{"report_id":"bf5abfd2-5c98-4974-aeac-11be77306c13","version":0,"status":"done","tags":[],"date":"2026-07-12T23:40:59Z","url":{"schema":"https","addr":"paradesktopinst.icu/","fqdn":"paradesktopinst.icu","domain":"paradesktopinst.icu","tld":"icu"},"ip":{"addr":"104.21.5.50","port":0,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"final":{"url":{"schema":"https","addr":"www.paradesktopinst.icu/","fqdn":"www.paradesktopinst.icu","domain":"paradesktopinst.icu","tld":"icu"},"title":"Paradigm Desktop Download","dom":{"size":6215034,"mime_type":"text/html; charset=utf-8","magic":"HTML document, ASCII text, with very long lines (31272)","md5":"18fa6a6da0e02831521bd7ed9cc5f259","sha1":"ee26a10ab3bab1a34140851dbe646c770859884d","sha256":"f7879f456cc31663fa1fe09837028d4d8d527aec0dc1920f60f98cccc98c3e32","sha512":"16f0073e97f3ebc7cefe980ee3d80e2d910a19fe9b8c75e9cdf77f9fb532084261f9a5af7acdc1dc51ca22209fa564dd78f85c831b047e65cf43e52589d0ab23","ssdeep":"49152:GhEfqo9fznufE2vfWV8Es+zpEsk9aEsCP3EsuSBZ8T2U2FGR8ofZVbr/L9zhgFG9:7","tlshash":"265612396979567f2c3375bda36f242e3e70a58bd808ccce7ddd21c18f9a6a05852e04","dom_hash":"domhash3e0ea65a8f6b31d69ddd69abb714fcfc","first_seen":"","last_seen":"","times_seen":0,"resource_available":false,"data":null}},"submit":{"url":{"schema":"https","addr":"paradesktopinst.icu/","fqdn":"paradesktopinst.icu","domain":"paradesktopinst.icu","tld":"icu"},"ip":{"addr":"104.21.5.50","port":0,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"tags":null,"meta":null},"settings":{"access":"public","device_type":"desktop","expires_at":"2027-08-16T23:40:59Z","useragent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0","referer":"","cookies":null,"exit_node":"qguvgzjxzsgb3vs"},"stats":{"alert_count":{"ids":0,"urlquery":0,"analyzer":6}},"detection":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-07-12","alert":"Sinkholed","trigger":"paradesktopinst.icu","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-07-12","alert":"Sinkholed","trigger":"paradesktopinst.icu","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-07-12","alert":"Sinkholed","trigger":"paradesktopinst.icu","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-07-12","alert":"Sinkholed","trigger":"www.paradesktopinst.icu","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-07-12","alert":"Sinkholed","trigger":"www.paradesktopinst.icu","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-07-12","alert":"Sinkholed","trigger":"www.paradesktopinst.icu","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null},"summary":[{"fqdn":"www.paradesktopinst.icu","ip":{"addr":"104.21.5.50","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"domain_registered":"2026-07-09","domain_rank":0,"first_seen":"2026-07-12T20:51:35.083025Z","last_seen":"2026-07-12T20:51:35.083025Z","alert_count":9,"request_count":3,"received_data":6340999,"sent_data":1571,"comment":"","tags":null,"fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"Vercel","description":"Vercel is a cloud platform for static frontends and serverless functions.","website":"https://vercel.com","common_platform_enumeration":"","icon":"vercel.svg","categories":["PaaS"]}]},{"fqdn":"paradesktopinst.icu","ip":{"addr":"104.21.5.50","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"domain_registered":"2026-07-09","domain_rank":0,"first_seen":"2026-07-12T20:51:35.080622Z","last_seen":"2026-07-12T20:51:35.080622Z","alert_count":3,"request_count":1,"received_data":772,"sent_data":488,"comment":"","tags":null,"fingerprints":[{"name":"Vercel","description":"Vercel is a cloud platform for static frontends and serverless functions.","website":"https://vercel.com","common_platform_enumeration":"","icon":"vercel.svg","categories":["PaaS"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}]}],"files":null,"artifacts":{"windows_shortcuts":null,"files":null,"telegram":null,"pdfs":null,"clipboard":null},"sensors":{"ids":null,"analyzer":null,"urlquery":null},"javascript":{"script":[{"url":{"schema":"https","addr":"www.paradesktopinst.icu/","fqdn":"www.paradesktopinst.icu","domain":"paradesktopinst.icu","tld":"icu"},"ip":{"addr":"104.21.5.50","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"scriptElement","is_inline":true,"md5":"9b1a7fa346d2eafed8ee711c8b286772","sha1":"3a99d7765a6cff98fdec7290b63254e4e25bc9da","sha256":"6d1ca309d7a1b9fd2e73b2fafcf35b73721fb94741f4502623accd0cef4752e2","sha512":"9b8956fb0300044509b16ff4a32e610fbeecd6573d550574c5c9757390d2deb660b21e840962a3f713870086f9fc25a8a7bed88b102b15acead5d261f28a9b1d","ssdeep":"","tlshash":"c5316a1252b322663c4bb0bd5fbbd84d763a400bd8095450788e918c5f70b6509f37cc","size":1717,"data":"","first_seen":"2026-06-17T18:20:20.998525Z","last_seen":"2026-07-13T01:31:14.019377Z","times_seen":20,"alerts":{"ids":null,"analyzer":null,"urlquery":null}}],"eval":null,"write":null,"console":null},"http":[{"url":{"schema":"https","addr":"paradesktopinst.icu/","fqdn":"paradesktopinst.icu","domain":"paradesktopinst.icu","tld":"icu"},"ip":{"addr":"104.21.5.50","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":true,"resource_type":"document","requested_by":"","date":"2026-07-12T23:40:25.423Z","timestamp":1783899625423,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"paradesktopinst.icu","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Thu, 09 Jul 2026 00:32:57 GMT","end":"Wed, 07 Oct 2026 01:31:28 GMT"},"fingerprint":{"sha1":"2E:B0:BD:F6:58:6C:E2:F3:86:CE:E5:3C:08:7B:E5:18:70:63:49:26","sha256":"F9:CE:95:7D:F6:85:25:A4:C1:4B:78:2F:78:F6:3B:3E:67:33:57:44:CA:0C:12:79:EC:A2:5A:1E:94:57:76:FA"}}},"request":{"raw":"GET / HTTP/1.1\r\nHost: paradesktopinst.icu\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nUpgrade-Insecure-Requests: 1\r\nSec-Fetch-Dest: document\r\nSec-Fetch-Mode: navigate\r\nSec-Fetch-Site: none\r\nPriority: u=0, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 308 \r\ndate: Sun, 12 Jul 2026 23:40:28 GMT\r\ncontent-type: text/html\r\nlocation: https://www.paradesktopinst.icu/\r\ncache-control: public, max-age=0, must-revalidate\r\nrefresh: 0;url=https://www.paradesktopinst.icu/\r\nserver: cloudflare\r\nstrict-transport-security: max-age=63072000\r\nx-vercel-id: arn1::njf6w-1783899628727-ee46e6b82f8b\r\ncf-cache-status: DYNAMIC\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=njtQmt9HsEDVhXng06RPfItH9J0j%2BLJ7nQbopZjs%2BTnqWQWEKbqTtqocs5QtB8NOs%2BTMRZ2uaBmuLT7tGMaRDQMeI4PC3KWjLdw%2BCckeO1i7qC9oZ1GxMG8X48sUlBu620Ff3y8f\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncf-ray: a1a3e4a6efedb1b8-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"308","status_text":"","fingerprints":[{"name":"Vercel","description":"Vercel is a cloud platform for static frontends and serverless functions.","website":"https://vercel.com","common_platform_enumeration":"","icon":"vercel.svg","categories":["PaaS"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":0,"size_decoded":0,"mime_type":"text/html; charset=utf-8","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-07-16T19:40:23.978724Z","times_seen":17296388,"resource_available":true,"data":null}},"time_used":3321,"timings":{"blocked":-1,"dns":67,"connect":1,"send":0,"wait":116,"receive":0,"ssl":3136},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-07-12","alert":"Sinkholed","trigger":"paradesktopinst.icu","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-07-12","alert":"Sinkholed","trigger":"paradesktopinst.icu","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-07-12","alert":"Sinkholed","trigger":"paradesktopinst.icu","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"www.paradesktopinst.icu/manus-storage/paradigm-hero-bg_a406690a.png","fqdn":"www.paradesktopinst.icu","domain":"paradesktopinst.icu","tld":"icu"},"ip":{"addr":"104.21.5.50","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://www.paradesktopinst.icu/","date":"2026-07-12T23:40:29.412Z","timestamp":1783899629412,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"paradesktopinst.icu","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Thu, 09 Jul 2026 00:32:57 GMT","end":"Wed, 07 Oct 2026 01:31:28 GMT"},"fingerprint":{"sha1":"2E:B0:BD:F6:58:6C:E2:F3:86:CE:E5:3C:08:7B:E5:18:70:63:49:26","sha256":"F9:CE:95:7D:F6:85:25:A4:C1:4B:78:2F:78:F6:3B:3E:67:33:57:44:CA:0C:12:79:EC:A2:5A:1E:94:57:76:FA"}}},"request":{"raw":"GET /manus-storage/paradigm-hero-bg_a406690a.png HTTP/1.1\r\nHost: www.paradesktopinst.icu\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://www.paradesktopinst.icu/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=4, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 404 \r\ncache-control: public, max-age=14400, must-revalidate\r\ncontent-type: text/plain; charset=utf-8\r\ndate: Sun, 12 Jul 2026 23:40:29 GMT\r\nserver: cloudflare\r\nstrict-transport-security: max-age=63072000\r\nx-vercel-error: NOT_FOUND\r\nx-vercel-id: arn1::vd4vj-1783899629471-26365794fab6\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncf-cache-status: EXPIRED\r\npriority: u=4,i\r\ncontent-encoding: zstd\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=J79KE0FnGaFjvYo77kKPAFulMo8JorWEQIZXzwTI5PJtJwXJBBSdtBZrl0EPzc9%2By%2BFoYCaQJlQOoXoxhwILY4M5JURUhahoNLF5DBGfKfZ7jgmzpjnYLILcWr36atwWtn5ZiAKFAfPaMg%3D%3D\"}]}\r\ncf-ray: a1a3e4abd88db51d-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"404","status_text":"","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"Vercel","description":"Vercel is a cloud platform for static frontends and serverless functions.","website":"https://vercel.com","common_platform_enumeration":"","icon":"vercel.svg","categories":["PaaS"]}],"data":{"size":79,"size_decoded":868,"mime_type":"text/plain; charset=utf-8","magic":"ASCII text","md5":"829bc746d88b4c778d227b01f0480e0b","sha1":"9f57e8c86581cc50908dbe57ec091177fe74c655","sha256":"19dfd2e3e684c5ffa91c8fb07825787884fab3020e0dbe3cde3b7c6f74b690d6","sha512":"67471bd1755ff303e25c71cd29f06b868d561593937de444c43bbf31f3e94e39094f8f19d03d379388ad2da4e50df5feb8a907569af79e137a6515875f8d2ec8","ssdeep":"","tlshash":"a4a0113f8a800c0e328c0a0022022a3808282222aea0aa0000ee2a80220208ea3800b8","first_seen":"2026-07-12T23:41:01.147266Z","last_seen":"2026-07-12T23:41:01.147266Z","times_seen":1,"resource_available":false,"data":null}},"time_used":81,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":81,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-07-12","alert":"Sinkholed","trigger":"www.paradesktopinst.icu","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-07-12","alert":"Sinkholed","trigger":"www.paradesktopinst.icu","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-07-12","alert":"Sinkholed","trigger":"www.paradesktopinst.icu","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"www.paradesktopinst.icu/favicon.ico","fqdn":"www.paradesktopinst.icu","domain":"paradesktopinst.icu","tld":"icu"},"ip":{"addr":"104.21.5.50","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://www.paradesktopinst.icu/","date":"2026-07-12T23:40:29.544Z","timestamp":1783899629544,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"paradesktopinst.icu","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Thu, 09 Jul 2026 00:32:57 GMT","end":"Wed, 07 Oct 2026 01:31:28 GMT"},"fingerprint":{"sha1":"2E:B0:BD:F6:58:6C:E2:F3:86:CE:E5:3C:08:7B:E5:18:70:63:49:26","sha256":"F9:CE:95:7D:F6:85:25:A4:C1:4B:78:2F:78:F6:3B:3E:67:33:57:44:CA:0C:12:79:EC:A2:5A:1E:94:57:76:FA"}}},"request":{"raw":"GET /favicon.ico HTTP/1.1\r\nHost: www.paradesktopinst.icu\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://www.paradesktopinst.icu/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=6\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 404 \r\ncache-control: public, max-age=14400, must-revalidate\r\ncontent-type: text/plain; charset=utf-8\r\ndate: Sun, 12 Jul 2026 23:40:29 GMT\r\nserver: cloudflare\r\nstrict-transport-security: max-age=63072000\r\nx-vercel-error: NOT_FOUND\r\nx-vercel-id: arn1::swt5d-1783899629600-f1150aac18d4\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncf-cache-status: EXPIRED\r\npriority: u=6,i=?0\r\ncontent-encoding: zstd\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=%2FZjTE1xOvLhQ79PyusiDzHQLtdhwlTWZu3R8l7aX2q48lONWSmjmSpfVzE1U9WC%2BiAOGN6Uv6ztQdaewk5BwdkKeldzXcW6x1WyG%2BByYFlkUbJLpsMiJtHCicCA2%2FwsnW3%2BG%2FPWk9YoIhg%3D%3D\"}]}\r\ncf-ray: a1a3e4aca89eb51d-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"404","status_text":"","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Vercel","description":"Vercel is a cloud platform for static frontends and serverless functions.","website":"https://vercel.com","common_platform_enumeration":"","icon":"vercel.svg","categories":["PaaS"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":79,"size_decoded":879,"mime_type":"text/plain; charset=utf-8","magic":"ASCII text","md5":"4476852d64f949c67b86edef0f39b149","sha1":"c90d6bc9000fb7f88d9e50823e1672cfa8ded611","sha256":"63d19916b56b41f94a218d1d742d884fafe5a3d0e57165689961fd059e2de8da","sha512":"cc3816d14750284911bfbf8c285a7554277c05f170e253df928aa3d7c2f85538b3e210261346eca9a927c6032cc1cfb77e21b500a8e21afcd86057f4515a4d05","ssdeep":"","tlshash":"1ba0112e0b802e0a33c200202a8202be08080022aa20e22088eaea00a2000cfa38c88a","first_seen":"2026-07-12T23:41:01.148227Z","last_seen":"2026-07-12T23:41:01.148227Z","times_seen":1,"resource_available":false,"data":null}},"time_used":69,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":69,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-07-12","alert":"Sinkholed","trigger":"www.paradesktopinst.icu","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-07-12","alert":"Sinkholed","trigger":"www.paradesktopinst.icu","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-07-12","alert":"Sinkholed","trigger":"www.paradesktopinst.icu","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"www.paradesktopinst.icu/","fqdn":"www.paradesktopinst.icu","domain":"paradesktopinst.icu","tld":"icu"},"ip":{"addr":"104.21.5.50","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":true,"resource_type":"document","requested_by":"","date":"2026-07-12T23:40:28.752Z","timestamp":1783899628752,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"paradesktopinst.icu","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Thu, 09 Jul 2026 00:32:57 GMT","end":"Wed, 07 Oct 2026 01:31:28 GMT"},"fingerprint":{"sha1":"2E:B0:BD:F6:58:6C:E2:F3:86:CE:E5:3C:08:7B:E5:18:70:63:49:26","sha256":"F9:CE:95:7D:F6:85:25:A4:C1:4B:78:2F:78:F6:3B:3E:67:33:57:44:CA:0C:12:79:EC:A2:5A:1E:94:57:76:FA"}}},"request":{"raw":"GET / HTTP/1.1\r\nHost: www.paradesktopinst.icu\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nUpgrade-Insecure-Requests: 1\r\nSec-Fetch-Dest: document\r\nSec-Fetch-Mode: navigate\r\nSec-Fetch-Site: none\r\nPriority: u=0, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\ndate: Sun, 12 Jul 2026 23:40:28 GMT\r\ncontent-type: text/html; charset=utf-8\r\naccess-control-allow-origin: *\r\nage: 249403\r\ncache-control: public, max-age=0, must-revalidate\r\ncontent-disposition: inline\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=nP0SEz38kd2tWTK4kHq%2FbMXOFMn03Jrm9982Jb5dBPBaDTIsjtCHTO8Nz3e43e%2FGMK3s4nSRhR1g%2BSjjRr%2BNAJCLANr7uHirMrhlzw6PXWSYPQEooXB640PQqu1tvZsEIJfpowV2x7pYxw%3D%3D\"}]}\r\nlast-modified: Fri, 10 Jul 2026 02:23:45 GMT\r\nserver: cloudflare\r\nstrict-transport-security: max-age=63072000\r\nx-vercel-cache: HIT\r\nx-vercel-id: arn1::tj9p4-1783899628847-105ceeb8cbe4\r\ncf-cache-status: DYNAMIC\r\nvary: accept-encoding\r\ncontent-encoding: zstd\r\ncf-ray: a1a3e4a7b90db1b8-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Vercel","description":"Vercel is a cloud platform for static frontends and serverless functions.","website":"https://vercel.com","common_platform_enumeration":"","icon":"vercel.svg","categories":["PaaS"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":6338376,"size_decoded":1978533,"mime_type":"text/html; charset=utf-8","magic":"HTML document, ASCII text, with very long lines (31272)","md5":"89e2ea4deecbcce2dd7f905a28e66c0b","sha1":"e9805850f903877960cb9076dcd87bb842304a67","sha256":"023da009f9cfb1306941d397b085b6291c6e831564f9c1b4d0cea20cdf252500","sha512":"c0e0ccbfa1e6530e4829c20ce1dda4e472e6a2d630cf0d1f5c24aca807bbc9dbe87a4d7fe7eed596e525803464fb1e7559301d454457caecbe6db97fd664d695","ssdeep":"24576:loTU9OfqUTR9PfzkT29kfE4TT9dfWV8EeW5Ae:lhEfqo9fznufE2vfWV8Ese","tlshash":"302523b21db6406e24f948beb261391ddd641b038dc5d8e5397d3ac13fa8f089d26cad","first_seen":"2026-07-12T20:51:39.454785Z","last_seen":"2026-07-12T23:41:01.149279Z","times_seen":2,"resource_available":true,"data":null}},"time_used":127,"timings":{"blocked":7,"dns":7,"connect":0,"send":0,"wait":113,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-07-12","alert":"Sinkholed","trigger":"www.paradesktopinst.icu","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-07-12","alert":"Sinkholed","trigger":"www.paradesktopinst.icu","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-07-12","alert":"Sinkholed","trigger":"www.paradesktopinst.icu","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}}]}