{"report_id":"bde115a1-f829-4dcd-992e-9f0562226458","version":6,"status":"done","tags":[],"date":"2026-04-06T13:12:52Z","url":{"schema":"https","addr":"safepol.com.co","fqdn":"safepol.com.co","domain":"safepol.com.co","tld":"com.co"},"ip":{"addr":"206.188.196.173","port":0,"asn":399629,"as":"BLNWX","country":"The Netherlands","country_code":"NL"},"final":{"url":{"schema":"https","addr":"safepol.com.co/","fqdn":"safepol.com.co","domain":"safepol.com.co","tld":"com.co"},"title":"403 Forbidden","dom":{"size":145,"mime_type":"text/html; charset=utf-8","magic":"HTML document, ASCII text","md5":"6e3c75dc9f395d9dc0e800ff68d4804e","sha1":"f46a9cab30830c256c9ba77fda62440efcbd8f16","sha256":"da961352ec639006879c8c72b28d25edf57eafc7bdeae84306cd31ab2b77a09c","sha512":"80e4b92ace5f8ddced3aca4d55f461b35ea0830f9e3a7b3b794853acb41c5f7d084f6a89d802b04342608c7791e2b3158899bb8dffd422ad0aa5dcdbd9e854e9","ssdeep":"","tlshash":"95c04c56756f680caa5356c116873a84d585c276488a4950db42069770c6577c4cb764","dom_hash":"domhash18da208b3b39949e9ba09528a720f5c0","first_seen":"","last_seen":"","times_seen":0,"resource_available":false,"data":null}},"submit":{"url":{"schema":"https","addr":"safepol.com.co","fqdn":"safepol.com.co","domain":"safepol.com.co","tld":"com.co"},"ip":{"addr":"206.188.196.173","port":0,"asn":399629,"as":"BLNWX","country":"The Netherlands","country_code":"NL"},"tags":null,"meta":null},"settings":{"access":"public","device_type":"desktop","expires_at":"2027-05-11T13:12:52Z","useragent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0","referer":"","cookies":null,"exit_node":"z0yflva4pidy47h"},"stats":{"alert_count":{"ids":0,"urlquery":0,"analyzer":4}},"detection":{"ids":null,"analyzer":[{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-04-06","alert":"Sinkholed","trigger":"safepol.com.co","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-04-06","alert":"Phishing Block","trigger":"safepol.com.co","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-04-06","alert":"Sinkholed","trigger":"safepol.com.co","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-04-06","alert":"Sinkholed","trigger":"safepol.com.co","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null},"summary":[{"fqdn":"safepol.com.co","ip":{"addr":"206.188.196.173","port":443,"asn":399629,"as":"BLNWX","country":"The Netherlands","country_code":"NL"},"domain_registered":"unknown","domain_rank":0,"first_seen":"2025-10-16T05:06:53.98145Z","last_seen":"2026-02-01T05:33:05.249761Z","alert_count":8,"request_count":2,"received_data":10349,"sent_data":918,"comment":"","tags":null,"fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx:1.24.0","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"OpenResty","description":"OpenResty is a web platform based on nginx which can run Lua scripts using its LuaJIT engine.","website":"https://openresty.org","common_platform_enumeration":"","icon":"OpenResty.svg","categories":["Web servers"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}]}],"files":null,"artifacts":{"windows_shortcuts":null,"files":null,"telegram":null,"pdfs":null,"clipboard":null},"sensors":{"ids":null,"analyzer":null,"urlquery":null},"javascript":{"script":null,"eval":null,"write":null,"console":null},"http":[{"url":{"schema":"https","addr":"safepol.com.co/","fqdn":"safepol.com.co","domain":"safepol.com.co","tld":"com.co"},"ip":{"addr":"206.188.196.173","port":443,"asn":399629,"as":"BLNWX","country":"The Netherlands","country_code":"NL"},"is_navigation_request":true,"resource_type":"document","requested_by":"","date":"2026-04-06T13:12:31.452Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"safepol.com.co","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Fri, 16 Jan 2026 23:44:42 GMT","end":"Thu, 16 Apr 2026 23:44:41 GMT"},"fingerprint":{"sha1":"88:E2:73:FE:A1:4A:D1:A2:9D:C4:7C:0E:15:35:CD:BB:05:F4:24:49","sha256":"90:0B:E1:A9:6A:D3:D9:7E:FC:B9:B2:B0:01:DE:1B:DE:51:CA:A9:F3:C1:19:39:7A:8C:23:BE:50:A6:58:BD:BD"}}},"request":{"raw":"GET / HTTP/1.1\r\nHost: safepol.com.co\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nUpgrade-Insecure-Requests: 1\r\nSec-Fetch-Dest: document\r\nSec-Fetch-Mode: navigate\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 403 Forbidden\r\ndate: Mon, 06 Apr 2026 13:12:31 GMT\r\ncontent-type: text/html; charset=utf-8\r\nserver: nginx/1.24.0\r\nstrict-transport-security: max-age=31536000\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"403","status_text":"Forbidden","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx:1.24.0","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":146,"size_decoded":0,"mime_type":"text/html; charset=utf-8","magic":"HTML document, ASCII text","md5":"84451aa8b737d0fbb788db7cac82508d","sha1":"7c6e385ba8df60024c7880af11fbc58c2668b4ef","sha256":"9c81b88adcb4f9da96a16b88c20cd0bdf9b65522d88cbef8bd10cbe18fb93f59","sha512":"b035de344672456d2f27ce43f8da434dfbce906f63bd6a677494351b63513afa05d12a56fb3e152612f53c792b3311854f1131f58e2f99b09e97405422364a72","ssdeep":"","tlshash":"41c04c56755f6908aa53568126872a84d186c37648ca49508b428297b0c6567c4cb768","first_seen":"2024-01-29T09:39:23Z","last_seen":"2026-04-06T13:12:59.160736Z","times_seen":4,"resource_available":false,"data":null}},"time_used":280,"timings":{"blocked":127,"dns":81,"connect":19,"send":0,"wait":20,"receive":0,"ssl":30},"alerts":{"ids":null,"analyzer":[{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-04-06","alert":"Sinkholed","trigger":"safepol.com.co","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-04-06","alert":"Phishing Block","trigger":"safepol.com.co","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-04-06","alert":"Sinkholed","trigger":"safepol.com.co","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-04-06","alert":"Sinkholed","trigger":"safepol.com.co","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"safepol.com.co/favicon.ico","fqdn":"safepol.com.co","domain":"safepol.com.co","tld":"com.co"},"ip":{"addr":"206.188.196.173","port":443,"asn":399629,"as":"BLNWX","country":"The Netherlands","country_code":"NL"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://safepol.com.co/","date":"2026-04-06T13:12:31.739Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"safepol.com.co","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Fri, 16 Jan 2026 23:44:42 GMT","end":"Thu, 16 Apr 2026 23:44:41 GMT"},"fingerprint":{"sha1":"88:E2:73:FE:A1:4A:D1:A2:9D:C4:7C:0E:15:35:CD:BB:05:F4:24:49","sha256":"90:0B:E1:A9:6A:D3:D9:7E:FC:B9:B2:B0:01:DE:1B:DE:51:CA:A9:F3:C1:19:39:7A:8C:23:BE:50:A6:58:BD:BD"}}},"request":{"raw":"GET /favicon.ico HTTP/1.1\r\nHost: safepol.com.co\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://safepol.com.co/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: openresty\r\ndate: Mon, 06 Apr 2026 13:12:31 GMT\r\ncontent-type: image/x-icon\r\ncontent-length: 9662\r\nlast-modified: Mon, 17 Nov 2025 23:03:12 GMT\r\netag: \"691ba9b0-25be\"\r\nexpires: Thu, 31 Dec 2037 23:55:55 GMT\r\ncache-control: max-age=315360000\r\nstrict-transport-security: max-age=31536000\r\naccept-ranges: bytes\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"OpenResty","description":"OpenResty is a web platform based on nginx which can run Lua scripts using its LuaJIT engine.","website":"https://openresty.org","common_platform_enumeration":"","icon":"OpenResty.svg","categories":["Web servers"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":9662,"size_decoded":0,"mime_type":"image/x-icon","magic":"MS Windows icon resource - 1 icon, 48x48, 32 bits/pixel","md5":"527c005ee9e01c6976188c2e9f858be9","sha1":"9ff009b14b2ddd296ed7672b61225d11c9972e01","sha256":"2729762551981a814b676637c3fed506689b1689038052e463dccf0c49e33260","sha512":"617ff6e089274c6bc419ef60a8a260b1b2dab633cfb8bd16400988ba13319d5b83ca00e02ccc4d8d4b9c874e67010f09af6f499291fe00e7708521040cbe495f","ssdeep":"96:9a5j6N1pcHpcl1pcg1pcZPM1vGV1pcdXnI:e+BcJcZcac0icW","tlshash":"1f125cab217b089decdc59b5dc64af0cdd796fcc6a75316527ba3ca206330c127d09a1","first_seen":"2023-10-14T03:48:03Z","last_seen":"2026-07-05T05:37:30.380104Z","times_seen":52,"resource_available":false,"data":null}},"time_used":21,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":20,"receive":1,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-04-06","alert":"Sinkholed","trigger":"safepol.com.co","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-04-06","alert":"Sinkholed","trigger":"safepol.com.co","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-04-06","alert":"Sinkholed","trigger":"safepol.com.co","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-04-06","alert":"Phishing Block","trigger":"safepol.com.co","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null}],"urlquery":null}}]}