_type":"text/css","magic":"ASCII text","md5":"2891822bfd970982b8543db66568bc70","sha1":"309813c0fe88f70082bfc66df46f2127f4dca234","sha256":"67c4c1167510362f240d95d1c555f68c86e293ea01f6e1eadc49056e970c056c","sha512":"19fc0af56df59db7b06bfffaac9d3b95a3bf7ec3d3a6a5cc85c0302fbd43081ccdec50355b8a215b6d9ba9fef32ddf827188fd970c57994103cc3eca58a397bc","ssdeep":"6144:YLLCGv62rxtawYKuPW3tMQXuzS+mA9LJWAOn6:YLLZ62rxtawYKuPW3tMQ+zSu9LJWAOn6","tlshash":"7f241fb66afced2e7c32da2999d85e54b34da8036d1d3e61bad4305c6ec13ecc813644","first_seen":"2026-01-03T19:49:36.868061Z","last_seen":"2026-04-18T00:23:15.488113Z","times_seen":23,"resource_available":false,"data":null}},"time_used":783,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":521,"receive":262,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-01-26","alert":"Sinkholed","trigger":"whatrtsapp.us.cc","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-01-26","alert":"Phishing Block","trigger":"whatrtsapp.us.cc","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-01-26","alert":"Sinkholed","trigger":"whatrtsapp.us.cc","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"whatrtsapp.us.cc/assets/index-AeJFvoKn.css","fqdn":"whatrtsapp.us.cc","domain":"us.cc","tld":"cc"},"ip":{"addr":"23.145.136.160","port":443,"asn":0,"as":"","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://whatrtsapp.us.cc/","date":"2026-01-26T05:50:58.078Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"whatleap.us.cc","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Fri, 23 Jan 2026 06:43:34 GMT","end":"Thu, 23 Apr 2026 06:43:33 GMT"},"fingerprint":{"sha1":"BD:33:AE:27:5A:28:CC:D6:23:20:92:5A:A6:8F:A7:6E:B3:AD:A7:58","sha256":"B0:5D:43:BE:E7:85:11:7C:0A:B6:A6:57:BC:3E:80:86:D8:6B:A2:8E:E5:BC:36:76:03:60:6F:9C:9A:8D:7A:3C"}}},"request":{"raw":"GET /assets/index-AeJFvoKn.css HTTP/1.1\r\nHost: whatrtsapp.us.cc\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://whatrtsapp.us.cc/\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Mon, 26 Jan 2026 05:50:58 GMT\r\nContent-Type: text/css\r\nTransfer-Encoding: chunked\r\nConnection: keep-alive\r\nLast-Modified: Wed, 31 Dec 2025 06:41:56 GMT\r\nVary: Accept-Encoding\r\nETag: W/\"6954c5b4-85fb0\"\r\nExpires: Sun, 25 Jan 2026 23:12:35 GMT\r\nCache-Control: max-age=43200\r\nStrict-Transport-Security: max-age=31536000\r\nAlt-Svc: quic=\":443\"; h3=\":443\"; h3-29=\":443\"; h3-27=\":443\";h3-25=\":443\"; h3-T050=\":443\"; h3-Q050=\":443\";h3-Q049=\":443\";h3-Q048=\":443\"; h3-Q046=\":443\"; h3-Q043=\":443\"\r\nContent-Encoding: gzip\r\nServer: nginx\r\nX-Cache-Status: HIT\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":548784,"size_decoded":0,"mime_type":"text/css","magic":"Unicode text, UTF-8 text, with very long lines (65528), with no line terminators","md5":"f3d4d1885ccacec6d9225a1c4e205163","sha1":"9ffef9f80e01048f7821418b2146f7d9fbb725e2","sha256":"67329c4e5bda79199801bbb14d6d4396e413d86811a74ed0f078b40d80d78496","sha512":"5f17248877dc3f2b4acd0937c98e084a46394e9bc6d1a2cf6f5c6461028d03a102f4d5ad7d56fd7a427d4d100e7cc67be3fcf61a987bda6efd0debf1cac6590c","ssdeep":"6144:RoSI0MGuhT7M8EcH7pTVkad36fFhsSIcO3jVMa/4uta78+B36JL7u1A+wMif/x0w:Rn4jsv1LK5","tlshash":"41c4d655e753513b2e17e67d7bc5e9d8bb28ea61dc12cba5f240a00845c3bf102a3d2b","first_seen":"2026-01-03T19:49:36.862316Z","last_seen":"2026-04-18T00:23:15.483453Z","times_seen":23,"resource_available":false,"data":null}},"time_used":2087,"timings":{"blocked":526,"dns":1,"connect":256,"send":0,"wait":513,"receive":516,"ssl":272},"alerts":{"ids":null,"analyzer":[{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-01-26","alert":"Sinkholed","trigger":"whatrtsapp.us.cc","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-01-26","alert":"Phishing Block","trigger":"whatrtsapp.us.cc","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-01-26","alert":"Sinkholed","trigger":"whatrtsapp.us.cc","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"whatrtsapp.us.cc/dianhua.png","fqdn":"whatrtsapp.us.cc","domain":"us.cc","tld":"cc"},"ip":{"addr":"23.145.136.160","port":443,"asn":0,"as":"","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://whatrtsapp.us.cc/","date":"2026-01-26T05:51:00.765Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"whatleap.us.cc","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Fri, 23 Jan 2026 06:43:34 GMT","end":"Thu, 23 Apr 2026 06:43:33 GMT"},"fingerprint":{"sha1":"BD:33:AE:27:5A:28:CC:D6:23:20:92:5A:A6:8F:A7:6E:B3:AD:A7:58","sha256":"B0:5D:43:BE:E7:85:11:7C:0A:B6:A6:57:BC:3E:80:86:D8:6B:A2:8E:E5:BC:36:76:03:60:6F:9C:9A:8D:7A:3C"}}},"request":{"raw":"GET /dianhua.png HTTP/1.1\r\nHost: whatrtsapp.us.cc\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://whatrtsapp.us.cc/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Mon, 26 Jan 2026 05:51:00 GMT\r\nContent-Type: image/png\r\nTransfer-Encoding: chunked\r\nConnection: keep-alive\r\nLast-Modified: Wed, 31 Dec 2025 06:41:56 GMT\r\nVary: Accept-Encoding\r\nETag: W/\"6954c5b4-12b2\"\r\nExpires: Tue, 24 Feb 2026 11:12:38 GMT\r\nCache-Control: max-age=2592000\r\nStrict-Transport-Security: max-age=31536000\r\nAlt-Svc: quic=\":443\"; h3=\":443\"; h3-29=\":443\"; h3-27=\":443\";h3-25=\":443\"; h3-T050=\":443\"; h3-Q050=\":443\";h3-Q049=\":443\";h3-Q048=\":443\"; h3-Q046=\":443\"; h3-Q043=\":443\"\r\nContent-Encoding: gzip\r\nServer: nginx\r\nX-Cache-Status: HIT\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":4786,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 200 x 200, 8-bit/color RGBA, non-interlaced","md5":"bcdea161b3a714f93dfebee6b9bf33b7","sha1":"f2302c9aa213a73a051635cb2634dc8afded2dbf","sha256":"841bafa862a8436d3c3a5ef0f3e7564bc016ba30769d4313f707ef30f9ec251f","sha512":"55971dcd48b4388e5c6db30479463d61bdee423f237ae1f6a5f9919793ffe38b0580b33590612ede5de12a2de51c2a910efdaf763746e1a4cfa2133680f3c556","ssdeep":"96:xpWCE11wukia4lcPKNENmg8Y9qXJS6HKanUDDBANp9nGg7/ERqFGswFe:GC0wfF4CwMqXJZHznCUnGg7/ERqFGVe","tlshash":"24a18eb940aae5f9f6851b2793d08918bc76012bbb483c56574d19f3ff6b1c50cb21a8","first_seen":"2026-01-03T19:49:36.858243Z","last_seen":"2026-04-18T00:23:15.486152Z","times_seen":23,"resource_available":false,"data":null}},"time_used":248,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":246,"receive":2,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-01-26","alert":"Phishing Block","trigger":"whatrtsapp.us.cc","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-01-26","alert":"Sinkholed","trigger":"whatrtsapp.us.cc","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-01-26","alert":"Sinkholed","trigger":"whatrtsapp.us.cc","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"skp.it.com/api/registerChat","fqdn":"skp.it.com","domain":"skp.it.com","tld":"it.com"},"ip":{"addr":"0.0.0.0","port":0,"asn":0,"as":"","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"https://whatrtsapp.us.cc/","date":"2026-01-26T05:51:00.773Z","timestamp":0,"http_version":"","security_state":"insecure","security_info":null,"request":{"raw":"OPTIONS /api/registerChat HTTP/1.1\r\nHost: skp.it.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nAccess-Control-Request-Method: POST\r\nAccess-Control-Request-Headers: content-type\r\nReferer: https://whatrtsapp.us.cc/\r\nOrigin: https://whatrtsapp.us.cc\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"OPTIONS"},"response":{"raw":"","headers":null,"cookies":null,"status_code":"","status_text":"","fingerprints":null,"data":{"size":0,"size_decoded":0,"mime_type":"","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-08-11T21:57:33.47713Z","times_seen":17844365,"resource_available":true,"data":null}},"time_used":7648,"timings":{"blocked":7648,"dns":0,"connect":0,"send":0,"wait":0,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"whatrtsapp.us.cc/app.css","fqdn":"whatrtsapp.us.cc","domain":"us.cc","tld":"cc"},"ip":{"addr":"23.145.136.160","port":443,"asn":0,"as":"","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://whatrtsapp.us.cc/","date":"2026-01-26T05:50:58.074Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"whatleap.us.cc","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Fri, 23 Jan 2026 06:43:34 GMT","end":"Thu, 23 Apr 2026 06:43:33 GMT"},"fingerprint":{"sha1":"BD:33:AE:27:5A:28:CC:D6:23:20:92:5A:A6:8F:A7:6E:B3:AD:A7:58","sha256":"B0:5D:43:BE:E7:85:11:7C:0A:B6:A6:57:BC:3E:80:86:D8:6B:A2:8E:E5:BC:36:76:03:60:6F:9C:9A:8D:7A:3C"}}},"request":{"raw":"GET /app.css HTTP/1.1\r\nHost: whatrtsapp.us.cc\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://whatrtsapp.us.cc/\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Mon, 26 Jan 2026 05:50:58 GMT\r\nContent-Type: text/css\r\nTransfer-Encoding: chunked\r\nConnection: keep-alive\r\nLast-Modified: Wed, 31 Dec 2025 06:41:56 GMT\r\nVary: Accept-Encoding\r\nETag: W/\"6954c5b4-38a0b\"\r\nExpires: Sun, 25 Jan 2026 23:12:34 GMT\r\nCache-Control: max-age=43200\r\nStrict-Transport-Security: max-age=31536000\r\nAlt-Svc: quic=\":443\"; h3=\":443\"; h3-29=\":443\"; h3-27=\":443\";h3-25=\":443\"; h3-T050=\":443\"; h3-Q050=\":443\";h3-Q049=\":443\";h3-Q048=\":443\"; h3-Q046=\":443\"; h3-Q043=\":443\"\r\nContent-Encoding: gzip\r\nServer: nginx\r\nX-Cache-Status: HIT\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":231947,"size_decoded":0,"mime_type":"text/css","magic":"Unicode text, UTF-8 text","md5":"bdf1775c97a75f0fa4c6c89f6707dd16","sha1":"2b7519e300a5f91deb4bae2aab50a3971490150e","sha256":"31788499ce90b2a464c987626b72e2874ff9b320958883862ce756ac3bbcc0f0","sha512":"34248ae312dc6f31a5be47cda8acbf8528fa3e22ab6c902fca13c13a8bfe13bb06568cd68aca087d9a6a197bc96f7f5fcfff99dca46c111f8359913677d1249b","ssdeep":"3072:F+7iT3g75TQ7LN+XdRkK2dL8B6Q2TuQ0n:F+783g1mIdRSL8BT2Tu3n","tlshash":"4334b46166d32a9c351b82bf33ea9b1773380887d409fe183dee70b88f591dd65b2910","first_seen":"2024-08-19T13:21:09.901808Z","last_seen":"2026-05-12T22:50:32.098469Z","times_seen":44,"resource_available":false,"data":null}},"time_used":774,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":515,"receive":259,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-01-26","alert":"Phishing Block","trigger":"whatrtsapp.us.cc","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-01-26","alert":"Sinkholed","trigger":"whatrtsapp.us.cc","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-01-26","alert":"Sinkholed","trigger":"whatrtsapp.us.cc","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"whatrtsapp.us.cc/index.css","fqdn":"whatrtsapp.us.cc","domain":"us.cc","tld":"cc"},"ip":{"addr":"23.145.136.160","port":443,"asn":0,"as":"","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://whatrtsapp.us.cc/","date":"2026-01-26T05:50:58.075Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"whatleap.us.cc","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Fri, 23 Jan 2026 06:43:34 GMT","end":"Thu, 23 Apr 2026 06:43:33 GMT"},"fingerprint":{"sha1":"BD:33:AE:27:5A:28:CC:D6:23:20:92:5A:A6:8F:A7:6E:B3:AD:A7:58","sha256":"B0:5D:43:BE:E7:85:11:7C:0A:B6:A6:57:BC:3E:80:86:D8:6B:A2:8E:E5:BC:36:76:03:60:6F:9C:9A:8D:7A:3C"}}},"request":{"raw":"GET /index.css HTTP/1.1\r\nHost: whatrtsapp.us.cc\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://whatrtsapp.us.cc/\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Mon, 26 Jan 2026 05:50:58 GMT\r\nContent-Type: text/css\r\nTransfer-Encoding: chunked\r\nConnection: keep-alive\r\nLast-Modified: Wed, 31 Dec 2025 06:41:56 GMT\r\nVary: Accept-Encoding\r\nETag: W/\"6954c5b4-4fbec\"\r\nExpires: Sun, 25 Jan 2026 23:12:35 GMT\r\nCache-Control: max-age=43200\r\nStrict-Transport-Security: max-age=31536000\r\nAlt-Svc: quic=\":443\"; h3=\":443\"; h3-29=\":443\"; h3-27=\":443\";h3-25=\":443\"; h3-T050=\":443\"; h3-Q050=\":443\";h3-Q049=\":443\";h3-Q048=\":443\"; h3-Q046=\":443\"; h3-Q043=\":443\"\r\nContent-Encoding: gzip\r\nServer: nginx\r\nX-Cache-Status: HIT\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":326636,"size_decoded":0,"mime_type":"text/css","magic":"Unicode text, UTF-8 text, with very long lines (65528), with no line terminators","md5":"d9918282432c8700aa59f285c4c97d2e","sha1":"613df3f3b236d3030b3c48e7bc76ead15fd6c815","sha256":"1dc721b88bf4de1541e8d82f04a57abffb4d53e22a61e20b83ba81c220bc0e40","sha512":"4a3a1528bb224b3fbdf7aedd870e09456e11757a1eef3b49bd58f22eceee189a8a0b57303930849ece98c8a879cca3813619a27aed3e18887b70d12d39c7c5f0","ssdeep":"6144:7VPiNX9+9KmPPhEmDW6W24KMAM2wbvKN4nku:hhEIu","tlshash":"9764b355e713653b182be63e79c4e9885f14df92d9228ba6fb40b40891c7da102e3d3f","first_seen":"2025-04-20T11:25:52.963782Z","last_seen":"2026-05-14T01:57:27.309193Z","times_seen":56,"resource_available":false,"data":null}},"time_used":1722,"timings":{"blocked":493,"dns":0,"connect":244,"send":0,"wait":488,"receive":245,"ssl":248},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-01-26","alert":"Sinkholed","trigger":"whatrtsapp.us.cc","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-01-26","alert":"Sinkholed","trigger":"whatrtsapp.us.cc","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-01-26","alert":"Phishing Block","trigger":"whatrtsapp.us.cc","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"api.ip.sb/geoip","fqdn":"api.ip.sb","domain":"ip.sb","tld":"sb"},"ip":{"addr":"172.67.75.172","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"https://whatrtsapp.us.cc/","date":"2026-01-26T05:51:00.424Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"api.ip.sb","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Tue, 16 Dec 2025 02:37:32 GMT","end":"Mon, 16 Mar 2026 03:37:30 GMT"},"fingerprint":{"sha1":"24:02:51:A7:97:86:16:7B:A6:FB:32:20:E8:6D:27:67:B4:5B:ED:59","sha256":"E6:A4:9B:54:C9:F6:6A:F9:19:BB:6D:05:75:CC:43:E5:AF:1E:84:9C:3A:4C:1D:C3:A9:A8:B1:E0:2E:03:56:7E"}}},"request":{"raw":"GET /geoip HTTP/1.1\r\nHost: api.ip.sb\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/json, text/plain, */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nOrigin: https://whatrtsapp.us.cc\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://whatrtsapp.us.cc/\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ndate: Mon, 26 Jan 2026 05:51:00 GMT\r\ncontent-type: application/json; charset=utf-8\r\ncf-ray: 9c3dbc6bfd654e4c-OSL\r\ncf-cache-status: HIT\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\naccess-control-allow-origin: *\r\nage: 18754\r\ncache-control: public, max-age=0, must-revalidate\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=Oo9lXVbYXhxHvfc5IxbpzvvvRsRJASF0r%2Fs9NjI9%2Bg3jwOQzx870k%2F0Qgb1YW9ZADo%2FyHg%2Bztbbhy3i3cMeKou8r7ceDhMfQ\"}]}\r\nserver: cloudflare\r\nstrict-transport-security: max-age=31536000; includeSubDomains; preload\r\nvary: Accept-Encoding, Accept-Encoding\r\nalt-svc: h3=\":443\"; ma=86400\r\nreferrer-policy: strict-origin-when-cross-origin\r\nx-cache-note: The cf-cache-status header doesnt actually reflect the real cache status, we always return the geo information of your current connecting ip (see the x-ip header)\r\nx-content-type-options: nosniff\r\nx-frame-options: SAMEORIGIN\r\nx-ip: 91.90.42.154\r\nx-protocol: HTTP/2.0\r\netag: W/\"1722fe518292b4d1c93ac93266674ce8139a5003\"\r\ncontent-encoding: br\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":345,"size_decoded":0,"mime_type":"application/json; charset=utf-8","magic":"JSON text data","md5":"d94f87a804d4460d8caa6086788666b9","sha1":"1722fe518292b4d1c93ac93266674ce8139a5003","sha256":"940ac2c71eb6279c6a8c959c0cfdb04aa1e90e374ec56860be5ca49fa4cd3617","sha512":"194a0dada58e4b46364264e447d858da331139d56a3ac75ba371f920a23f4dfdc507ad2c984e036bcd1dc65974cf0f31a6e524760819d427aadd50a2d617113b","ssdeep":"","tlshash":"22e0dfe840ac2f15b93b834e474dcda72bbc9109818ad5854db66f58c3c9bbf614670e","first_seen":"2026-01-15T08:18:10.875167Z","last_seen":"2026-01-26T09:09:46.071344Z","times_seen":10,"resource_available":false,"data":null}},"time_used":137,"timings":{"blocked":56,"dns":37,"connect":1,"send":0,"wait":22,"receive":0,"ssl":17},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"whatrtsapp.us.cc/apple-touch-icon.png","fqdn":"whatrtsapp.us.cc","domain":"us.cc","tld":"cc"},"ip":{"addr":"23.145.136.160","port":443,"asn":0,"as":"","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://whatrtsapp.us.cc/","date":"2026-01-26T05:51:00.658Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"whatleap.us.cc","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Fri, 23 Jan 2026 06:43:34 GMT","end":"Thu, 23 Apr 2026 06:43:33 GMT"},"fingerprint":{"sha1":"BD:33:AE:27:5A:28:CC:D6:23:20:92:5A:A6:8F:A7:6E:B3:AD:A7:58","sha256":"B0:5D:43:BE:E7:85:11:7C:0A:B6:A6:57:BC:3E:80:86:D8:6B:A2:8E:E5:BC:36:76:03:60:6F:9C:9A:8D:7A:3C"}}},"request":{"raw":"GET /apple-touch-icon.png HTTP/1.1\r\nHost: whatrtsapp.us.cc\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://whatrtsapp.us.cc/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Mon, 26 Jan 2026 05:51:00 GMT\r\nContent-Type: image/png\r\nTransfer-Encoding: chunked\r\nConnection: keep-alive\r\nLast-Modified: Wed, 31 Dec 2025 06:41:56 GMT\r\nVary: Accept-Encoding\r\nETag: W/\"6954c5b4-12c3\"\r\nExpires: Tue, 24 Feb 2026 11:12:38 GMT\r\nCache-Control: max-age=2592000\r\nStrict-Transport-Security: max-age=31536000\r\nAlt-Svc: quic=\":443\"; h3=\":443\"; h3-29=\":443\"; h3-27=\":443\";h3-25=\":443\"; h3-T050=\":443\"; h3-Q050=\":443\";h3-Q049=\":443\";h3-Q048=\":443\"; h3-Q046=\":443\"; h3-Q043=\":443\"\r\nContent-Encoding: gzip\r\nServer: nginx\r\nX-Cache-Status: HIT\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":4803,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 194 x 194, 8-bit colormap, non-interlaced","md5":"e872691e449e137aac21b048c42b9539","sha1":"bc1d23d193fdee85fad4e0c392a512645d07dd30","sha256":"8286d412dd31e8fab1f6d67092d86685fbc4f9702863f8262ce8fef566c96592","sha512":"2ee78b84c1587d146f871bebebeea2c53863c141ab46b1b72ca9dc9546d2114a381e274063acfdead781c09d156157dd91771adc0f63631c87b73a3fc58a844a","ssdeep":"96:a3QCa2VZRjKqmBP3llpe2K+tKnwmZHew7rzNCaI00vtCI6uD:aH7VbmBP3lGSmHewRCaI0ICI6uD","tlshash":"fea15cda77ec7a24486a3b6b87ccdd8ef481011071e9603bae098850794499b5ff7028","first_seen":"2023-05-03T14:02:32Z","last_seen":"2026-08-10T21:35:31.448415Z","times_seen":572,"resource_available":false,"data":null}},"time_used":257,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":257,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-01-26","alert":"Sinkholed","trigger":"whatrtsapp.us.cc","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-01-26","alert":"Sinkholed","trigger":"whatrtsapp.us.cc","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-01-26","alert":"Phishing Block","trigger":"whatrtsapp.us.cc","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"whatrtsapp.us.cc/assets/index-BNCAkVth.js","fqdn":"whatrtsapp.us.cc","domain":"us.cc","tld":"cc"},"ip":{"addr":"23.145.136.160","port":443,"asn":0,"as":"","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://whatrtsapp.us.cc/","date":"2026-01-26T05:50:58.077Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"whatleap.us.cc","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Fri, 23 Jan 2026 06:43:34 GMT","end":"Thu, 23 Apr 2026 06:43:33 GMT"},"fingerprint":{"sha1":"BD:33:AE:27:5A:28:CC:D6:23:20:92:5A:A6:8F:A7:6E:B3:AD:A7:58","sha256":"B0:5D:43:BE:E7:85:11:7C:0A:B6:A6:57:BC:3E:80:86:D8:6B:A2:8E:E5:BC:36:76:03:60:6F:9C:9A:8D:7A:3C"}}},"request":{"raw":"GET /assets/index-BNCAkVth.js HTTP/1.1\r\nHost: whatrtsapp.us.cc\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://whatrtsapp.us.cc/\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Mon, 26 Jan 2026 05:50:58 GMT\r\nContent-Type: application/javascript\r\nTransfer-Encoding: chunked\r\nConnection: keep-alive\r\nLast-Modified: Wed, 31 Dec 2025 06:41:56 GMT\r\nVary: Accept-Encoding\r\nETag: W/\"6954c5b4-174044\"\r\nExpires: Sun, 25 Jan 2026 23:12:35 GMT\r\nCache-Control: max-age=43200\r\nStrict-Transport-Security: max-age=31536000\r\nAlt-Svc: quic=\":443\"; h3=\":443\"; h3-29=\":443\"; h3-27=\":443\";h3-25=\":443\"; h3-T050=\":443\"; h3-Q050=\":443\";h3-Q049=\":443\";h3-Q048=\":443\"; h3-Q046=\":443\"; h3-Q043=\":443\"\r\nContent-Encoding: gzip\r\nServer: nginx\r\nX-Cache-Status: HIT\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":1523780,"size_decoded":0,"mime_type":"application/javascript","magic":"JavaScript source, ASCII text, with very long lines (43181)","md5":"e0c36348520aa733a142984430c37388","sha1":"f306e7413b8f029e1388e9c264dfbf7ab6bf353b","sha256":"7eea752602dbb0a1463014f52df9ac07d260f5ed07f25dcb843e9daea82214a0","sha512":"3f2f71d77550315d3339b094435f110502a4036dfcb6f0b7952f7d7da228e3330945e3e4a0e90a6570fe5fe480b89fc6cf02ed23268f10b4478f8e2def822351","ssdeep":"24576:aBmHiIc4ZPIM1B7/qf0UrymxfvyfF6mpRy2f2ZdNgcgWGWCXYl:aBmHiIc4ZPb1BC0UGmxfqfF6mpRyRNg8","tlshash":"3e255bc8b599b43983b755d5107f0006b23d1a58b40c84e4f0addee93a76d99a2bbf3c","first_seen":"2026-01-03T19:49:36.86546Z","last_seen":"2026-04-18T00:23:15.484434Z","times_seen":22,"resource_available":false,"data":null}},"time_used":2538,"timings":{"blocked":506,"dns":2,"connect":250,"send":0,"wait":501,"receive":1019,"ssl":256},"alerts":{"ids":null,"analyzer":[{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-01-26","alert":"Phishing Block","trigger":"whatrtsapp.us.cc","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-01-26","alert":"Sinkholed","trigger":"whatrtsapp.us.cc","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-01-26","alert":"Sinkholed","trigger":"whatrtsapp.us.cc","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"whatrtsapp.us.cc/assets/en-CUrTyJ4q.js","fqdn":"whatrtsapp.us.cc","domain":"us.cc","tld":"cc"},"ip":{"addr":"23.145.136.160","port":443,"asn":0,"as":"","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://whatrtsapp.us.cc/","date":"2026-01-26T05:51:00.421Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"whatleap.us.cc","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Fri, 23 Jan 2026 06:43:34 GMT","end":"Thu, 23 Apr 2026 06:43:33 GMT"},"fingerprint":{"sha1":"BD:33:AE:27:5A:28:CC:D6:23:20:92:5A:A6:8F:A7:6E:B3:AD:A7:58","sha256":"B0:5D:43:BE:E7:85:11:7C:0A:B6:A6:57:BC:3E:80:86:D8:6B:A2:8E:E5:BC:36:76:03:60:6F:9C:9A:8D:7A:3C"}}},"request":{"raw":"GET /assets/en-CUrTyJ4q.js HTTP/1.1\r\nHost: whatrtsapp.us.cc\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://whatrtsapp.us.cc/assets/index-BNCAkVth.js\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Mon, 26 Jan 2026 05:51:00 GMT\r\nContent-Type: application/javascript\r\nTransfer-Encoding: chunked\r\nConnection: keep-alive\r\nLast-Modified: Wed, 31 Dec 2025 06:41:56 GMT\r\nVary: Accept-Encoding\r\nETag: W/\"6954c5b4-1beb\"\r\nExpires: Sun, 25 Jan 2026 23:42:14 GMT\r\nCache-Control: max-age=43200\r\nStrict-Transport-Security: max-age=31536000\r\nAlt-Svc: quic=\":443\"; h3=\":443\"; h3-29=\":443\"; h3-27=\":443\";h3-25=\":443\"; h3-T050=\":443\"; h3-Q050=\":443\";h3-Q049=\":443\";h3-Q048=\":443\"; h3-Q046=\":443\"; h3-Q043=\":443\"\r\nContent-Encoding: gzip\r\nServer: nginx\r\nX-Cache-Status: HIT\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":7147,"size_decoded":0,"mime_type":"application/javascript","magic":"Unicode text, UTF-8 text, with very long lines (5898)","md5":"af171249877475e1dc78cebb3977551a","sha1":"c709ddd3363e7210600dba56d6c3fa87177e47a3","sha256":"2218d9ddbf6cfad7f30ee4971cba4f083ca93a77974b6659637e9c96f2757e4f","sha512":"16505d2c0ac8958c5c15aa0ff77549cf06c3e63de90afb49d21678021cfef1e18e0176ff638ae6e7b4ac8d7aff7a2edbcf899b6b2c02115b213bb98372289b91","ssdeep":"192:hlK61hUrrfH9dXO4VC8LKrOk/7+9CUxV+/5zUuaRnuDRArqId:hlT1hUrrv9dXO4VC8LPkj+9CUxV+/5zI","tlshash":"d3e1b6de655a2a330e8347077cbf770daaec052d8e67282f58ff415a62d5791732218c","first_seen":"2026-01-03T19:49:36.854829Z","last_seen":"2026-04-18T00:23:15.485321Z","times_seen":23,"resource_available":true,"data":null}},"time_used":252,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":251,"receive":1,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-01-26","alert":"Sinkholed","trigger":"whatrtsapp.us.cc","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-01-26","alert":"Sinkholed","trigger":"whatrtsapp.us.cc","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-01-26","alert":"Phishing Block","trigger":"whatrtsapp.us.cc","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"api.ip.sb/geoip","fqdn":"api.ip.sb","domain":"ip.sb","tld":"sb"},"ip":{"addr":"172.67.75.172","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"fetch","requested_by":"https://whatrtsapp.us.cc/","date":"2026-01-26T05:51:00.706Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"api.ip.sb","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Tue, 16 Dec 2025 02:37:32 GMT","end":"Mon, 16 Mar 2026 03:37:30 GMT"},"fingerprint":{"sha1":"24:02:51:A7:97:86:16:7B:A6:FB:32:20:E8:6D:27:67:B4:5B:ED:59","sha256":"E6:A4:9B:54:C9:F6:6A:F9:19:BB:6D:05:75:CC:43:E5:AF:1E:84:9C:3A:4C:1D:C3:A9:A8:B1:E0:2E:03:56:7E"}}},"request":{"raw":"GET /geoip HTTP/1.1\r\nHost: api.ip.sb\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://whatrtsapp.us.cc/\r\nOrigin: https://whatrtsapp.us.cc\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ndate: Mon, 26 Jan 2026 05:51:00 GMT\r\ncontent-type: application/json; charset=utf-8\r\ncf-ray: 9c3dbc6d6f9e4e4c-OSL\r\ncf-cache-status: HIT\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\naccess-control-allow-origin: *\r\nage: 18754\r\ncache-control: public, max-age=0, must-revalidate\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=aoUAZUmPSufiTtJIV90GYnFOsrmHspK3pd%2FR%2BkWdj1mX%2Bf5%2FxOSEOVc3J0JGmCycNW5TarztqKHZJgdT4SOw72etpYqMDl1a\"}]}\r\nserver: cloudflare\r\nstrict-transport-security: max-age=31536000; includeSubDomains; preload\r\nvary: Accept-Encoding, Accept-Encoding\r\nalt-svc: h3=\":443\"; ma=86400\r\nreferrer-policy: strict-origin-when-cross-origin\r\nx-cache-note: The cf-cache-status header doesnt actually reflect the real cache status, we always return the geo information of your current connecting ip (see the x-ip header)\r\nx-content-type-options: nosniff\r\nx-frame-options: SAMEORIGIN\r\nx-ip: 91.90.42.154\r\nx-protocol: HTTP/2.0\r\netag: W/\"1722fe518292b4d1c93ac93266674ce8139a5003\"\r\ncontent-encoding: br\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":345,"size_decoded":0,"mime_type":"application/json; charset=utf-8","magic":"JSON text data","md5":"d94f87a804d4460d8caa6086788666b9","sha1":"1722fe518292b4d1c93ac93266674ce8139a5003","sha256":"940ac2c71eb6279c6a8c959c0cfdb04aa1e90e374ec56860be5ca49fa4cd3617","sha512":"194a0dada58e4b46364264e447d858da331139d56a3ac75ba371f920a23f4dfdc507ad2c984e036bcd1dc65974cf0f31a6e524760819d427aadd50a2d617113b","ssdeep":"","tlshash":"22e0dfe840ac2f15b93b834e474dcda72bbc9109818ad5854db66f58c3c9bbf614670e","first_seen":"2026-01-15T08:18:10.875167Z","last_seen":"2026-01-26T09:09:46.071344Z","times_seen":10,"resource_available":false,"data":null}},"time_used":18,"timings":{"blocked":1,"dns":0,"connect":0,"send":0,"wait":17,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"whatrtsapp.us.cc/nation/no.svg","fqdn":"whatrtsapp.us.cc","domain":"us.cc","tld":"cc"},"ip":{"addr":"23.145.136.160","port":443,"asn":0,"as":"","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://whatrtsapp.us.cc/","date":"2026-01-26T05:51:00.760Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"whatleap.us.cc","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Fri, 23 Jan 2026 06:43:34 GMT","end":"Thu, 23 Apr 2026 06:43:33 GMT"},"fingerprint":{"sha1":"BD:33:AE:27:5A:28:CC:D6:23:20:92:5A:A6:8F:A7:6E:B3:AD:A7:58","sha256":"B0:5D:43:BE:E7:85:11:7C:0A:B6:A6:57:BC:3E:80:86:D8:6B:A2:8E:E5:BC:36:76:03:60:6F:9C:9A:8D:7A:3C"}}},"request":{"raw":"GET /nation/no.svg HTTP/1.1\r\nHost: whatrtsapp.us.cc\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://whatrtsapp.us.cc/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Mon, 26 Jan 2026 05:51:00 GMT\r\nContent-Type: image/svg+xml\r\nContent-Length: 318\r\nConnection: keep-alive\r\nLast-Modified: Wed, 31 Dec 2025 06:41:56 GMT\r\nETag: \"6954c5b4-13e\"\r\nStrict-Transport-Security: max-age=31536000\r\nAlt-Svc: quic=\":443\"; h3=\":443\"; h3-29=\":443\"; h3-27=\":443\";h3-25=\":443\"; h3-T050=\":443\"; h3-Q050=\":443\";h3-Q049=\":443\";h3-Q048=\":443\"; h3-Q046=\":443\"; h3-Q043=\":443\"\r\nServer: nginx\r\nX-Cache-Status: HIT\r\nAccept-Ranges: bytes\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":318,"size_decoded":0,"mime_type":"image/svg+xml","magic":"SVG Scalable Vector Graphics image","md5":"859a13561a1b24bfa65fb1a03835da49","sha1":"c2ab5ac79474bf31976cef328f5880ab07d0654f","sha256":"ceea17af051dceefd5759a824213eb40ac8a8095aa88a6874a7bbc8de637357a","sha512":"e0f028eca9a2f6dd45d61807c4929c1125a26f83de3062d3a4980cf32e1790093bafa0522c7a706882259ef22b057f0495833cc39f5b902bd22fe59a872c7f87","ssdeep":"","tlshash":"f5e0c2ecd33db800ca2483102f2d35e390a9b0cee18512ebfc5009a820ae6968dc3dd1","first_seen":"2023-05-07T17:48:28Z","last_seen":"2026-08-10T19:21:30.883112Z","times_seen":4611,"resource_available":false,"data":null}},"time_used":253,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":253,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-01-26","alert":"Sinkholed","trigger":"whatrtsapp.us.cc","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-01-26","alert":"Sinkholed","trigger":"whatrtsapp.us.cc","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-01-26","alert":"Phishing Block","trigger":"whatrtsapp.us.cc","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"whatrtsapp.us.cc/","fqdn":"whatrtsapp.us.cc","domain":"us.cc","tld":"cc"},"ip":{"addr":"23.145.136.159","port":443,"asn":0,"as":"","country":"United States","country_code":"US"},"is_navigation_request":true,"resource_type":"document","requested_by":"","date":"2026-01-26T05:50:56.451Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"whatleap.us.cc","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Fri, 23 Jan 2026 06:43:34 GMT","end":"Thu, 23 Apr 2026 06:43:33 GMT"},"fingerprint":{"sha1":"BD:33:AE:27:5A:28:CC:D6:23:20:92:5A:A6:8F:A7:6E:B3:AD:A7:58","sha256":"B0:5D:43:BE:E7:85:11:7C:0A:B6:A6:57:BC:3E:80:86:D8:6B:A2:8E:E5:BC:36:76:03:60:6F:9C:9A:8D:7A:3C"}}},"request":{"raw":"GET / HTTP/1.1\r\nHost: whatrtsapp.us.cc\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nUpgrade-Insecure-Requests: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: document\r\nSec-Fetch-Mode: navigate\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Mon, 26 Jan 2026 05:50:57 GMT\r\nContent-Type: text/html\r\nTransfer-Encoding: chunked\r\nConnection: keep-alive\r\nLast-Modified: Wed, 31 Dec 2025 06:41:56 GMT\r\nVary: Accept-Encoding\r\nETag: W/\"6954c5b4-1902\"\r\nStrict-Transport-Security: max-age=31536000\r\nAlt-Svc: quic=\":443\"; h3=\":443\"; h3-29=\":443\"; h3-27=\":443\";h3-25=\":443\"; h3-T050=\":443\"; h3-Q050=\":443\";h3-Q049=\":443\";h3-Q048=\":443\"; h3-Q046=\":443\"; h3-Q043=\":443\"\r\nContent-Encoding: gzip\r\nServer: nginx\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":6402,"size_decoded":0,"mime_type":"text/html","magic":"HTML document, ASCII text","md5":"69d07a59768b8895c2e2372f8f927ded","sha1":"690503e2c555a57b75d234874056a7ecde6af14d","sha256":"c397b5d72ab79a00bdf198a0efe0d4d59a85242f648813028d8637bc6f95ec41","sha512":"6458b514a52b9faf1c38fd065368f6bcb3e7b023506a564680732f0a38d46347c8e2315c954ce3786042c2b1475497c915a9103db1576b8dd0c798f090a244dc","ssdeep":"48:Duupv8dWQUyNmQFRJU1+pTwF9wVDqjAkD6qb9cEnCRatchVArIcMdYDT0DXl2Di6:6u1sRUyvZTKRlbOEfP4KgqhJ1DAQzIiL","tlshash":"1bd12d4549e3005a7c1bd1792bfb630923645403ce5ade587c9eb2bacf407ac98b3be1","first_seen":"2026-01-03T19:49:36.861156Z","last_seen":"2026-04-18T00:23:15.487025Z","times_seen":23,"resource_available":false,"data":null}},"time_used":2560,"timings":{"blocked":1115,"dns":580,"connect":261,"send":0,"wait":330,"receive":0,"ssl":269},"alerts":{"ids":null,"analyzer":[{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-01-26","alert":"Sinkholed","trigger":"whatrtsapp.us.cc","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-01-26","alert":"Sinkholed","trigger":"whatrtsapp.us.cc","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-01-26","alert":"Phishing Block","trigger":"whatrtsapp.us.cc","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"whatrtsapp.us.cc/img/favicon.png","fqdn":"whatrtsapp.us.cc","domain":"us.cc","tld":"cc"},"ip":{"addr":"23.145.136.160","port":443,"asn":0,"as":"","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://whatrtsapp.us.cc/","date":"2026-01-26T05:51:00.659Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"whatleap.us.cc","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Fri, 23 Jan 2026 06:43:34 GMT","end":"Thu, 23 Apr 2026 06:43:33 GMT"},"fingerprint":{"sha1":"BD:33:AE:27:5A:28:CC:D6:23:20:92:5A:A6:8F:A7:6E:B3:AD:A7:58","sha256":"B0:5D:43:BE:E7:85:11:7C:0A:B6:A6:57:BC:3E:80:86:D8:6B:A2:8E:E5:BC:36:76:03:60:6F:9C:9A:8D:7A:3C"}}},"request":{"raw":"GET /img/favicon.png HTTP/1.1\r\nHost: whatrtsapp.us.cc\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://whatrtsapp.us.cc/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Mon, 26 Jan 2026 05:51:00 GMT\r\nContent-Type: image/png\r\nContent-Length: 787\r\nConnection: keep-alive\r\nLast-Modified: Wed, 31 Dec 2025 06:41:56 GMT\r\nETag: \"6954c5b4-313\"\r\nExpires: Tue, 24 Feb 2026 00:38:19 GMT\r\nCache-Control: max-age=2592000\r\nStrict-Transport-Security: max-age=31536000\r\nAlt-Svc: quic=\":443\"; h3=\":443\"; h3-29=\":443\"; h3-27=\":443\";h3-25=\":443\"; h3-T050=\":443\"; h3-Q050=\":443\";h3-Q049=\":443\";h3-Q048=\":443\"; h3-Q046=\":443\"; h3-Q043=\":443\"\r\nServer: nginx\r\nX-Cache-Status: HIT\r\nAccept-Ranges: bytes\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":787,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced","md5":"c5088e888c97ad440a61d247596f88e5","sha1":"865a0d1bb7e1245e046c5e1bae988cce53330280","sha256":"d0cadf240e89340b93df35240e7809039c1c574be05fbe2cf3243e2f487bc9ec","sha512":"ae2a039fc7c2ec70ad33eec78b3392d96d7899fb8bfffce45808c5d9e1ae6b3a73607b85d04433de16da43a8c007cb158e5d461302845edd15cba387d4b7e946","ssdeep":"","tlshash":"3101c530a610efb8c39b8eaaa6a0c2741219119d967aa63a080de03fce608c042d003c","first_seen":"2023-05-03T14:02:32Z","last_seen":"2026-08-10T21:35:31.437027Z","times_seen":1564,"resource_available":false,"data":null}},"time_used":258,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":258,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-01-26","alert":"Sinkholed","trigger":"whatrtsapp.us.cc","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-01-26","alert":"Sinkholed","trigger":"whatrtsapp.us.cc","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-01-26","alert":"Phishing Block","trigger":"whatrtsapp.us.cc","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null}],"urlquery":null}}]}