{"report_id":"be238b74-e50d-43b0-b683-ef0c773e7771","version":0,"status":"done","tags":[],"date":"2026-09-17T13:41:22Z","url":{"schema":"http","addr":"yunk-frerink.alc.onl/","fqdn":"yunk-frerink.alc.onl","domain":"alc.onl","tld":"onl"},"ip":{"addr":"185.27.134.223","port":0,"asn":34119,"as":"Wildcard UK Limited","country":"United Kingdom","country_code":"GB"},"final":{"url":{"schema":"https","addr":"yunk-frerink.alc.onl/?i=1","fqdn":"yunk-frerink.alc.onl","domain":"alc.onl","tld":"onl"},"title":"Iniciar sesión en tu cuenta Microsoft","dom":{"size":23384,"mime_type":"text/html; charset=utf-8","magic":"HTML document, Unicode text, UTF-8 text","md5":"bb4c4efadac55bea0163804e26ec82a4","sha1":"e5c4127de800b26a906a2faf27b429abb2bf6e99","sha256":"5672ccfe79df237658085fd8c125c9735fb9fe1a444835482143b5e9e62077d5","sha512":"ffd6f9fb23739cb90ec58e335ca60db8e9e787988b67df6c2820b150d7c5e4663085035473437ccc7d628035ed65a44a5e564c697cad0e2e94b2c4f447e62473","ssdeep":"384:S9Azo+8dLZqHhTyOv/rWFVnPxSymFqjqIT730:S9Azo+8dLZqHhTyOv/rWFVYkms730","tlshash":"9cb2b381a9f709937013d16437f3ab4a767dc003d50acd393fad23988f86b999a53798","dom_hash":"domhashba89dd1c3d7ae4bb10333f57e7a5eaa7","first_seen":"2026-09-17T13:33:37.598898Z","last_seen":"2026-09-17T13:41:24.809485Z","times_seen":2,"resource_available":false,"data":null}},"submit":{"url":{"schema":"http","addr":"yunk-frerink.alc.onl/","fqdn":"yunk-frerink.alc.onl","domain":"alc.onl","tld":"onl"},"ip":{"addr":"185.27.134.223","port":0,"asn":34119,"as":"Wildcard UK Limited","country":"United Kingdom","country_code":"GB"},"tags":null,"meta":null},"settings":{"access":"public","device_type":"desktop","expires_at":"2027-10-22T13:41:22Z","useragent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0","referer":"","cookies":null,"exit_node":"qguvgzjxzsgb3vs"},"stats":{"alert_count":{"ids":0,"urlquery":0,"analyzer":2}},"detection":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-17","alert":"Sinkholed","trigger":"yunk-frerink.alc.onl","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-09-17","alert":"Sinkholed","trigger":"yunk-frerink.alc.onl","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null}],"urlquery":null},"summary":[{"fqdn":"fonts.googleapis.com","ip":{"addr":"142.250.178.106","port":443,"asn":15169,"as":"GOOGLE","country":"United States","country_code":"US"},"domain_registered":"2005-01-25","domain_rank":313,"first_seen":"2012-05-23T12:41:44Z","last_seen":"2026-09-13T22:43:30.72904Z","alert_count":0,"request_count":1,"received_data":508,"sent_data":531,"comment":"","tags":null,"fingerprints":null},{"fqdn":"c.s-microsoft.com","ip":{"addr":"2.18.174.85","port":443,"asn":16625,"as":"AKAMAI-AS","country":"Norway","country_code":"NO"},"domain_registered":"2012-02-07","domain_rank":46140,"first_seen":"2013-11-06T15:56:27Z","last_seen":"2026-09-14T15:12:53.488301Z","alert_count":0,"request_count":1,"received_data":367,"sent_data":547,"comment":"","tags":null,"fingerprints":[{"name":"Azure Front Door","description":"Azure Front Door is a scalable and secure entry point for fast delivery of your global web applications.","website":"https://docs.microsoft.com/en-us/azure/frontdoor/","common_platform_enumeration":"","icon":"Azure.svg","categories":["Load balancers"]},{"name":"Azure","description":"Azure is a cloud computing service for building, testing, deploying, and managing applications and services through Microsoft-managed data centers.","website":"https://azure.microsoft.com","common_platform_enumeration":"","icon":"Azure.svg","categories":["PaaS"]}]},{"fqdn":"cdnjs.cloudflare.com","ip":{"addr":"104.17.24.14","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"domain_registered":"2009-02-17","domain_rank":1222,"first_seen":"2012-05-23T12:49:49Z","last_seen":"2026-09-13T23:08:02.379663Z","alert_count":0,"request_count":1,"received_data":103038,"sent_data":529,"comment":"","tags":null,"fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}]},{"fqdn":"ajax.googleapis.com","ip":{"addr":"142.250.178.106","port":443,"asn":15169,"as":"GOOGLE","country":"United States","country_code":"US"},"domain_registered":"2005-01-25","domain_rank":3691,"first_seen":"2012-05-22T10:38:03Z","last_seen":"2026-09-14T08:46:41.386609Z","alert_count":0,"request_count":1,"received_data":90459,"sent_data":506,"comment":"","tags":null,"fingerprints":null},{"fqdn":"yunk-frerink.alc.onl","ip":{"addr":"185.27.134.223","port":443,"asn":34119,"as":"Wildcard UK Limited","country":"United Kingdom","country_code":"GB"},"domain_registered":"2026-02-11","domain_rank":0,"first_seen":"2026-09-17T13:33:35.224943Z","last_seen":"2026-09-17T13:33:35.224943Z","alert_count":12,"request_count":6,"received_data":1665579,"sent_data":3268,"comment":"","tags":null,"fingerprints":[{"name":"OpenResty","description":"OpenResty is a web platform based on nginx which can run Lua scripts using its LuaJIT engine.","website":"https://openresty.org","common_platform_enumeration":"","icon":"OpenResty.svg","categories":["Web servers"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"jQuery:3.5.1","description":"jQuery is a JavaScript library which is a free, open-source software designed to simplify HTML DOM tree traversal and manipulation, as well as event handling, CSS animation, and Ajax.","website":"https://jquery.com","common_platform_enumeration":"cpe:2.3:a:jquery:jquery:*:*:*:*:*:*:*:*","icon":"jQuery.svg","categories":["JavaScript libraries"]},{"name":"Google Hosted Libraries","description":"Google Hosted Libraries is a stable, reliable, high-speed, globally available content distribution network for the most popular, open-source JavaScript libraries.","website":"https://developers.google.com/speed/libraries","common_platform_enumeration":"","icon":"Google Developers.svg","categories":["CDN"]}]}],"files":null,"artifacts":{"windows_shortcuts":null,"files":null,"telegram":null,"pdfs":null,"clipboard":null},"sensors":{"ids":null,"analyzer":null,"urlquery":null},"javascript":{"script":[{"url":{"schema":"https","addr":"yunk-frerink.alc.onl/?i=1","fqdn":"yunk-frerink.alc.onl","domain":"alc.onl","tld":"onl"},"ip":{"addr":"185.27.134.223","port":443,"asn":34119,"as":"Wildcard UK Limited","country":"United Kingdom","country_code":"GB"},"introduction_type":"scriptElement","is_inline":true,"md5":"b80f72a309a5ae60e3bf984922d9a3c8","sha1":"a54ace43e127880a2ab6a47a4c9bf779be00cec9","sha256":"6cd1567f99a5771361981cf77c707627de6de1c63448b86cd796b2cd217f224d","sha512":"1b8f92ddfc033d3e434418f1f95398493bd3341b091d6523e841e0cb7a0c22eae173913b874717935337540e5e9b26b44ef8a53fb1460513c90a4ec407543374","ssdeep":"","tlshash":"4bd0c9d9e8d27874924821a21c3ad0216a395884548fa549f8400409eec630cdb26c30","size":198,"data":"","first_seen":"2026-06-07T15:59:48.443596Z","last_seen":"2026-09-17T13:41:24.819301Z","times_seen":120,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"yunk-frerink.alc.onl/?i=1","fqdn":"yunk-frerink.alc.onl","domain":"alc.onl","tld":"onl"},"ip":{"addr":"185.27.134.223","port":443,"asn":34119,"as":"Wildcard UK Limited","country":"United Kingdom","country_code":"GB"},"introduction_type":"scriptElement","is_inline":true,"md5":"e4e33bb31b505ccc9c597d58311e8822","sha1":"e0ad9a83e3aa512be875d367b18e0ccf045ac8ab","sha256":"6f093d84967400b650f294d3cadae749f36f9a64e922364e586e4f92bdb3be4a","sha512":"7ed62f7dc8b7dc8aee08c86cf3604de55552e861a2a0a820cfb267453b35538ab8e6360b762f3c09f08d631b2746b6c80e0f52c109dbe09e4fc3ec73cc09e287","ssdeep":"","tlshash":"4c811240b47716c016b7a27b2bfbd144ab2f410b680ad9113f6d4b8c1f06566fa63bc7","size":3891,"data":"","first_seen":"2026-08-02T15:39:00.419031Z","last_seen":"2026-09-17T13:41:24.820125Z","times_seen":3,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"yunk-frerink.alc.onl/aes.js","fqdn":"yunk-frerink.alc.onl","domain":"alc.onl","tld":"onl"},"ip":{"addr":"185.27.134.223","port":443,"asn":34119,"as":"Wildcard UK Limited","country":"United Kingdom","country_code":"GB"},"introduction_type":"scriptElement","is_inline":false,"md5":"fc66e046447092c606f2587837f96874","sha1":"fcf354a8044f494ee1f9fe868dde3f570f50e593","sha256":"5069425b121346b36f730910d05402d50920fc2178b01e0c878b71af4ef1eb96","sha512":"51cd149b2876e90621afc579fb172e253548a851d4c202181e1faba812f5beb1ae9ccf9f153137f60c569e05a79dcb272176e0126eceac54316208d2699a689f","ssdeep":"192:4hsoEj776Bn/tnHcgaollys/6+EgH3JLg7oLu0MyMVu:i50/3xoGs/jE839g2FB1","tlshash":"355200c203894a7cf2c92ed68c2f605620f3e54a3d251249efb399dbbc77d895075a36","size":13733,"data":"","first_seen":"2023-10-15T19:29:47Z","last_seen":"2026-09-17T17:51:57.660707Z","times_seen":8856,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"ajax.googleapis.com/ajax/libs/jquery/3.5.1/jquery.min.js","fqdn":"ajax.googleapis.com","domain":"ajax.googleapis.com","tld":"googleapis.com"},"ip":{"addr":"142.250.178.106","port":443,"asn":15169,"as":"GOOGLE","country":"United States","country_code":"US"},"introduction_type":"scriptElement","is_inline":false,"md5":"dc5e7f18c8d36ac1d3d4753a87c98d0a","sha1":"c8e1c8b386dc5b7a9184c763c88d19a346eb3342","sha256":"f7f6a5894f1d19ddad6fa392b2ece2c5e578cbf7da4ea805b6885eb6985b6e3d","sha512":"6cb4f4426f559c06190df97229c05a436820d21498350ac9f118a5625758435171418a022ed523bae46e668f9f8ea871feab6aff58ad2740b67a30f196d65516","ssdeep":"1536:AjExXUqrnxDjoXEZxkMV4SYSt0zvDD6ip3h8cApwEjOPrBeU6QLiTFbc0QlQvakF:AYh8eip3huuf6IidlrvakdtQ47GK1","tlshash":"a993f9ddb2c6702257a720ba007f510bf236199d6c4d8450f265d8e9bcb8a4e827bf7d","size":89476,"data":"","first_seen":"2023-03-07T01:02:01Z","last_seen":"2026-09-17T18:37:55.394223Z","times_seen":272334,"alerts":{"ids":null,"analyzer":null,"urlquery":null}}],"eval":null,"write":null,"console":null},"http":[{"url":{"schema":"https","addr":"yunk-frerink.alc.onl/?i=1","fqdn":"yunk-frerink.alc.onl","domain":"alc.onl","tld":"onl"},"ip":{"addr":"185.27.134.223","port":443,"asn":34119,"as":"Wildcard UK Limited","country":"United Kingdom","country_code":"GB"},"is_navigation_request":true,"resource_type":"document","requested_by":"","date":"2026-09-17T13:40:53.777Z","timestamp":1789652453777,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"alc.onl","organization":""},"issuer":{"commonName":"ZeroSSL ECC DV SSL CA 2","organization":"ZeroSSL GmbH"},"validity":{"start":"Fri, 03 Jul 2026 00:00:00 GMT","end":"Thu, 01 Oct 2026 23:59:59 GMT"},"fingerprint":{"sha1":"AD:DF:80:98:7D:AF:EB:68:38:74:2E:A8:43:05:8A:73:FA:44:81:66","sha256":"47:BD:26:DE:34:78:D7:9A:5F:94:60:DF:FB:B2:93:88:09:93:42:1D:99:51:C6:DE:C5:63:CA:A1:66:E9:B4:8A"}}},"request":{"raw":"GET /?i=1 HTTP/1.1\r\nHost: yunk-frerink.alc.onl\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://yunk-frerink.alc.onl/\r\nCookie: __test=ca03d00f8bd642b5f53b8752a3d912d2\r\nUpgrade-Insecure-Requests: 1\r\nSec-Fetch-Dest: document\r\nSec-Fetch-Mode: navigate\r\nSec-Fetch-Site: same-origin\r\nPriority: u=0, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nServer: openresty\r\nDate: Thu, 17 Sep 2026 13:40:53 GMT\r\nContent-Type: text/html; charset=UTF-8\r\nTransfer-Encoding: chunked\r\nConnection: keep-alive\r\nLast-Modified: Sat, 12 Sep 2026 08:11:34 GMT\r\nETag: \"5cfd-65b44bfd0f54c\"\r\nAccept-Ranges: bytes\r\nCache-Control: max-age=2592000, public, proxy-revalidate\r\nExpires: Sat, 17 Oct 2026 13:40:53 GMT\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"OpenResty","description":"OpenResty is a web platform based on nginx which can run Lua scripts using its LuaJIT engine.","website":"https://openresty.org","common_platform_enumeration":"","icon":"OpenResty.svg","categories":["Web servers"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"jQuery:3.5.1","description":"jQuery is a JavaScript library which is a free, open-source software designed to simplify HTML DOM tree traversal and manipulation, as well as event handling, CSS animation, and Ajax.","website":"https://jquery.com","common_platform_enumeration":"cpe:2.3:a:jquery:jquery:*:*:*:*:*:*:*:*","icon":"jQuery.svg","categories":["JavaScript libraries"]},{"name":"Google Hosted Libraries","description":"Google Hosted Libraries is a stable, reliable, high-speed, globally available content distribution network for the most popular, open-source JavaScript libraries.","website":"https://developers.google.com/speed/libraries","common_platform_enumeration":"","icon":"Google Developers.svg","categories":["CDN"]}],"data":{"size":23954,"size_decoded":24315,"mime_type":"text/html; charset=UTF-8","magic":"HTML document, Unicode text, UTF-8 text","md5":"6cc5a445479f79aa6c3122bf85607db0","sha1":"781608f4cf8aeb218708ccb6dc7485e752fd1483","sha256":"cb9edda8ef3cc730963dbf8c2f79c031fce1e7e01b39a4ff202948de9d9e5365","sha512":"9344449b396c7c115297caa0651709c060aaabc1c8f9ff686c0416d3b5a2e86e302e03f623e70617824846db41bec88b0d33f092163e11a7e371076105c2e7d4","ssdeep":"384:d93zo+8dLZqHhTyOv/rWFVzD8SoLqjLIT7PP:d93zo+8dLZqHhTyOv/rWFVLJvs7PP","tlshash":"9cb2b481a9f709937013d16437f3ab4a767dc103d50acd393ead23988f86bd99a53788","first_seen":"2026-09-17T13:33:37.61282Z","last_seen":"2026-09-17T13:41:24.811092Z","times_seen":2,"resource_available":true,"data":null}},"time_used":90,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":74,"receive":16,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-17","alert":"Sinkholed","trigger":"yunk-frerink.alc.onl","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-09-17","alert":"Sinkholed","trigger":"yunk-frerink.alc.onl","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"fonts.googleapis.com/css2?family=Segoe+UI:wght@400;600\u0026display=swap","fqdn":"fonts.googleapis.com","domain":"fonts.googleapis.com","tld":"googleapis.com"},"ip":{"addr":"142.250.178.106","port":443,"asn":15169,"as":"GOOGLE","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://yunk-frerink.alc.onl/?i=1","date":"2026-09-17T13:40:54.087Z","timestamp":1789652454087,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"upload.video.google.com","organization":""},"issuer":{"commonName":"WE2","organization":"Google Trust Services"},"validity":{"start":"Fri, 04 Sep 2026 08:06:15 GMT","end":"Fri, 27 Nov 2026 08:06:14 GMT"},"fingerprint":{"sha1":"4A:94:E8:7C:D6:24:98:F0:09:11:DC:AA:71:9C:1B:6F:0E:37:D6:F9","sha256":"27:EB:1A:85:AA:03:02:5C:92:96:B5:9A:18:1B:65:94:2D:6C:B8:A3:56:3D:E9:F8:5F:E3:62:83:5C:A8:C0:59"}}},"request":{"raw":"GET /css2?family=Segoe+UI:wght@400;600\u0026display=swap HTTP/1.1\r\nHost: fonts.googleapis.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-Fetch-Storage-Access: none\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://yunk-frerink.alc.onl/\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPriority: u=2\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 400 \r\ncontent-type: text/html; charset=utf-8\r\ncache-control: no-cache, no-store, max-age=0, must-revalidate\r\npragma: no-cache\r\nexpires: Mon, 01 Jan 1990 00:00:00 GMT\r\ndate: Thu, 17 Sep 2026 13:40:54 GMT\r\ncross-origin-resource-policy: cross-origin\r\ncross-origin-opener-policy: same-origin-allow-popups\r\ncontent-encoding: gzip\r\nserver: ESF\r\nx-xss-protection: 0\r\nx-frame-options: SAMEORIGIN\r\nx-content-type-options: nosniff\r\nalt-svc: h3=\":443\"; ma=2592000,h3-29=\":443\"; ma=2592000\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"400","status_text":"Bad Request","fingerprints":null,"data":{"size":0,"size_decoded":0,"mime_type":"text/html; charset=utf-8","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-09-17T18:41:51.81857Z","times_seen":18520184,"resource_available":true,"data":null}},"time_used":0,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":0,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"yunk-frerink.alc.onl/MSFT-Microsoft-sticky-logo-RE1Mu3b.png","fqdn":"yunk-frerink.alc.onl","domain":"alc.onl","tld":"onl"},"ip":{"addr":"185.27.134.223","port":443,"asn":34119,"as":"Wildcard UK Limited","country":"United Kingdom","country_code":"GB"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://yunk-frerink.alc.onl/?i=1","date":"2026-09-17T13:40:54.101Z","timestamp":1789652454101,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"alc.onl","organization":""},"issuer":{"commonName":"ZeroSSL ECC DV SSL CA 2","organization":"ZeroSSL GmbH"},"validity":{"start":"Fri, 03 Jul 2026 00:00:00 GMT","end":"Thu, 01 Oct 2026 23:59:59 GMT"},"fingerprint":{"sha1":"AD:DF:80:98:7D:AF:EB:68:38:74:2E:A8:43:05:8A:73:FA:44:81:66","sha256":"47:BD:26:DE:34:78:D7:9A:5F:94:60:DF:FB:B2:93:88:09:93:42:1D:99:51:C6:DE:C5:63:CA:A1:66:E9:B4:8A"}}},"request":{"raw":"GET /MSFT-Microsoft-sticky-logo-RE1Mu3b.png HTTP/1.1\r\nHost: yunk-frerink.alc.onl\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://yunk-frerink.alc.onl/?i=1\r\nCookie: __test=ca03d00f8bd642b5f53b8752a3d912d2\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nServer: openresty\r\nDate: Thu, 17 Sep 2026 13:40:53 GMT\r\nContent-Type: image/png\r\nContent-Length: 4054\r\nConnection: keep-alive\r\nLast-Modified: Sat, 12 Sep 2026 08:11:36 GMT\r\nETag: \"fd6-65b44bfeaf1e6\"\r\nCache-Control: max-age=2592000, public, proxy-revalidate\r\nExpires: Sat, 17 Oct 2026 13:40:53 GMT\r\nAccept-Ranges: bytes\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"OpenResty","description":"OpenResty is a web platform based on nginx which can run Lua scripts using its LuaJIT engine.","website":"https://openresty.org","common_platform_enumeration":"","icon":"OpenResty.svg","categories":["Web servers"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":4054,"size_decoded":4393,"mime_type":"image/png","magic":"PNG image data, 216 x 46, 8-bit/color RGBA, non-interlaced","md5":"9f14c20150a003d7ce4de57c298f0fba","sha1":"daa53cf17cc45878a1b153f3c3bf47dc9669d78f","sha256":"112fec798b78aa02e102a724b5cb1990c0f909bc1d8b7b1fa256eab41bbc0960","sha512":"d4f6e49c854e15fe48d6a1f1a03fda93218ab8fcdb2c443668e7df478830831acc2b41daefc25ed38fcc8d96c4401377374fed35c36a5017a11e63c8dae5c487","ssdeep":"","tlshash":"d0816d07ff018801919ee9570485507acb618cd1e7f91061a987c825c9b5cf82abcde7","first_seen":"2023-04-05T04:39:01Z","last_seen":"2026-09-17T15:57:56.276369Z","times_seen":12684,"resource_available":false,"data":null}},"time_used":183,"timings":{"blocked":75,"dns":0,"connect":33,"send":0,"wait":35,"receive":1,"ssl":39},"alerts":{"ids":null,"analyzer":[{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-09-17","alert":"Sinkholed","trigger":"yunk-frerink.alc.onl","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-17","alert":"Sinkholed","trigger":"yunk-frerink.alc.onl","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"yunk-frerink.alc.onl/candado.png","fqdn":"yunk-frerink.alc.onl","domain":"alc.onl","tld":"onl"},"ip":{"addr":"185.27.134.223","port":443,"asn":34119,"as":"Wildcard UK Limited","country":"United Kingdom","country_code":"GB"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://yunk-frerink.alc.onl/?i=1","date":"2026-09-17T13:40:54.103Z","timestamp":1789652454103,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"alc.onl","organization":""},"issuer":{"commonName":"ZeroSSL ECC DV SSL CA 2","organization":"ZeroSSL GmbH"},"validity":{"start":"Fri, 03 Jul 2026 00:00:00 GMT","end":"Thu, 01 Oct 2026 23:59:59 GMT"},"fingerprint":{"sha1":"AD:DF:80:98:7D:AF:EB:68:38:74:2E:A8:43:05:8A:73:FA:44:81:66","sha256":"47:BD:26:DE:34:78:D7:9A:5F:94:60:DF:FB:B2:93:88:09:93:42:1D:99:51:C6:DE:C5:63:CA:A1:66:E9:B4:8A"}}},"request":{"raw":"GET /candado.png HTTP/1.1\r\nHost: yunk-frerink.alc.onl\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://yunk-frerink.alc.onl/?i=1\r\nCookie: __test=ca03d00f8bd642b5f53b8752a3d912d2\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nServer: openresty\r\nDate: Thu, 17 Sep 2026 13:40:53 GMT\r\nContent-Type: image/png\r\nContent-Length: 1537382\r\nConnection: keep-alive\r\nLast-Modified: Sat, 12 Sep 2026 08:11:32 GMT\r\nETag: \"177566-65b44bfbbc737\"\r\nCache-Control: max-age=2592000, public, proxy-revalidate\r\nExpires: Sat, 17 Oct 2026 13:40:53 GMT\r\nAccept-Ranges: bytes\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"OpenResty","description":"OpenResty is a web platform based on nginx which can run Lua scripts using its LuaJIT engine.","website":"https://openresty.org","common_platform_enumeration":"","icon":"OpenResty.svg","categories":["Web servers"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":1537382,"size_decoded":1537727,"mime_type":"image/png","magic":"PNG image data, 1024 x 1024, 8-bit/color RGBA, non-interlaced","md5":"38b8787093216fc47b2ffd2a8ac5c0dd","sha1":"1831a621c0524b16f1537d26d9fb099eaf5aa887","sha256":"9175987475a6a382681edb34401f9308523e658aa4335468c1b12933c77812e2","sha512":"394905cec1a4da5a29bef984209824a0572f24696c7e48aede2011db06ed4972e05936b57a3b2f2c7e95031e8f5f4c723cfe1dbd4c90c203c83725040e3964d6","ssdeep":"24576:kJwQn+oWV0Ft7TFlCjlhlnGOlPaZ+IX5j9DRrg478qCjlJpU5:kdn+nV0ZlCEOlSkIJjN5g4bQpU5","tlshash":"13252363c35e4b41c2622bb1f8dd803a7ca52981aade144763eb3c0c79c1f1e57989f6","first_seen":"2026-08-02T15:39:00.408863Z","last_seen":"2026-09-17T13:41:24.814097Z","times_seen":3,"resource_available":false,"data":null}},"time_used":364,"timings":{"blocked":75,"dns":0,"connect":0,"send":0,"wait":79,"receive":210,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-17","alert":"Sinkholed","trigger":"yunk-frerink.alc.onl","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-09-17","alert":"Sinkholed","trigger":"yunk-frerink.alc.onl","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"c.s-microsoft.com/favicon.ico?v2","fqdn":"c.s-microsoft.com","domain":"s-microsoft.com","tld":"com"},"ip":{"addr":"2.18.174.85","port":443,"asn":16625,"as":"AKAMAI-AS","country":"Norway","country_code":"NO"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://yunk-frerink.alc.onl/?i=1","date":"2026-09-17T13:40:54.480Z","timestamp":1789652454480,"http_version":"HTTP/2","security_state":"","security_info":null,"request":{"raw":"GET /favicon.ico?v2 HTTP/1.1\r\nHost: c.s-microsoft.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-Fetch-Storage-Access: none\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://yunk-frerink.alc.onl/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPriority: u=6\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 404 \r\ncontent-type: text/html\r\nvary: Accept-Encoding\r\nx-azure-ref: 20260917T134054Z-154556895847v62rhC1AMSenys00000022bg00000000d461\r\ncontent-encoding: gzip\r\ncache-control: max-age=604800\r\nexpires: Thu, 24 Sep 2026 13:40:54 GMT\r\ndate: Thu, 17 Sep 2026 13:40:54 GMT\r\naccess-control-allow-methods: GET,POST\r\naccess-control-allow-origin: *\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"404","status_text":"Not Found","fingerprints":[{"name":"Azure Front Door","description":"Azure Front Door is a scalable and secure entry point for fast delivery of your global web applications.","website":"https://docs.microsoft.com/en-us/azure/frontdoor/","common_platform_enumeration":"","icon":"Azure.svg","categories":["Load balancers"]},{"name":"Azure","description":"Azure is a cloud computing service for building, testing, deploying, and managing applications and services through Microsoft-managed data centers.","website":"https://azure.microsoft.com","common_platform_enumeration":"","icon":"Azure.svg","categories":["PaaS"]}],"data":{"size":0,"size_decoded":0,"mime_type":"text/html","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-09-17T18:41:51.81857Z","times_seen":18520184,"resource_available":true,"data":null}},"time_used":0,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":0,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"cdnjs.cloudflare.com/ajax/libs/font-awesome/6.4.0/css/all.min.css","fqdn":"cdnjs.cloudflare.com","domain":"cloudflare.com","tld":"com"},"ip":{"addr":"104.17.24.14","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://yunk-frerink.alc.onl/?i=1","date":"2026-09-17T13:40:54.091Z","timestamp":1789652454091,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"cdnjs.cloudflare.com","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Mon, 07 Sep 2026 14:43:48 GMT","end":"Sun, 06 Dec 2026 15:43:45 GMT"},"fingerprint":{"sha1":"70:B5:44:5C:25:65:CF:4A:4B:DB:6F:16:E1:4E:D9:85:C7:F3:75:4E","sha256":"63:B5:DA:B8:4F:95:99:9A:4B:77:FF:DB:3F:8D:7E:3D:1A:62:AD:A9:D9:06:9E:C3:59:6F:4A:61:A2:D2:20:CB"}}},"request":{"raw":"GET /ajax/libs/font-awesome/6.4.0/css/all.min.css HTTP/1.1\r\nHost: cdnjs.cloudflare.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-Fetch-Storage-Access: none\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://yunk-frerink.alc.onl/\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPriority: u=2\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nserver-timing: cfExtPri\r\nserver: cloudflare\r\ndate: Thu, 17 Sep 2026 13:40:54 GMT\r\ncontent-type: text/css; charset=utf-8\r\npriority: u=2,i=?0\r\ncf-cache-status: BYPASS\r\naccess-control-allow-origin: *\r\nage: 4197530\r\ncache-control: no-transform, public, s-maxage=30672000, max-age=30672000, immutable\r\ncontent-encoding: br\r\nlast-modified: Mon, 27 Mar 2023 17:46:59 GMT\r\nvary: Accept-Encoding\r\ncross-origin-resource-policy: cross-origin\r\ntiming-allow-origin: *\r\nx-content-type-options: nosniff\r\ncf-cdnjs-via: cfworker/r2\r\nx-cdnjs-cache: HIT\r\nstrict-transport-security: max-age=15780000\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=IGPAW98kzq%2BumSQaQo%2Fol%2FHA7sU9bWfzoCOf2MJc3JMhxc6MtiKBEy4D12%2BOmS%2FIVw3ONizR%2BcIjBEVJ6WUZmH0Dpr5ykGMZqshTsRXOhAR7paBzo20WB%2F36azO4FfVvk0JoyX6x\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.01,\"max_age\":604800}\r\ncf-ray: a3c8867e2e810daa-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\ncontent-length: 18752\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":102025,"size_decoded":19765,"mime_type":"text/css; charset=utf-8","magic":"ASCII text, with very long lines (52276)","md5":"ded1c367363e8b20bdc6a19b8350a737","sha1":"8c06d82739d14b094ff6d9036021a252bd1d985d","sha256":"1edb1725a9ea8ca4dcf2f5508cee183218aa1685e47c1b23056717f754f58ebf","sha512":"89e71d2e66ac925ec2564aa45cd43f647fd72e5bd664e2728fb632eed71e9e6a43d72a404a8ce9993fc4d223ed985201e3a66676d01cf5e341bc7d07fd9a6207","ssdeep":"1536:OwMCMPMCMjMCM4MCMwMCM3sVMX709gbPMfjSFOTyPGuZprfZCl:S709gMGFiyPGuZpfZCl","tlshash":"2ea3a7f9e44c05d97732c44bab95b37c65b6f738d5810ca9f02f580c1ad26a822c6f7a","first_seen":"2023-04-06T15:05:25Z","last_seen":"2026-09-17T17:22:44.888616Z","times_seen":62101,"resource_available":true,"data":null}},"time_used":28,"timings":{"blocked":-1,"dns":3,"connect":10,"send":0,"wait":15,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"ajax.googleapis.com/ajax/libs/jquery/3.5.1/jquery.min.js","fqdn":"ajax.googleapis.com","domain":"ajax.googleapis.com","tld":"googleapis.com"},"ip":{"addr":"142.250.178.106","port":443,"asn":15169,"as":"GOOGLE","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://yunk-frerink.alc.onl/?i=1","date":"2026-09-17T13:40:54.093Z","timestamp":1789652454093,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"upload.video.google.com","organization":""},"issuer":{"commonName":"WE2","organization":"Google Trust Services"},"validity":{"start":"Fri, 04 Sep 2026 08:06:15 GMT","end":"Fri, 27 Nov 2026 08:06:14 GMT"},"fingerprint":{"sha1":"4A:94:E8:7C:D6:24:98:F0:09:11:DC:AA:71:9C:1B:6F:0E:37:D6:F9","sha256":"27:EB:1A:85:AA:03:02:5C:92:96:B5:9A:18:1B:65:94:2D:6C:B8:A3:56:3D:E9:F8:5F:E3:62:83:5C:A8:C0:59"}}},"request":{"raw":"GET /ajax/libs/jquery/3.5.1/jquery.min.js HTTP/1.1\r\nHost: ajax.googleapis.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-Fetch-Storage-Access: none\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://yunk-frerink.alc.onl/\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPriority: u=2\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\naccept-ranges: bytes\r\ncontent-encoding: gzip\r\naccess-control-allow-origin: *\r\ncontent-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/hosted-libraries-pushers\r\ncross-origin-resource-policy: cross-origin\r\ncross-origin-opener-policy: same-origin; report-to=\"hosted-libraries-pushers\"\r\nreport-to: {\"group\":\"hosted-libraries-pushers\",\"max_age\":2592000,\"endpoints\":[{\"url\":\"https://csp.withgoogle.com/csp/report-to/hosted-libraries-pushers\"}]}\r\ntiming-allow-origin: *\r\ncontent-length: 31021\r\nx-content-type-options: nosniff\r\nserver: sffe\r\nx-xss-protection: 0\r\ndate: Wed, 16 Sep 2026 10:31:15 GMT\r\nexpires: Thu, 16 Sep 2027 10:31:15 GMT\r\ncache-control: public, max-age=31536000, stale-while-revalidate=2592000\r\nage: 97779\r\nlast-modified: Fri, 08 May 2020 07:05:03 GMT\r\ncontent-type: text/javascript; charset=UTF-8\r\nvary: Accept-Encoding\r\nalt-svc: h3=\":443\"; ma=2592000,h3-29=\":443\"; ma=2592000\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":null,"data":{"size":89476,"size_decoded":32004,"mime_type":"text/javascript; charset=UTF-8","magic":"JavaScript source, ASCII text, with very long lines (65451)","md5":"dc5e7f18c8d36ac1d3d4753a87c98d0a","sha1":"c8e1c8b386dc5b7a9184c763c88d19a346eb3342","sha256":"f7f6a5894f1d19ddad6fa392b2ece2c5e578cbf7da4ea805b6885eb6985b6e3d","sha512":"6cb4f4426f559c06190df97229c05a436820d21498350ac9f118a5625758435171418a022ed523bae46e668f9f8ea871feab6aff58ad2740b67a30f196d65516","ssdeep":"1536:AjExXUqrnxDjoXEZxkMV4SYSt0zvDD6ip3h8cApwEjOPrBeU6QLiTFbc0QlQvakF:AYh8eip3huuf6IidlrvakdtQ47GK1","tlshash":"a993f9ddb2c6702257a720ba007f510bf236199d6c4d8450f265d8e9bcb8a4e827bf7d","first_seen":"2023-03-07T01:02:01Z","last_seen":"2026-09-17T18:37:55.394223Z","times_seen":272334,"resource_available":true,"data":null}},"time_used":83,"timings":{"blocked":-1,"dns":3,"connect":17,"send":0,"wait":17,"receive":16,"ssl":30},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"yunk-frerink.alc.onl/78_3a53c38a2dc671fb4daf.jpg","fqdn":"yunk-frerink.alc.onl","domain":"alc.onl","tld":"onl"},"ip":{"addr":"185.27.134.223","port":443,"asn":34119,"as":"Wildcard UK Limited","country":"United Kingdom","country_code":"GB"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://yunk-frerink.alc.onl/?i=1","date":"2026-09-17T13:40:54.203Z","timestamp":1789652454203,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"alc.onl","organization":""},"issuer":{"commonName":"ZeroSSL ECC DV SSL CA 2","organization":"ZeroSSL GmbH"},"validity":{"start":"Fri, 03 Jul 2026 00:00:00 GMT","end":"Thu, 01 Oct 2026 23:59:59 GMT"},"fingerprint":{"sha1":"AD:DF:80:98:7D:AF:EB:68:38:74:2E:A8:43:05:8A:73:FA:44:81:66","sha256":"47:BD:26:DE:34:78:D7:9A:5F:94:60:DF:FB:B2:93:88:09:93:42:1D:99:51:C6:DE:C5:63:CA:A1:66:E9:B4:8A"}}},"request":{"raw":"GET /78_3a53c38a2dc671fb4daf.jpg HTTP/1.1\r\nHost: yunk-frerink.alc.onl\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://yunk-frerink.alc.onl/?i=1\r\nCookie: __test=ca03d00f8bd642b5f53b8752a3d912d2\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=4, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nServer: openresty\r\nDate: Thu, 17 Sep 2026 13:40:53 GMT\r\nContent-Type: image/jpeg\r\nContent-Length: 83760\r\nConnection: keep-alive\r\nLast-Modified: Sat, 12 Sep 2026 08:11:33 GMT\r\nETag: \"14730-65b44bfc95fd1\"\r\nCache-Control: max-age=2592000, public, proxy-revalidate\r\nExpires: Sat, 17 Oct 2026 13:40:53 GMT\r\nAccept-Ranges: bytes\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"OpenResty","description":"OpenResty is a web platform based on nginx which can run Lua scripts using its LuaJIT engine.","website":"https://openresty.org","common_platform_enumeration":"","icon":"OpenResty.svg","categories":["Web servers"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":83760,"size_decoded":84103,"mime_type":"image/jpeg","magic":"JPEG image data, JFIF standard 1.01, resolution (DPI), density 72x72, segment length 16, progressive, precision 8, 1920x1081, components 3","md5":"3a53c38a2dc671fb4dafb29ed2e8d602","sha1":"6c83cbe368608a866f734a3caa31a747ebd6339c","sha256":"e9d90d78575f9051b6506d28e0c55f4ffa11f7a72f7d7890bc9890a738529617","sha512":"daa7f14355e997e3d077a7ed2fb24c5f2040ef352fe4f05eec7f96e531eadf107992dc1dfea72819d57083001af93396ee310823247e1fdf98470a8775de6198","ssdeep":"1536:mOLbXdVvM+BgwLPflu+xPAekUx+kNTq9CXkZrYivV9qmiKscG2LN6C5c7KQP+oZ3:mOLbXdVewLPflu+PbIkM9v/vTLUQc7KY","tlshash":"1c8302b2eb889af7ca142331c4bf4d293271794266ce1962876b97bb0c25137bc9d741","first_seen":"2025-03-19T05:26:43.42815Z","last_seen":"2026-09-17T13:41:24.816435Z","times_seen":144,"resource_available":false,"data":null}},"time_used":192,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":36,"receive":71,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-09-17","alert":"Sinkholed","trigger":"yunk-frerink.alc.onl","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-17","alert":"Sinkholed","trigger":"yunk-frerink.alc.onl","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"yunk-frerink.alc.onl/","fqdn":"yunk-frerink.alc.onl","domain":"alc.onl","tld":"onl"},"ip":{"addr":"185.27.134.223","port":443,"asn":34119,"as":"Wildcard UK Limited","country":"United Kingdom","country_code":"GB"},"is_navigation_request":true,"resource_type":"document","requested_by":"","date":"2026-09-17T13:40:53.366Z","timestamp":1789652453366,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"alc.onl","organization":""},"issuer":{"commonName":"ZeroSSL ECC DV SSL CA 2","organization":"ZeroSSL GmbH"},"validity":{"start":"Fri, 03 Jul 2026 00:00:00 GMT","end":"Thu, 01 Oct 2026 23:59:59 GMT"},"fingerprint":{"sha1":"AD:DF:80:98:7D:AF:EB:68:38:74:2E:A8:43:05:8A:73:FA:44:81:66","sha256":"47:BD:26:DE:34:78:D7:9A:5F:94:60:DF:FB:B2:93:88:09:93:42:1D:99:51:C6:DE:C5:63:CA:A1:66:E9:B4:8A"}}},"request":{"raw":"GET / HTTP/1.1\r\nHost: yunk-frerink.alc.onl\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nUpgrade-Insecure-Requests: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: document\r\nSec-Fetch-Mode: navigate\r\nSec-Fetch-Site: none\r\nPriority: u=0, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nServer: openresty\r\nDate: Thu, 17 Sep 2026 13:40:53 GMT\r\nContent-Type: text/html\r\nContent-Length: 847\r\nConnection: keep-alive\r\nExpires: Thu, 01 Jan 1970 00:00:01 GMT\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"OpenResty","description":"OpenResty is a web platform based on nginx which can run Lua scripts using its LuaJIT engine.","website":"https://openresty.org","common_platform_enumeration":"","icon":"OpenResty.svg","categories":["Web servers"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":847,"size_decoded":1057,"mime_type":"text/html","magic":"HTML document, ASCII text, with very long lines (847), with no line terminators","md5":"25414806e23a38f58cf6b5c3c96030d5","sha1":"ebf75f0d2a89385cf226c66ba7b0f60c2373cf4c","sha256":"c3024f3f74a0877fac1f03c398a7ff51c93f84a0ee156b88ef7ca065ce16d4f2","sha512":"debd827fb28dd07aef284761cdbbb83162d1e14ad1e40abcac0711ac93452d397ab097ff4824058359212eb4a313b7f49531e1aabe03813f46b88680f7ebdf45","ssdeep":"","tlshash":"800141b4eca2e0c69bc000d01837c96e641196a2e501caafc0c242e5a1e1fdc0e49c3f","first_seen":"2026-09-17T13:33:37.609492Z","last_seen":"2026-09-17T18:45:49.327101Z","times_seen":3,"resource_available":true,"data":null}},"time_used":179,"timings":{"blocked":0,"dns":67,"connect":34,"send":0,"wait":34,"receive":0,"ssl":43},"alerts":{"ids":null,"analyzer":[{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-09-17","alert":"Sinkholed","trigger":"yunk-frerink.alc.onl","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-17","alert":"Sinkholed","trigger":"yunk-frerink.alc.onl","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"yunk-frerink.alc.onl/aes.js","fqdn":"yunk-frerink.alc.onl","domain":"alc.onl","tld":"onl"},"ip":{"addr":"185.27.134.223","port":443,"asn":34119,"as":"Wildcard UK Limited","country":"United Kingdom","country_code":"GB"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://yunk-frerink.alc.onl/","date":"2026-09-17T13:40:53.709Z","timestamp":1789652453709,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"alc.onl","organization":""},"issuer":{"commonName":"ZeroSSL ECC DV SSL CA 2","organization":"ZeroSSL GmbH"},"validity":{"start":"Fri, 03 Jul 2026 00:00:00 GMT","end":"Thu, 01 Oct 2026 23:59:59 GMT"},"fingerprint":{"sha1":"AD:DF:80:98:7D:AF:EB:68:38:74:2E:A8:43:05:8A:73:FA:44:81:66","sha256":"47:BD:26:DE:34:78:D7:9A:5F:94:60:DF:FB:B2:93:88:09:93:42:1D:99:51:C6:DE:C5:63:CA:A1:66:E9:B4:8A"}}},"request":{"raw":"GET /aes.js HTTP/1.1\r\nHost: yunk-frerink.alc.onl\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://yunk-frerink.alc.onl/\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nServer: openresty\r\nDate: Thu, 17 Sep 2026 13:40:53 GMT\r\nContent-Type: application/javascript\r\nContent-Length: 13733\r\nLast-Modified: Sun, 15 Oct 2023 16:54:07 GMT\r\nConnection: keep-alive\r\nETag: \"652c192f-35a5\"\r\nAccept-Ranges: bytes\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"OpenResty","description":"OpenResty is a web platform based on nginx which can run Lua scripts using its LuaJIT engine.","website":"https://openresty.org","common_platform_enumeration":"","icon":"OpenResty.svg","categories":["Web servers"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":13733,"size_decoded":13984,"mime_type":"application/javascript","magic":"ASCII text, with very long lines (13733), with no line terminators","md5":"fc66e046447092c606f2587837f96874","sha1":"fcf354a8044f494ee1f9fe868dde3f570f50e593","sha256":"5069425b121346b36f730910d05402d50920fc2178b01e0c878b71af4ef1eb96","sha512":"51cd149b2876e90621afc579fb172e253548a851d4c202181e1faba812f5beb1ae9ccf9f153137f60c569e05a79dcb272176e0126eceac54316208d2699a689f","ssdeep":"192:4hsoEj776Bn/tnHcgaollys/6+EgH3JLg7oLu0MyMVu:i50/3xoGs/jE839g2FB1","tlshash":"355200c203894a7cf2c92ed68c2f605620f3e54a3d251249efb399dbbc77d895075a36","first_seen":"2023-10-15T19:29:47Z","last_seen":"2026-09-17T17:51:57.660707Z","times_seen":8856,"resource_available":true,"data":null}},"time_used":42,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":34,"receive":8,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-17","alert":"Sinkholed","trigger":"yunk-frerink.alc.onl","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-09-17","alert":"Sinkholed","trigger":"yunk-frerink.alc.onl","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null}],"urlquery":null}}]}