{"report_id":"ba1b6138-c5e8-400a-b605-d68a2e79ba9d","version":0,"status":"done","tags":["suspicious"],"date":"2026-07-22T21:54:11Z","url":{"schema":"https","addr":"ccleaner.mom/","fqdn":"ccleaner.mom","domain":"ccleaner.mom","tld":"mom"},"ip":{"addr":"104.21.54.157","port":0,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"final":{"url":{"schema":"https","addr":"ccleaner.mom/","fqdn":"ccleaner.mom","domain":"ccleaner.mom","tld":"mom"},"title":"Ultra Cleaner - GOOGLE PLAY","dom":{"size":13468,"mime_type":"text/html; charset=utf-8","magic":"HTML document, Unicode text, UTF-8 text","md5":"61c39f073b008de43229c65beb939d0f","sha1":"6d582bce7d910ce73f6d3458088d3b1993c75d98","sha256":"b15fba17c7b26b0ae5421d00a8f5a51a316c9347453ffd81eb47b4b889c0fe70","sha512":"2697b439db847a0fb33b23c299c4678d957706e43b6211854ff9e1fba04c165e6353003e4e10368fb60e469e4ec674ef8b1644ba469613a2b414a28d84373150","ssdeep":"192:o7qSk//YVVoZnEVfWLwDYnRNmC+w8oKgRjshv/j+ZgErrJhLdj:hrcYN67oKgRghv/j+3r9","tlshash":"f95274a242f70827349ac4913fa7978b3a959083951bd6543bfd87d48fc2d92e913b8c","dom_hash":"domhash11ec99d3bd8499bca9da6c3f7199bd93","first_seen":"","last_seen":"","times_seen":0,"resource_available":false,"data":null}},"submit":{"url":{"schema":"https","addr":"ccleaner.mom/","fqdn":"ccleaner.mom","domain":"ccleaner.mom","tld":"mom"},"ip":{"addr":"104.21.54.157","port":0,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"tags":null,"meta":null},"settings":{"access":"public","device_type":"desktop","expires_at":"2027-08-26T21:54:11Z","useragent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0","referer":"","cookies":null,"exit_node":"qguvgzjxzsgb3vs"},"stats":{"alert_count":{"ids":0,"urlquery":2,"analyzer":3}},"detection":{"ids":null,"analyzer":[{"sensor_name":"infosec_yara","sensor_type":"yara","title":"YARAhub by abuse.ch","description":"YARAhub by abuse.ch","scan_date":"2026-07-22","alert":"Detects file containing Telegram Bot API","trigger":"ccleaner.mom/","verdict":"malware","severity":"medium","comment":"","link":"https://yaraify.abuse.ch/yarahub/","meta":{"author":"rectifyq","date":"2024-09-07","description":"Detects file containing Telegram Bot API","rule":"telegram_bot_api","yarahub_author_twitter":"@_rectifyq","yarahub_license":"CC0 1.0","yarahub_reference_md5":"9DA48D34DC999B4E05E0C6716A3B3B83","yarahub_rule_matching_tlp":"TLP:WHITE","yarahub_rule_sharing_tlp":"TLP:WHITE","yarahub_uuid":"58c9e4fe-d1e9-46ed-913c-dba943ac16d6"}},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-07-22","alert":"Sinkholed","trigger":"ccleaner.mom","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-07-22","alert":"Sinkholed","trigger":"ccleaner.mom","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":[{"sensor_name":"urlquery","alert":"Suspicious - Suspicious Javascript code","verdict":"suspicious","severity":"medium","comment":"","tags":["suspicious"],"meta":null},{"sensor_name":"urlquery","alert":"Suspicious - Suspicious Javascript code","verdict":"suspicious","severity":"medium","comment":"","tags":["suspicious"],"meta":null}]},"summary":[{"fqdn":"ccleaner.mom","ip":{"addr":"172.67.140.86","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"domain_registered":"2026-07-20","domain_rank":0,"first_seen":"2026-07-22T21:54:11.491583Z","last_seen":"2026-07-22T21:54:11.491583Z","alert_count":18,"request_count":8,"received_data":202646,"sent_data":4021,"comment":"","tags":null,"fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}]},{"fqdn":"cdn-icons-png.flaticon.com","ip":{"addr":"23.36.76.130","port":443,"asn":20940,"as":"Akamai International B.V.","country":"Norway","country_code":"NO"},"domain_registered":"2013-05-10","domain_rank":239972,"first_seen":"2021-09-02T06:55:19Z","last_seen":"2026-07-17T06:29:22.949059Z","alert_count":0,"request_count":1,"received_data":15701,"sent_data":555,"comment":"","tags":null,"fingerprints":null},{"fqdn":"api.telegram.org","ip":{"addr":"149.154.166.110","port":443,"asn":62041,"as":"Telegram Messenger Inc","country":"United Kingdom","country_code":"GB"},"domain_registered":"2003-12-15","domain_rank":206724,"first_seen":"2015-06-25T10:09:00Z","last_seen":"2026-07-21T20:53:14.116342Z","alert_count":0,"request_count":1,"received_data":334,"sent_data":601,"comment":"","tags":null,"fingerprints":[{"name":"Nginx:1.30.1","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}]}],"files":null,"artifacts":{"windows_shortcuts":null,"files":null,"telegram":null,"pdfs":null,"clipboard":null},"sensors":{"ids":null,"analyzer":null,"urlquery":[{"sensor_name":"urlquery","alert":"Suspicious - Suspicious Javascript code","verdict":"suspicious","severity":"medium","comment":"","tags":["suspicious"],"meta":null}]},"javascript":{"script":[{"url":{"schema":"https","addr":"ccleaner.mom/","fqdn":"ccleaner.mom","domain":"ccleaner.mom","tld":"mom"},"ip":{"addr":"172.67.140.86","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"scriptElement","is_inline":true,"md5":"a4796167988d680dac9eff20fd6b5442","sha1":"cc7930cc594df603062d6a6ac941dcac8b0925ba","sha256":"44c95f7d72cf5c53d1f681a3c1d109fd4b186f886bd0950328c9101b1c42c662","sha512":"0f7ab87ce60941c0ae2aa47cd023c0aaa128e57745f1152cba3ce59215e6df8d3050016eb43b71ebe7015ffde28d307f6435302d774fb87650b55ce111b82434","ssdeep":"","tlshash":"c761336912770d790453b4bf7b8b7504263390a33608dd66796dc681bf86a34c2b37db","size":3464,"data":"","first_seen":"2026-07-22T21:53:21.594519Z","last_seen":"2026-07-22T21:54:14.507553Z","times_seen":2,"alerts":{"ids":null,"analyzer":[{"sensor_name":"infosec_yara","sensor_type":"yara","title":"YARAhub by abuse.ch","description":"YARAhub by abuse.ch","scan_date":"2026-07-22","alert":"Detects file containing Telegram Bot API","trigger":"ccleaner.mom/","verdict":"malware","severity":"medium","comment":"","link":"https://yaraify.abuse.ch/yarahub/","meta":{"author":"rectifyq","date":"2024-09-07","description":"Detects file containing Telegram Bot API","rule":"telegram_bot_api","yarahub_author_twitter":"@_rectifyq","yarahub_license":"CC0 1.0","yarahub_reference_md5":"9DA48D34DC999B4E05E0C6716A3B3B83","yarahub_rule_matching_tlp":"TLP:WHITE","yarahub_rule_sharing_tlp":"TLP:WHITE","yarahub_uuid":"58c9e4fe-d1e9-46ed-913c-dba943ac16d6"}}],"urlquery":null}}],"eval":null,"write":null,"console":null},"http":[{"url":{"schema":"https","addr":"ccleaner.mom/image/2.jpg?v=2","fqdn":"ccleaner.mom","domain":"ccleaner.mom","tld":"mom"},"ip":{"addr":"172.67.140.86","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://ccleaner.mom/","date":"2026-07-22T21:53:47.082Z","timestamp":1784757227082,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"ccleaner.mom","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Mon, 20 Jul 2026 23:07:43 GMT","end":"Mon, 19 Oct 2026 00:05:06 GMT"},"fingerprint":{"sha1":"F3:88:45:F9:72:54:61:BE:78:13:83:C7:D6:9E:6C:CA:D7:23:90:CE","sha256":"09:89:85:30:40:3D:06:6B:6E:AE:44:3E:20:A1:D1:58:FD:BC:36:96:98:1F:0B:43:85:53:2E:AC:A9:71:66:66"}}},"request":{"raw":"GET /image/2.jpg?v=2 HTTP/1.1\r\nHost: ccleaner.mom\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://ccleaner.mom/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=4, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nserver: cloudflare\r\ndate: Wed, 22 Jul 2026 21:53:47 GMT\r\ncontent-type: image/jpeg\r\nlast-modified: Tue, 21 Jul 2026 00:05:52 GMT\r\nvary: accept-encoding\r\npriority: u=4,i\r\netag: W/\"6a5eb7e0-7487\"\r\ncontent-encoding: gzip\r\ncache-control: max-age=14400\r\ncf-cache-status: MISS\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=ou7jA4pXEcTgD9yJwYxE6jmcefvEd%2FoQeZxLuGV6PNb5VnwdP4NERB8BmuipVlIHvSKf6IVgyUjnbVgg7lAYt%2BDZm9bPBONgEsbXVWUcFGLZpS1%2F0Txqi2s515g%2B%2B7Y%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncf-ray: a1f5ae1d39502efa-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":29831,"size_decoded":30162,"mime_type":"image/jpeg","magic":"JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, progressive, precision 8, 228x755, components 3","md5":"06fca469614846b8e1ba3eb13f4fc8c0","sha1":"91e5b241e3a688d82403bce23bdbca7344267465","sha256":"2b474b6b630ce95057f28a668613130dc2efa54a3382208046dd2b58ece96641","sha512":"ca8e9cb21adb7aefa77d8f931190d68e3cfc78c85c4e0859d9af5df0a8c6a18ca6eb62b902a48a0a37b217740e2c21980c1156bc8f3179bc2846a8c7ec7656de","ssdeep":"384:AIIDfFWumU43QEGiZ8nE9lUCgeRCxz3/pccI1tWZJhbe9EyaPQy73Vt1GkNAwvvH:6OUqQhEUC/6vcmZ7beey/6tIwvvznz","tlshash":"1dd2e0665e1d1e4ff0a1317de0e28824deab7106f21f467f4eb191024758aadaee3141","first_seen":"2026-07-22T21:53:21.578051Z","last_seen":"2026-07-22T21:54:14.490547Z","times_seen":2,"resource_available":false,"data":null}},"time_used":140,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":137,"receive":3,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-07-22","alert":"Sinkholed","trigger":"ccleaner.mom","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-07-22","alert":"Sinkholed","trigger":"ccleaner.mom","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"ccleaner.mom/image/3.jpg?v=2","fqdn":"ccleaner.mom","domain":"ccleaner.mom","tld":"mom"},"ip":{"addr":"172.67.140.86","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://ccleaner.mom/","date":"2026-07-22T21:53:47.083Z","timestamp":1784757227083,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"ccleaner.mom","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Mon, 20 Jul 2026 23:07:43 GMT","end":"Mon, 19 Oct 2026 00:05:06 GMT"},"fingerprint":{"sha1":"F3:88:45:F9:72:54:61:BE:78:13:83:C7:D6:9E:6C:CA:D7:23:90:CE","sha256":"09:89:85:30:40:3D:06:6B:6E:AE:44:3E:20:A1:D1:58:FD:BC:36:96:98:1F:0B:43:85:53:2E:AC:A9:71:66:66"}}},"request":{"raw":"GET /image/3.jpg?v=2 HTTP/1.1\r\nHost: ccleaner.mom\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://ccleaner.mom/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=4, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nserver: cloudflare\r\ndate: Wed, 22 Jul 2026 21:53:47 GMT\r\ncontent-type: image/jpeg\r\nlast-modified: Tue, 21 Jul 2026 00:05:52 GMT\r\nvary: accept-encoding\r\npriority: u=4,i\r\netag: W/\"6a5eb7e0-85bf\"\r\ncontent-encoding: gzip\r\ncache-control: max-age=14400\r\ncf-cache-status: MISS\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=SBcDir4lVaII7qkkCakB%2FMGa5rXqMcmOPoJQwtjWlub%2FcDl9RsAhOL%2BSCNZadsutVuVYfee7KQl9R8og6FF8dzd415VEZnFWTomWQfhIJr9duv3J4uPxTpLt0p5KqHM%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncf-ray: a1f5ae1d39522efa-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":34239,"size_decoded":34369,"mime_type":"image/jpeg","magic":"JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, progressive, precision 8, 235x757, components 3","md5":"f6c044c1ff9e1cc7d91a96ed004c476a","sha1":"d465bde04450f5a6da9e8a1a268c453da317067b","sha256":"0e2f947f47ccab11ea8c39d58aaeb315b078cd668f9670c5d51667761acb0099","sha512":"22622b39eb75211c2d322279f239c2c489d99be91cbda9cf2c72155d387bed3068a3f3faaf9c17015284ee912c1aa83a0a68a9726c7a0cf4147c102b90a4f519","ssdeep":"768:GQA5RBOgjZbZwQdXorgo/NWJsNh9UYRwi38bVgnNxx:uzOgFNN4rgPcjUaMbsNxx","tlshash":"dcf2e13641805b47eda46c3d13cc873fe716b9230dd01b36db4e96769fe720856caa88","first_seen":"2026-07-22T21:53:21.587432Z","last_seen":"2026-07-22T21:54:14.492608Z","times_seen":2,"resource_available":false,"data":null}},"time_used":140,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":137,"receive":3,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-07-22","alert":"Sinkholed","trigger":"ccleaner.mom","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-07-22","alert":"Sinkholed","trigger":"ccleaner.mom","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"ccleaner.mom/image/5.jpg?v=2","fqdn":"ccleaner.mom","domain":"ccleaner.mom","tld":"mom"},"ip":{"addr":"172.67.140.86","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://ccleaner.mom/","date":"2026-07-22T21:53:47.085Z","timestamp":1784757227085,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"ccleaner.mom","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Mon, 20 Jul 2026 23:07:43 GMT","end":"Mon, 19 Oct 2026 00:05:06 GMT"},"fingerprint":{"sha1":"F3:88:45:F9:72:54:61:BE:78:13:83:C7:D6:9E:6C:CA:D7:23:90:CE","sha256":"09:89:85:30:40:3D:06:6B:6E:AE:44:3E:20:A1:D1:58:FD:BC:36:96:98:1F:0B:43:85:53:2E:AC:A9:71:66:66"}}},"request":{"raw":"GET /image/5.jpg?v=2 HTTP/1.1\r\nHost: ccleaner.mom\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://ccleaner.mom/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=4, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nserver: cloudflare\r\ndate: Wed, 22 Jul 2026 21:53:47 GMT\r\ncontent-type: image/jpeg\r\nlast-modified: Tue, 21 Jul 2026 00:05:52 GMT\r\nvary: accept-encoding\r\npriority: u=4,i\r\netag: W/\"6a5eb7e0-8658\"\r\ncontent-encoding: gzip\r\ncache-control: max-age=14400\r\ncf-cache-status: MISS\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=ZkK5LRcNMUby9ZGR9TCTnWkkLFC8Edxow8AYUSSFvvxn3jA7RA0JGa11TL5AtRYLX%2FBx%2FvogLA3Wt7Nh%2B8DpaxU4R6DN6LaRM5PJnZHr6P2HWr3WgVYa8FkBc34eNEc%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncf-ray: a1f5ae1d49542efa-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":34392,"size_decoded":34790,"mime_type":"image/jpeg","magic":"JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, progressive, precision 8, 234x756, components 3","md5":"d1c2512d67243b8367e9fa338ac36a74","sha1":"aeb60c827e30192c7f2d63f7c1811ab01b31cf64","sha256":"970ee8cb5131f999966ef678655614f691279c1dd33661fd5a7739d59edc7988","sha512":"11ca90207d036e0991727997656f14937322c841684d65bf75842d2a452d3435ec0fb9bd2fadda235f22fd9fcaf0a181d990a0336afbe561930144aeaf3c6ad6","ssdeep":"768:dTYsI59P7LkQxzOZG07Ybny1/J2SgwGRq:dTYsMjLQPYbnsryq","tlshash":"bef2f1b7e6303b91e91d2ebec5f44382eadbfe26581349d71878943e4f2903477a1845","first_seen":"2026-07-22T21:53:21.552595Z","last_seen":"2026-07-22T21:54:14.493323Z","times_seen":2,"resource_available":false,"data":null}},"time_used":140,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":140,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-07-22","alert":"Sinkholed","trigger":"ccleaner.mom","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-07-22","alert":"Sinkholed","trigger":"ccleaner.mom","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"ccleaner.mom/favicon.ico","fqdn":"ccleaner.mom","domain":"ccleaner.mom","tld":"mom"},"ip":{"addr":"172.67.140.86","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://ccleaner.mom/","date":"2026-07-22T21:53:47.288Z","timestamp":1784757227288,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"ccleaner.mom","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Mon, 20 Jul 2026 23:07:43 GMT","end":"Mon, 19 Oct 2026 00:05:06 GMT"},"fingerprint":{"sha1":"F3:88:45:F9:72:54:61:BE:78:13:83:C7:D6:9E:6C:CA:D7:23:90:CE","sha256":"09:89:85:30:40:3D:06:6B:6E:AE:44:3E:20:A1:D1:58:FD:BC:36:96:98:1F:0B:43:85:53:2E:AC:A9:71:66:66"}}},"request":{"raw":"GET /favicon.ico HTTP/1.1\r\nHost: ccleaner.mom\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://ccleaner.mom/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=6\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 404 \r\nserver: cloudflare\r\ndate: Wed, 22 Jul 2026 21:53:47 GMT\r\ncontent-type: text/html; charset=iso-8859-1\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=Ben2LMhM%2FYh6OkqK9lrfGW7B8WLp4GyGRE9XzBTgivZeDrRnIg83WMjiLazTz1Lx9gTXMD7%2FY2%2BzGHs0D9UPzUNktlheQJgyOdBlIGLghZxw9sDmhUCgSM8pb62bUaA%3D\"}]}\r\npriority: u=6,i=?0\r\ncache-control: max-age=14400\r\ncf-cache-status: MISS\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncontent-encoding: zstd\r\ncf-ray: a1f5ae1e89962efa-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"404","status_text":"","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":275,"size_decoded":838,"mime_type":"text/html; charset=iso-8859-1","magic":"HTML document, ASCII text","md5":"13c6dcedceb654eb7c9e49615050821d","sha1":"746711ba741f0439714c2a190ac8f64bb7591dc8","sha256":"a1bfec600275dbd4a134ce3d2125c394a68caf3d8a97ddd89bd09cadd445b36e","sha512":"3f3a06b29fd300339a07f7fbbaebeaa251804faaf6106e72b5e3a778740574e2c63546bfff6b3c1bd6eb63b04ad8ad89131ac3f5065c4831d9f9d44077358307","ssdeep":"","tlshash":"56d02bde904363964811156039c155c22a8d12faa43a81e82dc6d49b529857ecddaa9c","first_seen":"2026-07-22T21:54:14.495301Z","last_seen":"2026-07-22T21:54:14.495301Z","times_seen":1,"resource_available":false,"data":null}},"time_used":110,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":110,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-07-22","alert":"Sinkholed","trigger":"ccleaner.mom","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-07-22","alert":"Sinkholed","trigger":"ccleaner.mom","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"cdn-icons-png.flaticon.com/512/732/732208.png","fqdn":"cdn-icons-png.flaticon.com","domain":"flaticon.com","tld":"com"},"ip":{"addr":"23.36.76.130","port":443,"asn":20940,"as":"Akamai International B.V.","country":"Norway","country_code":"NO"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://ccleaner.mom/","date":"2026-07-22T21:53:47.075Z","timestamp":1784757227075,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.flaticon.com","organization":""},"issuer":{"commonName":"YE1","organization":"Let's Encrypt"},"validity":{"start":"Fri, 29 May 2026 07:09:24 GMT","end":"Thu, 27 Aug 2026 07:09:23 GMT"},"fingerprint":{"sha1":"3F:C9:F2:2C:B9:3D:5A:B8:5C:51:20:99:4A:C7:F4:FD:B5:63:CE:B3","sha256":"48:B1:A6:08:9F:69:B3:F5:90:BB:AD:4A:A5:2D:34:F3:29:98:74:97:08:A8:63:F0:CC:8B:1F:82:E6:40:F8:E6"}}},"request":{"raw":"GET /512/732/732208.png HTTP/1.1\r\nHost: cdn-icons-png.flaticon.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-Fetch-Storage-Access: none\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://ccleaner.mom/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPriority: u=4, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\ncontent-length: 15167\r\netag: \"8412cc2c8fb288c9c3cb9063e2e2aa11\"\r\nlast-modified: Thu, 24 Apr 2025 01:39:04 GMT\r\ncontent-type: image/png\r\naccept-ranges: bytes\r\ndate: Wed, 22 Jul 2026 21:53:47 GMT\r\nalt-svc: h3=\":443\"; ma=93600,h3-29=\":443\"; ma=93600\r\nserver-timing: cdn-cache; desc=HIT, edge; dur=1, ak_p; desc=\"1784757227081_388254846_50322307_26_1154_0_18_22\";dur=1\r\nvary: Accept-Encoding\r\naccess-control-allow-origin: *\r\npragma: public\r\ncache-control: public, max-age=31536000\r\nx-default-rule: YES\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":null,"data":{"size":15167,"size_decoded":15701,"mime_type":"image/png","magic":"PNG image data, 512 x 512, 8-bit/color RGBA, non-interlaced","md5":"8412cc2c8fb288c9c3cb9063e2e2aa11","sha1":"83937b799fe0b96626825b2fa42ef19191d4cc92","sha256":"d08838f32bcc7cec0c1961f399b85207d038e5021f374863edad9f1219a76904","sha512":"dcac32f03607bf7c08cbf7a09e547e984a4e193bb5ea5b00a7a724196fa59b5da0cdee90240022dd8119719396ef53010f3108d0a5634e709a85931ba8be1e69","ssdeep":"384:oVwxF2+4dsciLvJxMXNK0pMRQa9hqjynI33Lmj643Wp4FPOA4FLdJhh37oIu:7v2Tds302RrqjyW3LmmpNLdJhh3w","tlshash":"8362c144e8f31f5bd62d38f91e46296409860d6f9387c4db82f8ccf46b8e9d1976a070","first_seen":"2024-05-22T15:18:49Z","last_seen":"2026-07-22T21:54:14.497574Z","times_seen":30,"resource_available":false,"data":null}},"time_used":33,"timings":{"blocked":-1,"dns":10,"connect":1,"send":0,"wait":3,"receive":0,"ssl":19},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"ccleaner.mom/icon/icon.jpg","fqdn":"ccleaner.mom","domain":"ccleaner.mom","tld":"mom"},"ip":{"addr":"172.67.140.86","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://ccleaner.mom/","date":"2026-07-22T21:53:47.077Z","timestamp":1784757227077,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"ccleaner.mom","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Mon, 20 Jul 2026 23:07:43 GMT","end":"Mon, 19 Oct 2026 00:05:06 GMT"},"fingerprint":{"sha1":"F3:88:45:F9:72:54:61:BE:78:13:83:C7:D6:9E:6C:CA:D7:23:90:CE","sha256":"09:89:85:30:40:3D:06:6B:6E:AE:44:3E:20:A1:D1:58:FD:BC:36:96:98:1F:0B:43:85:53:2E:AC:A9:71:66:66"}}},"request":{"raw":"GET /icon/icon.jpg HTTP/1.1\r\nHost: ccleaner.mom\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://ccleaner.mom/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=4, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nserver: cloudflare\r\ndate: Wed, 22 Jul 2026 21:53:47 GMT\r\ncontent-type: image/jpeg\r\nlast-modified: Tue, 21 Jul 2026 00:06:11 GMT\r\nvary: accept-encoding\r\npriority: u=4,i\r\netag: W/\"6a5eb7f3-6b5d\"\r\ncontent-encoding: gzip\r\ncache-control: max-age=14400\r\ncf-cache-status: MISS\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=H5hHPEMaqnvL%2FxkJNA%2BGQ4Il7gMrU8lUkmPKML96hZehjW4mIoz%2Bur1WmUk4WmoOi3g1lmnWvGbLJx8Ka63w%2BbaFT6MZ7VfHeAeAlwzuQG5Dh4KV0xwSSmUVIPCozmE%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncf-ray: a1f5ae1d39472efa-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":27485,"size_decoded":25762,"mime_type":"image/jpeg","magic":"JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, baseline, precision 8, 512x512, components 3","md5":"23f377595f810fc051de395a73750f5c","sha1":"60b2da88b8666bb5b2219b4f0da9feb1d360764b","sha256":"63771e066d02e86f109e7613dcf669c96123a274bfdc258d8f7754d48bec7788","sha512":"a04244a9744ab7adaac65b0d933bc81bcfd8c3ae9a2ede5fdaa7ce66e4661ee6653410da43eb501a0ec5678d6f7c22212ea4d5a433a847530cb3b978798d2cdf","ssdeep":"768:3J2UjRb24op3eAJvoeYlgTLCWAcrednhzxcNHJ85:3J3A1JAaP/McNHJ85","tlshash":"4ec2cf934a45c96e8c6e02b5fe0319cc7f6b4729cd646bef23337ec962d89a7005990c","first_seen":"2026-07-22T21:53:21.566756Z","last_seen":"2026-07-22T21:54:14.498597Z","times_seen":2,"resource_available":false,"data":null}},"time_used":179,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":179,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-07-22","alert":"Sinkholed","trigger":"ccleaner.mom","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-07-22","alert":"Sinkholed","trigger":"ccleaner.mom","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"ccleaner.mom/image/1.jpg?v=2","fqdn":"ccleaner.mom","domain":"ccleaner.mom","tld":"mom"},"ip":{"addr":"172.67.140.86","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://ccleaner.mom/","date":"2026-07-22T21:53:47.078Z","timestamp":1784757227078,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"ccleaner.mom","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Mon, 20 Jul 2026 23:07:43 GMT","end":"Mon, 19 Oct 2026 00:05:06 GMT"},"fingerprint":{"sha1":"F3:88:45:F9:72:54:61:BE:78:13:83:C7:D6:9E:6C:CA:D7:23:90:CE","sha256":"09:89:85:30:40:3D:06:6B:6E:AE:44:3E:20:A1:D1:58:FD:BC:36:96:98:1F:0B:43:85:53:2E:AC:A9:71:66:66"}}},"request":{"raw":"GET /image/1.jpg?v=2 HTTP/1.1\r\nHost: ccleaner.mom\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://ccleaner.mom/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=4, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nserver: cloudflare\r\ndate: Wed, 22 Jul 2026 21:53:47 GMT\r\ncontent-type: image/jpeg\r\nlast-modified: Tue, 21 Jul 2026 00:05:52 GMT\r\nvary: accept-encoding\r\npriority: u=4,i\r\netag: W/\"6a5eb7e0-69df\"\r\ncontent-encoding: gzip\r\ncache-control: max-age=14400\r\ncf-cache-status: MISS\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=zP5Mxpq%2FzvfGMUpF6Ne%2FYErTTVPHB2mgp4thQiJ5tk2FmJxNB8fJ74bw9PALBP8ovpl0a%2F55OrWh0A%2B1DjPf8Jx4%2FvptVEydz7gBRCyxdLE3Dn2LYe9C9igTXplJ6HI%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncf-ray: a1f5ae1d39492efa-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":27103,"size_decoded":27420,"mime_type":"image/jpeg","magic":"JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, progressive, precision 8, 235x759, components 3","md5":"7efc1755c747778a1f53de2e61b2ee3a","sha1":"1fa486337f9175a4f71542fb9cec7289aac367b3","sha256":"565ae014fb86548def3c60d754b4d82fd855b6287b0817483424d33a77f16fe8","sha512":"e39c59770eb9041e10692e85ce03fea35d17a3a23a832169e3576f04cd7fdb82f8c8bb4baadcf75189964e89fd2c816c8b7c8e350ad27b04b347f89a5437cf6a","ssdeep":"384:AItyxsMPrwvobbhn58rTbKPRf65kigMFSObhZRzYsh37cCWe03JJDp2Vz:VyhDwgbbh58rkkfgMFxbhREN3vpYz","tlshash":"84c2d1e2f7a3e936e815163202c15914f7e6ba292093f4ff74557f7d933a2e108609d2","first_seen":"2026-07-22T21:53:21.572026Z","last_seen":"2026-07-22T21:54:14.50144Z","times_seen":2,"resource_available":false,"data":null}},"time_used":196,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":196,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-07-22","alert":"Sinkholed","trigger":"ccleaner.mom","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-07-22","alert":"Sinkholed","trigger":"ccleaner.mom","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"ccleaner.mom/image/4.jpg?v=2","fqdn":"ccleaner.mom","domain":"ccleaner.mom","tld":"mom"},"ip":{"addr":"172.67.140.86","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://ccleaner.mom/","date":"2026-07-22T21:53:47.084Z","timestamp":1784757227084,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"ccleaner.mom","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Mon, 20 Jul 2026 23:07:43 GMT","end":"Mon, 19 Oct 2026 00:05:06 GMT"},"fingerprint":{"sha1":"F3:88:45:F9:72:54:61:BE:78:13:83:C7:D6:9E:6C:CA:D7:23:90:CE","sha256":"09:89:85:30:40:3D:06:6B:6E:AE:44:3E:20:A1:D1:58:FD:BC:36:96:98:1F:0B:43:85:53:2E:AC:A9:71:66:66"}}},"request":{"raw":"GET /image/4.jpg?v=2 HTTP/1.1\r\nHost: ccleaner.mom\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://ccleaner.mom/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=4, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nserver: cloudflare\r\ndate: Wed, 22 Jul 2026 21:53:47 GMT\r\ncontent-type: image/jpeg\r\nlast-modified: Tue, 21 Jul 2026 00:05:52 GMT\r\nvary: accept-encoding\r\npriority: u=4,i\r\netag: W/\"6a5eb7e0-74a8\"\r\ncontent-encoding: gzip\r\ncache-control: max-age=14400\r\ncf-cache-status: MISS\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=eTMPLkuXHm1uoh1Blkx2s11vmO%2FSBb81gpdBqNqSIgiGh9eeG7zUhOjnOBzDXP8KUIVTOLf%2BlFvlgM9o65q6E2c71Hlb%2BnZOiTf%2Fp5wTa%2BcRj3CoyaKo1oEUq36v2BE%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncf-ray: a1f5ae1d39532efa-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":29864,"size_decoded":30213,"mime_type":"image/jpeg","magic":"JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, progressive, precision 8, 237x756, components 3","md5":"e8badb33b64188f1c594949365cec8bd","sha1":"0b4bcfa278bdef563fa30f4c0b8e016a775a3d7d","sha256":"dff9896b15c42344a42e86579f8209011435f50297d1adbe988aaf8ec86d1f92","sha512":"a27323a77d9ab446ef667bea870d072d120040abc22225dee4bd2755b2a82964eb0d63c0fc3172f4eada3bd04131e3e82d6b0aa77ca997d32a35ee25568e1484","ssdeep":"768:/x5LaLajRp9PwutKHPd+pdabT9FZW4RmPW9+eV2epNJYS:5sLajRg1PL9FZ3R9+eVxpNmS","tlshash":"a1d2f101db163602ce1b06b815e82e86f52dfa96b7304331afcb5ad65f4c6c52b5a1fc","first_seen":"2026-07-22T21:53:21.591421Z","last_seen":"2026-07-22T21:54:14.503232Z","times_seen":2,"resource_available":false,"data":null}},"time_used":140,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":139,"receive":1,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-07-22","alert":"Sinkholed","trigger":"ccleaner.mom","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-07-22","alert":"Sinkholed","trigger":"ccleaner.mom","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"api.telegram.org/bot8902150277:AAF5CpDD7PFGufvmaRdzB8L32d7vgCFylrY/sendMessage","fqdn":"api.telegram.org","domain":"telegram.org","tld":"org"},"ip":{"addr":"149.154.166.110","port":443,"asn":62041,"as":"Telegram Messenger Inc","country":"United Kingdom","country_code":"GB"},"is_navigation_request":false,"resource_type":"fetch","requested_by":"https://ccleaner.mom/","date":"2026-07-22T21:53:47.101Z","timestamp":1784757227101,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"mlkem768x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"api.telegram.org","organization":""},"issuer":{"commonName":"Go Daddy Secure Certificate Authority - G2","organization":"GoDaddy.com, Inc."},"validity":{"start":"Tue, 11 Nov 2025 15:14:09 GMT","end":"Sun, 13 Dec 2026 15:14:09 GMT"},"fingerprint":{"sha1":"EC:27:13:72:1E:6C:94:9F:47:59:A4:24:4F:AB:9B:02:E3:6E:54:41","sha256":"64:47:03:9A:C9:ED:B9:03:8C:07:6E:AA:3D:BF:75:4B:4C:C1:4E:C1:A5:8C:83:2D:3E:FD:0C:E7:F7:82:C2:71"}}},"request":{"raw":"OPTIONS /bot8902150277:AAF5CpDD7PFGufvmaRdzB8L32d7vgCFylrY/sendMessage HTTP/1.1\r\nHost: api.telegram.org\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nAccess-Control-Request-Method: POST\r\nAccess-Control-Request-Headers: content-type\r\nReferer: https://ccleaner.mom/\r\nOrigin: https://ccleaner.mom\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPriority: u=4\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"OPTIONS"},"response":{"raw":"HTTP/2 204 \r\nserver: nginx/1.30.1\r\ndate: Wed, 22 Jul 2026 21:53:47 GMT\r\naccess-control-max-age: 86400\r\naccess-control-allow-origin: *\r\naccess-control-allow-methods: GET, POST, OPTIONS\r\naccess-control-allow-headers: content-type\r\naccess-control-expose-headers: Content-Length,Content-Type,Date,Server,Connection\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"204","status_text":"","fingerprints":[{"name":"Nginx:1.30.1","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":0,"size_decoded":334,"mime_type":"text/plain","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-07-23T00:24:31.034548Z","times_seen":17464322,"resource_available":true,"data":null}},"time_used":153,"timings":{"blocked":-1,"dns":0,"connect":20,"send":0,"wait":23,"receive":0,"ssl":110},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"ccleaner.mom/","fqdn":"ccleaner.mom","domain":"ccleaner.mom","tld":"mom"},"ip":{"addr":"172.67.140.86","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":true,"resource_type":"document","requested_by":"","date":"2026-07-22T21:53:40.048Z","timestamp":1784757220048,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"ccleaner.mom","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Mon, 20 Jul 2026 23:07:43 GMT","end":"Mon, 19 Oct 2026 00:05:06 GMT"},"fingerprint":{"sha1":"F3:88:45:F9:72:54:61:BE:78:13:83:C7:D6:9E:6C:CA:D7:23:90:CE","sha256":"09:89:85:30:40:3D:06:6B:6E:AE:44:3E:20:A1:D1:58:FD:BC:36:96:98:1F:0B:43:85:53:2E:AC:A9:71:66:66"}}},"request":{"raw":"GET / HTTP/1.1\r\nHost: ccleaner.mom\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nUpgrade-Insecure-Requests: 1\r\nSec-Fetch-Dest: document\r\nSec-Fetch-Mode: navigate\r\nSec-Fetch-Site: none\r\nPriority: u=0, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\ndate: Wed, 22 Jul 2026 21:53:46 GMT\r\ncontent-type: text/html; charset=UTF-8\r\nserver: cloudflare\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nlast-modified: Tue, 21 Jul 2026 00:13:09 GMT\r\nvary: Accept-Encoding\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=3VxdUTYdF4DRsXEsUnrw1%2B%2B7evBOsPi%2Bx8QJB0VFsYA9vuNt6bswHp%2BeC5pUlElJpbAQOS%2FlA8t2Bx04qncMux9I3IMdYq9gIB4zi5oTxhLT10v86M3L8fUzyiXQgOI%3D\"}]}\r\ncf-cache-status: DYNAMIC\r\ncontent-encoding: zstd\r\ncf-ray: a1f5ae19bedb56c1-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":14051,"size_decoded":4847,"mime_type":"text/html; charset=UTF-8","magic":"HTML document, Unicode text, UTF-8 text, with CRLF line terminators","md5":"b72fda7d790371689a0e2e9f42b21d14","sha1":"5f0432929e5df8aab4c6d94f3a6b508a07a84b6d","sha256":"39b5c2ee89740d3d57b572367a8e07a587b6f30bea2c21ec8983b1def66403b4","sha512":"aae0826ed80ad0fe61393a56b256e04c2d75e6bcd8f3914f9a1c79e1bc95cbc230082b3dd10d7ffc70aa49384d17a29ffec1ffb2171554ba077cb02f271ebf81","ssdeep":"192:9A6I6S3F8x8zKlZVVhHkFyc3JmCd38oNyTw1ymkwXjPQRBN:xKJJMoNyTgymkwXWBN","tlshash":"7e526264c1a604272177c9956fa2578afe9181438b0792583ffc53939ff2d25da23ecc","first_seen":"2026-07-22T21:53:21.564222Z","last_seen":"2026-07-22T21:54:14.505541Z","times_seen":2,"resource_available":true,"data":null}},"time_used":6587,"timings":{"blocked":-1,"dns":63,"connect":1,"send":0,"wait":120,"receive":0,"ssl":6403},"alerts":{"ids":null,"analyzer":[{"sensor_name":"infosec_yara","sensor_type":"yara","title":"YARAhub by abuse.ch","description":"YARAhub by abuse.ch","scan_date":"2026-07-22","alert":"Detects file containing Telegram Bot API","trigger":"ccleaner.mom/","verdict":"malware","severity":"medium","comment":"","link":"https://yaraify.abuse.ch/yarahub/","meta":{"author":"rectifyq","date":"2024-09-07","description":"Detects file containing Telegram Bot API","rule":"telegram_bot_api","yarahub_author_twitter":"@_rectifyq","yarahub_license":"CC0 1.0","yarahub_reference_md5":"9DA48D34DC999B4E05E0C6716A3B3B83","yarahub_rule_matching_tlp":"TLP:WHITE","yarahub_rule_sharing_tlp":"TLP:WHITE","yarahub_uuid":"58c9e4fe-d1e9-46ed-913c-dba943ac16d6"}},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-07-22","alert":"Sinkholed","trigger":"ccleaner.mom","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-07-22","alert":"Sinkholed","trigger":"ccleaner.mom","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null}],"urlquery":[{"sensor_name":"urlquery","alert":"Suspicious - Suspicious Javascript code","verdict":"suspicious","severity":"medium","comment":"","tags":["suspicious"],"meta":null}]}}]}