{"report_id":"b9446a87-e34d-400a-b0ec-2dd37ed50e45","version":0,"status":"done","tags":[],"date":"2026-09-05T14:50:32Z","url":{"schema":"http","addr":"upservice-dienst.net/","fqdn":"upservice-dienst.net","domain":"upservice-dienst.net","tld":"net"},"ip":{"addr":"158.94.208.174","port":0,"asn":786,"as":"Jisc Services Limited","country":"United Kingdom","country_code":"GB"},"final":{"url":{"schema":"https","addr":"upservice-dienst.net/","fqdn":"upservice-dienst.net","domain":"upservice-dienst.net","tld":"net"},"title":"Track","dom":{"size":3441,"mime_type":"text/html; charset=utf-8","magic":"HTML document, ASCII text, with very long lines (3020)","md5":"9a21600f3b3deba9921c73ea2e079197","sha1":"369e548d0b51a0c567b47ebec659c11f870a2e78","sha256":"0d8ef6028e9a6f2daf950081e5e77f1762f581c37c279777bdf76d9d8fca73c8","sha512":"04c3ebcc528a2bf8e7d72a790d0aad98267a089b119dd3409bbb4a43f3ac23ad5b77d302d4f3c4f828a519f30bdf6ee3784e7c0c9d13bb53061692c70da98cef","ssdeep":"","tlshash":"a96198bc11500b6dfd72cd0b9b607a1ce46276eeeb164444ee773161df9680998f90bc","dom_hash":"domhash042e649474025d9a5459858826b5648b","first_seen":"2026-09-05T14:50:45.751113Z","last_seen":"2026-09-05T14:50:45.751113Z","times_seen":1,"resource_available":false,"data":null}},"submit":{"url":{"schema":"http","addr":"upservice-dienst.net/","fqdn":"upservice-dienst.net","domain":"upservice-dienst.net","tld":"net"},"ip":{"addr":"158.94.208.174","port":0,"asn":786,"as":"Jisc Services Limited","country":"United Kingdom","country_code":"GB"},"tags":null,"meta":null},"settings":{"access":"public","device_type":"desktop","expires_at":"2027-10-10T14:50:32Z","useragent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0","referer":"","cookies":null,"exit_node":"qguvgzjxzsgb3vs"},"stats":{"alert_count":{"ids":0,"urlquery":0,"analyzer":2}},"detection":{"ids":null,"analyzer":[{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-09-05","alert":"Phishing Block","trigger":"upservice-dienst.net","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-05","alert":"Sinkholed","trigger":"upservice-dienst.net","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null},"summary":[{"fqdn":"upservice-dienst.net","ip":{"addr":"158.94.208.174","port":443,"asn":786,"as":"Jisc Services Limited","country":"United Kingdom","country_code":"GB"},"domain_registered":"2026-09-04","domain_rank":0,"first_seen":"2026-09-05T14:50:34.459164Z","last_seen":"2026-09-05T14:50:34.459164Z","alert_count":14,"request_count":7,"received_data":2206735,"sent_data":3400,"comment":"","tags":null,"fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"PHP:8.4.25","description":"PHP is a general-purpose scripting language used for web development.","website":"https://php.net","common_platform_enumeration":"cpe:2.3:a:php:php:*:*:*:*:*:*:*:*","icon":"PHP.svg","categories":["Programming languages"]},{"name":"Plesk","description":"Plesk is a web hosting and server data centre automation software with a control panel developed for Linux and Windows-based retail hosting service providers.","website":"https://www.plesk.com","common_platform_enumeration":"cpe:2.3:a:parallels:parallels_plesk_panel:*:*:*:*:*:*:*:*","icon":"Plesk.svg","categories":["Hosting panels"]}]}],"files":null,"artifacts":{"windows_shortcuts":null,"files":null,"telegram":null,"pdfs":null,"clipboard":null},"sensors":{"ids":null,"analyzer":null,"urlquery":null},"javascript":{"script":[{"url":{"schema":"https","addr":"upservice-dienst.net/assets/index-D9ylUgtY.js","fqdn":"upservice-dienst.net","domain":"upservice-dienst.net","tld":"net"},"ip":{"addr":"158.94.208.174","port":443,"asn":786,"as":"Jisc Services Limited","country":"United Kingdom","country_code":"GB"},"introduction_type":"scriptElement","is_inline":false,"md5":"e417cd6dbab0eb5b93bb73ab7facb287","sha1":"c067c79074b98b7105109ec66c10062feebe6d03","sha256":"ac78e262cc4f066043bb0908eac09b2008a27bc2849ed14ef1037616ba85543d","sha512":"caf212c3e458117f5d9287d8c03e68fce73d2fdb899a35f833527344835ee36c43587b4b930763cada87045490d669c0c625771dcd5b02cba103609faa9b505a","ssdeep":"49152:GCjFnRB66icOYlZc+lJK7bga2zeq28J4WTpQJrTIQZutsM8mlNw28BDkk42H:Pr6ZchVnNXG","tlshash":"d9a53bd97276e839499a3284355f0117762b1be0f4ceca80b3d8ca4939e153cb937a79","size":2180024,"data":"","first_seen":"2024-09-04T03:26:04Z","last_seen":"2026-09-05T14:50:45.773889Z","times_seen":10,"alerts":{"ids":null,"analyzer":null,"urlquery":null}}],"eval":null,"write":null,"console":[{"level":"error","text":"Error fetching IP address:map[actor:server1.conn0.watcher14.process7//obj22 class:Object extensible:true frozen:false isError:false ownPropertyLength:6 preview:map[kind:Object ownProperties:map[code:map[configurable:true enumerable:true value:ERR_NETWORK writable:true] config:map[configurable:true enumerable:true value:map[actor:server1.conn0.watcher14.process7//obj23 class:Object extensible:true frozen:false isError:false ownPropertyLength:17 sealed:false type:object] writable:true] message:map[configurable:true enumerable:true value:Network Error writable:true] name:map[configurable:true enumerable:true value:AxiosError writable:true] request:map[configurable:true enumerable:true value:map[actor:server1.conn0.watcher14.process7//obj24 class:XMLHttpRequest extensible:true frozen:false isError:false ownPropertyLength:0 sealed:false type:object] writable:true]] ownPropertiesLength:6 safeGetterValues:map[stack:map[enumerable:false getterPrototypeLevel:2 getterValue: writable:true]]] sealed:false type:object]","filename":"https://upservice-dienst.net/assets/index-D9ylUgtY.js","line_number":80,"column_number":5435},{"level":"error","text":"Error fetching data:cc argument must be an ISO 3166-1 alpha-2 string, but got 'undefined' instead.","filename":"https://upservice-dienst.net/assets/index-D9ylUgtY.js","line_number":115,"column_number":235}]},"http":[{"url":{"schema":"https","addr":"upservice-dienst.net/Panel/stats/update.php?put=totale\u0026PWD=BLACKFORCE","fqdn":"upservice-dienst.net","domain":"upservice-dienst.net","tld":"net"},"ip":{"addr":"158.94.208.174","port":443,"asn":786,"as":"Jisc Services Limited","country":"United Kingdom","country_code":"GB"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"https://upservice-dienst.net/","date":"2026-09-05T14:50:02.565Z","timestamp":1788619802565,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"upservice-dienst.net","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Fri, 04 Sep 2026 14:27:51 GMT","end":"Thu, 03 Dec 2026 14:27:50 GMT"},"fingerprint":{"sha1":"39:6B:B7:F4:18:4D:A2:50:B3:F7:5A:04:27:62:8A:29:57:56:10:45","sha256":"E0:48:B4:24:CF:12:1D:87:3F:4E:6B:56:87:93:03:E3:42:D0:80:5E:23:E7:7D:F3:FE:67:F3:E3:49:2B:22:8A"}}},"request":{"raw":"GET /Panel/stats/update.php?put=totale\u0026PWD=BLACKFORCE HTTP/1.1\r\nHost: upservice-dienst.net\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/json, text/plain, */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://upservice-dienst.net/\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nserver: nginx\r\ndate: Sat, 05 Sep 2026 14:50:02 GMT\r\ncontent-type: text/html; charset=UTF-8\r\ncontent-length: 24\r\naccess-control-allow-origin: *\r\naccess-control-allow-methods: GET, POST, OPTIONS\r\naccess-control-allow-headers: Content-Type\r\nvary: Accept-Encoding\r\ncontent-encoding: gzip\r\nalt-svc: h3=\":443\"; ma=86400\r\nx-powered-by: PHP/8.4.25, PleskLin\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"PHP:8.4.25","description":"PHP is a general-purpose scripting language used for web development.","website":"https://php.net","common_platform_enumeration":"cpe:2.3:a:php:php:*:*:*:*:*:*:*:*","icon":"PHP.svg","categories":["Programming languages"]}],"data":{"size":4,"size_decoded":390,"mime_type":"text/html; charset=UTF-8","magic":"ASCII text, with no line terminators","md5":"6b2ded51d81a4403d8a4bd25fa1e57ee","sha1":"e5fd9cfe0e8039111d54b588e77b2bb0cad41c3a","sha256":"a4c3ed04a95a3da14a9d235c83d868bed7c0f45cf7f3faa751ee8f50598d2211","sha512":"07b8a32b38151e20c27bf64ee5fa32cf2f19e2ef0f749e50ecf8069a368eddd1f0822b7b4dea7e8380d9e26425efbeb54ccac432c09b75b82356afcf94cec37d","ssdeep":"","tlshash":"54300000000000003000000c00003000000000000c0000000000000000000000000000","first_seen":"2023-03-09T12:27:28Z","last_seen":"2026-09-05T15:05:32.813408Z","times_seen":2690,"resource_available":true,"data":null}},"time_used":106,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":106,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-09-05","alert":"Phishing Block","trigger":"upservice-dienst.net","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-05","alert":"Sinkholed","trigger":"upservice-dienst.net","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"upservice-dienst.net/favicon.ico","fqdn":"upservice-dienst.net","domain":"upservice-dienst.net","tld":"net"},"ip":{"addr":"158.94.208.174","port":443,"asn":786,"as":"Jisc Services Limited","country":"United Kingdom","country_code":"GB"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://upservice-dienst.net/","date":"2026-09-05T14:50:02.676Z","timestamp":1788619802676,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"upservice-dienst.net","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Fri, 04 Sep 2026 14:27:51 GMT","end":"Thu, 03 Dec 2026 14:27:50 GMT"},"fingerprint":{"sha1":"39:6B:B7:F4:18:4D:A2:50:B3:F7:5A:04:27:62:8A:29:57:56:10:45","sha256":"E0:48:B4:24:CF:12:1D:87:3F:4E:6B:56:87:93:03:E3:42:D0:80:5E:23:E7:7D:F3:FE:67:F3:E3:49:2B:22:8A"}}},"request":{"raw":"GET /favicon.ico HTTP/1.1\r\nHost: upservice-dienst.net\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://upservice-dienst.net/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=6\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nserver: nginx\r\ndate: Sat, 05 Sep 2026 14:50:02 GMT\r\ncontent-type: image/vnd.microsoft.icon\r\ncontent-length: 2238\r\nlast-modified: Fri, 04 Sep 2026 15:30:27 GMT\r\netag: \"6a9ae413-8be\"\r\nalt-svc: h3=\":443\"; ma=86400\r\nx-powered-by: PleskLin\r\naccept-ranges: bytes\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"Plesk","description":"Plesk is a web hosting and server data centre automation software with a control panel developed for Linux and Windows-based retail hosting service providers.","website":"https://www.plesk.com","common_platform_enumeration":"cpe:2.3:a:parallels:parallels_plesk_panel:*:*:*:*:*:*:*:*","icon":"Plesk.svg","categories":["Hosting panels"]}],"data":{"size":2238,"size_decoded":2511,"mime_type":"image/vnd.microsoft.icon","magic":"MS Windows icon resource - 1 icon, 32x32, 8 bits/pixel","md5":"afd13e52f285793f5eaa266c12a19abe","sha1":"4b71098176443981be65286ec864b12ebc233f81","sha256":"9ca2236bb4ec1714e173cecb6bcc95c82e12df204c7d4c87fe4b9f01135efce8","sha512":"6e019c9022885e2281635cc9586241f012851b28c667577af944339b2a5537bed1bf7a1fac3e776bccbaaf17130bded8184ce5f5b0c0a7efd1f7df321e5e979f","ssdeep":"","tlshash":"9041e31dfe80d0f4ce116235fac58f7ba729591030535632f71d5ab6dd72843c2d5981","first_seen":"2023-04-30T19:01:06Z","last_seen":"2026-09-05T14:50:45.75674Z","times_seen":870,"resource_available":false,"data":null}},"time_used":99,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":99,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-09-05","alert":"Phishing Block","trigger":"upservice-dienst.net","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-05","alert":"Sinkholed","trigger":"upservice-dienst.net","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"upservice-dienst.net/antibots/check.php?ip=null\u0026PWD=BLACKFORCE","fqdn":"upservice-dienst.net","domain":"upservice-dienst.net","tld":"net"},"ip":{"addr":"158.94.208.174","port":443,"asn":786,"as":"Jisc Services Limited","country":"United Kingdom","country_code":"GB"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"https://upservice-dienst.net/","date":"2026-09-05T14:50:03.349Z","timestamp":1788619803349,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"upservice-dienst.net","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Fri, 04 Sep 2026 14:27:51 GMT","end":"Thu, 03 Dec 2026 14:27:50 GMT"},"fingerprint":{"sha1":"39:6B:B7:F4:18:4D:A2:50:B3:F7:5A:04:27:62:8A:29:57:56:10:45","sha256":"E0:48:B4:24:CF:12:1D:87:3F:4E:6B:56:87:93:03:E3:42:D0:80:5E:23:E7:7D:F3:FE:67:F3:E3:49:2B:22:8A"}}},"request":{"raw":"GET /antibots/check.php?ip=null\u0026PWD=BLACKFORCE HTTP/1.1\r\nHost: upservice-dienst.net\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/json, text/plain, */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://upservice-dienst.net/\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nserver: nginx\r\ndate: Sat, 05 Sep 2026 14:50:03 GMT\r\ncontent-type: text/html; charset=UTF-8\r\ncontent-length: 60\r\naccess-control-allow-origin: *\r\naccess-control-allow-methods: GET, POST, OPTIONS\r\naccess-control-allow-headers: Content-Type\r\nvary: Accept-Encoding\r\ncontent-encoding: gzip\r\nalt-svc: h3=\":443\"; ma=86400\r\nx-powered-by: PHP/8.4.25, PleskLin\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"PHP:8.4.25","description":"PHP is a general-purpose scripting language used for web development.","website":"https://php.net","common_platform_enumeration":"cpe:2.3:a:php:php:*:*:*:*:*:*:*:*","icon":"PHP.svg","categories":["Programming languages"]}],"data":{"size":40,"size_decoded":426,"mime_type":"text/html; charset=UTF-8","magic":"ASCII text, with no line terminators","md5":"c0c359a2817e4f3a450168227ee6f8d3","sha1":"c84ad71c3c7b87d35baef95bf93cfa149e5008ce","sha256":"1b8105e8c3dc56befae26dac6c55c61233052455da99916f0d65b28ff56bf590","sha512":"afc890049cc954186d5c7c47eaecafa0bdad98471757700c8c76dde15b01e2cab894f86b361b774d0754a1267effa35c733accb97fa12336de6cdf106461694e","ssdeep":"","tlshash":"f1900475c501540d505135035153d0304ff15c05435570350ccc0c04100cc0137d7540","first_seen":"2026-07-07T06:56:54.870963Z","last_seen":"2026-09-05T15:05:32.833201Z","times_seen":7,"resource_available":false,"data":null}},"time_used":476,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":476,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-09-05","alert":"Phishing Block","trigger":"upservice-dienst.net","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-05","alert":"Sinkholed","trigger":"upservice-dienst.net","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"upservice-dienst.net/","fqdn":"upservice-dienst.net","domain":"upservice-dienst.net","tld":"net"},"ip":{"addr":"158.94.208.174","port":443,"asn":786,"as":"Jisc Services Limited","country":"United Kingdom","country_code":"GB"},"is_navigation_request":true,"resource_type":"document","requested_by":"","date":"2026-09-05T14:50:00.595Z","timestamp":1788619800595,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"upservice-dienst.net","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Fri, 04 Sep 2026 14:27:51 GMT","end":"Thu, 03 Dec 2026 14:27:50 GMT"},"fingerprint":{"sha1":"39:6B:B7:F4:18:4D:A2:50:B3:F7:5A:04:27:62:8A:29:57:56:10:45","sha256":"E0:48:B4:24:CF:12:1D:87:3F:4E:6B:56:87:93:03:E3:42:D0:80:5E:23:E7:7D:F3:FE:67:F3:E3:49:2B:22:8A"}}},"request":{"raw":"GET / HTTP/1.1\r\nHost: upservice-dienst.net\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nUpgrade-Insecure-Requests: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: document\r\nSec-Fetch-Mode: navigate\r\nSec-Fetch-Site: none\r\nPriority: u=0, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nserver: nginx\r\ndate: Sat, 05 Sep 2026 14:50:00 GMT\r\ncontent-type: text/html\r\ncontent-length: 292\r\nx-accel-version: 0.01\r\nlast-modified: Fri, 04 Sep 2026 15:30:39 GMT\r\netag: \"1c7-65aa9f35e8c0f-gzip\"\r\naccept-ranges: bytes\r\nvary: Accept-Encoding\r\ncontent-encoding: gzip\r\nalt-svc: h3=\":443\"; ma=86400\r\nx-powered-by: PleskLin\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"Plesk","description":"Plesk is a web hosting and server data centre automation software with a control panel developed for Linux and Windows-based retail hosting service providers.","website":"https://www.plesk.com","common_platform_enumeration":"cpe:2.3:a:parallels:parallels_plesk_panel:*:*:*:*:*:*:*:*","icon":"Plesk.svg","categories":["Hosting panels"]}],"data":{"size":455,"size_decoded":649,"mime_type":"text/html","magic":"HTML document, ASCII text","md5":"9794d27cebc214e4728c181f470b0544","sha1":"56a397f2b525986b6ff1a5d3d64a5f73d838e637","sha256":"3483857071865093ee81bb5ce165b55cf04fddccefab7c209f9e7e5527dd67ee","sha512":"ee62fe626d057f29172a5062108a04b1a44b3320f9267614f7f4053d43ca94e0104657765f383f82a5af624b8383c8939b813927f7c510f5c53eb1dcad8de56a","ssdeep":"","tlshash":"c9f05c4598e0c915133007545ec1f918de96eb874789ad4821eb507d5fc4b82cedf5bc","first_seen":"2024-09-04T03:26:04Z","last_seen":"2026-09-05T14:50:45.761404Z","times_seen":16,"resource_available":false,"data":null}},"time_used":300,"timings":{"blocked":-1,"dns":11,"connect":92,"send":0,"wait":100,"receive":0,"ssl":97},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-05","alert":"Sinkholed","trigger":"upservice-dienst.net","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-09-05","alert":"Phishing Block","trigger":"upservice-dienst.net","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"upservice-dienst.net/assets/index-CNJ9uCtU.css","fqdn":"upservice-dienst.net","domain":"upservice-dienst.net","tld":"net"},"ip":{"addr":"158.94.208.174","port":443,"asn":786,"as":"Jisc Services Limited","country":"United Kingdom","country_code":"GB"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://upservice-dienst.net/","date":"2026-09-05T14:50:01.106Z","timestamp":1788619801106,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"upservice-dienst.net","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Fri, 04 Sep 2026 14:27:51 GMT","end":"Thu, 03 Dec 2026 14:27:50 GMT"},"fingerprint":{"sha1":"39:6B:B7:F4:18:4D:A2:50:B3:F7:5A:04:27:62:8A:29:57:56:10:45","sha256":"E0:48:B4:24:CF:12:1D:87:3F:4E:6B:56:87:93:03:E3:42:D0:80:5E:23:E7:7D:F3:FE:67:F3:E3:49:2B:22:8A"}}},"request":{"raw":"GET /assets/index-CNJ9uCtU.css HTTP/1.1\r\nHost: upservice-dienst.net\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://upservice-dienst.net/\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=2\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nserver: nginx\r\ndate: Sat, 05 Sep 2026 14:50:01 GMT\r\ncontent-type: text/css\r\nlast-modified: Fri, 04 Sep 2026 15:29:08 GMT\r\netag: W/\"6a9ae3c4-540d\"\r\nalt-svc: h3=\":443\"; ma=86400\r\nx-powered-by: PleskLin\r\ncontent-encoding: br\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"Plesk","description":"Plesk is a web hosting and server data centre automation software with a control panel developed for Linux and Windows-based retail hosting service providers.","website":"https://www.plesk.com","common_platform_enumeration":"cpe:2.3:a:parallels:parallels_plesk_panel:*:*:*:*:*:*:*:*","icon":"Plesk.svg","categories":["Hosting panels"]}],"data":{"size":21517,"size_decoded":4796,"mime_type":"text/css","magic":"ASCII text, with very long lines (21516)","md5":"2f14f420448f8a5d00eeb1545db35056","sha1":"83f82939efd62affd0808f8b89d5cc858fceec9b","sha256":"898d2672c624513f1333a7d7d5a40e5b9ea9640c4bc06f6e54e919d28c934b2a","sha512":"58ec3966c844cd9ac304467dcfa55a546d4323331722aca15682605f7124bd110008e2c56fc7e7d676cc1dc43277ab77e1a7efeeaf2da897e68efb269b740fb3","ssdeep":"192:vxwOW9JyW9JyJ4TsfdsfzsfHL/IAfdu0EOG0q/4mNMlWFqL5lu2cs85l3/9l0sfz:5waIoPmi2Nb","tlshash":"2ba297286a54003e7c27c1faf6d4fa9d750ab0c1ce3f99aaed8215149ad23f61de161c","first_seen":"2024-08-01T00:03:56Z","last_seen":"2026-09-05T14:50:45.765118Z","times_seen":21,"resource_available":false,"data":null}},"time_used":149,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":149,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-09-05","alert":"Phishing Block","trigger":"upservice-dienst.net","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-05","alert":"Sinkholed","trigger":"upservice-dienst.net","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"upservice-dienst.net/config/panel.php?PWD=BLACKFORCE","fqdn":"upservice-dienst.net","domain":"upservice-dienst.net","tld":"net"},"ip":{"addr":"158.94.208.174","port":443,"asn":786,"as":"Jisc Services Limited","country":"United Kingdom","country_code":"GB"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"https://upservice-dienst.net/","date":"2026-09-05T14:50:02.938Z","timestamp":1788619802938,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"upservice-dienst.net","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Fri, 04 Sep 2026 14:27:51 GMT","end":"Thu, 03 Dec 2026 14:27:50 GMT"},"fingerprint":{"sha1":"39:6B:B7:F4:18:4D:A2:50:B3:F7:5A:04:27:62:8A:29:57:56:10:45","sha256":"E0:48:B4:24:CF:12:1D:87:3F:4E:6B:56:87:93:03:E3:42:D0:80:5E:23:E7:7D:F3:FE:67:F3:E3:49:2B:22:8A"}}},"request":{"raw":"GET /config/panel.php?PWD=BLACKFORCE HTTP/1.1\r\nHost: upservice-dienst.net\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/json, text/plain, */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://upservice-dienst.net/\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nserver: nginx\r\ndate: Sat, 05 Sep 2026 14:50:02 GMT\r\ncontent-type: text/html; charset=UTF-8\r\ncontent-length: 191\r\naccess-control-allow-origin: *\r\naccess-control-allow-methods: GET, POST, OPTIONS\r\naccess-control-allow-headers: Content-Type\r\nvary: Accept-Encoding\r\ncontent-encoding: gzip\r\nalt-svc: h3=\":443\"; ma=86400\r\nx-powered-by: PHP/8.4.25, PleskLin\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"PHP:8.4.25","description":"PHP is a general-purpose scripting language used for web development.","website":"https://php.net","common_platform_enumeration":"cpe:2.3:a:php:php:*:*:*:*:*:*:*:*","icon":"PHP.svg","categories":["Programming languages"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":236,"size_decoded":558,"mime_type":"text/html; charset=UTF-8","magic":"JSON text data","md5":"ef61ad711c442a0450f8f8e7bb457fc8","sha1":"d2f3ec6dbea668c3d9430342082b75ac2c416625","sha256":"3eddef565dd2b5743fd9933d31276072d3f5d4f40a7f41f672af45c8987820f2","sha512":"35bb3eb552107ff895d9627a26573bf6988cd9a549e996dec9004a8ca572b7c5a874ae91636294d5c581d221f6ee806b03f4fa88c3741ebb1952fa9278b9b13c","ssdeep":"","tlshash":"6ad0a71946852c7cd82a090020627b822e3d646ab612c141708e69677cb788b00bd51b","first_seen":"2026-09-05T14:50:45.768476Z","last_seen":"2026-09-05T14:50:45.768476Z","times_seen":1,"resource_available":false,"data":null}},"time_used":101,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":101,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-09-05","alert":"Phishing Block","trigger":"upservice-dienst.net","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-05","alert":"Sinkholed","trigger":"upservice-dienst.net","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"upservice-dienst.net/assets/index-D9ylUgtY.js","fqdn":"upservice-dienst.net","domain":"upservice-dienst.net","tld":"net"},"ip":{"addr":"158.94.208.174","port":443,"asn":786,"as":"Jisc Services Limited","country":"United Kingdom","country_code":"GB"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://upservice-dienst.net/","date":"2026-09-05T14:50:01.105Z","timestamp":1788619801105,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"upservice-dienst.net","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Fri, 04 Sep 2026 14:27:51 GMT","end":"Thu, 03 Dec 2026 14:27:50 GMT"},"fingerprint":{"sha1":"39:6B:B7:F4:18:4D:A2:50:B3:F7:5A:04:27:62:8A:29:57:56:10:45","sha256":"E0:48:B4:24:CF:12:1D:87:3F:4E:6B:56:87:93:03:E3:42:D0:80:5E:23:E7:7D:F3:FE:67:F3:E3:49:2B:22:8A"}}},"request":{"raw":"GET /assets/index-D9ylUgtY.js HTTP/1.1\r\nHost: upservice-dienst.net\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://upservice-dienst.net/\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nserver: nginx\r\ndate: Sat, 05 Sep 2026 14:50:01 GMT\r\ncontent-type: application/javascript\r\nlast-modified: Fri, 04 Sep 2026 15:29:10 GMT\r\netag: W/\"6a9ae3c6-2143b8\"\r\nalt-svc: h3=\":443\"; ma=86400\r\nx-powered-by: PleskLin\r\ncontent-encoding: br\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Plesk","description":"Plesk is a web hosting and server data centre automation software with a control panel developed for Linux and Windows-based retail hosting service providers.","website":"https://www.plesk.com","common_platform_enumeration":"cpe:2.3:a:parallels:parallels_plesk_panel:*:*:*:*:*:*:*:*","icon":"Plesk.svg","categories":["Hosting panels"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":2180024,"size_decoded":608145,"mime_type":"application/javascript","magic":"JavaScript source, ASCII text, with very long lines (37550)","md5":"fb24acd157abab3ba8883ceca84e730e","sha1":"d6fa761b572560e05c9926d43ca714b2539145e0","sha256":"2f0d531f66799925ae10251af49311e408c2ba7f8031df59bf392f557abe699b","sha512":"ead94a19faad3fdabf701ff9a87ce3d33feb19101e753708ef98e22dc56015c83118b489641ef7b791f6d2be831e6c9c9259d71fd58001760ee0c25e9a6aa287","ssdeep":"24576:GCjFtZ0LGB6FgpP/MqkMH4YQ3w1uq/OYlZc+lJK7bgt82V:GCjFnRB66icOYlZc+lJK7bga2V","tlshash":"8d25a1dd663bdd3e09993344364f02137aaf0be1e1de9a8063c4da0539e453cb9366b9","first_seen":"2026-07-07T06:56:54.869258Z","last_seen":"2026-09-05T14:50:45.77117Z","times_seen":4,"resource_available":false,"data":null}},"time_used":1146,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":151,"receive":995,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-09-05","alert":"Phishing Block","trigger":"upservice-dienst.net","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-05","alert":"Sinkholed","trigger":"upservice-dienst.net","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}}]}