{"report_id":"bfa74f86-fd8a-42ed-a2dc-92ebdbe0e2a9","version":6,"status":"done","tags":[],"date":"2026-04-23T17:34:35Z","url":{"schema":"http","addr":"savanigems.com/NDMwZjdXOXoxazd3Nkc=","fqdn":"savanigems.com","domain":"savanigems.com","tld":"com"},"ip":{"addr":"149.255.62.150","port":0,"asn":34931,"as":"Awareness Software Limited","country":"United Kingdom","country_code":"GB"},"final":{"url":{"schema":"https","addr":"savanigems.com/NDMwZjdXOXoxazd3Nkc=","fqdn":"savanigems.com","domain":"savanigems.com","tld":"com"},"title":"savanigems.com/NDMwZjdXOXoxazd3Nkc=","dom":{"size":1534,"mime_type":"text/html; charset=utf-8","magic":"HTML document, Unicode text, UTF-8 text, with very long lines (1049)","md5":"c4b393485aedee485db52aa2cdc5011b","sha1":"ee5ae3d1a1ff9c38384d7e04d446f1408846d636","sha256":"763db274e2e3733f1648bac973fd25aae09318744971fdf916860acf9800b3b2","sha512":"f1eaa9dcc6aafb12a7bb335e4e8ee135f1b157d54cd3751d442ac671df5509e09e5aab9d20e98a3bcc6eb1526a0f366ed9122bf5190bfa1d0b8e92a888400fb6","ssdeep":"","tlshash":"1631dc185853d62702238084d8f1ae04b0bbfb8fd31dbc5139a942aa1fd7ca9a9574fc","dom_hash":"domhash6b352e6346382d03d086b940f2324963","first_seen":"2026-04-23T17:34:36.782445Z","last_seen":"2026-04-23T17:34:36.782445Z","times_seen":1,"resource_available":false,"data":null}},"submit":{"url":{"schema":"http","addr":"savanigems.com/NDMwZjdXOXoxazd3Nkc=","fqdn":"savanigems.com","domain":"savanigems.com","tld":"com"},"ip":{"addr":"149.255.62.150","port":0,"asn":34931,"as":"Awareness Software Limited","country":"United Kingdom","country_code":"GB"},"tags":null,"meta":null},"settings":{"access":"public","device_type":"desktop","expires_at":"2027-05-28T17:34:35Z","useragent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0","referer":"","cookies":null,"exit_node":"z0yflva4pidy47h"},"stats":{"alert_count":{"ids":0,"urlquery":0,"analyzer":1}},"detection":{"ids":null,"analyzer":[{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-04-23","alert":"Sinkholed","trigger":"savanigems.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null}],"urlquery":null},"summary":[{"fqdn":"imagizer.imageshack.com","ip":{"addr":"38.99.77.17","port":443,"asn":36323,"as":"EZRI-36323","country":"United States","country_code":"US"},"domain_registered":"2002-08-11","domain_rank":255795,"first_seen":"2014-07-18T10:03:47Z","last_seen":"2026-04-17T05:47:40.797211Z","alert_count":0,"request_count":1,"received_data":24375,"sent_data":454,"comment":"","tags":null,"fingerprints":[{"name":"Nginx:1.2.8","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"Varnish","description":"Varnish is a reverse caching proxy.","website":"https://www.varnish-cache.org","common_platform_enumeration":"cpe:2.3:a:varnish-software:varnish_cache:*:*:*:*:*:*:*:*","icon":"Varnish.svg","categories":["Caching"]}]},{"fqdn":"savanigems.com","ip":{"addr":"149.255.62.150","port":443,"asn":34931,"as":"Awareness Software Limited","country":"United Kingdom","country_code":"GB"},"domain_registered":"2009-04-15","domain_rank":0,"first_seen":"2026-04-06T00:04:53.357147Z","last_seen":"2026-04-20T09:51:10.957034Z","alert_count":6,"request_count":6,"received_data":960078,"sent_data":2968,"comment":"","tags":null,"fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}]}],"files":null,"artifacts":{"windows_shortcuts":null,"files":null,"telegram":null,"pdfs":null,"clipboard":null},"sensors":{"ids":null,"analyzer":null,"urlquery":null},"javascript":{"script":[{"url":{"schema":"https","addr":"savanigems.com/reactive/assets/index-Bk54cYFI.js","fqdn":"savanigems.com","domain":"savanigems.com","tld":"com"},"ip":{"addr":"149.255.62.150","port":443,"asn":34931,"as":"Awareness Software Limited","country":"United Kingdom","country_code":"GB"},"introduction_type":"scriptElement","is_inline":false,"md5":"28b9f22bf08e2da2b07c65a88b0ab198","sha1":"c36e0323b552c766fe635cb25b567fc5320b0f23","sha256":"5ab685b6230b78f995e0ad729d47e52c637556b735aa355c7ad97c192ee4bc58","sha512":"61633577d3d0f9c14832b39cf66dc608bf66e0c479cdd241410aa799cc1a49d379cd6041284e6e279c611f463c4f322d5dcf5548244fce850f6330b01f5949b4","ssdeep":"3072:vPSBnUJUQwm95cHYJGzZuLEa1JqLBVFcelBc:vqBp9mJJut2JyBVyB","tlshash":"06c32ae93182b47213ea09e6507a0402f33d2d59380d94d8f1acedeb3d6785591bafbd","size":124019,"data":"","first_seen":"2026-03-14T22:26:10.318789Z","last_seen":"2026-04-23T17:34:36.788562Z","times_seen":12,"alerts":{"ids":null,"analyzer":null,"urlquery":null}}],"eval":null,"write":null,"console":null},"http":[{"url":{"schema":"https","addr":"imagizer.imageshack.com/img924/9864/8kBRmQ.png","fqdn":"imagizer.imageshack.com","domain":"imageshack.com","tld":"com"},"ip":{"addr":"38.99.77.17","port":443,"asn":36323,"as":"EZRI-36323","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://savanigems.com/reactive/430f7W9z1k7w6G","date":"2026-04-23T17:34:10.635Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256","key_group_name":"P256","signature_name":"RSA-PKCS1-SHA256","protocol":"TLSv1.2","cert":{"subject":{"commonName":"*.imageshack.com","organization":""},"issuer":{"commonName":"Go Daddy Secure Certificate Authority - G2","organization":"GoDaddy.com, Inc."},"validity":{"start":"Wed, 04 Feb 2026 17:17:07 GMT","end":"Mon, 08 Mar 2027 17:17:07 GMT"},"fingerprint":{"sha1":"EC:5F:D1:8C:1B:03:A7:34:77:97:00:E7:58:54:3E:E8:74:C9:17:22","sha256":"A1:CE:2E:26:5E:FD:5F:25:FC:97:DE:52:40:68:E8:17:81:63:6D:5A:DA:7C:B7:64:B5:F4:88:1E:2B:04:24:A9"}}},"request":{"raw":"GET /img924/9864/8kBRmQ.png HTTP/1.1\r\nHost: imagizer.imageshack.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://savanigems.com/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nServer: nginx/1.2.8\r\nDate: Thu, 23 Apr 2026 17:34:12 GMT\r\nContent-Type: image/webp\r\nContent-Length: 23330\r\nConnection: keep-alive\r\nX-Original-Response-Code: 200\r\nX-Original-Filesize: 42866\r\nX-Origin-Fetch-Time: 76\r\nX-Original-Resolution: 1280x1280\r\nX-Imagizer-Host: imageshack.imagizer.com\r\nxkey: imageshack.imagizer.com\r\nETag: c4ca4238a0b923820dcc509a6f75849b\r\nX-Ops: {\"quality\":60}\r\nX-Cache-Hits: 0\r\nAccept-Ranges: bytes\r\nX-Varnish: 985579472\r\nAge: 0\r\nVia: 1.1 varnish\r\nX-Varnish-Hits: 0\r\nX-Varnish-IP: 38.99.77.38\r\nX-Varnish-Port: 17001\r\nAccess-Control-Allow-Methods: GET, HEAD, OPTIONS\r\nAccess-Control-Allow-Origin: *\r\nAccess-Control-Allow-Headers: Authorization,Content-Type,Accept,Origin,User-Agent,DNT,Cache-Control,X-Mx-ReqToken,Keep-Alive,X-Requested-With,If-Modified-Since\r\nAccess-Control-Expose-Headers: Authorization,Content-Type,Accept,Origin,User-Agent,DNT,Cache-Control,X-Mx-ReqToken,Keep-Alive,X-Requested-With,If-Modified-Since\r\nExpires: Sat, 23 May 2026 17:34:12 GMT\r\nCache-Control: max-age=2592000, public\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx:1.2.8","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"Varnish","description":"Varnish is a reverse caching proxy.","website":"https://www.varnish-cache.org","common_platform_enumeration":"cpe:2.3:a:varnish-software:varnish_cache:*:*:*:*:*:*:*:*","icon":"Varnish.svg","categories":["Caching"]}],"data":{"size":23330,"size_decoded":0,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image","md5":"2d17d70d1afd6b77cd09f4c480c727f3","sha1":"86368b63e17511d489a402321ffeebb2694ee555","sha256":"f4fc09980873d5682b31c397be09f4a1f6f2a2c21e5a840aafc1fdb505f59148","sha512":"4e8b36b3f12cafc04f86ddef6b3bdd4bc90b4a82ee44a5d0c17e28b370a2a95b6d3e0b137366731cc28629aada57eb7bb5b48f94789a2e53b695078a38e93a20","ssdeep":"384:bWyqXxDakozJpn4fBSCJ3MkXvMHEbcNsOYKPz2W+5945zl2Wh7fu1N0EUArylb2X:PqXBrozYBDd/2XZXMgX7faN9UAe2YNkd","tlshash":"c1a2c08ec93e9ef418cc94314af3395b719ad02846039c6dee6a6f5684e7a0349d5122","first_seen":"2026-04-23T17:34:36.78356Z","last_seen":"2026-04-23T17:34:36.78356Z","times_seen":1,"resource_available":false,"data":null}},"time_used":2522,"timings":{"blocked":865,"dns":197,"connect":165,"send":0,"wait":790,"receive":1,"ssl":502},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"savanigems.com/NDMwZjdXOXoxazd3Nkc=","fqdn":"savanigems.com","domain":"savanigems.com","tld":"com"},"ip":{"addr":"149.255.62.150","port":443,"asn":34931,"as":"Awareness Software Limited","country":"United Kingdom","country_code":"GB"},"is_navigation_request":true,"resource_type":"document","requested_by":"","date":"2026-04-23T17:34:09.405Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"savanigems.com","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Fri, 10 Apr 2026 09:34:18 GMT","end":"Thu, 09 Jul 2026 09:34:17 GMT"},"fingerprint":{"sha1":"F3:35:73:D1:48:57:B2:C5:0D:90:F2:A1:D0:A9:71:27:28:0D:A4:82","sha256":"A1:A4:DE:53:94:4B:3B:90:50:50:96:D0:46:1E:EA:57:79:C3:54:3D:60:EA:2A:1C:CD:3D:04:2E:78:E8:00:93"}}},"request":{"raw":"GET /NDMwZjdXOXoxazd3Nkc= HTTP/1.1\r\nHost: savanigems.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nUpgrade-Insecure-Requests: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: document\r\nSec-Fetch-Mode: navigate\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Thu, 23 Apr 2026 17:34:08 GMT\r\ncontent-type: text/html; charset=UTF-8\r\nvary: Accept-Encoding, Accept-Encoding\r\ncontent-encoding: br\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":313,"size_decoded":0,"mime_type":"text/html; charset=UTF-8","magic":"HTML document, ASCII text, with CRLF line terminators","md5":"3b8f98478444fa4520149921c15b0235","sha1":"5b6f7a47cc92761d62a99cffef132c5f8c5fb3b0","sha256":"cbaddebef8d0d9066e8d5e6367ef298a35df591bfcb66bb808b11cb3a8f71d5a","sha512":"926a2b07ccbae2013ebc8fc75486734f0e6bb2347e0e316c8484a16c0471a07b600cfceacecfa89ededf0d43cf09d846ee6c96f91d5703504ecf5b98e9e340eb","ssdeep":"","tlshash":"35e0c2bfa9096c6d52b5653278d029094b5a2cc6b3091902f89161bb18d3b458ddb36d","first_seen":"2026-04-23T17:34:36.784855Z","last_seen":"2026-04-23T17:34:36.784855Z","times_seen":1,"resource_available":false,"data":null}},"time_used":294,"timings":{"blocked":122,"dns":48,"connect":33,"send":0,"wait":50,"receive":0,"ssl":37},"alerts":{"ids":null,"analyzer":[{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-04-23","alert":"Sinkholed","trigger":"savanigems.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"savanigems.com/favicon.ico","fqdn":"savanigems.com","domain":"savanigems.com","tld":"com"},"ip":{"addr":"149.255.62.150","port":443,"asn":34931,"as":"Awareness Software Limited","country":"United Kingdom","country_code":"GB"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://savanigems.com/NDMwZjdXOXoxazd3Nkc=","date":"2026-04-23T17:34:09.735Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"savanigems.com","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Fri, 10 Apr 2026 09:34:18 GMT","end":"Thu, 09 Jul 2026 09:34:17 GMT"},"fingerprint":{"sha1":"F3:35:73:D1:48:57:B2:C5:0D:90:F2:A1:D0:A9:71:27:28:0D:A4:82","sha256":"A1:A4:DE:53:94:4B:3B:90:50:50:96:D0:46:1E:EA:57:79:C3:54:3D:60:EA:2A:1C:CD:3D:04:2E:78:E8:00:93"}}},"request":{"raw":"GET /favicon.ico HTTP/1.1\r\nHost: savanigems.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://savanigems.com/NDMwZjdXOXoxazd3Nkc=\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Thu, 23 Apr 2026 17:34:08 GMT\r\ncontent-type: text/html\r\nlast-modified: Fri, 13 Mar 2026 15:07:08 GMT\r\nvary: Accept-Encoding, Accept-Encoding\r\ncontent-encoding: br\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":495,"size_decoded":0,"mime_type":"text/html","magic":"HTML document, ASCII text, with CRLF, CR, LF line terminators","md5":"6b90ef4a3c339f3643bf7ca4a161da18","sha1":"d0a4f5e65cd7b32362406bf88bee0429b1472502","sha256":"eb1045e26cb48054717018d794c8307d36d0d2cd9f392ac5fdfd0c5269eee664","sha512":"a8fa60fef0cabf852d19a5b92d4c2cedf57ce7b8f6d4529fa1ee9f9f1cb33062e10d7af6c62bf41b6557a9a13df02b52b4e39b4ccd8b9a243768a2ace5e7368d","ssdeep":"","tlshash":"7af0974180d09c1603304624aec3e549d95be3ca43086e4232eaa07b2fa2b8acedf4a5","first_seen":"2026-03-14T22:26:10.313123Z","last_seen":"2026-04-23T17:34:36.786078Z","times_seen":11,"resource_available":false,"data":null}},"time_used":37,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":37,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-04-23","alert":"Sinkholed","trigger":"savanigems.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"savanigems.com/reactive/430f7W9z1k7w6G","fqdn":"savanigems.com","domain":"savanigems.com","tld":"com"},"ip":{"addr":"149.255.62.150","port":443,"asn":34931,"as":"Awareness Software Limited","country":"United Kingdom","country_code":"GB"},"is_navigation_request":false,"resource_type":"subdocument","requested_by":"https://savanigems.com/NDMwZjdXOXoxazd3Nkc=","date":"2026-04-23T17:34:09.730Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"savanigems.com","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Fri, 10 Apr 2026 09:34:18 GMT","end":"Thu, 09 Jul 2026 09:34:17 GMT"},"fingerprint":{"sha1":"F3:35:73:D1:48:57:B2:C5:0D:90:F2:A1:D0:A9:71:27:28:0D:A4:82","sha256":"A1:A4:DE:53:94:4B:3B:90:50:50:96:D0:46:1E:EA:57:79:C3:54:3D:60:EA:2A:1C:CD:3D:04:2E:78:E8:00:93"}}},"request":{"raw":"GET /reactive/430f7W9z1k7w6G HTTP/1.1\r\nHost: savanigems.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://savanigems.com/NDMwZjdXOXoxazd3Nkc=\r\nUpgrade-Insecure-Requests: 1\r\nSec-Fetch-Dest: frame\r\nSec-Fetch-Mode: navigate\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Thu, 23 Apr 2026 17:34:08 GMT\r\ncontent-type: text/html\r\nlast-modified: Fri, 13 Mar 2026 15:07:08 GMT\r\nvary: Accept-Encoding, Accept-Encoding\r\ncontent-encoding: br\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":495,"size_decoded":0,"mime_type":"text/html","magic":"HTML document, ASCII text, with CRLF, CR, LF line terminators","md5":"6b90ef4a3c339f3643bf7ca4a161da18","sha1":"d0a4f5e65cd7b32362406bf88bee0429b1472502","sha256":"eb1045e26cb48054717018d794c8307d36d0d2cd9f392ac5fdfd0c5269eee664","sha512":"a8fa60fef0cabf852d19a5b92d4c2cedf57ce7b8f6d4529fa1ee9f9f1cb33062e10d7af6c62bf41b6557a9a13df02b52b4e39b4ccd8b9a243768a2ace5e7368d","ssdeep":"","tlshash":"7af0974180d09c1603304624aec3e549d95be3ca43086e4232eaa07b2fa2b8acedf4a5","first_seen":"2026-03-14T22:26:10.313123Z","last_seen":"2026-04-23T17:34:36.786078Z","times_seen":11,"resource_available":false,"data":null}},"time_used":38,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":38,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-04-23","alert":"Sinkholed","trigger":"savanigems.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"savanigems.com/reactive/assets/index-Y3KJSJff.css","fqdn":"savanigems.com","domain":"savanigems.com","tld":"com"},"ip":{"addr":"149.255.62.150","port":443,"asn":34931,"as":"Awareness Software Limited","country":"United Kingdom","country_code":"GB"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://savanigems.com/reactive/430f7W9z1k7w6G","date":"2026-04-23T17:34:09.787Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"savanigems.com","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Fri, 10 Apr 2026 09:34:18 GMT","end":"Thu, 09 Jul 2026 09:34:17 GMT"},"fingerprint":{"sha1":"F3:35:73:D1:48:57:B2:C5:0D:90:F2:A1:D0:A9:71:27:28:0D:A4:82","sha256":"A1:A4:DE:53:94:4B:3B:90:50:50:96:D0:46:1E:EA:57:79:C3:54:3D:60:EA:2A:1C:CD:3D:04:2E:78:E8:00:93"}}},"request":{"raw":"GET /reactive/assets/index-Y3KJSJff.css HTTP/1.1\r\nHost: savanigems.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://savanigems.com/reactive/430f7W9z1k7w6G\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Thu, 23 Apr 2026 17:34:08 GMT\r\ncontent-type: text/css\r\nlast-modified: Fri, 13 Mar 2026 15:07:08 GMT\r\nvary: Accept-Encoding, Accept-Encoding\r\ncontent-encoding: br\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":833021,"size_decoded":0,"mime_type":"text/css","magic":"ASCII text, with very long lines (65536), with no line terminators","md5":"ab28f49a4db7bb2381ca33b58bf28589","sha1":"8c17d2c08af3882b0d200a2b4969dba6a99b705b","sha256":"e12211a73fc2579e739e4406805c4f3167787fc970d75ac0dd54bbfba1bbe815","sha512":"0e3fd3c7b780b715b2775e2cb35c5bfbb41a1678e097d0ab81a9c84bba5d8cf51c5bab787dc31bbd32eaed1540ee569a66db28f3898ef137e53255217b41de0e","ssdeep":"6144:eM2+596hM2+596SM2+596IR8BC1uccGsCyBmFk6iT2vy9kKa3sQSiZ0WprLrM:eM2+596hM2+596SM2+596IR8WSKZprLY","tlshash":"0005fb94d811b8792d1237ac430c97edaa393050be4ab731b1c9d2e096c77f756eb62c","first_seen":"2026-03-14T22:26:10.316326Z","last_seen":"2026-04-23T17:34:36.787369Z","times_seen":12,"resource_available":false,"data":null}},"time_used":82,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":82,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-04-23","alert":"Sinkholed","trigger":"savanigems.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"savanigems.com/reactive/assets/index-Bk54cYFI.js","fqdn":"savanigems.com","domain":"savanigems.com","tld":"com"},"ip":{"addr":"149.255.62.150","port":443,"asn":34931,"as":"Awareness Software Limited","country":"United Kingdom","country_code":"GB"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://savanigems.com/reactive/430f7W9z1k7w6G","date":"2026-04-23T17:34:09.785Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"savanigems.com","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Fri, 10 Apr 2026 09:34:18 GMT","end":"Thu, 09 Jul 2026 09:34:17 GMT"},"fingerprint":{"sha1":"F3:35:73:D1:48:57:B2:C5:0D:90:F2:A1:D0:A9:71:27:28:0D:A4:82","sha256":"A1:A4:DE:53:94:4B:3B:90:50:50:96:D0:46:1E:EA:57:79:C3:54:3D:60:EA:2A:1C:CD:3D:04:2E:78:E8:00:93"}}},"request":{"raw":"GET /reactive/assets/index-Bk54cYFI.js HTTP/1.1\r\nHost: savanigems.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://savanigems.com/reactive/430f7W9z1k7w6G\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Thu, 23 Apr 2026 17:34:08 GMT\r\ncontent-type: text/javascript\r\nlast-modified: Fri, 13 Mar 2026 15:07:08 GMT\r\nvary: Accept-Encoding, Accept-Encoding\r\ncontent-encoding: br\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":124019,"size_decoded":0,"mime_type":"text/javascript","magic":"JavaScript source, ASCII text, with very long lines (65536), with no line terminators","md5":"28b9f22bf08e2da2b07c65a88b0ab198","sha1":"c36e0323b552c766fe635cb25b567fc5320b0f23","sha256":"5ab685b6230b78f995e0ad729d47e52c637556b735aa355c7ad97c192ee4bc58","sha512":"61633577d3d0f9c14832b39cf66dc608bf66e0c479cdd241410aa799cc1a49d379cd6041284e6e279c611f463c4f322d5dcf5548244fce850f6330b01f5949b4","ssdeep":"3072:vPSBnUJUQwm95cHYJGzZuLEa1JqLBVFcelBc:vqBp9mJJut2JyBVyB","tlshash":"06c32ae93182b47213ea09e6507a0402f33d2d59380d94d8f1acedeb3d6785591bafbd","first_seen":"2026-03-14T22:26:10.318789Z","last_seen":"2026-04-23T17:34:36.788562Z","times_seen":12,"resource_available":true,"data":null}},"time_used":83,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":83,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-04-23","alert":"Sinkholed","trigger":"savanigems.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"savanigems.com/reactive/agent.php","fqdn":"savanigems.com","domain":"savanigems.com","tld":"com"},"ip":{"addr":"149.255.62.150","port":443,"asn":34931,"as":"Awareness Software Limited","country":"United Kingdom","country_code":"GB"},"is_navigation_request":false,"resource_type":"fetch","requested_by":"https://savanigems.com/reactive/430f7W9z1k7w6G","date":"2026-04-23T17:34:10.066Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"savanigems.com","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Fri, 10 Apr 2026 09:34:18 GMT","end":"Thu, 09 Jul 2026 09:34:17 GMT"},"fingerprint":{"sha1":"F3:35:73:D1:48:57:B2:C5:0D:90:F2:A1:D0:A9:71:27:28:0D:A4:82","sha256":"A1:A4:DE:53:94:4B:3B:90:50:50:96:D0:46:1E:EA:57:79:C3:54:3D:60:EA:2A:1C:CD:3D:04:2E:78:E8:00:93"}}},"request":{"raw":"POST /reactive/agent.php HTTP/1.1\r\nHost: savanigems.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://savanigems.com/reactive/430f7W9z1k7w6G\r\nContent-Type: application/json\r\nContent-Length: 24\r\nOrigin: https://savanigems.com\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"POST","post_data":{"size":24,"data":"{\"upn\":\"430f7W9z1k7w6G\"}"}},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Thu, 23 Apr 2026 17:34:09 GMT\r\ncontent-type: application/json; charset=utf-8\r\nvary: Accept-Encoding, Accept-Encoding\r\ncontent-encoding: br\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":453,"size_decoded":0,"mime_type":"application/json; charset=utf-8","magic":"JSON text data","md5":"b2f9bbbf1351c30e7eb5ec905beb5e82","sha1":"1c0cc0a81818bfff07186328eea98aa018b2d569","sha256":"91bd815fb71bcd27f225d3b46418e3d29dcff590fb6655e8bae6118cf391fa77","sha512":"06f35c2af7a0dff011688a329b78468d035804cc4791a6ad475603c967da0ed3a3e981e45b2c23eeb824df9f27693f1ff236bf249f9e15e5fd890fecc35d585e","ssdeep":"","tlshash":"aaf012c17bba259e145ceb85953fded85c8a2cc288ab94b2476c53c08024104bf2d393","first_seen":"2026-04-23T17:34:36.789635Z","last_seen":"2026-04-23T17:34:36.789635Z","times_seen":1,"resource_available":false,"data":null}},"time_used":551,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":551,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-04-23","alert":"Sinkholed","trigger":"savanigems.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null}],"urlquery":null}}]}