{"report_id":"c6a75c7a-5621-4dbb-a329-27c394dc59fc","version":6,"status":"done","tags":[],"date":"2025-11-25T18:22:36Z","url":{"schema":"http","addr":"www.hjft-wahtsapp.com/","fqdn":"www.hjft-wahtsapp.com","domain":"hjft-wahtsapp.com","tld":"com"},"ip":{"addr":"103.80.133.25","port":0,"asn":205960,"as":"Hdtidc Limited","country":"South Korea","country_code":"KR"},"final":{"url":{"schema":"https","addr":"www.hjft-wahtsapp.com/","fqdn":"www.hjft-wahtsapp.com","domain":"hjft-wahtsapp.com","tld":"com"},"title":"403","dom":{"size":2100,"mime_type":"text/html; charset=utf-8","magic":"HTML document, Unicode text, UTF-8 text","md5":"4b30aa9ae19cfc94334e9c94cfc8e1d2","sha1":"26b46a7e4311de5706a65d58e54c5781be38ee90","sha256":"dcf51fc91ab706e1ca57c8f98508cf01f989af0ed298331bf2adb8c0d2789b18","sha512":"f9d5b7dcc7f51501782a7ff3a3a2f4397f7c3693ab50ebe31aca7e197c1a28edda0a4306507eb0622b1fb6685ff008880bad07145ca6482945ea1a0893118a84","ssdeep":"","tlshash":"0941306584e304010abbe1181bb7f54838b89407e257d80a798c3f98df41f5c96e7b84","dom_hash":"domhash75cdc2b0dacddf6e3bb7ccac022f0681","first_seen":"2025-11-25T18:22:38.606663Z","last_seen":"2025-11-26T09:04:32.4161Z","times_seen":2,"resource_available":false,"data":null}},"submit":{"url":{"schema":"http","addr":"www.hjft-wahtsapp.com/","fqdn":"www.hjft-wahtsapp.com","domain":"hjft-wahtsapp.com","tld":"com"},"ip":{"addr":"103.80.133.25","port":0,"asn":205960,"as":"Hdtidc Limited","country":"South Korea","country_code":"KR"},"tags":null,"meta":null},"settings":{"access":"public","device_type":"desktop","expires_at":"2026-12-30T18:22:36Z","useragent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0","referer":"","cookies":null,"exit_node":"z0yflva4pidy47h"},"stats":{"alert_count":{"ids":1,"urlquery":0,"analyzer":5}},"detection":{"ids":[{"sensor_name":"suricata","title":"Suricata IDS","description":"Suricata /w Emerging Threats Pro","date":"2025-11-25T18:22:14Z","timestamp":1764094934,"ip_dst":{"addr":"172.18.0.12","port":39084,"asn":0,"as":"","country":"","country_code":"zz"},"ip_src":{"addr":"103.80.133.25","port":443,"asn":205960,"as":"Hdtidc Limited","country":"South Korea","country_code":"KR"},"severity":"medium","alert":"ET DROP Spamhaus DROP Listed Traffic Inbound group 19","source":"{\"timestamp\":\"2025-11-25T18:22:14.495373+0000\",\"flow_id\":1460378870930691,\"in_iface\":\"br-31613a7ed13b\",\"event_type\":\"alert\",\"src_ip\":\"103.80.133.25\",\"src_port\":443,\"dest_ip\":\"172.18.0.12\",\"dest_port\":39084,\"proto\":\"TCP\",\"metadata\":{\"flowbits\":[\"ET.Evil\",\"ET.DROPIP\"]},\"alert\":{\"action\":\"allowed\",\"gid\":1,\"signature_id\":2400018,\"rev\":4421,\"signature\":\"ET DROP Spamhaus DROP Listed Traffic Inbound group 19\",\"category\":\"Misc Attack\",\"severity\":2,\"metadata\":{\"affected_product\":[\"Any\"],\"attack_target\":[\"Any\"],\"created_at\":[\"2010_12_30\"],\"deployment\":[\"Perimeter\"],\"signature_severity\":[\"Minor\"],\"tag\":[\"Dshield\"],\"updated_at\":[\"2025_08_01\"]}},\"flow\":{\"pkts_toserver\":1,\"pkts_toclient\":1,\"bytes_toserver\":74,\"bytes_toclient\":74,\"start\":\"2025-11-25T18:22:14.253187+0000\"}}"}],"analyzer":[{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2025-11-25","alert":"Sinkholed","trigger":"www.hjft-wahtsapp.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2025-11-25","alert":"Phishing Block","trigger":"www.hjft-wahtsapp.com","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2025-11-25","alert":"Sinkholed","trigger":"www.hjft-wahtsapp.com","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-11-25","alert":"Sinkholed","trigger":"www.hjft-wahtsapp.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2025-11-25","alert":"Sinkholed","trigger":"www.hjft-wahtsapp.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null},"summary":[{"fqdn":"www.hjft-wahtsapp.com","ip":{"addr":"103.80.133.25","port":443,"asn":205960,"as":"Hdtidc Limited","country":"South Korea","country_code":"KR"},"domain_registered":"2025-09-28","domain_rank":0,"first_seen":"2025-11-25T18:22:36.562632Z","last_seen":"2025-11-25T18:22:36.562632Z","alert_count":25,"request_count":5,"received_data":9460,"sent_data":2257,"comment":"","tags":null,"fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}]},{"fqdn":"hm.baidu.com","ip":{"addr":"111.45.3.198","port":443,"asn":9808,"as":"China Mobile Communications Group Co., Ltd.","country":"China","country_code":"CN"},"domain_registered":"1999-10-11","domain_rank":54491,"first_seen":"2012-05-26T08:38:45Z","last_seen":"2025-11-24T00:18:37.797758Z","alert_count":0,"request_count":2,"received_data":30877,"sent_data":1097,"comment":"","tags":null,"fingerprints":[{"name":"Apache HTTP Server","description":"Apache is a free and open-source cross-platform web server software.","website":"https://httpd.apache.org/","common_platform_enumeration":"cpe:2.3:a:apache:http_server:*:*:*:*:*:*:*:*","icon":"Apache.svg","categories":["Web servers"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}]}],"files":null,"artifacts":{"windows_shortcuts":null,"files":null,"telegram":null,"pdfs":null,"clipboard":null},"sensors":{"ids":null,"analyzer":null,"urlquery":null},"javascript":{"script":[{"url":{"schema":"https","addr":"hm.baidu.com/hm.js?d9bb8c3e0a8ddf6347b7d9d99b109ee0","fqdn":"hm.baidu.com","domain":"baidu.com","tld":"com"},"ip":{"addr":"111.45.3.198","port":443,"asn":9808,"as":"China Mobile Communications Group Co., Ltd.","country":"China","country_code":"CN"},"introduction_type":"scriptElement","is_inline":false,"md5":"e40db9e15c623dc90ca870e9c9370be6","sha1":"c227b7fe62f8e057b4b35148367e450c00c68270","sha256":"53f276462fd7b01a1ed86e311a5c2473b64679ca0609b0de0cec0b74472bac83","sha512":"bfb60a91d31c0fbdc9271a826c6b9a84fc3bd4ef1538c2aaad38b85c96534cf9ecf8323f6420f4dc2fd2a67d82df4f3167eff9130337fad816260684e6b4554e","ssdeep":"384:ewJSoLMJJTRl6s1JXFVCFI/TayvuodsZPIGm8XaR1JRwvutq1tGdc7M04gRw6:ew4VJfHgMdvussZPIx82Rwvutcto07v","tlshash":"e9d2d9a9b282713293a324a5153f324ef17b5a54bd4968a4f11894c07d38fbb027bfdd","size":29895,"data":"","first_seen":"2025-11-25T18:22:38.614841Z","last_seen":"2025-11-25T18:22:38.614841Z","times_seen":1,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"www.hjft-wahtsapp.com/","fqdn":"www.hjft-wahtsapp.com","domain":"hjft-wahtsapp.com","tld":"com"},"ip":{"addr":"103.80.133.25","port":443,"asn":205960,"as":"Hdtidc Limited","country":"South Korea","country_code":"KR"},"introduction_type":"Function","is_inline":false,"md5":"76677dee952a022a3082d8830cbe1cc1","sha1":"5026987d31a730694cf76922d468386c3dfbb231","sha256":"37f1989df8b22e2bc710056095949d78165c0d9cfe8736742c972b96e34052cd","sha512":"18a0b4c35b2ec2c1710f38840ede5b811f4b59327524e8fd22b4997d3e857f5b10a7e40267a9bac0bc1e7f5dab5664b19ec3341d85aca9a3f6f1a04a38fabf99","ssdeep":"","tlshash":"f0d0958c71c1c48c37f33cc594af190cc58d1e1115545d514d0258933dc5f7325215dd","size":276,"data":"","first_seen":"2025-11-25T18:22:38.62021Z","last_seen":"2025-11-25T18:22:38.62021Z","times_seen":1,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"www.hjft-wahtsapp.com/","fqdn":"www.hjft-wahtsapp.com","domain":"hjft-wahtsapp.com","tld":"com"},"ip":{"addr":"103.80.133.25","port":443,"asn":205960,"as":"Hdtidc Limited","country":"South Korea","country_code":"KR"},"introduction_type":"scriptElement","is_inline":true,"md5":"530b0a5417fe117c413b71716e175700","sha1":"7a5b31284a4a017cef8fa86ef677d1af65f2e2db","sha256":"4067dc1753c1d80f75322d0d44155dabaa200edd48867f89abadfa264d248dd8","sha512":"ee43a9f192e381109e5d2666fac7fc38946a6d810bab8d1da0d20fc5121e163f6bc512f8de785051fd1bed599a11ece5746173618ecad6b0c075355e4272f4ea","ssdeep":"","tlshash":"00f0e5a4c0e148d189af725e276bfcd53e3114c3e015a0023d1c0f5ddfc026c83a5b42","size":530,"data":"","first_seen":"2025-10-19T14:14:10.924441Z","last_seen":"2025-12-06T03:12:34.907396Z","times_seen":190,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"www.hjft-wahtsapp.com/tj.js","fqdn":"www.hjft-wahtsapp.com","domain":"hjft-wahtsapp.com","tld":"com"},"ip":{"addr":"103.80.133.25","port":443,"asn":205960,"as":"Hdtidc Limited","country":"South Korea","country_code":"KR"},"introduction_type":"scriptElement","is_inline":false,"md5":"613791a5a916b495ab9f29cf170362fd","sha1":"e0a2847de1f94e2da4e6b8ff33297f7f9329683a","sha256":"ed9a078418e9dd1e4dd1a38464df766dbeb7161d4f17429fefa43b4c7f00f74e","sha512":"8e68e70ad39f838e489d2ad78136ae601f091d956386444d4982e3c351ee764606210fc47b61078e00c75e1b18bf948833b12aa3415fa44337a9d347c13b534c","ssdeep":"","tlshash":"24d02e0f2c9458382375082910fbe94cb6a2546d403da40180dce890a9a0fc2082eb88","size":252,"data":"","first_seen":"2025-11-05T15:43:16.692057Z","last_seen":"2026-07-12T13:54:11.067192Z","times_seen":668,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"www.hjft-wahtsapp.com/","fqdn":"www.hjft-wahtsapp.com","domain":"hjft-wahtsapp.com","tld":"com"},"ip":{"addr":"103.80.133.25","port":443,"asn":205960,"as":"Hdtidc Limited","country":"South Korea","country_code":"KR"},"introduction_type":"scriptElement","is_inline":true,"md5":"469b675ffd2f2f9a50d483fe914eefc0","sha1":"ccebbe1dd5e353b60e3b00938d01f7fc62633b22","sha256":"330cdf74f605b78c83d0a108059ce29f21b55be9e056b07643b91fbfe65130aa","sha512":"d0a774f7f98ffbfea442c4fe73b7a4fa336de02d9c4e5a3b3a056f53a7b5c72693dea19a632771d17ed5a851134bad4a48176a4476e67f416c15ec61b677b801","ssdeep":"","tlshash":"be112f3861a724000ff6e229abaaa11434ad5417b773c80ef21db2507f12f1ce0e6ec6","size":888,"data":"","first_seen":"2025-11-25T18:22:38.622554Z","last_seen":"2025-11-26T09:04:32.441774Z","times_seen":2,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"www.hjft-wahtsapp.com/","fqdn":"www.hjft-wahtsapp.com","domain":"hjft-wahtsapp.com","tld":"com"},"ip":{"addr":"103.80.133.25","port":443,"asn":205960,"as":"Hdtidc Limited","country":"South Korea","country_code":"KR"},"introduction_type":"Function","is_inline":false,"md5":"1c5c9160600df2d96d69a4ea16cec7ed","sha1":"3cf678c9135cc952ba6970ef545035bb757a443f","sha256":"a3520fe88e248d2b6c9c6db93309a037ef969fe297208e5bd7e49a55bb32c808","sha512":"2a298a8c2552c6a6c6f8d3f7327d2e9abfa87a0dbb27e9e528a8539b416155c0860f54f46464dfe7e5d49c7906a9eacdac7e5181b86ef15a83276a8f4fee0546","ssdeep":"","tlshash":"078004d531c35040475331d400571cd4503444f014444d544040d4511c55030d1154dc","size":37,"data":"","first_seen":"2023-04-11T21:49:14Z","last_seen":"2026-08-12T13:40:47.828388Z","times_seen":121774,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"www.hjft-wahtsapp.com/","fqdn":"www.hjft-wahtsapp.com","domain":"hjft-wahtsapp.com","tld":"com"},"ip":{"addr":"103.80.133.25","port":443,"asn":205960,"as":"Hdtidc Limited","country":"South Korea","country_code":"KR"},"introduction_type":"Function","is_inline":false,"md5":"1c5c9160600df2d96d69a4ea16cec7ed","sha1":"3cf678c9135cc952ba6970ef545035bb757a443f","sha256":"a3520fe88e248d2b6c9c6db93309a037ef969fe297208e5bd7e49a55bb32c808","sha512":"2a298a8c2552c6a6c6f8d3f7327d2e9abfa87a0dbb27e9e528a8539b416155c0860f54f46464dfe7e5d49c7906a9eacdac7e5181b86ef15a83276a8f4fee0546","ssdeep":"","tlshash":"078004d531c35040475331d400571cd4503444f014444d544040d4511c55030d1154dc","size":37,"data":"","first_seen":"2023-04-11T21:49:14Z","last_seen":"2026-08-12T13:40:47.828388Z","times_seen":121774,"alerts":{"ids":null,"analyzer":null,"urlquery":null}}],"eval":null,"write":[{"md5":"d97623d172f087d9640da9acd38830ff","sha1":"515bd358bb7d990930f0e2b3de399db1787a2567","sha256":"fe04a9dc88d3f3be8d4f6bc63a9a80f45a4c6d8460e7551dab849457c091920a","sha512":"ce6a1969f698a616663f1a19ccfa12a37a4f6d782432d8a08aeb7879efd3e2becf168422ea66bc47e74f6ba865efaae6eabe3c4faba280d7a21f3a94d7c55da1","ssdeep":"","tlshash":"f0400000000000000000000000300000000000000003000c000000c0c0000000300000","size":7,"data":"","first_seen":"2023-03-12T20:41:17Z","last_seen":"2026-08-05T21:33:10.000859Z","times_seen":9187,"alerts":{"ids":null,"analyzer":null,"urlquery":null}}],"console":null},"http":[{"url":{"schema":"https","addr":"www.hjft-wahtsapp.com/","fqdn":"www.hjft-wahtsapp.com","domain":"hjft-wahtsapp.com","tld":"com"},"ip":{"addr":"103.80.133.25","port":443,"asn":205960,"as":"Hdtidc Limited","country":"South Korea","country_code":"KR"},"is_navigation_request":true,"resource_type":"document","requested_by":"","date":"2025-11-25T18:22:13.927Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"bbj-wahst5pp.com","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Thu, 16 Oct 2025 04:40:07 GMT","end":"Wed, 14 Jan 2026 04:40:06 GMT"},"fingerprint":{"sha1":"AA:8F:92:60:F6:B7:D4:D4:6B:18:55:56:3E:C8:27:5E:2D:62:12:9C","sha256":"4F:8B:FB:15:9A:EF:86:12:EC:67:2F:E0:E5:FD:79:20:57:B0:C6:F2:E4:B3:97:BF:DC:95:22:A9:9D:D8:BC:68"}}},"request":{"raw":"GET / HTTP/1.1\r\nHost: www.hjft-wahtsapp.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nUpgrade-Insecure-Requests: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: document\r\nSec-Fetch-Mode: navigate\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 403 Forbidden\r\nserver: nginx\r\ndate: Tue, 25 Nov 2025 18:22:14 GMT\r\ncontent-type: text/html; charset=UTF-8\r\nvary: Accept-Encoding\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"403","status_text":"Forbidden","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":2028,"size_decoded":0,"mime_type":"text/html; charset=UTF-8","magic":"HTML document, Unicode text, UTF-8 text","md5":"21c622cb880eb84cd52fddabe9d48f26","sha1":"398e31dff5e4f13c3a3bfc62cde7d0028f167860","sha256":"606cbf4e48d542f6add9134cb1e2e959436839813a64becde8b7064e4faaed52","sha512":"cb2921182220c88e1b05361fb4d51ebc77600b0f8e6356d523604cba3acaecf00c3e296f863727514b2bf80d2a3b1c1f6dacf8c53a388da54e808a9626306735","ssdeep":"","tlshash":"de41426884e314010aabe1282bb6f54438b55447f257d806798c3f999f42f1c96e7fc5","first_seen":"2025-11-25T18:22:38.610454Z","last_seen":"2025-11-26T09:04:32.434624Z","times_seen":2,"resource_available":false,"data":null}},"time_used":1888,"timings":{"blocked":820,"dns":326,"connect":242,"send":0,"wait":248,"receive":0,"ssl":248},"alerts":{"ids":null,"analyzer":[{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2025-11-25","alert":"Sinkholed","trigger":"www.hjft-wahtsapp.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2025-11-25","alert":"Phishing Block","trigger":"www.hjft-wahtsapp.com","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2025-11-25","alert":"Sinkholed","trigger":"www.hjft-wahtsapp.com","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-11-25","alert":"Sinkholed","trigger":"www.hjft-wahtsapp.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2025-11-25","alert":"Sinkholed","trigger":"www.hjft-wahtsapp.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"http","addr":"www.hjft-wahtsapp.com/","fqdn":"www.hjft-wahtsapp.com","domain":"hjft-wahtsapp.com","tld":"com"},"ip":{"addr":"103.80.133.25","port":80,"asn":205960,"as":"Hdtidc Limited","country":"South Korea","country_code":"KR"},"is_navigation_request":true,"resource_type":"document","requested_by":"","date":"2025-11-25T18:22:15.104Z","timestamp":0,"http_version":"","security_state":"insecure","security_info":null,"request":{"raw":"GET / HTTP/1.1\r\nHost: www.hjft-wahtsapp.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate\r\nDNT: 1\r\nConnection: keep-alive\r\nUpgrade-Insecure-Requests: 1\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 301 Moved Permanently\r\nServer: nginx\r\nDate: Tue, 25 Nov 2025 18:22:15 GMT\r\nContent-Type: text/html\r\nContent-Length: 162\r\nConnection: keep-alive\r\nLocation: https://www.hjft-wahtsapp.com/\r\nStrict-Transport-Security: max-age=31536000\r\nAlt-Svc: quic=\":443\"; h3=\":443\"; h3-29=\":443\"; h3-27=\":443\";h3-25=\":443\"; h3-T050=\":443\"; h3-Q050=\":443\";h3-Q049=\":443\";h3-Q048=\":443\"; h3-Q046=\":443\"; h3-Q043=\":443\"\r\n\r\n","headers":null,"cookies":null,"status_code":"301","status_text":"Moved Permanently","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":2028,"size_decoded":0,"mime_type":"text/html; charset=UTF-8","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-08-12T22:54:03.779504Z","times_seen":17861910,"resource_available":true,"data":null}},"time_used":738,"timings":{"blocked":246,"dns":1,"connect":246,"send":0,"wait":245,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2025-11-25","alert":"Sinkholed","trigger":"www.hjft-wahtsapp.com","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2025-11-25","alert":"Sinkholed","trigger":"www.hjft-wahtsapp.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2025-11-25","alert":"Sinkholed","trigger":"www.hjft-wahtsapp.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2025-11-25","alert":"Phishing Block","trigger":"www.hjft-wahtsapp.com","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-11-25","alert":"Sinkholed","trigger":"www.hjft-wahtsapp.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"www.hjft-wahtsapp.com/","fqdn":"www.hjft-wahtsapp.com","domain":"hjft-wahtsapp.com","tld":"com"},"ip":{"addr":"103.80.133.25","port":443,"asn":205960,"as":"Hdtidc Limited","country":"South Korea","country_code":"KR"},"is_navigation_request":true,"resource_type":"document","requested_by":"","date":"2025-11-25T18:22:15.600Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"bbj-wahst5pp.com","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Thu, 16 Oct 2025 04:40:07 GMT","end":"Wed, 14 Jan 2026 04:40:06 GMT"},"fingerprint":{"sha1":"AA:8F:92:60:F6:B7:D4:D4:6B:18:55:56:3E:C8:27:5E:2D:62:12:9C","sha256":"4F:8B:FB:15:9A:EF:86:12:EC:67:2F:E0:E5:FD:79:20:57:B0:C6:F2:E4:B3:97:BF:DC:95:22:A9:9D:D8:BC:68"}}},"request":{"raw":"GET / HTTP/1.1\r\nHost: www.hjft-wahtsapp.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nUpgrade-Insecure-Requests: 1\r\nSec-Fetch-Dest: document\r\nSec-Fetch-Mode: navigate\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 403 Forbidden\r\nserver: nginx\r\ndate: Tue, 25 Nov 2025 18:22:15 GMT\r\ncontent-type: text/html; charset=UTF-8\r\nvary: Accept-Encoding\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"403","status_text":"Forbidden","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":2028,"size_decoded":0,"mime_type":"text/html; charset=UTF-8","magic":"HTML document, Unicode text, UTF-8 text","md5":"21c622cb880eb84cd52fddabe9d48f26","sha1":"398e31dff5e4f13c3a3bfc62cde7d0028f167860","sha256":"606cbf4e48d542f6add9134cb1e2e959436839813a64becde8b7064e4faaed52","sha512":"cb2921182220c88e1b05361fb4d51ebc77600b0f8e6356d523604cba3acaecf00c3e296f863727514b2bf80d2a3b1c1f6dacf8c53a388da54e808a9626306735","ssdeep":"","tlshash":"de41426884e314010aabe1282bb6f54438b55447f257d806798c3f999f42f1c96e7fc5","first_seen":"2025-11-25T18:22:38.610454Z","last_seen":"2025-11-26T09:04:32.434624Z","times_seen":2,"resource_available":false,"data":null}},"time_used":246,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":246,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2025-11-25","alert":"Phishing Block","trigger":"www.hjft-wahtsapp.com","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2025-11-25","alert":"Sinkholed","trigger":"www.hjft-wahtsapp.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2025-11-25","alert":"Sinkholed","trigger":"www.hjft-wahtsapp.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2025-11-25","alert":"Sinkholed","trigger":"www.hjft-wahtsapp.com","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-11-25","alert":"Sinkholed","trigger":"www.hjft-wahtsapp.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"www.hjft-wahtsapp.com/tj.js","fqdn":"www.hjft-wahtsapp.com","domain":"hjft-wahtsapp.com","tld":"com"},"ip":{"addr":"103.80.133.25","port":443,"asn":205960,"as":"Hdtidc Limited","country":"South Korea","country_code":"KR"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://www.hjft-wahtsapp.com/","date":"2025-11-25T18:22:15.927Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"bbj-wahst5pp.com","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Thu, 16 Oct 2025 04:40:07 GMT","end":"Wed, 14 Jan 2026 04:40:06 GMT"},"fingerprint":{"sha1":"AA:8F:92:60:F6:B7:D4:D4:6B:18:55:56:3E:C8:27:5E:2D:62:12:9C","sha256":"4F:8B:FB:15:9A:EF:86:12:EC:67:2F:E0:E5:FD:79:20:57:B0:C6:F2:E4:B3:97:BF:DC:95:22:A9:9D:D8:BC:68"}}},"request":{"raw":"GET /tj.js HTTP/1.1\r\nHost: www.hjft-wahtsapp.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://www.hjft-wahtsapp.com/\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Tue, 25 Nov 2025 18:22:16 GMT\r\ncontent-type: application/javascript\r\ncontent-length: 252\r\nlast-modified: Tue, 04 Nov 2025 14:43:42 GMT\r\netag: \"690a111e-fc\"\r\nexpires: Wed, 26 Nov 2025 06:22:16 GMT\r\ncache-control: max-age=43200\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: quic=\":443\"; h3=\":443\"; h3-29=\":443\"; h3-27=\":443\";h3-25=\":443\"; h3-T050=\":443\"; h3-Q050=\":443\";h3-Q049=\":443\";h3-Q048=\":443\"; h3-Q046=\":443\"; h3-Q043=\":443\"\r\naccept-ranges: bytes\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":252,"size_decoded":0,"mime_type":"application/javascript","magic":"JavaScript source, ASCII text","md5":"613791a5a916b495ab9f29cf170362fd","sha1":"e0a2847de1f94e2da4e6b8ff33297f7f9329683a","sha256":"ed9a078418e9dd1e4dd1a38464df766dbeb7161d4f17429fefa43b4c7f00f74e","sha512":"8e68e70ad39f838e489d2ad78136ae601f091d956386444d4982e3c351ee764606210fc47b61078e00c75e1b18bf948833b12aa3415fa44337a9d347c13b534c","ssdeep":"","tlshash":"24d02e0f2c9458382375082910fbe94cb6a2546d403da40180dce890a9a0fc2082eb88","first_seen":"2025-11-05T15:43:16.692057Z","last_seen":"2026-07-12T13:54:11.067192Z","times_seen":668,"resource_available":true,"data":null}},"time_used":243,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":243,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2025-11-25","alert":"Sinkholed","trigger":"www.hjft-wahtsapp.com","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2025-11-25","alert":"Phishing Block","trigger":"www.hjft-wahtsapp.com","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2025-11-25","alert":"Sinkholed","trigger":"www.hjft-wahtsapp.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2025-11-25","alert":"Sinkholed","trigger":"www.hjft-wahtsapp.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-11-25","alert":"Sinkholed","trigger":"www.hjft-wahtsapp.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"hm.baidu.com/hm.js?d9bb8c3e0a8ddf6347b7d9d99b109ee0","fqdn":"hm.baidu.com","domain":"baidu.com","tld":"com"},"ip":{"addr":"111.45.3.198","port":443,"asn":9808,"as":"China Mobile Communications Group Co., Ltd.","country":"China","country_code":"CN"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://www.hjft-wahtsapp.com/","date":"2025-11-25T18:22:16.174Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.2","cert":{"subject":{"commonName":"baidu.com","organization":"Beijing Baidu Netcom Science Technology Co., Ltd"},"issuer":{"commonName":"GlobalSign RSA OV SSL CA 2018","organization":"GlobalSign nv-sa"},"validity":{"start":"Wed, 09 Jul 2025 07:01:02 GMT","end":"Mon, 10 Aug 2026 07:01:01 GMT"},"fingerprint":{"sha1":"21:BF:66:0D:67:BE:7A:7F:49:48:05:30:F4:7F:09:F2:30:36:CA:63","sha256":"0D:82:2C:9A:90:5A:EF:E9:8F:37:12:C0:E0:26:30:EE:95:33:2C:45:5F:E7:74:5D:F0:8D:BC:79:F4:B0:A1:49"}}},"request":{"raw":"GET /hm.js?d9bb8c3e0a8ddf6347b7d9d99b109ee0 HTTP/1.1\r\nHost: hm.baidu.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://www.hjft-wahtsapp.com/\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nCache-Control: max-age=0, must-revalidate\r\nContent-Encoding: gzip\r\nContent-Length: 11289\r\nContent-Type: application/javascript\r\nDate: Tue, 25 Nov 2025 18:22:17 GMT\r\nEtag: 0c124a531e4a2b448421a10f00d4038a\r\nP3p: CP=\"CURa ADMa DEVa PSAo PSDo OUR BUS UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR\"\r\nServer: apache\r\nSet-Cookie: HMACCOUNT=6009FF3173CA3279; Path=/; Domain=hm.baidu.com; Expires=Sun, 18 Jan 2038 00:00:00 GMT\r\nStrict-Transport-Security: max-age=172800\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Apache HTTP Server","description":"Apache is a free and open-source cross-platform web server software.","website":"https://httpd.apache.org/","common_platform_enumeration":"cpe:2.3:a:apache:http_server:*:*:*:*:*:*:*:*","icon":"Apache.svg","categories":["Web servers"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":29895,"size_decoded":0,"mime_type":"application/javascript","magic":"JavaScript source, ASCII text, with very long lines (619)","md5":"e40db9e15c623dc90ca870e9c9370be6","sha1":"c227b7fe62f8e057b4b35148367e450c00c68270","sha256":"53f276462fd7b01a1ed86e311a5c2473b64679ca0609b0de0cec0b74472bac83","sha512":"bfb60a91d31c0fbdc9271a826c6b9a84fc3bd4ef1538c2aaad38b85c96534cf9ecf8323f6420f4dc2fd2a67d82df4f3167eff9130337fad816260684e6b4554e","ssdeep":"384:ewJSoLMJJTRl6s1JXFVCFI/TayvuodsZPIGm8XaR1JRwvutq1tGdc7M04gRw6:ew4VJfHgMdvussZPIx82Rwvutcto07v","tlshash":"e9d2d9a9b282713293a324a5153f324ef17b5a54bd4968a4f11894c07d38fbb027bfdd","first_seen":"2025-11-25T18:22:38.614841Z","last_seen":"2025-11-25T18:22:38.614841Z","times_seen":1,"resource_available":true,"data":null}},"time_used":1686,"timings":{"blocked":699,"dns":1,"connect":227,"send":0,"wait":287,"receive":1,"ssl":468},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"www.hjft-wahtsapp.com/favicon.ico","fqdn":"www.hjft-wahtsapp.com","domain":"hjft-wahtsapp.com","tld":"com"},"ip":{"addr":"103.80.133.25","port":443,"asn":205960,"as":"Hdtidc Limited","country":"South Korea","country_code":"KR"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://www.hjft-wahtsapp.com/","date":"2025-11-25T18:22:16.274Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"bbj-wahst5pp.com","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Thu, 16 Oct 2025 04:40:07 GMT","end":"Wed, 14 Jan 2026 04:40:06 GMT"},"fingerprint":{"sha1":"AA:8F:92:60:F6:B7:D4:D4:6B:18:55:56:3E:C8:27:5E:2D:62:12:9C","sha256":"4F:8B:FB:15:9A:EF:86:12:EC:67:2F:E0:E5:FD:79:20:57:B0:C6:F2:E4:B3:97:BF:DC:95:22:A9:9D:D8:BC:68"}}},"request":{"raw":"GET /favicon.ico HTTP/1.1\r\nHost: www.hjft-wahtsapp.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://www.hjft-wahtsapp.com/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Tue, 25 Nov 2025 18:22:16 GMT\r\ncontent-type: image/x-icon\r\ncontent-length: 1385\r\nlast-modified: Fri, 24 Oct 2025 13:20:10 GMT\r\netag: \"68fb7d0a-569\"\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: quic=\":443\"; h3=\":443\"; h3-29=\":443\"; h3-27=\":443\";h3-25=\":443\"; h3-T050=\":443\"; h3-Q050=\":443\";h3-Q049=\":443\";h3-Q048=\":443\"; h3-Q046=\":443\"; h3-Q043=\":443\"\r\naccept-ranges: bytes\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":1385,"size_decoded":0,"mime_type":"image/x-icon","magic":"PNG image data, 32 x 32, 8-bit/color RGBA, non-interlaced","md5":"b70e6078004aeb5146c635cc4c8af761","sha1":"08361cabab0812baeb8ecf4dfbdddd10a9104423","sha256":"20ce7e373448ca2a51d95f60fc906f57cc27d103a6bba4e33be3453f7b23b98e","sha512":"76e0a9f494998151ab5f5d1ef2f1e2cd826135537e6b3e77e6653997d6e073696880a1ab5100c6a85aea926edcfe036c31513d08f58c0bcc02db0a4c8b6bec09","ssdeep":"","tlshash":"bf210bf3e36020e90841d4310333621b57fa4f7b6d909371f071509112b944845a1e97","first_seen":"2024-12-25T11:23:49.33594Z","last_seen":"2026-08-01T18:23:46.596239Z","times_seen":1965,"resource_available":false,"data":null}},"time_used":243,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":243,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2025-11-25","alert":"Sinkholed","trigger":"www.hjft-wahtsapp.com","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2025-11-25","alert":"Sinkholed","trigger":"www.hjft-wahtsapp.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2025-11-25","alert":"Phishing Block","trigger":"www.hjft-wahtsapp.com","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2025-11-25","alert":"Sinkholed","trigger":"www.hjft-wahtsapp.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-11-25","alert":"Sinkholed","trigger":"www.hjft-wahtsapp.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"hm.baidu.com/hm.gif?hca=6009FF3173CA3279\u0026cc=1\u0026ck=1\u0026cl=24-bit\u0026ds=1280x1024\u0026vl=1024\u0026et=0\u0026ja=0\u0026ln=en-us\u0026lo=0\u0026rnd=194470790\u0026si=d9bb8c3e0a8ddf6347b7d9d99b109ee0\u0026v=1.3.2\u0026lv=1\u0026sn=23807\u0026r=0\u0026ww=1280\u0026u=https%3A%2F%2Fwww.hjft-wahtsapp.com%2F\u0026tt=403","fqdn":"hm.baidu.com","domain":"baidu.com","tld":"com"},"ip":{"addr":"111.45.3.198","port":443,"asn":9808,"as":"China Mobile Communications Group Co., Ltd.","country":"China","country_code":"CN"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://www.hjft-wahtsapp.com/","date":"2025-11-25T18:22:17.243Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.2","cert":{"subject":{"commonName":"baidu.com","organization":"Beijing Baidu Netcom Science Technology Co., Ltd"},"issuer":{"commonName":"GlobalSign RSA OV SSL CA 2018","organization":"GlobalSign nv-sa"},"validity":{"start":"Wed, 09 Jul 2025 07:01:02 GMT","end":"Mon, 10 Aug 2026 07:01:01 GMT"},"fingerprint":{"sha1":"21:BF:66:0D:67:BE:7A:7F:49:48:05:30:F4:7F:09:F2:30:36:CA:63","sha256":"0D:82:2C:9A:90:5A:EF:E9:8F:37:12:C0:E0:26:30:EE:95:33:2C:45:5F:E7:74:5D:F0:8D:BC:79:F4:B0:A1:49"}}},"request":{"raw":"GET /hm.gif?hca=6009FF3173CA3279\u0026cc=1\u0026ck=1\u0026cl=24-bit\u0026ds=1280x1024\u0026vl=1024\u0026et=0\u0026ja=0\u0026ln=en-us\u0026lo=0\u0026rnd=194470790\u0026si=d9bb8c3e0a8ddf6347b7d9d99b109ee0\u0026v=1.3.2\u0026lv=1\u0026sn=23807\u0026r=0\u0026ww=1280\u0026u=https%3A%2F%2Fwww.hjft-wahtsapp.com%2F\u0026tt=403 HTTP/1.1\r\nHost: hm.baidu.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://www.hjft-wahtsapp.com/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nCache-Control: private, max-age=0, no-cache\r\nContent-Length: 43\r\nContent-Type: image/gif\r\nDate: Tue, 25 Nov 2025 18:22:17 GMT\r\nP3p: CP=\"CURa ADMa DEVa PSAo PSDo OUR BUS UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR\"\r\nPragma: no-cache\r\nServer: apache\r\nSet-Cookie: HMACCOUNT=860976E3694DCFAA; Path=/; Domain=hm.baidu.com; Expires=Sun, 18 Jan 2038 00:00:00 GMT\r\nStrict-Transport-Security: max-age=172800\r\nX-Content-Type-Options: nosniff\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Apache HTTP Server","description":"Apache is a free and open-source cross-platform web server software.","website":"https://httpd.apache.org/","common_platform_enumeration":"cpe:2.3:a:apache:http_server:*:*:*:*:*:*:*:*","icon":"Apache.svg","categories":["Web servers"]}],"data":{"size":43,"size_decoded":0,"mime_type":"image/gif","magic":"GIF image data, version 89a, 1 x 1","md5":"ad4b0f606e0f8465bc4c4c170b37e1a3","sha1":"50b30fd5f87c85fe5cba2635cb83316ca71250d7","sha256":"cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda","sha512":"ebfe0c0df4bcc167d5cb6ebdd379f9083df62bef63a23818e1c6adf0f64b65467ea58b7cd4d03cf0a1b1a2b07fb7b969bf35f25f1f8538cc65cf3eebdf8a0910","ssdeep":"","tlshash":"15900003fbc08002c2b2e0300b3b0380238ce2200aa8030b80aeb0acecaa3a20c03020","first_seen":"2023-04-05T02:54:03Z","last_seen":"2026-08-12T21:13:09.722696Z","times_seen":376664,"resource_available":true,"data":null}},"time_used":291,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":291,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}}]}