{"report_id":"bc86eac6-74e5-49bf-a540-5ed5259c7bdd","version":0,"status":"done","tags":[],"date":"2026-08-20T02:03:22Z","url":{"schema":"http","addr":"tw.googlemarket.shop/","fqdn":"tw.googlemarket.shop","domain":"googlemarket.shop","tld":"shop"},"ip":{"addr":"185.68.16.168","port":0,"asn":200000,"as":"Hosting Ukraine LTD","country":"Ukraine","country_code":"UA"},"final":{"url":{"schema":"https","addr":"tw.googlemarket.shop/","fqdn":"tw.googlemarket.shop","domain":"googlemarket.shop","tld":"shop"},"title":"Trust Wallet Card","dom":{"size":9945,"mime_type":"text/html; charset=utf-8","magic":"HTML document, ASCII text, with very long lines (354)","md5":"e3597952953bfc3f78cac6d4982afdb0","sha1":"936b3ce4b1912708782da31c1f0198f4bac633e4","sha256":"c231e7a1eb4f12003e5bd91778adddf5e438b29323035fdb52429ad9ee286934","sha512":"1cf11eea651b4e1000457755004aa117254898090cf1e196d695b81b109bcbe6c87c66a9681d3023f39444eb4b7a3a446c70bf0c34f143b465dcc2a4acc3d53d","ssdeep":"192:hxA+zUu3uMZPOfnxO2clXV1xU10FoqVw9Ke+Myv:hxA+4u3G42clXV1xi0iqVw94MI","tlshash":"be22616aa9f06236119743c3f6a663eb2ef1d907d91a404131bd06b85fe2fc5d92350f","dom_hash":"domhashbc0521518b478f35908d41b80ef0cadf","first_seen":"2026-08-20T02:03:28.166534Z","last_seen":"2026-08-20T02:03:28.166534Z","times_seen":1,"resource_available":false,"data":null}},"submit":{"url":{"schema":"http","addr":"tw.googlemarket.shop/","fqdn":"tw.googlemarket.shop","domain":"googlemarket.shop","tld":"shop"},"ip":{"addr":"185.68.16.168","port":0,"asn":200000,"as":"Hosting Ukraine LTD","country":"Ukraine","country_code":"UA"},"tags":null,"meta":null},"settings":{"access":"public","device_type":"desktop","expires_at":"2027-09-24T02:03:22Z","useragent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0","referer":"","cookies":null,"exit_node":"qguvgzjxzsgb3vs"},"stats":{"alert_count":{"ids":0,"urlquery":0,"analyzer":1}},"detection":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-08-20","alert":"Sinkholed","trigger":"tw.googlemarket.shop","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null},"summary":[{"fqdn":"tw.googlemarket.shop","ip":{"addr":"185.68.16.168","port":443,"asn":200000,"as":"Hosting Ukraine LTD","country":"Ukraine","country_code":"UA"},"domain_registered":"unknown","domain_rank":0,"first_seen":"2026-08-20T02:01:28.411594Z","last_seen":"2026-08-20T02:01:28.411594Z","alert_count":12,"request_count":12,"received_data":2546959,"sent_data":5995,"comment":"","tags":null,"fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}]}],"files":null,"artifacts":{"windows_shortcuts":null,"files":null,"telegram":null,"pdfs":null,"clipboard":null},"sensors":{"ids":null,"analyzer":null,"urlquery":null},"javascript":{"script":[{"url":{"schema":"https","addr":"tw.googlemarket.shop/pixel-bootstrap.php","fqdn":"tw.googlemarket.shop","domain":"googlemarket.shop","tld":"shop"},"ip":{"addr":"185.68.16.168","port":443,"asn":200000,"as":"Hosting Ukraine LTD","country":"Ukraine","country_code":"UA"},"introduction_type":"scriptElement","is_inline":false,"md5":"e333b61cca5dba63fbfece6d008b441e","sha1":"901bc72f9ec46fe4ee0e4f8f51f6a615dbeaba76","sha256":"7d3c936de5bf5a205a653edb3f4d4426cc83f8fe89de8bd224fa2d21fbb5deeb","sha512":"6d88c636369d51648a5da6c32b75effcfbf2c886f918ac5dc1e2be98cbcaae22345e1ce61832c048742991217ccb924a208bd8b07db1805727f53142b6581e89","ssdeep":"","tlshash":"daf0205d2ca5b81233fa6439c313676e3ad21700308b5136c149c8507a644e36c5eecd","size":556,"data":"","first_seen":"2026-08-20T02:01:34.421375Z","last_seen":"2026-08-20T02:03:28.171119Z","times_seen":2,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"tw.googlemarket.shop/config.js","fqdn":"tw.googlemarket.shop","domain":"googlemarket.shop","tld":"shop"},"ip":{"addr":"185.68.16.168","port":443,"asn":200000,"as":"Hosting Ukraine LTD","country":"Ukraine","country_code":"UA"},"introduction_type":"scriptElement","is_inline":false,"md5":"89f229e6768e563094a655aace4dc2c8","sha1":"d978932b5e9ccb5e1a8d497aee2bdfa005a00ae5","sha256":"94997d21bca5cdc9858d03eabf8b19012bd2571eb6bb6c1b8b4f2c7a92741db9","sha512":"9b91dec9fd6f4dd9e96bdb7ccfdace7b732b859888a0d3de4319894b3fbc2cd2609397032a07e08bfe9f61103be4dfba04cf0e352b79af79537bf185e5e54189","ssdeep":"","tlshash":"17511f1f9f0817302b474355760a59d36531954b6b9478a32a23026d176e3eaa3f328f","size":3034,"data":"","first_seen":"2026-08-20T02:01:34.407031Z","last_seen":"2026-08-20T02:03:28.174134Z","times_seen":2,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"tw.googlemarket.shop/app.js","fqdn":"tw.googlemarket.shop","domain":"googlemarket.shop","tld":"shop"},"ip":{"addr":"185.68.16.168","port":443,"asn":200000,"as":"Hosting Ukraine LTD","country":"Ukraine","country_code":"UA"},"introduction_type":"scriptElement","is_inline":false,"md5":"0d00b7b16eb863261d0ebf71d629d662","sha1":"b73af2b498fe6a1d89c0561418682c8d9b3b1ec0","sha256":"4d2a295b4494922815b50d76e2fddf459d8279ad8a23130b214862a3db43ffa3","sha512":"ff1f9096d2eaa8e970905c3f2876469ac257e626c50c057aa68baf46f7bed354ae03c04450046a563bebad68688236bb9146b24ffdc714e6fb228b476e76836d","ssdeep":"96:hKjIsaWCxMjStic0gjaA8Dq6AvDSyXpVE2NyNGrG:hKjIsaWCxMjeic0gjp8GD7DVEdErG","tlshash":"519175a9f5f1206a40336171873ff2681b37958370cac89eb58c16646fc1f2ac47388c","size":4397,"data":"","first_seen":"2026-08-20T02:01:34.40957Z","last_seen":"2026-08-20T02:03:28.174761Z","times_seen":2,"alerts":{"ids":null,"analyzer":null,"urlquery":null}}],"eval":null,"write":null,"console":null},"http":[{"url":{"schema":"https","addr":"tw.googlemarket.shop/assets/screens/screen-1.png","fqdn":"tw.googlemarket.shop","domain":"googlemarket.shop","tld":"shop"},"ip":{"addr":"185.68.16.168","port":443,"asn":200000,"as":"Hosting Ukraine LTD","country":"Ukraine","country_code":"UA"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://tw.googlemarket.shop/","date":"2026-08-20T02:02:53.068Z","timestamp":1787191373068,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"tw.googlemarket.shop","organization":""},"issuer":{"commonName":"YR1","organization":"Let's Encrypt"},"validity":{"start":"Sun, 16 Aug 2026 18:52:45 GMT","end":"Sat, 14 Nov 2026 18:52:44 GMT"},"fingerprint":{"sha1":"1A:84:F5:27:9C:B4:37:09:C7:6B:5F:8E:BD:B6:8F:15:49:83:7F:FE","sha256":"FF:92:A9:73:42:B7:35:C0:E2:A6:F4:9E:22:A8:0B:99:CC:19:38:EC:E8:2E:43:FC:88:14:39:23:1E:42:96:B6"}}},"request":{"raw":"GET /assets/screens/screen-1.png HTTP/1.1\r\nHost: tw.googlemarket.shop\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://tw.googlemarket.shop/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nserver: nginx\r\ndate: Thu, 20 Aug 2026 02:02:53 GMT\r\ncontent-type: image/png\r\ncontent-length: 437828\r\nlast-modified: Sun, 16 Aug 2026 19:07:33 GMT\r\netag: \"6a820a75-6ae44\"\r\nx-ray: wnp67278:0.000/wn67278:0.000/\r\naccept-ranges: bytes\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":437828,"size_decoded":438094,"mime_type":"image/png","magic":"PNG image data, 720 x 1280, 8-bit/color RGB, non-interlaced","md5":"ac3702e03dfb2bea6f178de2aad9e0f6","sha1":"829f83cd2b3e73af207404fdb7db06e5428ae58b","sha256":"2aeb8db91f0c7940abba3378dbb291bc843e6626ff5fdcd60e07dec0199d5990","sha512":"08cc0eea9f6180f12c3fb5942efb2fbc9a1987d57c3e03d539d1e336c02046031dc9b3486516332571bf1bbc4e6883464076cc9663722d8f81ea7ab23cf08fcd","ssdeep":"12288:yQSyIg6LDxJfHA1qJt3MjsebTbMullNSX+tbRxJ1ZR9LtQ2FDzmu:5SX/BdPWnLl5dxJ9ptL3mu","tlshash":"8c9423f3842890e089d34c337b2713ef957d48b0a527624d5c35a0a696f7578eb6e78c","first_seen":"2026-08-20T02:01:34.41208Z","last_seen":"2026-08-20T02:03:28.168421Z","times_seen":2,"resource_available":false,"data":null}},"time_used":308,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":255,"receive":53,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-08-20","alert":"Sinkholed","trigger":"tw.googlemarket.shop","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"tw.googlemarket.shop/assets/screens/screen-3.png","fqdn":"tw.googlemarket.shop","domain":"googlemarket.shop","tld":"shop"},"ip":{"addr":"185.68.16.168","port":443,"asn":200000,"as":"Hosting Ukraine LTD","country":"Ukraine","country_code":"UA"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://tw.googlemarket.shop/","date":"2026-08-20T02:02:53.073Z","timestamp":1787191373073,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"tw.googlemarket.shop","organization":""},"issuer":{"commonName":"YR1","organization":"Let's Encrypt"},"validity":{"start":"Sun, 16 Aug 2026 18:52:45 GMT","end":"Sat, 14 Nov 2026 18:52:44 GMT"},"fingerprint":{"sha1":"1A:84:F5:27:9C:B4:37:09:C7:6B:5F:8E:BD:B6:8F:15:49:83:7F:FE","sha256":"FF:92:A9:73:42:B7:35:C0:E2:A6:F4:9E:22:A8:0B:99:CC:19:38:EC:E8:2E:43:FC:88:14:39:23:1E:42:96:B6"}}},"request":{"raw":"GET /assets/screens/screen-3.png HTTP/1.1\r\nHost: tw.googlemarket.shop\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://tw.googlemarket.shop/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nserver: nginx\r\ndate: Thu, 20 Aug 2026 02:02:53 GMT\r\ncontent-type: image/png\r\ncontent-length: 355933\r\nlast-modified: Sun, 16 Aug 2026 19:07:33 GMT\r\netag: \"6a820a75-56e5d\"\r\nx-ray: wnp67278:0.000/wn67278:0.000/\r\naccept-ranges: bytes\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":355933,"size_decoded":356199,"mime_type":"image/png","magic":"PNG image data, 720 x 1280, 8-bit/color RGB, non-interlaced","md5":"0eda4df542c0c40a057140a05fd5a657","sha1":"89ba667875cdae06eade47b45fd299c40d23dee4","sha256":"423ece94cdc6b9ebd6ca9731bed14df9594b7d281aa15fe80538966e194b3697","sha512":"627c8d61d7f44e0fa0e2ba8cda4df9692aabb5c347487b3c5cc97fde63541338ce9f6447c2116f7eeb9773cb84fe23c9213b00f1d3b7bce3677ef0422dd01572","ssdeep":"6144:hmPfCATDovdf0S0+kYteODEhr9NFmmCt55e1bs82VkdI1gRt/B36Dzib4u:0CATSfTFkY4hrz4FtnZ8NdOgRX36M4u","tlshash":"6074239a8893c2f1a823519786b7111c6b68345df5d107bcc11df5ad2aba2a0713cdaf","first_seen":"2026-08-20T02:01:34.386271Z","last_seen":"2026-08-20T02:03:28.169144Z","times_seen":2,"resource_available":false,"data":null}},"time_used":396,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":358,"receive":38,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-08-20","alert":"Sinkholed","trigger":"tw.googlemarket.shop","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"tw.googlemarket.shop/assets/screens/screen-5.png","fqdn":"tw.googlemarket.shop","domain":"googlemarket.shop","tld":"shop"},"ip":{"addr":"185.68.16.168","port":443,"asn":200000,"as":"Hosting Ukraine LTD","country":"Ukraine","country_code":"UA"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://tw.googlemarket.shop/","date":"2026-08-20T02:02:53.074Z","timestamp":1787191373074,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"tw.googlemarket.shop","organization":""},"issuer":{"commonName":"YR1","organization":"Let's Encrypt"},"validity":{"start":"Sun, 16 Aug 2026 18:52:45 GMT","end":"Sat, 14 Nov 2026 18:52:44 GMT"},"fingerprint":{"sha1":"1A:84:F5:27:9C:B4:37:09:C7:6B:5F:8E:BD:B6:8F:15:49:83:7F:FE","sha256":"FF:92:A9:73:42:B7:35:C0:E2:A6:F4:9E:22:A8:0B:99:CC:19:38:EC:E8:2E:43:FC:88:14:39:23:1E:42:96:B6"}}},"request":{"raw":"GET /assets/screens/screen-5.png HTTP/1.1\r\nHost: tw.googlemarket.shop\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://tw.googlemarket.shop/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nserver: nginx\r\ndate: Thu, 20 Aug 2026 02:02:53 GMT\r\ncontent-type: image/png\r\ncontent-length: 421808\r\nlast-modified: Sun, 16 Aug 2026 19:07:33 GMT\r\netag: \"6a820a75-66fb0\"\r\nx-ray: wnp67278:0.000/wn67278:0.000/\r\naccept-ranges: bytes\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":421808,"size_decoded":422074,"mime_type":"image/png","magic":"PNG image data, 720 x 1280, 8-bit/color RGB, non-interlaced","md5":"b208db77e5187cc10372396d5a556dff","sha1":"b97d4636ea0fcc32de20064278d4981c54515e06","sha256":"aba59b1ca36059a8f629eecc9cd99121ec78e038a224e6046c627d51e4b90a79","sha512":"5d7a2894bac00ff3f058aba0f4a45054e54b4f32ad1cd2709db0d3eaf32618b39d45b463810a25d41a289368334cc8bf3aea1c91a6a130e2603ffa2bccd57b09","ssdeep":"6144:Tw9V68T5S4XfLAL/8lDj6bzDU/C1Kp4lbNU5AUAapXeNm8Lh9e05GLaqSc:TOV6ES4XfLAzKGyQKp4lbep91are058","tlshash":"bc9423e682e44d72c221432d06f109e7be71341c9aa34066fcbfe514ea76786095efdb","first_seen":"2026-08-20T02:01:34.389685Z","last_seen":"2026-08-20T02:03:28.169866Z","times_seen":2,"resource_available":false,"data":null}},"time_used":403,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":395,"receive":8,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-08-20","alert":"Sinkholed","trigger":"tw.googlemarket.shop","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"tw.googlemarket.shop/styles.css","fqdn":"tw.googlemarket.shop","domain":"googlemarket.shop","tld":"shop"},"ip":{"addr":"185.68.16.168","port":443,"asn":200000,"as":"Hosting Ukraine LTD","country":"Ukraine","country_code":"UA"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://tw.googlemarket.shop/","date":"2026-08-20T02:02:53.053Z","timestamp":1787191373053,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"tw.googlemarket.shop","organization":""},"issuer":{"commonName":"YR1","organization":"Let's Encrypt"},"validity":{"start":"Sun, 16 Aug 2026 18:52:45 GMT","end":"Sat, 14 Nov 2026 18:52:44 GMT"},"fingerprint":{"sha1":"1A:84:F5:27:9C:B4:37:09:C7:6B:5F:8E:BD:B6:8F:15:49:83:7F:FE","sha256":"FF:92:A9:73:42:B7:35:C0:E2:A6:F4:9E:22:A8:0B:99:CC:19:38:EC:E8:2E:43:FC:88:14:39:23:1E:42:96:B6"}}},"request":{"raw":"GET /styles.css HTTP/1.1\r\nHost: tw.googlemarket.shop\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://tw.googlemarket.shop/\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=2\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nserver: nginx\r\ndate: Thu, 20 Aug 2026 02:02:53 GMT\r\ncontent-type: text/css\r\nlast-modified: Sun, 16 Aug 2026 19:08:59 GMT\r\netag: W/\"6a820acb-2384\"\r\nx-ray: wnp67278:0.000/wn67278:0.000/\r\ncontent-encoding: br\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":9092,"size_decoded":2704,"mime_type":"text/css","magic":"ASCII text, with very long lines (1085)","md5":"66bac498010de0e7606672b6dd7a226b","sha1":"a3a75aed80e28c3e74f2046b967b1d21ffdd0ee8","sha256":"51a57e70c71d2716233d6bb915baf2a1f59672b756fa002af572f87b00211d10","sha512":"a609185cc59b5c8cb4ca76933b46810edeff5cd62aba955eaf640ad2c6c5f59cd73df0dc45032a05a2fbf74fc19e6456c6ad0c8397747086e3af7f541d28206b","ssdeep":"192:K3voh+6hKYabPjJ0Oxm2UmNlyUn8mZ9Is:uAh+6hKYmPNBmTTUn8m/Is","tlshash":"e3127272a240613cf96be8a5ba95738f30105413d46307eaddd2b578c6cb6f30ab970a","first_seen":"2026-08-20T02:01:34.401529Z","last_seen":"2026-08-20T02:03:28.170495Z","times_seen":2,"resource_available":false,"data":null}},"time_used":53,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":53,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-08-20","alert":"Sinkholed","trigger":"tw.googlemarket.shop","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"tw.googlemarket.shop/pixel-bootstrap.php","fqdn":"tw.googlemarket.shop","domain":"googlemarket.shop","tld":"shop"},"ip":{"addr":"185.68.16.168","port":443,"asn":200000,"as":"Hosting Ukraine LTD","country":"Ukraine","country_code":"UA"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://tw.googlemarket.shop/","date":"2026-08-20T02:02:53.057Z","timestamp":1787191373057,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"tw.googlemarket.shop","organization":""},"issuer":{"commonName":"YR1","organization":"Let's Encrypt"},"validity":{"start":"Sun, 16 Aug 2026 18:52:45 GMT","end":"Sat, 14 Nov 2026 18:52:44 GMT"},"fingerprint":{"sha1":"1A:84:F5:27:9C:B4:37:09:C7:6B:5F:8E:BD:B6:8F:15:49:83:7F:FE","sha256":"FF:92:A9:73:42:B7:35:C0:E2:A6:F4:9E:22:A8:0B:99:CC:19:38:EC:E8:2E:43:FC:88:14:39:23:1E:42:96:B6"}}},"request":{"raw":"GET /pixel-bootstrap.php HTTP/1.1\r\nHost: tw.googlemarket.shop\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://tw.googlemarket.shop/\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=2\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nserver: nginx\r\ndate: Thu, 20 Aug 2026 02:02:53 GMT\r\ncontent-type: application/javascript; charset=utf-8\r\nx-ray: wnp67278:0.000/wn67278:0.000/wa67278:D=645\r\ncontent-encoding: br\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":556,"size_decoded":526,"mime_type":"application/javascript; charset=utf-8","magic":"ASCII text","md5":"e333b61cca5dba63fbfece6d008b441e","sha1":"901bc72f9ec46fe4ee0e4f8f51f6a615dbeaba76","sha256":"7d3c936de5bf5a205a653edb3f4d4426cc83f8fe89de8bd224fa2d21fbb5deeb","sha512":"6d88c636369d51648a5da6c32b75effcfbf2c886f918ac5dc1e2be98cbcaae22345e1ce61832c048742991217ccb924a208bd8b07db1805727f53142b6581e89","ssdeep":"","tlshash":"daf0205d2ca5b81233fa6439c313676e3ad21700308b5136c149c8507a644e36c5eecd","first_seen":"2026-08-20T02:01:34.421375Z","last_seen":"2026-08-20T02:03:28.171119Z","times_seen":2,"resource_available":true,"data":null}},"time_used":53,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":53,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-08-20","alert":"Sinkholed","trigger":"tw.googlemarket.shop","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"tw.googlemarket.shop/assets/icon.png","fqdn":"tw.googlemarket.shop","domain":"googlemarket.shop","tld":"shop"},"ip":{"addr":"185.68.16.168","port":443,"asn":200000,"as":"Hosting Ukraine LTD","country":"Ukraine","country_code":"UA"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://tw.googlemarket.shop/","date":"2026-08-20T02:02:53.066Z","timestamp":1787191373066,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"tw.googlemarket.shop","organization":""},"issuer":{"commonName":"YR1","organization":"Let's Encrypt"},"validity":{"start":"Sun, 16 Aug 2026 18:52:45 GMT","end":"Sat, 14 Nov 2026 18:52:44 GMT"},"fingerprint":{"sha1":"1A:84:F5:27:9C:B4:37:09:C7:6B:5F:8E:BD:B6:8F:15:49:83:7F:FE","sha256":"FF:92:A9:73:42:B7:35:C0:E2:A6:F4:9E:22:A8:0B:99:CC:19:38:EC:E8:2E:43:FC:88:14:39:23:1E:42:96:B6"}}},"request":{"raw":"GET /assets/icon.png HTTP/1.1\r\nHost: tw.googlemarket.shop\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://tw.googlemarket.shop/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nserver: nginx\r\ndate: Thu, 20 Aug 2026 02:02:53 GMT\r\ncontent-type: image/png\r\ncontent-length: 264585\r\nlast-modified: Sun, 16 Aug 2026 19:07:33 GMT\r\netag: \"6a820a75-40989\"\r\nx-ray: wnp67278:0.000/wn67278:0.000/\r\naccept-ranges: bytes\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":264585,"size_decoded":264851,"mime_type":"image/png","magic":"PNG image data, 1254 x 1254, 8-bit/color RGB, non-interlaced","md5":"5515566e1734c4b2f2c7446f7cb75317","sha1":"73e95afece5bde552c060d92643969d65a035cfe","sha256":"2698e89501354b5a4161b6736c8e98f64b3a120daee4b447f32097d2ca1163c8","sha512":"406081c031d1685e4418c5e42245d66b74a07f6dbedfb52b10a8b5538f5bad37bb8cff6a8312eb8fc3c4e657fb7ae4d19bac4cd0b36d3051229683e59f90966f","ssdeep":"6144:qiaiufvL23dI2mvZGxdP1XybOo4Q86UVyushzzE7:qdZL23dI2mBGVroKLYz0","tlshash":"df4412c0d4c672ba8e63ee6d6e224a81fd1e30696d4f02748b5e960a337f1a45c475cf","first_seen":"2026-08-20T02:01:34.416187Z","last_seen":"2026-08-20T02:03:28.171815Z","times_seen":2,"resource_available":false,"data":null}},"time_used":255,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":98,"receive":157,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-08-20","alert":"Sinkholed","trigger":"tw.googlemarket.shop","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"tw.googlemarket.shop/assets/screens/screen-4.png","fqdn":"tw.googlemarket.shop","domain":"googlemarket.shop","tld":"shop"},"ip":{"addr":"185.68.16.168","port":443,"asn":200000,"as":"Hosting Ukraine LTD","country":"Ukraine","country_code":"UA"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://tw.googlemarket.shop/","date":"2026-08-20T02:02:53.069Z","timestamp":1787191373069,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"tw.googlemarket.shop","organization":""},"issuer":{"commonName":"YR1","organization":"Let's Encrypt"},"validity":{"start":"Sun, 16 Aug 2026 18:52:45 GMT","end":"Sat, 14 Nov 2026 18:52:44 GMT"},"fingerprint":{"sha1":"1A:84:F5:27:9C:B4:37:09:C7:6B:5F:8E:BD:B6:8F:15:49:83:7F:FE","sha256":"FF:92:A9:73:42:B7:35:C0:E2:A6:F4:9E:22:A8:0B:99:CC:19:38:EC:E8:2E:43:FC:88:14:39:23:1E:42:96:B6"}}},"request":{"raw":"GET /assets/screens/screen-4.png HTTP/1.1\r\nHost: tw.googlemarket.shop\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://tw.googlemarket.shop/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nserver: nginx\r\ndate: Thu, 20 Aug 2026 02:02:53 GMT\r\ncontent-type: image/png\r\ncontent-length: 452437\r\nlast-modified: Sun, 16 Aug 2026 19:07:33 GMT\r\netag: \"6a820a75-6e755\"\r\nx-ray: wnp67278:0.000/wn67278:0.000/\r\naccept-ranges: bytes\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":452437,"size_decoded":452703,"mime_type":"image/png","magic":"PNG image data, 720 x 1280, 8-bit/color RGB, non-interlaced","md5":"35a4dbb6df791ee2874b03646272c60a","sha1":"768de3396de2b75057f7b57aee281a91717aa471","sha256":"2f9112114b43f37168e4deeb199e069336c6c8e71bef165ac3f86dc0ea2da458","sha512":"16f2a621ed3cd2dcd31d8b30f4d933659465a5a98a8c9775062a4e80b52b2f92fe1d65988f4e636fef6c53c3aadfea7d954832b2b8a209066c934314aa4128ab","ssdeep":"12288:KA8kRaEvzGLRL8dU51M4V+dynuybh2QkKpynfLbbv/Pcz9UF:KvkRaEvqL8+VuyZbh29fL/0xUF","tlshash":"f6a42399d4c87fb3c5372018bff581a69d37b09017e68d2457398804a4fdaed8b2d96c","first_seen":"2026-08-20T02:01:34.418707Z","last_seen":"2026-08-20T02:03:28.172354Z","times_seen":2,"resource_available":false,"data":null}},"time_used":358,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":309,"receive":49,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-08-20","alert":"Sinkholed","trigger":"tw.googlemarket.shop","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"tw.googlemarket.shop/assets/screens/screen-2.png","fqdn":"tw.googlemarket.shop","domain":"googlemarket.shop","tld":"shop"},"ip":{"addr":"185.68.16.168","port":443,"asn":200000,"as":"Hosting Ukraine LTD","country":"Ukraine","country_code":"UA"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://tw.googlemarket.shop/","date":"2026-08-20T02:02:53.070Z","timestamp":1787191373070,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"tw.googlemarket.shop","organization":""},"issuer":{"commonName":"YR1","organization":"Let's Encrypt"},"validity":{"start":"Sun, 16 Aug 2026 18:52:45 GMT","end":"Sat, 14 Nov 2026 18:52:44 GMT"},"fingerprint":{"sha1":"1A:84:F5:27:9C:B4:37:09:C7:6B:5F:8E:BD:B6:8F:15:49:83:7F:FE","sha256":"FF:92:A9:73:42:B7:35:C0:E2:A6:F4:9E:22:A8:0B:99:CC:19:38:EC:E8:2E:43:FC:88:14:39:23:1E:42:96:B6"}}},"request":{"raw":"GET /assets/screens/screen-2.png HTTP/1.1\r\nHost: tw.googlemarket.shop\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://tw.googlemarket.shop/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nserver: nginx\r\ndate: Thu, 20 Aug 2026 02:02:53 GMT\r\ncontent-type: image/png\r\ncontent-length: 323617\r\nlast-modified: Sun, 16 Aug 2026 19:07:33 GMT\r\netag: \"6a820a75-4f021\"\r\nx-ray: wnp67278:0.000/wn67278:0.000/\r\naccept-ranges: bytes\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":323617,"size_decoded":323883,"mime_type":"image/png","magic":"PNG image data, 720 x 1280, 8-bit/color RGB, non-interlaced","md5":"3500d014c6d643c50d6ade17773b9652","sha1":"9f2d7c0160234e86b8bb11e14320defdeb2455e7","sha256":"e253f4cc572699095c3eea37deb945c69656122e8b5829fe9754cf529587c4de","sha512":"23cd78598c4be1e0c3fbdfc9b2cadafe8796ed554192f108e51a9317f8fd730c4e02017d5df06ec32815db2785996aba50a7881b8cf8939baf5dd280ce3fa428","ssdeep":"6144:xdbqfymQPHDYIQFGSqgYYltRoBeBgw28Mrz/RJi3zUwpXbIrIlWV:xdb2ybZT1ZYl/oBeBgw+FJi3zUYbKSWV","tlshash":"cd64239a90f7e677976a845b473dd81c2fc6105bb573c02a093b4088c067aeee3f06e5","first_seen":"2026-08-20T02:01:34.404398Z","last_seen":"2026-08-20T02:03:28.172996Z","times_seen":2,"resource_available":false,"data":null}},"time_used":360,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":356,"receive":4,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-08-20","alert":"Sinkholed","trigger":"tw.googlemarket.shop","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"tw.googlemarket.shop/assets/icon.png","fqdn":"tw.googlemarket.shop","domain":"googlemarket.shop","tld":"shop"},"ip":{"addr":"185.68.16.168","port":443,"asn":200000,"as":"Hosting Ukraine LTD","country":"Ukraine","country_code":"UA"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://tw.googlemarket.shop/","date":"2026-08-20T02:02:53.485Z","timestamp":1787191373485,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"tw.googlemarket.shop","organization":""},"issuer":{"commonName":"YR1","organization":"Let's Encrypt"},"validity":{"start":"Sun, 16 Aug 2026 18:52:45 GMT","end":"Sat, 14 Nov 2026 18:52:44 GMT"},"fingerprint":{"sha1":"1A:84:F5:27:9C:B4:37:09:C7:6B:5F:8E:BD:B6:8F:15:49:83:7F:FE","sha256":"FF:92:A9:73:42:B7:35:C0:E2:A6:F4:9E:22:A8:0B:99:CC:19:38:EC:E8:2E:43:FC:88:14:39:23:1E:42:96:B6"}}},"request":{"raw":"GET /assets/icon.png HTTP/1.1\r\nHost: tw.googlemarket.shop\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://tw.googlemarket.shop/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=6\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nserver: nginx\r\ndate: Thu, 20 Aug 2026 02:02:53 GMT\r\ncontent-type: image/png\r\ncontent-length: 264585\r\nlast-modified: Sun, 16 Aug 2026 19:07:33 GMT\r\netag: \"6a820a75-40989\"\r\nx-ray: wnp67278:0.000/wn67278:0.000/\r\naccept-ranges: bytes\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":264585,"size_decoded":264851,"mime_type":"image/png","magic":"PNG image data, 1254 x 1254, 8-bit/color RGB, non-interlaced","md5":"5515566e1734c4b2f2c7446f7cb75317","sha1":"73e95afece5bde552c060d92643969d65a035cfe","sha256":"2698e89501354b5a4161b6736c8e98f64b3a120daee4b447f32097d2ca1163c8","sha512":"406081c031d1685e4418c5e42245d66b74a07f6dbedfb52b10a8b5538f5bad37bb8cff6a8312eb8fc3c4e657fb7ae4d19bac4cd0b36d3051229683e59f90966f","ssdeep":"6144:qiaiufvL23dI2mvZGxdP1XybOo4Q86UVyushzzE7:qdZL23dI2mBGVroKLYz0","tlshash":"df4412c0d4c672ba8e63ee6d6e224a81fd1e30696d4f02748b5e960a337f1a45c475cf","first_seen":"2026-08-20T02:01:34.416187Z","last_seen":"2026-08-20T02:03:28.171815Z","times_seen":2,"resource_available":false,"data":null}},"time_used":55,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":53,"receive":2,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-08-20","alert":"Sinkholed","trigger":"tw.googlemarket.shop","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"tw.googlemarket.shop/","fqdn":"tw.googlemarket.shop","domain":"googlemarket.shop","tld":"shop"},"ip":{"addr":"185.68.16.168","port":443,"asn":200000,"as":"Hosting Ukraine LTD","country":"Ukraine","country_code":"UA"},"is_navigation_request":true,"resource_type":"document","requested_by":"","date":"2026-08-20T02:02:52.597Z","timestamp":1787191372597,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"tw.googlemarket.shop","organization":""},"issuer":{"commonName":"YR1","organization":"Let's Encrypt"},"validity":{"start":"Sun, 16 Aug 2026 18:52:45 GMT","end":"Sat, 14 Nov 2026 18:52:44 GMT"},"fingerprint":{"sha1":"1A:84:F5:27:9C:B4:37:09:C7:6B:5F:8E:BD:B6:8F:15:49:83:7F:FE","sha256":"FF:92:A9:73:42:B7:35:C0:E2:A6:F4:9E:22:A8:0B:99:CC:19:38:EC:E8:2E:43:FC:88:14:39:23:1E:42:96:B6"}}},"request":{"raw":"GET / HTTP/1.1\r\nHost: tw.googlemarket.shop\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nUpgrade-Insecure-Requests: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: document\r\nSec-Fetch-Mode: navigate\r\nSec-Fetch-Site: none\r\nPriority: u=0, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nserver: nginx\r\ndate: Thu, 20 Aug 2026 02:02:52 GMT\r\ncontent-type: text/html; charset=UTF-8\r\nx-ray: wnp67278:0.000/wn67278:0.000/wa67278:D=834\r\ncontent-encoding: br\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":6059,"size_decoded":1718,"mime_type":"text/html; charset=UTF-8","magic":"HTML document, ASCII text, with very long lines (354)","md5":"8e35b3caf325ef68e28ea21e97aa608c","sha1":"6ccd448f83d1b4e71647f0e7257f2322a6104780","sha256":"f4149a197902d9ac4cff484f1ad734133cbce9034343440abe71bedec9ce2105","sha512":"0960ff31e28c4a1df9d185de2fe1d2922813e25bddda086b991be246218c80e8cb66a1c9f3c92781cb9ab8af6fc72688cc309e7a7a162ea72c2fbca31ed3abec","ssdeep":"96:/zo1m5fWFu6ZFJf3UObYfg4clXok1XlUmdFGdidgd2d+dOAP4:/zru37JPOfBclXV1jF2q0GRAg","tlshash":"b6c130b9a0f0e13600a76ad3b16607eb2df2ca43d919504531be09b15fe3e95de2380f","first_seen":"2026-08-20T02:01:34.398489Z","last_seen":"2026-08-20T02:03:28.173544Z","times_seen":2,"resource_available":false,"data":null}},"time_used":217,"timings":{"blocked":0,"dns":3,"connect":52,"send":0,"wait":54,"receive":0,"ssl":108},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-08-20","alert":"Sinkholed","trigger":"tw.googlemarket.shop","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"tw.googlemarket.shop/config.js","fqdn":"tw.googlemarket.shop","domain":"googlemarket.shop","tld":"shop"},"ip":{"addr":"185.68.16.168","port":443,"asn":200000,"as":"Hosting Ukraine LTD","country":"Ukraine","country_code":"UA"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://tw.googlemarket.shop/","date":"2026-08-20T02:02:53.060Z","timestamp":1787191373060,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"tw.googlemarket.shop","organization":""},"issuer":{"commonName":"YR1","organization":"Let's Encrypt"},"validity":{"start":"Sun, 16 Aug 2026 18:52:45 GMT","end":"Sat, 14 Nov 2026 18:52:44 GMT"},"fingerprint":{"sha1":"1A:84:F5:27:9C:B4:37:09:C7:6B:5F:8E:BD:B6:8F:15:49:83:7F:FE","sha256":"FF:92:A9:73:42:B7:35:C0:E2:A6:F4:9E:22:A8:0B:99:CC:19:38:EC:E8:2E:43:FC:88:14:39:23:1E:42:96:B6"}}},"request":{"raw":"GET /config.js HTTP/1.1\r\nHost: tw.googlemarket.shop\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://tw.googlemarket.shop/\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nserver: nginx\r\ndate: Thu, 20 Aug 2026 02:02:53 GMT\r\ncontent-type: application/javascript\r\nlast-modified: Mon, 17 Aug 2026 23:19:01 GMT\r\netag: W/\"6a8396e5-bda\"\r\nx-ray: wnp67278:0.000/wn67278:0.000/\r\ncontent-encoding: br\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":3034,"size_decoded":1346,"mime_type":"application/javascript","magic":"ASCII text, with very long lines (340)","md5":"89f229e6768e563094a655aace4dc2c8","sha1":"d978932b5e9ccb5e1a8d497aee2bdfa005a00ae5","sha256":"94997d21bca5cdc9858d03eabf8b19012bd2571eb6bb6c1b8b4f2c7a92741db9","sha512":"9b91dec9fd6f4dd9e96bdb7ccfdace7b732b859888a0d3de4319894b3fbc2cd2609397032a07e08bfe9f61103be4dfba04cf0e352b79af79537bf185e5e54189","ssdeep":"","tlshash":"17511f1f9f0817302b474355760a59d36531954b6b9478a32a23026d176e3eaa3f328f","first_seen":"2026-08-20T02:01:34.407031Z","last_seen":"2026-08-20T02:03:28.174134Z","times_seen":2,"resource_available":true,"data":null}},"time_used":52,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":52,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-08-20","alert":"Sinkholed","trigger":"tw.googlemarket.shop","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"tw.googlemarket.shop/app.js","fqdn":"tw.googlemarket.shop","domain":"googlemarket.shop","tld":"shop"},"ip":{"addr":"185.68.16.168","port":443,"asn":200000,"as":"Hosting Ukraine LTD","country":"Ukraine","country_code":"UA"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://tw.googlemarket.shop/","date":"2026-08-20T02:02:53.061Z","timestamp":1787191373061,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"tw.googlemarket.shop","organization":""},"issuer":{"commonName":"YR1","organization":"Let's Encrypt"},"validity":{"start":"Sun, 16 Aug 2026 18:52:45 GMT","end":"Sat, 14 Nov 2026 18:52:44 GMT"},"fingerprint":{"sha1":"1A:84:F5:27:9C:B4:37:09:C7:6B:5F:8E:BD:B6:8F:15:49:83:7F:FE","sha256":"FF:92:A9:73:42:B7:35:C0:E2:A6:F4:9E:22:A8:0B:99:CC:19:38:EC:E8:2E:43:FC:88:14:39:23:1E:42:96:B6"}}},"request":{"raw":"GET /app.js HTTP/1.1\r\nHost: tw.googlemarket.shop\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://tw.googlemarket.shop/\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nserver: nginx\r\ndate: Thu, 20 Aug 2026 02:02:53 GMT\r\ncontent-type: application/javascript\r\nlast-modified: Mon, 17 Aug 2026 23:19:01 GMT\r\netag: W/\"6a8396e5-112d\"\r\nx-ray: wnp67278:0.000/wn67278:0.000/\r\ncontent-encoding: br\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":4397,"size_decoded":1709,"mime_type":"application/javascript","magic":"JavaScript source, ASCII text","md5":"0d00b7b16eb863261d0ebf71d629d662","sha1":"b73af2b498fe6a1d89c0561418682c8d9b3b1ec0","sha256":"4d2a295b4494922815b50d76e2fddf459d8279ad8a23130b214862a3db43ffa3","sha512":"ff1f9096d2eaa8e970905c3f2876469ac257e626c50c057aa68baf46f7bed354ae03c04450046a563bebad68688236bb9146b24ffdc714e6fb228b476e76836d","ssdeep":"96:hKjIsaWCxMjStic0gjaA8Dq6AvDSyXpVE2NyNGrG:hKjIsaWCxMjeic0gjp8GD7DVEdErG","tlshash":"519175a9f5f1206a40336171873ff2681b37958370cac89eb58c16646fc1f2ac47388c","first_seen":"2026-08-20T02:01:34.40957Z","last_seen":"2026-08-20T02:03:28.174761Z","times_seen":2,"resource_available":true,"data":null}},"time_used":52,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":52,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-08-20","alert":"Sinkholed","trigger":"tw.googlemarket.shop","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}}]}