{"report_id":"c328fdeb-7032-414b-9a69-afeb5fe2f035","version":6,"status":"done","tags":[],"date":"2025-10-25T17:28:44Z","url":{"schema":"http","addr":"testdomain1948.com/cdn-cgi/phish-bypass?atok=h3xdOjzJxlXa9OdpcQL5fL1c3QtkWdITfUsLMK6ym64-1761388574.7059875-0.0.1.1-/\u0026original_path=/\u0026cf-turnstile-response=","fqdn":"testdomain1948.com","domain":"testdomain1948.com","tld":"com"},"ip":{"addr":"172.67.171.5","port":0,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"final":{"url":{"schema":"http","addr":"testdomain1948.com/cdn-cgi/phish-bypass?atok=h3xdOjzJxlXa9OdpcQL5fL1c3QtkWdITfUsLMK6ym64-1761388574.7059875-0.0.1.1-/\u0026original_path=/\u0026cf-turnstile-response=","fqdn":"testdomain1948.com","domain":"testdomain1948.com","tld":"com"},"title":"testdomain1948.com/cdn-cgi/phish-bypass?atok=h3xdOjzJxlXa9OdpcQL5fL1c3QtkWdITfUsLMK6ym64-1761388574.7059875-0.0.1.1-/\u0026original_path=/\u0026cf-turnstile-response="},"submit":{"url":{"schema":"http","addr":"testdomain1948.com/cdn-cgi/phish-bypass?atok=h3xdOjzJxlXa9OdpcQL5fL1c3QtkWdITfUsLMK6ym64-1761388574.7059875-0.0.1.1-/\u0026original_path=/\u0026cf-turnstile-response=","fqdn":"testdomain1948.com","domain":"testdomain1948.com","tld":"com"},"ip":{"addr":"172.67.171.5","port":0,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"tags":null,"meta":null},"settings":{"access":"public","device_type":"desktop","expires_at":"2026-11-29T17:28:44Z","useragent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0","referer":"","cookies":null,"exit_node":"z0yflva4pidy47h"},"stats":{"alert_count":{"ids":0,"urlquery":0,"analyzer":3}},"detection":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2025-10-25","alert":"Sinkholed","trigger":"testdomain1948.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-10-25","alert":"Sinkholed","trigger":"testdomain1948.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2025-10-25","alert":"Phishing Block","trigger":"testdomain1948.com","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null}],"urlquery":null},"summary":[{"fqdn":"testdomain1948.com","ip":{"addr":"104.21.79.194","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"domain_registered":"unknown","domain_rank":0,"first_seen":"No data","last_seen":"No data","alert_count":69,"request_count":23,"received_data":16445,"sent_data":9742,"comment":"","tags":null,"fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}]}],"files":null,"artifacts":{"windows_shortcuts":null,"files":null,"telegram":null,"pdfs":null,"clipboard":null},"sensors":{"ids":[{"sensor_name":"suricata","description":"Suricata /w Emerging Threats Pro","alerts":null}],"analyzer":null,"urlquery":null},"javascript":{"script":null,"eval":null,"write":null,"console":null},"http":[{"url":{"schema":"https","addr":"testdomain1948.com/favicon.ico","fqdn":"testdomain1948.com","domain":"testdomain1948.com","tld":"com"},"ip":{"addr":"104.21.79.194","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"http://testdomain1948.com/cdn-cgi/phish-bypass?atok=h3xdOjzJxlXa9OdpcQL5fL1c3QtkWdITfUsLMK6ym64-1761388574.7059875-0.0.1.1-/\u0026original_path=/\u0026cf-turnstile-response=","date":"2025-10-25T17:28:22.863Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"testdomain1948.com","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Fri, 26 Sep 2025 06:16:30 GMT","end":"Thu, 25 Dec 2025 07:15:14 GMT"},"fingerprint":{"sha1":"E7:48:7F:3F:D1:33:9D:14:78:77:57:49:F4:7E:4C:F8:89:E0:C1:13","sha256":"CC:34:CC:6B:20:15:CF:DB:71:93:41:D7:54:AD:CE:B5:AA:C1:C0:29:BD:FF:49:5E:F0:78:DB:6B:52:D6:EA:83"}}},"request":{"raw":"GET /favicon.ico HTTP/1.1\r\nHost: testdomain1948.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 301 Moved Permanently\r\ndate: Sat, 25 Oct 2025 17:28:22 GMT\r\nserver: cloudflare\r\ncross-origin-resource-policy: cross-origin\r\nlocation: https://testdomain1948.com/favicon.ico\r\nvary: accept-encoding\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=rhrswsR0x3Zt56qSS2Bv%2BtMUXhzaDvkBsV1mJrz7DGWPVUwDOLIbhejSjEWnUOCV8cN7S4UqSsTfBC2XsCGo1mcs3urUKZq2OjfINjVFRnQzmQ%3D%3D\"}]}\r\ncontent-type: text/html; charset=iso-8859-1\r\nage: 0\r\ncache-control: max-age=14400\r\ncf-cache-status: HIT\r\npriority: u=6,i=?0\r\ncf-ray: 99436e16df0c723c-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"301","status_text":"Moved Permanently","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":0,"size_decoded":0,"mime_type":"text/html; charset=iso-8859-1","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-08-07T13:07:03.550089Z","times_seen":17761838,"resource_available":true,"data":null}},"time_used":7,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":7,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2025-10-25","alert":"Sinkholed","trigger":"testdomain1948.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-10-25","alert":"Sinkholed","trigger":"testdomain1948.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2025-10-25","alert":"Phishing Block","trigger":"testdomain1948.com","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"testdomain1948.com/favicon.ico","fqdn":"testdomain1948.com","domain":"testdomain1948.com","tld":"com"},"ip":{"addr":"104.21.79.194","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"http://testdomain1948.com/cdn-cgi/phish-bypass?atok=h3xdOjzJxlXa9OdpcQL5fL1c3QtkWdITfUsLMK6ym64-1761388574.7059875-0.0.1.1-/\u0026original_path=/\u0026cf-turnstile-response=","date":"2025-10-25T17:28:22.912Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"testdomain1948.com","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Fri, 26 Sep 2025 06:16:30 GMT","end":"Thu, 25 Dec 2025 07:15:14 GMT"},"fingerprint":{"sha1":"E7:48:7F:3F:D1:33:9D:14:78:77:57:49:F4:7E:4C:F8:89:E0:C1:13","sha256":"CC:34:CC:6B:20:15:CF:DB:71:93:41:D7:54:AD:CE:B5:AA:C1:C0:29:BD:FF:49:5E:F0:78:DB:6B:52:D6:EA:83"}}},"request":{"raw":"GET /favicon.ico HTTP/1.1\r\nHost: testdomain1948.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 301 Moved Permanently\r\ndate: Sat, 25 Oct 2025 17:28:22 GMT\r\nserver: cloudflare\r\ncross-origin-resource-policy: cross-origin\r\nlocation: https://testdomain1948.com/favicon.ico\r\nvary: accept-encoding\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=3Oe99GV5FnpqYUsVmD7B23O0LV9nnKqr30cgnqe9stsjTLBf2pTHXODatyOqOfFzDLMDXIorO%2FMq7hHrwjW7SGLM70Wr3ayLvbna2e3cQOEJdw%3D%3D\"}]}\r\ncontent-type: text/html; charset=iso-8859-1\r\nage: 0\r\ncache-control: max-age=14400\r\ncf-cache-status: HIT\r\npriority: u=6,i=?0\r\ncf-ray: 99436e172f15723c-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"301","status_text":"Moved Permanently","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":0,"size_decoded":0,"mime_type":"text/html; charset=iso-8859-1","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-08-07T13:07:03.550089Z","times_seen":17761838,"resource_available":true,"data":null}},"time_used":9,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":9,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2025-10-25","alert":"Sinkholed","trigger":"testdomain1948.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2025-10-25","alert":"Phishing Block","trigger":"testdomain1948.com","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-10-25","alert":"Sinkholed","trigger":"testdomain1948.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"testdomain1948.com/favicon.ico","fqdn":"testdomain1948.com","domain":"testdomain1948.com","tld":"com"},"ip":{"addr":"104.21.79.194","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"http://testdomain1948.com/cdn-cgi/phish-bypass?atok=h3xdOjzJxlXa9OdpcQL5fL1c3QtkWdITfUsLMK6ym64-1761388574.7059875-0.0.1.1-/\u0026original_path=/\u0026cf-turnstile-response=","date":"2025-10-25T17:28:22.934Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"testdomain1948.com","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Fri, 26 Sep 2025 06:16:30 GMT","end":"Thu, 25 Dec 2025 07:15:14 GMT"},"fingerprint":{"sha1":"E7:48:7F:3F:D1:33:9D:14:78:77:57:49:F4:7E:4C:F8:89:E0:C1:13","sha256":"CC:34:CC:6B:20:15:CF:DB:71:93:41:D7:54:AD:CE:B5:AA:C1:C0:29:BD:FF:49:5E:F0:78:DB:6B:52:D6:EA:83"}}},"request":{"raw":"GET /favicon.ico HTTP/1.1\r\nHost: testdomain1948.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 301 Moved Permanently\r\ndate: Sat, 25 Oct 2025 17:28:22 GMT\r\nserver: cloudflare\r\ncross-origin-resource-policy: cross-origin\r\nlocation: https://testdomain1948.com/favicon.ico\r\nvary: accept-encoding\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=AL%2F3mHZYere5QhTWIjRgOV9TbSjin%2BoX%2FL2Gm5sjPSW0odMfdU%2BxloLL%2Bzb1bzz1dYoPJ%2B7NQSQRVKBFPD2fsU7qHtlLyyenZOuhDzL2elnMvA%3D%3D\"}]}\r\ncontent-type: text/html; charset=iso-8859-1\r\nage: 0\r\ncache-control: max-age=14400\r\ncf-cache-status: HIT\r\npriority: u=6,i=?0\r\ncf-ray: 99436e175f18723c-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"301","status_text":"Moved Permanently","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":0,"size_decoded":0,"mime_type":"text/html; charset=iso-8859-1","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-08-07T13:07:03.550089Z","times_seen":17761838,"resource_available":true,"data":null}},"time_used":7,"timings":{"blocked":2,"dns":0,"connect":0,"send":0,"wait":5,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2025-10-25","alert":"Phishing Block","trigger":"testdomain1948.com","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2025-10-25","alert":"Sinkholed","trigger":"testdomain1948.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-10-25","alert":"Sinkholed","trigger":"testdomain1948.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"testdomain1948.com/cdn-cgi/phish-bypass?atok=h3xdOjzJxlXa9OdpcQL5fL1c3QtkWdITfUsLMK6ym64-1761388574.7059875-0.0.1.1-/\u0026original_path=/\u0026cf-turnstile-response=","fqdn":"testdomain1948.com","domain":"testdomain1948.com","tld":"com"},"ip":{"addr":"104.21.79.194","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":true,"resource_type":"document","requested_by":"","date":"2025-10-25T17:28:22.092Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"testdomain1948.com","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Fri, 26 Sep 2025 06:16:30 GMT","end":"Thu, 25 Dec 2025 07:15:14 GMT"},"fingerprint":{"sha1":"E7:48:7F:3F:D1:33:9D:14:78:77:57:49:F4:7E:4C:F8:89:E0:C1:13","sha256":"CC:34:CC:6B:20:15:CF:DB:71:93:41:D7:54:AD:CE:B5:AA:C1:C0:29:BD:FF:49:5E:F0:78:DB:6B:52:D6:EA:83"}}},"request":{"raw":"GET /cdn-cgi/phish-bypass?atok=h3xdOjzJxlXa9OdpcQL5fL1c3QtkWdITfUsLMK6ym64-1761388574.7059875-0.0.1.1-/\u0026original_path=/\u0026cf-turnstile-response= HTTP/1.1\r\nHost: testdomain1948.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nUpgrade-Insecure-Requests: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: document\r\nSec-Fetch-Mode: navigate\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 400 Bad Request\r\ndate: Sat, 25 Oct 2025 17:28:22 GMT\r\ncontent-length: 23\r\ncache-control: private, max-age=0, no-store, no-cache, must-revalidate, post-check=0, pre-check=0\r\nexpires: Thu, 01 Jan 1970 00:00:01 GMT\r\nreferrer-policy: same-origin\r\nx-frame-options: SAMEORIGIN\r\nvary: accept-encoding\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=wmHud75%2BoX24FQ8guLOzupxwOXTUtPSrGyYQ6pu8qPQYLY2%2BO4RKpHNKk0T6EBDsm9TNm2rXsz0me7COG%2FeK00638TnmXO%2BJFtEcXPwNzXo%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nserver: cloudflare\r\ncf-ray: 99436e1348e056ae-OSL\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"400","status_text":"Bad Request","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":23,"size_decoded":0,"mime_type":"text/plain","magic":"ASCII text, with no line terminators","md5":"1862a245f1f02bd4477a17e9432e3a25","sha1":"5e9e7ba669c7c6e7aa7aede335b0b22f0a08b88f","sha256":"e999e13afc2c76a9b3523daa037814a97f9ad5310ee32c4dfe3b5d006a0ed73b","sha512":"d9a8704b10b2897fa29358a36d8f8a180a97f1752ac745065c11ca1698055fd59415d32ac54e451a2237dc460d8a465ffacdbfc7009bf8e2f4fd885acc189e16","ssdeep":"","tlshash":"6b70000a0800320022000820002082a2af808080000000088ee2cce00808080a002220","first_seen":"2025-04-28T11:02:45.558882Z","last_seen":"2026-08-06T20:03:53.942532Z","times_seen":43313,"resource_available":true,"data":null}},"time_used":398,"timings":{"blocked":196,"dns":1,"connect":1,"send":0,"wait":5,"receive":0,"ssl":192},"alerts":{"ids":null,"analyzer":[{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2025-10-25","alert":"Phishing Block","trigger":"testdomain1948.com","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2025-10-25","alert":"Sinkholed","trigger":"testdomain1948.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-10-25","alert":"Sinkholed","trigger":"testdomain1948.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"testdomain1948.com/favicon.ico","fqdn":"testdomain1948.com","domain":"testdomain1948.com","tld":"com"},"ip":{"addr":"104.21.79.194","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"http://testdomain1948.com/cdn-cgi/phish-bypass?atok=h3xdOjzJxlXa9OdpcQL5fL1c3QtkWdITfUsLMK6ym64-1761388574.7059875-0.0.1.1-/\u0026original_path=/\u0026cf-turnstile-response=","date":"2025-10-25T17:28:22.783Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"testdomain1948.com","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Fri, 26 Sep 2025 06:16:30 GMT","end":"Thu, 25 Dec 2025 07:15:14 GMT"},"fingerprint":{"sha1":"E7:48:7F:3F:D1:33:9D:14:78:77:57:49:F4:7E:4C:F8:89:E0:C1:13","sha256":"CC:34:CC:6B:20:15:CF:DB:71:93:41:D7:54:AD:CE:B5:AA:C1:C0:29:BD:FF:49:5E:F0:78:DB:6B:52:D6:EA:83"}}},"request":{"raw":"GET /favicon.ico HTTP/1.1\r\nHost: testdomain1948.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 301 Moved Permanently\r\ndate: Sat, 25 Oct 2025 17:28:22 GMT\r\ncontent-type: text/html; charset=iso-8859-1\r\nlocation: https://testdomain1948.com/favicon.ico\r\nserver: cloudflare\r\ncross-origin-resource-policy: cross-origin\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=8sR91ebR8KhsggX5Mkv9%2FM3L%2BZNK6k9XIhuBaKnF9QGkM6h4FjTTw3sfD7DkaADjzssQrJo%2BCFHKZ8T1MxobMypXIjftA1kx5svNUBY1LyY%3D\"}]}\r\nage: 0\r\ncache-control: max-age=14400\r\ncf-cache-status: HIT\r\nvary: accept-encoding\r\ncf-ray: 99436e165aef56bd-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"301","status_text":"Moved Permanently","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":0,"size_decoded":0,"mime_type":"text/html; charset=iso-8859-1","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-08-07T13:07:03.550089Z","times_seen":17761838,"resource_available":true,"data":null}},"time_used":5,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":5,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2025-10-25","alert":"Phishing Block","trigger":"testdomain1948.com","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2025-10-25","alert":"Sinkholed","trigger":"testdomain1948.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-10-25","alert":"Sinkholed","trigger":"testdomain1948.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"testdomain1948.com/favicon.ico","fqdn":"testdomain1948.com","domain":"testdomain1948.com","tld":"com"},"ip":{"addr":"104.21.79.194","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"http://testdomain1948.com/cdn-cgi/phish-bypass?atok=h3xdOjzJxlXa9OdpcQL5fL1c3QtkWdITfUsLMK6ym64-1761388574.7059875-0.0.1.1-/\u0026original_path=/\u0026cf-turnstile-response=","date":"2025-10-25T17:28:22.988Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"testdomain1948.com","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Fri, 26 Sep 2025 06:16:30 GMT","end":"Thu, 25 Dec 2025 07:15:14 GMT"},"fingerprint":{"sha1":"E7:48:7F:3F:D1:33:9D:14:78:77:57:49:F4:7E:4C:F8:89:E0:C1:13","sha256":"CC:34:CC:6B:20:15:CF:DB:71:93:41:D7:54:AD:CE:B5:AA:C1:C0:29:BD:FF:49:5E:F0:78:DB:6B:52:D6:EA:83"}}},"request":{"raw":"GET /favicon.ico HTTP/1.1\r\nHost: testdomain1948.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 301 Moved Permanently\r\ndate: Sat, 25 Oct 2025 17:28:22 GMT\r\nserver: cloudflare\r\ncross-origin-resource-policy: cross-origin\r\nlocation: https://testdomain1948.com/favicon.ico\r\nvary: accept-encoding\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=zmAjE7s3vZrCQ%2Fxpz95y2r01VtyqgLb9qqwobW3%2FMOC8qt30L8ELA%2FA%2FZnObcpl9H51MsSo3hwJhP6HWO%2FLqEhfmaV7Q6UmpW0skhJawvLTcPQ%3D%3D\"}]}\r\ncontent-type: text/html; charset=iso-8859-1\r\nage: 0\r\ncache-control: max-age=14400\r\ncf-cache-status: HIT\r\npriority: u=6,i=?0\r\ncf-ray: 99436e179f31723c-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"301","status_text":"Moved Permanently","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":0,"size_decoded":0,"mime_type":"text/html; charset=iso-8859-1","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-08-07T13:07:03.550089Z","times_seen":17761838,"resource_available":true,"data":null}},"time_used":5,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":5,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2025-10-25","alert":"Sinkholed","trigger":"testdomain1948.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2025-10-25","alert":"Phishing Block","trigger":"testdomain1948.com","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-10-25","alert":"Sinkholed","trigger":"testdomain1948.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"testdomain1948.com/favicon.ico","fqdn":"testdomain1948.com","domain":"testdomain1948.com","tld":"com"},"ip":{"addr":"104.21.79.194","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"http://testdomain1948.com/cdn-cgi/phish-bypass?atok=h3xdOjzJxlXa9OdpcQL5fL1c3QtkWdITfUsLMK6ym64-1761388574.7059875-0.0.1.1-/\u0026original_path=/\u0026cf-turnstile-response=","date":"2025-10-25T17:28:23.033Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"testdomain1948.com","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Fri, 26 Sep 2025 06:16:30 GMT","end":"Thu, 25 Dec 2025 07:15:14 GMT"},"fingerprint":{"sha1":"E7:48:7F:3F:D1:33:9D:14:78:77:57:49:F4:7E:4C:F8:89:E0:C1:13","sha256":"CC:34:CC:6B:20:15:CF:DB:71:93:41:D7:54:AD:CE:B5:AA:C1:C0:29:BD:FF:49:5E:F0:78:DB:6B:52:D6:EA:83"}}},"request":{"raw":"GET /favicon.ico HTTP/1.1\r\nHost: testdomain1948.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 301 Moved Permanently\r\ndate: Sat, 25 Oct 2025 17:28:23 GMT\r\nserver: cloudflare\r\ncross-origin-resource-policy: cross-origin\r\nlocation: https://testdomain1948.com/favicon.ico\r\nvary: accept-encoding\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=8jVUBuIJBqEvjs6Ad%2FV%2BMbRRHQ2Vj4C3s9%2BwvUFyYS8ZEVGu%2B2OTTv0%2FUK6Fw3GD3B2rM02nDa6iO6%2FT2EwJ3ZFgnUcsFB2uhpMN6Jya%2F4mK2Q%3D%3D\"}]}\r\ncontent-type: text/html; charset=iso-8859-1\r\nage: 0\r\ncache-control: max-age=14400\r\ncf-cache-status: HIT\r\npriority: u=6,i=?0\r\ncf-ray: 99436e17ef49723c-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"301","status_text":"Moved Permanently","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":0,"size_decoded":0,"mime_type":"text/html; charset=iso-8859-1","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-08-07T13:07:03.550089Z","times_seen":17761838,"resource_available":true,"data":null}},"time_used":4,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":4,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2025-10-25","alert":"Sinkholed","trigger":"testdomain1948.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2025-10-25","alert":"Phishing Block","trigger":"testdomain1948.com","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-10-25","alert":"Sinkholed","trigger":"testdomain1948.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"testdomain1948.com/favicon.ico","fqdn":"testdomain1948.com","domain":"testdomain1948.com","tld":"com"},"ip":{"addr":"104.21.79.194","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"http://testdomain1948.com/cdn-cgi/phish-bypass?atok=h3xdOjzJxlXa9OdpcQL5fL1c3QtkWdITfUsLMK6ym64-1761388574.7059875-0.0.1.1-/\u0026original_path=/\u0026cf-turnstile-response=","date":"2025-10-25T17:28:22.751Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"testdomain1948.com","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Fri, 26 Sep 2025 06:16:30 GMT","end":"Thu, 25 Dec 2025 07:15:14 GMT"},"fingerprint":{"sha1":"E7:48:7F:3F:D1:33:9D:14:78:77:57:49:F4:7E:4C:F8:89:E0:C1:13","sha256":"CC:34:CC:6B:20:15:CF:DB:71:93:41:D7:54:AD:CE:B5:AA:C1:C0:29:BD:FF:49:5E:F0:78:DB:6B:52:D6:EA:83"}}},"request":{"raw":"GET /favicon.ico HTTP/1.1\r\nHost: testdomain1948.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 301 Moved Permanently\r\ndate: Sat, 25 Oct 2025 17:28:22 GMT\r\ncontent-type: text/html; charset=iso-8859-1\r\nlocation: https://testdomain1948.com/favicon.ico\r\nserver: cloudflare\r\ncross-origin-resource-policy: cross-origin\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=mPK0sBVqVPnLhWNI1ewBGDb7%2FqYbjprfKClGBeylvXbA7B68WNpU7ldrEltM9vLI9bOV6Be%2Bhu7TuAmvu%2BqvejUllosG3flW02TTlheag1g%3D\"}]}\r\nage: 0\r\ncache-control: max-age=14400\r\ncf-cache-status: HIT\r\nvary: accept-encoding\r\ncf-ray: 99436e162ac456bd-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"301","status_text":"Moved Permanently","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":0,"size_decoded":0,"mime_type":"text/html; charset=iso-8859-1","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-08-07T13:07:03.550089Z","times_seen":17761838,"resource_available":true,"data":null}},"time_used":7,"timings":{"blocked":1,"dns":0,"connect":0,"send":0,"wait":6,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2025-10-25","alert":"Sinkholed","trigger":"testdomain1948.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2025-10-25","alert":"Phishing Block","trigger":"testdomain1948.com","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-10-25","alert":"Sinkholed","trigger":"testdomain1948.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"testdomain1948.com/favicon.ico","fqdn":"testdomain1948.com","domain":"testdomain1948.com","tld":"com"},"ip":{"addr":"104.21.79.194","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"http://testdomain1948.com/cdn-cgi/phish-bypass?atok=h3xdOjzJxlXa9OdpcQL5fL1c3QtkWdITfUsLMK6ym64-1761388574.7059875-0.0.1.1-/\u0026original_path=/\u0026cf-turnstile-response=","date":"2025-10-25T17:28:22.816Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"testdomain1948.com","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Fri, 26 Sep 2025 06:16:30 GMT","end":"Thu, 25 Dec 2025 07:15:14 GMT"},"fingerprint":{"sha1":"E7:48:7F:3F:D1:33:9D:14:78:77:57:49:F4:7E:4C:F8:89:E0:C1:13","sha256":"CC:34:CC:6B:20:15:CF:DB:71:93:41:D7:54:AD:CE:B5:AA:C1:C0:29:BD:FF:49:5E:F0:78:DB:6B:52:D6:EA:83"}}},"request":{"raw":"GET /favicon.ico HTTP/1.1\r\nHost: testdomain1948.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 301 Moved Permanently\r\ndate: Sat, 25 Oct 2025 17:28:22 GMT\r\nserver: cloudflare\r\ncross-origin-resource-policy: cross-origin\r\nlocation: https://testdomain1948.com/favicon.ico\r\nvary: accept-encoding\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=cvY8M3YqgqVpKNo5JhH3HJLwcXd54%2FhWctSL8TBX2Su%2FHG5cpDtQRt4oK3buDmtfA9s8GL1QbXWgfzWxHERz7Ru8ZSHkVk%2F3LOy%2BCt7r6LdZEQ%3D%3D\"}]}\r\ncontent-type: text/html; charset=iso-8859-1\r\nage: 0\r\ncache-control: max-age=14400\r\ncf-cache-status: HIT\r\npriority: u=6,i=?0\r\ncf-ray: 99436e169f05723c-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"301","status_text":"Moved Permanently","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":0,"size_decoded":0,"mime_type":"text/html; charset=iso-8859-1","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-08-07T13:07:03.550089Z","times_seen":17761838,"resource_available":true,"data":null}},"time_used":8,"timings":{"blocked":2,"dns":0,"connect":0,"send":0,"wait":6,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2025-10-25","alert":"Phishing Block","trigger":"testdomain1948.com","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2025-10-25","alert":"Sinkholed","trigger":"testdomain1948.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-10-25","alert":"Sinkholed","trigger":"testdomain1948.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"testdomain1948.com/favicon.ico","fqdn":"testdomain1948.com","domain":"testdomain1948.com","tld":"com"},"ip":{"addr":"104.21.79.194","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"http://testdomain1948.com/cdn-cgi/phish-bypass?atok=h3xdOjzJxlXa9OdpcQL5fL1c3QtkWdITfUsLMK6ym64-1761388574.7059875-0.0.1.1-/\u0026original_path=/\u0026cf-turnstile-response=","date":"2025-10-25T17:28:22.902Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"testdomain1948.com","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Fri, 26 Sep 2025 06:16:30 GMT","end":"Thu, 25 Dec 2025 07:15:14 GMT"},"fingerprint":{"sha1":"E7:48:7F:3F:D1:33:9D:14:78:77:57:49:F4:7E:4C:F8:89:E0:C1:13","sha256":"CC:34:CC:6B:20:15:CF:DB:71:93:41:D7:54:AD:CE:B5:AA:C1:C0:29:BD:FF:49:5E:F0:78:DB:6B:52:D6:EA:83"}}},"request":{"raw":"GET /favicon.ico HTTP/1.1\r\nHost: testdomain1948.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 301 Moved Permanently\r\ndate: Sat, 25 Oct 2025 17:28:22 GMT\r\nserver: cloudflare\r\ncross-origin-resource-policy: cross-origin\r\nlocation: https://testdomain1948.com/favicon.ico\r\nvary: accept-encoding\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=rRouyBxYfgGyjYpNuXDCPz2CJvCkzyitoQL%2FvDN76AQ5f04VyjTRLmQdDFil7g4Kui%2Bqg7oFzQ2mHHtFGDDHenpyaRckfoLJfORkWsEBw9ZFEw%3D%3D\"}]}\r\ncontent-type: text/html; charset=iso-8859-1\r\nage: 0\r\ncache-control: max-age=14400\r\ncf-cache-status: HIT\r\npriority: u=6,i=?0\r\ncf-ray: 99436e171f14723c-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"301","status_text":"Moved Permanently","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":0,"size_decoded":0,"mime_type":"text/html; charset=iso-8859-1","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-08-07T13:07:03.550089Z","times_seen":17761838,"resource_available":true,"data":null}},"time_used":5,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":5,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2025-10-25","alert":"Sinkholed","trigger":"testdomain1948.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2025-10-25","alert":"Phishing Block","trigger":"testdomain1948.com","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-10-25","alert":"Sinkholed","trigger":"testdomain1948.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"testdomain1948.com/favicon.ico","fqdn":"testdomain1948.com","domain":"testdomain1948.com","tld":"com"},"ip":{"addr":"104.21.79.194","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"http://testdomain1948.com/cdn-cgi/phish-bypass?atok=h3xdOjzJxlXa9OdpcQL5fL1c3QtkWdITfUsLMK6ym64-1761388574.7059875-0.0.1.1-/\u0026original_path=/\u0026cf-turnstile-response=","date":"2025-10-25T17:28:22.973Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"testdomain1948.com","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Fri, 26 Sep 2025 06:16:30 GMT","end":"Thu, 25 Dec 2025 07:15:14 GMT"},"fingerprint":{"sha1":"E7:48:7F:3F:D1:33:9D:14:78:77:57:49:F4:7E:4C:F8:89:E0:C1:13","sha256":"CC:34:CC:6B:20:15:CF:DB:71:93:41:D7:54:AD:CE:B5:AA:C1:C0:29:BD:FF:49:5E:F0:78:DB:6B:52:D6:EA:83"}}},"request":{"raw":"GET /favicon.ico HTTP/1.1\r\nHost: testdomain1948.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 301 Moved Permanently\r\ndate: Sat, 25 Oct 2025 17:28:22 GMT\r\nserver: cloudflare\r\ncross-origin-resource-policy: cross-origin\r\nlocation: https://testdomain1948.com/favicon.ico\r\nvary: accept-encoding\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=jDIUbJ7O45cPrWF7LSBqzB5Mt%2FCFCxiaHC1nuHZMaVO97d8x2GNcJIKO2%2FqSqWflHDyadic%2BKpN6FB385FwdwrBuO9WMsEncuL7iZLQ9DydRNQ%3D%3D\"}]}\r\ncontent-type: text/html; charset=iso-8859-1\r\nage: 0\r\ncache-control: max-age=14400\r\ncf-cache-status: HIT\r\npriority: u=6,i=?0\r\ncf-ray: 99436e178f2e723c-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"301","status_text":"Moved Permanently","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":0,"size_decoded":0,"mime_type":"text/html; charset=iso-8859-1","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-08-07T13:07:03.550089Z","times_seen":17761838,"resource_available":true,"data":null}},"time_used":5,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":5,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2025-10-25","alert":"Phishing Block","trigger":"testdomain1948.com","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2025-10-25","alert":"Sinkholed","trigger":"testdomain1948.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-10-25","alert":"Sinkholed","trigger":"testdomain1948.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"testdomain1948.com/favicon.ico","fqdn":"testdomain1948.com","domain":"testdomain1948.com","tld":"com"},"ip":{"addr":"104.21.79.194","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"http://testdomain1948.com/cdn-cgi/phish-bypass?atok=h3xdOjzJxlXa9OdpcQL5fL1c3QtkWdITfUsLMK6ym64-1761388574.7059875-0.0.1.1-/\u0026original_path=/\u0026cf-turnstile-response=","date":"2025-10-25T17:28:23.003Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"testdomain1948.com","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Fri, 26 Sep 2025 06:16:30 GMT","end":"Thu, 25 Dec 2025 07:15:14 GMT"},"fingerprint":{"sha1":"E7:48:7F:3F:D1:33:9D:14:78:77:57:49:F4:7E:4C:F8:89:E0:C1:13","sha256":"CC:34:CC:6B:20:15:CF:DB:71:93:41:D7:54:AD:CE:B5:AA:C1:C0:29:BD:FF:49:5E:F0:78:DB:6B:52:D6:EA:83"}}},"request":{"raw":"GET /favicon.ico HTTP/1.1\r\nHost: testdomain1948.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 301 Moved Permanently\r\ndate: Sat, 25 Oct 2025 17:28:22 GMT\r\nserver: cloudflare\r\ncross-origin-resource-policy: cross-origin\r\nlocation: https://testdomain1948.com/favicon.ico\r\nvary: accept-encoding\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=KFxbsoTUzu6IZxRnCHFkyghgduh23NL4jc42JOmqLhfuo3TmuPlE62v9AxfOAuloIChbtrzQZ2c13IHewRMVSI7Vy9G71AyfB%2FQXXcsWjjl9Lg%3D%3D\"}]}\r\ncontent-type: text/html; charset=iso-8859-1\r\nage: 0\r\ncache-control: max-age=14400\r\ncf-cache-status: HIT\r\npriority: u=6,i=?0\r\ncf-ray: 99436e17bf3b723c-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"301","status_text":"Moved Permanently","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":0,"size_decoded":0,"mime_type":"text/html; charset=iso-8859-1","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-08-07T13:07:03.550089Z","times_seen":17761838,"resource_available":true,"data":null}},"time_used":5,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":5,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2025-10-25","alert":"Phishing Block","trigger":"testdomain1948.com","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2025-10-25","alert":"Sinkholed","trigger":"testdomain1948.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-10-25","alert":"Sinkholed","trigger":"testdomain1948.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"testdomain1948.com/favicon.ico","fqdn":"testdomain1948.com","domain":"testdomain1948.com","tld":"com"},"ip":{"addr":"104.21.79.194","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"http://testdomain1948.com/cdn-cgi/phish-bypass?atok=h3xdOjzJxlXa9OdpcQL5fL1c3QtkWdITfUsLMK6ym64-1761388574.7059875-0.0.1.1-/\u0026original_path=/\u0026cf-turnstile-response=","date":"2025-10-25T17:28:23.019Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"testdomain1948.com","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Fri, 26 Sep 2025 06:16:30 GMT","end":"Thu, 25 Dec 2025 07:15:14 GMT"},"fingerprint":{"sha1":"E7:48:7F:3F:D1:33:9D:14:78:77:57:49:F4:7E:4C:F8:89:E0:C1:13","sha256":"CC:34:CC:6B:20:15:CF:DB:71:93:41:D7:54:AD:CE:B5:AA:C1:C0:29:BD:FF:49:5E:F0:78:DB:6B:52:D6:EA:83"}}},"request":{"raw":"GET /favicon.ico HTTP/1.1\r\nHost: testdomain1948.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 301 Moved Permanently\r\ndate: Sat, 25 Oct 2025 17:28:23 GMT\r\nserver: cloudflare\r\ncross-origin-resource-policy: cross-origin\r\nlocation: https://testdomain1948.com/favicon.ico\r\nvary: accept-encoding\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=k3Q3xtPYx80no1nePyIfpbWIIsfmsDv509C3%2ByfIZTlEBfpCfB9zZMhRxdzcoBxLHwsXXjT1PeDJzw%2FChy1%2Bqak8ai3p3ITxGJLn8vgNh5jjOw%3D%3D\"}]}\r\ncontent-type: text/html; charset=iso-8859-1\r\nage: 0\r\ncache-control: max-age=14400\r\ncf-cache-status: HIT\r\npriority: u=6,i=?0\r\ncf-ray: 99436e17df3f723c-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"301","status_text":"Moved Permanently","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":0,"size_decoded":0,"mime_type":"text/html; charset=iso-8859-1","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-08-07T13:07:03.550089Z","times_seen":17761838,"resource_available":true,"data":null}},"time_used":5,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":5,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2025-10-25","alert":"Sinkholed","trigger":"testdomain1948.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2025-10-25","alert":"Phishing Block","trigger":"testdomain1948.com","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-10-25","alert":"Sinkholed","trigger":"testdomain1948.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"http","addr":"testdomain1948.com/cdn-cgi/phish-bypass?atok=h3xdOjzJxlXa9OdpcQL5fL1c3QtkWdITfUsLMK6ym64-1761388574.7059875-0.0.1.1-/\u0026original_path=/\u0026cf-turnstile-response=","fqdn":"testdomain1948.com","domain":"testdomain1948.com","tld":"com"},"ip":{"addr":"104.21.79.194","port":80,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":true,"resource_type":"document","requested_by":"","date":"2025-10-25T17:28:22.399Z","timestamp":0,"http_version":"","security_state":"insecure","security_info":null,"request":{"raw":"GET /cdn-cgi/phish-bypass?atok=h3xdOjzJxlXa9OdpcQL5fL1c3QtkWdITfUsLMK6ym64-1761388574.7059875-0.0.1.1-/\u0026original_path=/\u0026cf-turnstile-response= HTTP/1.1\r\nHost: testdomain1948.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate\r\nDNT: 1\r\nConnection: keep-alive\r\nUpgrade-Insecure-Requests: 1\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 400 Bad Request\r\nDate: Sat, 25 Oct 2025 17:28:22 GMT\r\nContent-Length: 23\r\nConnection: keep-alive\r\nCache-Control: private, max-age=0, no-store, no-cache, must-revalidate, post-check=0, pre-check=0\r\nExpires: Thu, 01 Jan 1970 00:00:01 GMT\r\nReferrer-Policy: same-origin\r\nX-Frame-Options: SAMEORIGIN\r\nVary: accept-encoding\r\nReport-To: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=cynIQWGy84UYjTNSqFP0Wiu8RNoNInEhsew6fFFrp%2FPw%2FkJdB94yd88e8ENZXrtpAzAedZSmZSsPGrE%2Fw9p%2BdDXRkOCrnjuJZqgmYWxA4OE%3D\"}]}\r\nNel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nServer: cloudflare\r\nCF-RAY: 99436e13f9295688-OSL\r\nalt-svc: h2=\":443\"; ma=60\r\n\r\n","headers":null,"cookies":null,"status_code":"400","status_text":"Bad Request","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":23,"size_decoded":0,"mime_type":"text/plain","magic":"ASCII text, with no line terminators","md5":"1862a245f1f02bd4477a17e9432e3a25","sha1":"5e9e7ba669c7c6e7aa7aede335b0b22f0a08b88f","sha256":"e999e13afc2c76a9b3523daa037814a97f9ad5310ee32c4dfe3b5d006a0ed73b","sha512":"d9a8704b10b2897fa29358a36d8f8a180a97f1752ac745065c11ca1698055fd59415d32ac54e451a2237dc460d8a465ffacdbfc7009bf8e2f4fd885acc189e16","ssdeep":"","tlshash":"6b70000a0800320022000820002082a2af808080000000088ee2cce00808080a002220","first_seen":"2025-04-28T11:02:45.558882Z","last_seen":"2026-08-06T20:03:53.942532Z","times_seen":43313,"resource_available":true,"data":null}},"time_used":16,"timings":{"blocked":0,"dns":1,"connect":1,"send":0,"wait":14,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2025-10-25","alert":"Phishing Block","trigger":"testdomain1948.com","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2025-10-25","alert":"Sinkholed","trigger":"testdomain1948.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-10-25","alert":"Sinkholed","trigger":"testdomain1948.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"testdomain1948.com/favicon.ico","fqdn":"testdomain1948.com","domain":"testdomain1948.com","tld":"com"},"ip":{"addr":"104.21.79.194","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"http://testdomain1948.com/cdn-cgi/phish-bypass?atok=h3xdOjzJxlXa9OdpcQL5fL1c3QtkWdITfUsLMK6ym64-1761388574.7059875-0.0.1.1-/\u0026original_path=/\u0026cf-turnstile-response=","date":"2025-10-25T17:28:22.765Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"testdomain1948.com","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Fri, 26 Sep 2025 06:16:30 GMT","end":"Thu, 25 Dec 2025 07:15:14 GMT"},"fingerprint":{"sha1":"E7:48:7F:3F:D1:33:9D:14:78:77:57:49:F4:7E:4C:F8:89:E0:C1:13","sha256":"CC:34:CC:6B:20:15:CF:DB:71:93:41:D7:54:AD:CE:B5:AA:C1:C0:29:BD:FF:49:5E:F0:78:DB:6B:52:D6:EA:83"}}},"request":{"raw":"GET /favicon.ico HTTP/1.1\r\nHost: testdomain1948.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 301 Moved Permanently\r\ndate: Sat, 25 Oct 2025 17:28:22 GMT\r\ncontent-type: text/html; charset=iso-8859-1\r\nlocation: https://testdomain1948.com/favicon.ico\r\nserver: cloudflare\r\ncross-origin-resource-policy: cross-origin\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=VP8MOZqpGTvbWjCaQvCSB24HyinEVkaBAy6gmci06Z3gg8d74JEn6QGn0rUQg5bujfJovC5HZOf%2BGTmUSCeTfheasZX%2BnudLSXSLl6H0H44%3D\"}]}\r\nage: 0\r\ncache-control: max-age=14400\r\ncf-cache-status: HIT\r\nvary: accept-encoding\r\ncf-ray: 99436e163aca56bd-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"301","status_text":"Moved Permanently","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":0,"size_decoded":0,"mime_type":"text/html; charset=iso-8859-1","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-08-07T13:07:03.550089Z","times_seen":17761838,"resource_available":true,"data":null}},"time_used":5,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":5,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2025-10-25","alert":"Phishing Block","trigger":"testdomain1948.com","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2025-10-25","alert":"Sinkholed","trigger":"testdomain1948.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-10-25","alert":"Sinkholed","trigger":"testdomain1948.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"testdomain1948.com/favicon.ico","fqdn":"testdomain1948.com","domain":"testdomain1948.com","tld":"com"},"ip":{"addr":"104.21.79.194","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"http://testdomain1948.com/cdn-cgi/phish-bypass?atok=h3xdOjzJxlXa9OdpcQL5fL1c3QtkWdITfUsLMK6ym64-1761388574.7059875-0.0.1.1-/\u0026original_path=/\u0026cf-turnstile-response=","date":"2025-10-25T17:28:22.876Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"testdomain1948.com","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Fri, 26 Sep 2025 06:16:30 GMT","end":"Thu, 25 Dec 2025 07:15:14 GMT"},"fingerprint":{"sha1":"E7:48:7F:3F:D1:33:9D:14:78:77:57:49:F4:7E:4C:F8:89:E0:C1:13","sha256":"CC:34:CC:6B:20:15:CF:DB:71:93:41:D7:54:AD:CE:B5:AA:C1:C0:29:BD:FF:49:5E:F0:78:DB:6B:52:D6:EA:83"}}},"request":{"raw":"GET /favicon.ico HTTP/1.1\r\nHost: testdomain1948.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 301 Moved Permanently\r\ndate: Sat, 25 Oct 2025 17:28:22 GMT\r\nserver: cloudflare\r\ncross-origin-resource-policy: cross-origin\r\nlocation: https://testdomain1948.com/favicon.ico\r\nvary: accept-encoding\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=UASVzSXaxYKn6M%2B21CT5wEVqWL86iKB0K7LpWPWBQJ9Z%2BnGnbGNkNH8ntX%2Fj4vT4jSmB%2FCWqfJKMg7dcFnITtPIXrVUoVbjpVPvj0TTh58y0Uw%3D%3D\"}]}\r\ncontent-type: text/html; charset=iso-8859-1\r\nage: 0\r\ncache-control: max-age=14400\r\ncf-cache-status: HIT\r\npriority: u=6,i=?0\r\ncf-ray: 99436e16ff0d723c-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"301","status_text":"Moved Permanently","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":0,"size_decoded":0,"mime_type":"text/html; charset=iso-8859-1","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-08-07T13:07:03.550089Z","times_seen":17761838,"resource_available":true,"data":null}},"time_used":9,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":9,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2025-10-25","alert":"Sinkholed","trigger":"testdomain1948.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2025-10-25","alert":"Phishing Block","trigger":"testdomain1948.com","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-10-25","alert":"Sinkholed","trigger":"testdomain1948.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"testdomain1948.com/favicon.ico","fqdn":"testdomain1948.com","domain":"testdomain1948.com","tld":"com"},"ip":{"addr":"104.21.79.194","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"http://testdomain1948.com/cdn-cgi/phish-bypass?atok=h3xdOjzJxlXa9OdpcQL5fL1c3QtkWdITfUsLMK6ym64-1761388574.7059875-0.0.1.1-/\u0026original_path=/\u0026cf-turnstile-response=","date":"2025-10-25T17:28:22.949Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"testdomain1948.com","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Fri, 26 Sep 2025 06:16:30 GMT","end":"Thu, 25 Dec 2025 07:15:14 GMT"},"fingerprint":{"sha1":"E7:48:7F:3F:D1:33:9D:14:78:77:57:49:F4:7E:4C:F8:89:E0:C1:13","sha256":"CC:34:CC:6B:20:15:CF:DB:71:93:41:D7:54:AD:CE:B5:AA:C1:C0:29:BD:FF:49:5E:F0:78:DB:6B:52:D6:EA:83"}}},"request":{"raw":"GET /favicon.ico HTTP/1.1\r\nHost: testdomain1948.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 301 Moved Permanently\r\ndate: Sat, 25 Oct 2025 17:28:22 GMT\r\nserver: cloudflare\r\ncross-origin-resource-policy: cross-origin\r\nlocation: https://testdomain1948.com/favicon.ico\r\nvary: accept-encoding\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=%2Bqui1DK4Aatq6KbuD6my5mu1Abtb52g58BiJKiOIMG48vS9dvLHxZXfXI2oKfP8%2Fk9Fr8E6cOwzSXc4WPfM7%2BQ5Sv4tRiBC5f4KvSCCf%2FSjRng%3D%3D\"}]}\r\ncontent-type: text/html; charset=iso-8859-1\r\nage: 0\r\ncache-control: max-age=14400\r\ncf-cache-status: HIT\r\npriority: u=6,i=?0\r\ncf-ray: 99436e176f19723c-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"301","status_text":"Moved Permanently","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":0,"size_decoded":0,"mime_type":"text/html; charset=iso-8859-1","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-08-07T13:07:03.550089Z","times_seen":17761838,"resource_available":true,"data":null}},"time_used":5,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":5,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2025-10-25","alert":"Sinkholed","trigger":"testdomain1948.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2025-10-25","alert":"Phishing Block","trigger":"testdomain1948.com","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-10-25","alert":"Sinkholed","trigger":"testdomain1948.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"testdomain1948.com/favicon.ico","fqdn":"testdomain1948.com","domain":"testdomain1948.com","tld":"com"},"ip":{"addr":"104.21.79.194","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"http://testdomain1948.com/cdn-cgi/phish-bypass?atok=h3xdOjzJxlXa9OdpcQL5fL1c3QtkWdITfUsLMK6ym64-1761388574.7059875-0.0.1.1-/\u0026original_path=/\u0026cf-turnstile-response=","date":"2025-10-25T17:28:22.961Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"testdomain1948.com","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Fri, 26 Sep 2025 06:16:30 GMT","end":"Thu, 25 Dec 2025 07:15:14 GMT"},"fingerprint":{"sha1":"E7:48:7F:3F:D1:33:9D:14:78:77:57:49:F4:7E:4C:F8:89:E0:C1:13","sha256":"CC:34:CC:6B:20:15:CF:DB:71:93:41:D7:54:AD:CE:B5:AA:C1:C0:29:BD:FF:49:5E:F0:78:DB:6B:52:D6:EA:83"}}},"request":{"raw":"GET /favicon.ico HTTP/1.1\r\nHost: testdomain1948.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 301 Moved Permanently\r\ndate: Sat, 25 Oct 2025 17:28:22 GMT\r\nserver: cloudflare\r\ncross-origin-resource-policy: cross-origin\r\nlocation: https://testdomain1948.com/favicon.ico\r\nvary: accept-encoding\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=gn7x0DGpvgcM9i%2BoJKvUxl0OPPJGHmbBCyixDSbriJfbiCHyaZxezx1PKi%2Bs3tk5lxI7F1M%2FeIp3Izp4wb0xRdO%2BawwAH9j0rYWcg3ZJflHoMA%3D%3D\"}]}\r\ncontent-type: text/html; charset=iso-8859-1\r\nage: 0\r\ncache-control: max-age=14400\r\ncf-cache-status: HIT\r\npriority: u=6,i=?0\r\ncf-ray: 99436e177f1b723c-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"301","status_text":"Moved Permanently","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":0,"size_decoded":0,"mime_type":"text/html; charset=iso-8859-1","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-08-07T13:07:03.550089Z","times_seen":17761838,"resource_available":true,"data":null}},"time_used":5,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":5,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2025-10-25","alert":"Sinkholed","trigger":"testdomain1948.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2025-10-25","alert":"Phishing Block","trigger":"testdomain1948.com","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-10-25","alert":"Sinkholed","trigger":"testdomain1948.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"http","addr":"testdomain1948.com/favicon.ico","fqdn":"testdomain1948.com","domain":"testdomain1948.com","tld":"com"},"ip":{"addr":"104.21.79.194","port":80,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"http://testdomain1948.com/cdn-cgi/phish-bypass?atok=h3xdOjzJxlXa9OdpcQL5fL1c3QtkWdITfUsLMK6ym64-1761388574.7059875-0.0.1.1-/\u0026original_path=/\u0026cf-turnstile-response=","date":"2025-10-25T17:28:22.581Z","timestamp":0,"http_version":"","security_state":"insecure","security_info":null,"request":{"raw":"GET /favicon.ico HTTP/1.1\r\nHost: testdomain1948.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate\r\nReferer: http://testdomain1948.com/cdn-cgi/phish-bypass?atok=h3xdOjzJxlXa9OdpcQL5fL1c3QtkWdITfUsLMK6ym64-1761388574.7059875-0.0.1.1-/\u0026original_path=/\u0026cf-turnstile-response=\r\nDNT: 1\r\nConnection: keep-alive\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 301 Moved Permanently\r\nDate: Sat, 25 Oct 2025 17:28:22 GMT\r\nContent-Type: text/html; charset=iso-8859-1\r\nTransfer-Encoding: chunked\r\nConnection: keep-alive\r\nServer: cloudflare\r\nCross-Origin-Resource-Policy: cross-origin\r\nLocation: https://testdomain1948.com/favicon.ico\r\nNel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nReport-To: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=Yya2ccQJR1Lx2BkRXF9SySxhYMEMot4tosqjpvB3W3ApRd%2F7RsTvftXd9zdtS32vpkGHG6bWtxncExzNu%2Bkf%2FmeM%2FSHoXyYoggq71g1g0Lo%3D\"}]}\r\nCache-Control: max-age=14400\r\ncf-cache-status: MISS\r\nVary: accept-encoding\r\nCF-RAY: 99436e150a055688-OSL\r\nalt-svc: h2=\":443\"; ma=60\r\n\r\n","headers":null,"cookies":null,"status_code":"301","status_text":"Moved Permanently","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":0,"size_decoded":0,"mime_type":"text/html; charset=iso-8859-1","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-08-07T13:07:03.550089Z","times_seen":17761838,"resource_available":true,"data":null}},"time_used":72,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":72,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2025-10-25","alert":"Phishing Block","trigger":"testdomain1948.com","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2025-10-25","alert":"Sinkholed","trigger":"testdomain1948.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-10-25","alert":"Sinkholed","trigger":"testdomain1948.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"testdomain1948.com/favicon.ico","fqdn":"testdomain1948.com","domain":"testdomain1948.com","tld":"com"},"ip":{"addr":"104.21.79.194","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"http://testdomain1948.com/cdn-cgi/phish-bypass?atok=h3xdOjzJxlXa9OdpcQL5fL1c3QtkWdITfUsLMK6ym64-1761388574.7059875-0.0.1.1-/\u0026original_path=/\u0026cf-turnstile-response=","date":"2025-10-25T17:28:22.666Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"testdomain1948.com","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Fri, 26 Sep 2025 06:16:30 GMT","end":"Thu, 25 Dec 2025 07:15:14 GMT"},"fingerprint":{"sha1":"E7:48:7F:3F:D1:33:9D:14:78:77:57:49:F4:7E:4C:F8:89:E0:C1:13","sha256":"CC:34:CC:6B:20:15:CF:DB:71:93:41:D7:54:AD:CE:B5:AA:C1:C0:29:BD:FF:49:5E:F0:78:DB:6B:52:D6:EA:83"}}},"request":{"raw":"GET /favicon.ico HTTP/1.1\r\nHost: testdomain1948.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 301 Moved Permanently\r\ndate: Sat, 25 Oct 2025 17:28:22 GMT\r\ncontent-type: text/html; charset=iso-8859-1\r\nlocation: https://testdomain1948.com/favicon.ico\r\nserver: cloudflare\r\ncross-origin-resource-policy: cross-origin\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=uLPB8KNnLhcU5jAO4tomJZTgkbaM6jeqz2mStfgW%2FzJHbJlvjTyHnMa4wvQeY2KMDJuX59uFsYyJG79XcSpHROL5iFMA0FSb6LRuptIqYUI%3D\"}]}\r\nage: 0\r\ncache-control: max-age=14400\r\ncf-cache-status: HIT\r\nvary: accept-encoding\r\ncf-ray: 99436e15ea8c56bd-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"301","status_text":"Moved Permanently","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":0,"size_decoded":0,"mime_type":"text/html; charset=iso-8859-1","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-08-07T13:07:03.550089Z","times_seen":17761838,"resource_available":true,"data":null}},"time_used":61,"timings":{"blocked":-1,"dns":0,"connect":1,"send":0,"wait":13,"receive":0,"ssl":47},"alerts":{"ids":null,"analyzer":[{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2025-10-25","alert":"Phishing Block","trigger":"testdomain1948.com","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2025-10-25","alert":"Sinkholed","trigger":"testdomain1948.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-10-25","alert":"Sinkholed","trigger":"testdomain1948.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"testdomain1948.com/favicon.ico","fqdn":"testdomain1948.com","domain":"testdomain1948.com","tld":"com"},"ip":{"addr":"104.21.79.194","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"http://testdomain1948.com/cdn-cgi/phish-bypass?atok=h3xdOjzJxlXa9OdpcQL5fL1c3QtkWdITfUsLMK6ym64-1761388574.7059875-0.0.1.1-/\u0026original_path=/\u0026cf-turnstile-response=","date":"2025-10-25T17:28:22.796Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"testdomain1948.com","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Fri, 26 Sep 2025 06:16:30 GMT","end":"Thu, 25 Dec 2025 07:15:14 GMT"},"fingerprint":{"sha1":"E7:48:7F:3F:D1:33:9D:14:78:77:57:49:F4:7E:4C:F8:89:E0:C1:13","sha256":"CC:34:CC:6B:20:15:CF:DB:71:93:41:D7:54:AD:CE:B5:AA:C1:C0:29:BD:FF:49:5E:F0:78:DB:6B:52:D6:EA:83"}}},"request":{"raw":"GET /favicon.ico HTTP/1.1\r\nHost: testdomain1948.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 301 Moved Permanently\r\ndate: Sat, 25 Oct 2025 17:28:22 GMT\r\nserver: cloudflare\r\ncross-origin-resource-policy: cross-origin\r\nlocation: https://testdomain1948.com/favicon.ico\r\nvary: accept-encoding\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=p9wkG5PMN8%2FmJoemIsBYxx%2Fl%2BrRw4RNU7aRsjBr68IGzkTK4oOeL6btobal9FLlEcmlvpVisNk4IzkW4SholEXEDONJ6Lnvici%2FG1znxJO5Y5Q%3D%3D\"}]}\r\ncontent-type: text/html; charset=iso-8859-1\r\nage: 0\r\ncache-control: max-age=14400\r\ncf-cache-status: HIT\r\npriority: u=6,i=?0\r\ncf-ray: 99436e167f03723c-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"301","status_text":"Moved Permanently","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":0,"size_decoded":0,"mime_type":"text/html; charset=iso-8859-1","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-08-07T13:07:03.550089Z","times_seen":17761838,"resource_available":true,"data":null}},"time_used":10,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":10,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2025-10-25","alert":"Phishing Block","trigger":"testdomain1948.com","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2025-10-25","alert":"Sinkholed","trigger":"testdomain1948.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-10-25","alert":"Sinkholed","trigger":"testdomain1948.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"testdomain1948.com/favicon.ico","fqdn":"testdomain1948.com","domain":"testdomain1948.com","tld":"com"},"ip":{"addr":"104.21.79.194","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"http://testdomain1948.com/cdn-cgi/phish-bypass?atok=h3xdOjzJxlXa9OdpcQL5fL1c3QtkWdITfUsLMK6ym64-1761388574.7059875-0.0.1.1-/\u0026original_path=/\u0026cf-turnstile-response=","date":"2025-10-25T17:28:22.832Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"testdomain1948.com","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Fri, 26 Sep 2025 06:16:30 GMT","end":"Thu, 25 Dec 2025 07:15:14 GMT"},"fingerprint":{"sha1":"E7:48:7F:3F:D1:33:9D:14:78:77:57:49:F4:7E:4C:F8:89:E0:C1:13","sha256":"CC:34:CC:6B:20:15:CF:DB:71:93:41:D7:54:AD:CE:B5:AA:C1:C0:29:BD:FF:49:5E:F0:78:DB:6B:52:D6:EA:83"}}},"request":{"raw":"GET /favicon.ico HTTP/1.1\r\nHost: testdomain1948.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 301 Moved Permanently\r\ndate: Sat, 25 Oct 2025 17:28:22 GMT\r\nserver: cloudflare\r\ncross-origin-resource-policy: cross-origin\r\nlocation: https://testdomain1948.com/favicon.ico\r\nvary: accept-encoding\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=O2a%2BQh91iCTKo6Llffh8CqXX%2FvZ7M9kkzWIOF1an1SbdnV%2BUsfNGvB9Ml1s34g8Aj8h9JWhofLdzPmrSukQQATJhy9PzfqhCS9GezRwCcCWf9A%3D%3D\"}]}\r\ncontent-type: text/html; charset=iso-8859-1\r\nage: 0\r\ncache-control: max-age=14400\r\ncf-cache-status: HIT\r\npriority: u=6,i=?0\r\ncf-ray: 99436e16af08723c-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"301","status_text":"Moved Permanently","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":0,"size_decoded":0,"mime_type":"text/html; charset=iso-8859-1","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-08-07T13:07:03.550089Z","times_seen":17761838,"resource_available":true,"data":null}},"time_used":7,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":7,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2025-10-25","alert":"Sinkholed","trigger":"testdomain1948.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2025-10-25","alert":"Phishing Block","trigger":"testdomain1948.com","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-10-25","alert":"Sinkholed","trigger":"testdomain1948.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"testdomain1948.com/favicon.ico","fqdn":"testdomain1948.com","domain":"testdomain1948.com","tld":"com"},"ip":{"addr":"104.21.79.194","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"http://testdomain1948.com/cdn-cgi/phish-bypass?atok=h3xdOjzJxlXa9OdpcQL5fL1c3QtkWdITfUsLMK6ym64-1761388574.7059875-0.0.1.1-/\u0026original_path=/\u0026cf-turnstile-response=","date":"2025-10-25T17:28:22.846Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"testdomain1948.com","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Fri, 26 Sep 2025 06:16:30 GMT","end":"Thu, 25 Dec 2025 07:15:14 GMT"},"fingerprint":{"sha1":"E7:48:7F:3F:D1:33:9D:14:78:77:57:49:F4:7E:4C:F8:89:E0:C1:13","sha256":"CC:34:CC:6B:20:15:CF:DB:71:93:41:D7:54:AD:CE:B5:AA:C1:C0:29:BD:FF:49:5E:F0:78:DB:6B:52:D6:EA:83"}}},"request":{"raw":"GET /favicon.ico HTTP/1.1\r\nHost: testdomain1948.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 301 Moved Permanently\r\ndate: Sat, 25 Oct 2025 17:28:22 GMT\r\nserver: cloudflare\r\ncross-origin-resource-policy: cross-origin\r\nlocation: https://testdomain1948.com/favicon.ico\r\nvary: accept-encoding\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=OSTHQSnpu042Hm3nqpZPZlUca1DfLIh7KaLWX25NkMxmnW1Sa3ndQg02HLTlceiu0tyNoxQnKtLbQEOKlJvyXRpNDwwX%2FNOCITC2R5gYn4oHBA%3D%3D\"}]}\r\ncontent-type: text/html; charset=iso-8859-1\r\nage: 0\r\ncache-control: max-age=14400\r\ncf-cache-status: HIT\r\npriority: u=6,i=?0\r\ncf-ray: 99436e16cf0a723c-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"301","status_text":"Moved Permanently","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":0,"size_decoded":0,"mime_type":"text/html; charset=iso-8859-1","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-08-07T13:07:03.550089Z","times_seen":17761838,"resource_available":true,"data":null}},"time_used":6,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":5,"receive":1,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2025-10-25","alert":"Phishing Block","trigger":"testdomain1948.com","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2025-10-25","alert":"Sinkholed","trigger":"testdomain1948.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-10-25","alert":"Sinkholed","trigger":"testdomain1948.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}}]}