{"report_id":"c6b3ec79-cb0d-4f11-bc83-81b9216d4527","version":0,"status":"done","tags":["phishing","suspicious"],"date":"2026-08-26T09:58:21Z","url":{"schema":"http","addr":"apinchofjoy.com/xibeldsdeals.html","fqdn":"apinchofjoy.com","domain":"apinchofjoy.com","tld":"com"},"ip":{"addr":"104.243.32.48","port":0,"asn":23470,"as":"RELIABLESITE","country":"United States","country_code":"US"},"final":{"url":{"schema":"https","addr":"apinchofjoy.com/xibeldsdeals.html","fqdn":"apinchofjoy.com","domain":"apinchofjoy.com","tld":"com"},"title":"Webmail Portal Access","dom":{"size":32276,"mime_type":"text/html; charset=utf-8","magic":"HTML document, ASCII text, with very long lines (21422)","md5":"1eadf6bf470046d30575e0088acd924f","sha1":"bac89951455463c8b0b27c1c95e9593bdcfdd99f","sha256":"e9173cfcd1cf59834fb3d4c3ae6060064c11a3b7f159746d8478194da319239c","sha512":"0068b09e8955ee8bc9b08ba8890db6441e82515fc609e04113c4f40381d94c5d3c17fbe125a3d806a094e67b638815306232baa3bf2ced1e75c1828ef474e3af","ssdeep":"768:F9hyS5LTGja1vEwk4mEuglurKRoBZCGewOoGQ:FPSjatEwDxlurxBZCSFGQ","tlshash":"37e27d6296ef1d77205389d829ad868527ac0463430dcf6cbebd5184afc9b59e833b4c","dom_hash":"domhash52c0dd0b79913a24e9248c3e571ed48c","first_seen":"2026-08-24T21:30:04.126144Z","last_seen":"2026-08-26T09:58:30.240293Z","times_seen":2,"resource_available":false,"data":null}},"submit":{"url":{"schema":"http","addr":"apinchofjoy.com/xibeldsdeals.html","fqdn":"apinchofjoy.com","domain":"apinchofjoy.com","tld":"com"},"ip":{"addr":"104.243.32.48","port":0,"asn":23470,"as":"RELIABLESITE","country":"United States","country_code":"US"},"tags":null,"meta":null},"settings":{"access":"public","device_type":"desktop","expires_at":"2027-09-30T09:58:21Z","useragent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0","referer":"","cookies":null,"exit_node":"qguvgzjxzsgb3vs"},"stats":{"alert_count":{"ids":0,"urlquery":4,"analyzer":2}},"detection":{"ids":null,"analyzer":[{"sensor_name":"infosec_yara","sensor_type":"yara","title":"YARAhub by abuse.ch","description":"YARAhub by abuse.ch","scan_date":"2026-08-26","alert":"Detects file containing Telegram Bot API","trigger":"apinchofjoy.com/xibeldsdeals.html","verdict":"malware","severity":"medium","comment":"","link":"https://yaraify.abuse.ch/yarahub/","meta":{"author":"rectifyq","date":"2024-09-07","description":"Detects file containing Telegram Bot API","rule":"telegram_bot_api","yarahub_author_twitter":"@_rectifyq","yarahub_license":"CC0 1.0","yarahub_reference_md5":"9DA48D34DC999B4E05E0C6716A3B3B83","yarahub_rule_matching_tlp":"TLP:WHITE","yarahub_rule_sharing_tlp":"TLP:WHITE","yarahub_uuid":"58c9e4fe-d1e9-46ed-913c-dba943ac16d6"}},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-08-26","alert":"Sinkholed","trigger":"apinchofjoy.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":[{"sensor_name":"urlquery","alert":"Phishing - Generic phishing","verdict":"phishing","severity":"medium","comment":"","tags":["phishing"],"meta":null},{"sensor_name":"urlquery","alert":"Suspicious - Suspicious Javascript code","verdict":"suspicious","severity":"medium","comment":"","tags":["suspicious"],"meta":null},{"sensor_name":"urlquery","alert":"Phishing - Known Phishing Kit detected","verdict":"phishing","severity":"high","comment":"","tags":["phishing"],"meta":null},{"sensor_name":"urlquery","alert":"Phishing - Known Phishing Kit detected","verdict":"phishing","severity":"high","comment":"","tags":["phishing"],"meta":null}]},"summary":[{"fqdn":"stackpath.bootstrapcdn.com","ip":{"addr":"104.18.10.207","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"domain_registered":"2012-05-25","domain_rank":21970,"first_seen":"2018-04-05T04:41:29Z","last_seen":"2026-08-24T12:57:49.129453Z","alert_count":0,"request_count":2,"received_data":322442,"sent_data":1046,"comment":"","tags":null,"fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}]},{"fqdn":"ajax.googleapis.com","ip":{"addr":"142.251.38.106","port":443,"asn":15169,"as":"GOOGLE","country":"United States","country_code":"US"},"domain_registered":"2005-01-25","domain_rank":3691,"first_seen":"2012-05-22T10:38:03Z","last_seen":"2026-08-24T08:39:13.43974Z","alert_count":0,"request_count":1,"received_data":86562,"sent_data":486,"comment":"","tags":null,"fingerprints":null},{"fqdn":"apinchofjoy.com","ip":{"addr":"104.243.32.48","port":443,"asn":23470,"as":"RELIABLESITE","country":"United States","country_code":"US"},"domain_registered":"2011-08-17","domain_rank":2013793,"first_seen":"2026-03-28T06:07:43.866413Z","last_seen":"2026-08-24T21:30:03.407367Z","alert_count":7,"request_count":2,"received_data":34501,"sent_data":1024,"comment":"","tags":null,"fingerprints":[{"name":"Apache HTTP Server","description":"Apache is a free and open-source cross-platform web server software.","website":"https://httpd.apache.org/","common_platform_enumeration":"cpe:2.3:a:apache:http_server:*:*:*:*:*:*:*:*","icon":"Apache.svg","categories":["Web servers"]},{"name":"Endurance Page Cache","description":"Endurance Page Cache adds basic file-based caching to WordPress.","website":"https://github.com/bluehost/endurance-page-cache","common_platform_enumeration":"","icon":"endurance-cache.png","categories":["WordPress plugins","Caching"]},{"name":"Google Hosted Libraries","description":"Google Hosted Libraries is a stable, reliable, high-speed, globally available content distribution network for the most popular, open-source JavaScript libraries.","website":"https://developers.google.com/speed/libraries","common_platform_enumeration":"","icon":"Google Developers.svg","categories":["CDN"]},{"name":"jQuery:2.2.4","description":"jQuery is a JavaScript library which is a free, open-source software designed to simplify HTML DOM tree traversal and manipulation, as well as event handling, CSS animation, and Ajax.","website":"https://jquery.com","common_platform_enumeration":"cpe:2.3:a:jquery:jquery:*:*:*:*:*:*:*:*","icon":"jQuery.svg","categories":["JavaScript libraries"]},{"name":"Bootstrap:4.5.2","description":"Bootstrap is a free and open-source CSS framework directed at responsive, mobile-first front-end web development. It contains CSS and JavaScript-based design templates for typography, forms, buttons, navigation, and other interface components.","website":"https://getbootstrap.com","common_platform_enumeration":"cpe:2.3:a:getbootstrap:bootstrap:*:*:*:*:*:*:*:*","icon":"Bootstrap.svg","categories":["UI frameworks"]}]}],"files":null,"artifacts":{"windows_shortcuts":null,"files":null,"telegram":null,"pdfs":null,"clipboard":null},"sensors":{"ids":null,"analyzer":null,"urlquery":[{"sensor_name":"urlquery","alert":"Phishing - Generic phishing","verdict":"phishing","severity":"medium","comment":"","tags":["phishing"],"meta":null},{"sensor_name":"urlquery","alert":"Suspicious - Suspicious Javascript code","verdict":"suspicious","severity":"medium","comment":"","tags":["suspicious"],"meta":null},{"sensor_name":"urlquery","alert":"Phishing - Known Phishing Kit detected","verdict":"phishing","severity":"high","comment":"","tags":["phishing"],"meta":null}]},"javascript":{"script":[{"url":{"schema":"https","addr":"apinchofjoy.com/xibeldsdeals.html","fqdn":"apinchofjoy.com","domain":"apinchofjoy.com","tld":"com"},"ip":{"addr":"104.243.32.48","port":443,"asn":23470,"as":"RELIABLESITE","country":"United States","country_code":"US"},"introduction_type":"eventHandler","is_inline":false,"md5":"85eb31bb532b85f3727b92dbd9932f47","sha1":"4164d36a57c3662abe3d232635bb22c86fd03aa8","sha256":"04a2138913713ecb511f39ce3428f1896922d972193e970cb811f4b2440218c8","sha512":"5aa12323c93fb59a84d203eb05753f256f809d0a57e264cbb78c66a8eeb38aeee3a5867b6eacbe8b054b46758932d6e550863e14ae96dabfe7db4e863c5b8366","ssdeep":"","tlshash":"4550000c00cc000c000000000c00f00000c000003000c00000300003c000c003c00000","size":9,"data":"","first_seen":"2024-04-07T16:57:27Z","last_seen":"2026-08-26T09:58:30.250194Z","times_seen":197,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"ajax.googleapis.com/ajax/libs/jquery/2.2.4/jquery.min.js","fqdn":"ajax.googleapis.com","domain":"ajax.googleapis.com","tld":"googleapis.com"},"ip":{"addr":"142.251.38.106","port":443,"asn":15169,"as":"GOOGLE","country":"United States","country_code":"US"},"introduction_type":"scriptElement","is_inline":false,"md5":"2f6b11a7e914718e0290410e85366fe9","sha1":"69bb69e25ca7d5ef0935317584e6153f3fd9a88c","sha256":"05b85d96f41fff14d8f608dad03ab71e2c1017c2da0914d7c59291bad7a54f8e","sha512":"0d40bccaa59fedecf7243d63b33c42592541d0330fefc78ec81a4c6b9689922d5b211011ca4be23ae22621cce4c658f52a1552c92d7ac3615241eb640f8514db","ssdeep":"1536:EYE1JVoiB9JqZdXXe2pD3PgoIiulrUndZ6a4tfOR7WpfWBZ2BJda4w9W3qG9a986:v4J+OlfOhWppCW6G9a98Hr2","tlshash":"1e83c6d9b2d6706297b734b850bf410bb17a98dab44c8c60f059d4e47eb4a8e507bf2c","size":85578,"data":"","first_seen":"2023-03-07T01:02:00Z","last_seen":"2026-08-26T12:36:16.981523Z","times_seen":295348,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"apinchofjoy.com/xibeldsdeals.html","fqdn":"apinchofjoy.com","domain":"apinchofjoy.com","tld":"com"},"ip":{"addr":"104.243.32.48","port":443,"asn":23470,"as":"RELIABLESITE","country":"United States","country_code":"US"},"introduction_type":"scriptElement","is_inline":true,"md5":"98255dfa0d9221ef22188f70e7c068d8","sha1":"c85eae2d0517b30b118b6befac2a4a86f5e72e69","sha256":"a55ceeeb0de157d629473bfdeb0933c00787100aec1846f03130c247df22bc4c","sha512":"aa3c18d7518e491569a681d266086579f46226873e5cfdfef68385d15ffe9c35f0cea0b8c61fdcad51e98560eabc5bb23662009b4d0e9a6685181e988da3352f","ssdeep":"","tlshash":"ba5143d1e3dd21ab107261ba287f928832bd493f5804dd04fc7cd418bf98f2ab566885","size":2884,"data":"","first_seen":"2026-08-24T21:30:04.133306Z","last_seen":"2026-08-26T09:58:30.252177Z","times_seen":2,"alerts":{"ids":null,"analyzer":[{"sensor_name":"infosec_yara","sensor_type":"yara","title":"YARAhub by abuse.ch","description":"YARAhub by abuse.ch","scan_date":"2026-08-26","alert":"Detects file containing Telegram Bot API","trigger":"apinchofjoy.com/xibeldsdeals.html","verdict":"malware","severity":"medium","comment":"","link":"https://yaraify.abuse.ch/yarahub/","meta":{"author":"rectifyq","date":"2024-09-07","description":"Detects file containing Telegram Bot API","rule":"telegram_bot_api","yarahub_author_twitter":"@_rectifyq","yarahub_license":"CC0 1.0","yarahub_reference_md5":"9DA48D34DC999B4E05E0C6716A3B3B83","yarahub_rule_matching_tlp":"TLP:WHITE","yarahub_rule_sharing_tlp":"TLP:WHITE","yarahub_uuid":"58c9e4fe-d1e9-46ed-913c-dba943ac16d6"}}],"urlquery":null}}],"eval":null,"write":null,"console":null},"http":[{"url":{"schema":"https","addr":"stackpath.bootstrapcdn.com/bootstrap/4.5.2/css/bootstrap.min.css","fqdn":"stackpath.bootstrapcdn.com","domain":"bootstrapcdn.com","tld":"com"},"ip":{"addr":"104.18.10.207","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://apinchofjoy.com/xibeldsdeals.html","date":"2026-08-26T09:57:54.637Z","timestamp":1787738274637,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"bootstrapcdn.com","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Wed, 01 Jul 2026 06:33:56 GMT","end":"Tue, 29 Sep 2026 07:33:46 GMT"},"fingerprint":{"sha1":"95:C5:B1:CC:FD:2D:A2:1D:9E:F8:29:11:70:8F:C2:32:DB:0A:16:D8","sha256":"67:23:C0:55:AC:EE:9D:BF:1F:32:F6:C6:31:3A:5A:3F:85:B5:50:88:71:96:38:D1:BB:37:21:B0:0C:CF:B9:EA"}}},"request":{"raw":"GET /bootstrap/4.5.2/css/bootstrap.min.css HTTP/1.1\r\nHost: stackpath.bootstrapcdn.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-Fetch-Storage-Access: none\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://apinchofjoy.com/\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPriority: u=2\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\ndate: Wed, 26 Aug 2026 09:57:54 GMT\r\ncontent-type: text/css; charset=utf-8\r\npriority: u=2,i=?0\r\nserver: cloudflare\r\ncdn-pullzone: 252412\r\ncdn-requestcountrycode: DE\r\nvary: Accept-Encoding\r\naccess-control-allow-origin: *\r\ncache-control: public, max-age=31919000\r\ncontent-encoding: br\r\netag: \"816af0eddd3b4822c2756227c7e7b7ee\"\r\nlast-modified: Mon, 25 Jan 2021 22:04:11 GMT\r\ncdn-cachedat: 08/01/2025 14:01:30\r\ncdn-proxyver: 1.33\r\ncdn-requestpullcode: 200\r\ncdn-requestpullsuccess: True\r\ncdn-edgestorageid: 1333\r\ntiming-allow-origin: *\r\ncross-origin-resource-policy: cross-origin\r\nx-content-type-options: nosniff\r\ncdn-status: 200\r\ncdn-requesttime: 0\r\ncdn-requestid: e13c975a97cf1d979719c9c3a6826594\r\ncdn-cache: HIT\r\nage: 140769\r\ncf-cache-status: HIT\r\nstrict-transport-security: max-age=31536000; includeSubDomains; preload\r\ncf-ray: a311f9989a7056bd-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":160302,"size_decoded":25819,"mime_type":"text/css; charset=utf-8","magic":"ASCII text, with very long lines (65326)","md5":"816af0eddd3b4822c2756227c7e7b7ee","sha1":"c470239d4c7db36d56dc3a74a080c62218c6edc4","sha256":"5b0fbe5b7ad705f6a937c4998ad02f73d8f0d976fe231b74aef0ec996990c93a","sha512":"32844d968c5b4ad05c0fccf733fd819a74feae0e08b0cc4f917686876cc3e8b18d34513cd16de89ec02145c30032b4a8c962fdc43ec4aedd267a7eef47c2d466","ssdeep":"1536:V47CIJ0T2r+ryEIA1pDEBi8yNcuSEcA1/uypq3SYiLENM6HN26b:S7VSGGq3SYiLENM6HN26b","tlshash":"0bf353a6f5a0312de4a7c61964d0bafd152f8245d7224bfbf827376487892c70a73e4c","first_seen":"2023-04-05T03:15:58Z","last_seen":"2026-08-26T09:58:30.244549Z","times_seen":14754,"resource_available":false,"data":null}},"time_used":35,"timings":{"blocked":-1,"dns":3,"connect":14,"send":0,"wait":18,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"ajax.googleapis.com/ajax/libs/jquery/2.2.4/jquery.min.js","fqdn":"ajax.googleapis.com","domain":"ajax.googleapis.com","tld":"googleapis.com"},"ip":{"addr":"142.251.38.106","port":443,"asn":15169,"as":"GOOGLE","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://apinchofjoy.com/xibeldsdeals.html","date":"2026-08-26T09:57:54.640Z","timestamp":1787738274640,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"upload.video.google.com","organization":""},"issuer":{"commonName":"WR2","organization":"Google Trust Services"},"validity":{"start":"Wed, 05 Aug 2026 20:43:45 GMT","end":"Wed, 28 Oct 2026 20:43:44 GMT"},"fingerprint":{"sha1":"1E:50:A8:26:86:57:06:AF:03:D0:36:74:91:62:52:AE:87:D0:50:0C","sha256":"18:6F:33:F9:74:07:4C:C9:5D:94:38:03:B5:86:40:07:10:6F:E2:91:F9:CC:9C:DC:92:11:AA:41:F7:ED:5A:8E"}}},"request":{"raw":"GET /ajax/libs/jquery/2.2.4/jquery.min.js HTTP/1.1\r\nHost: ajax.googleapis.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-Fetch-Storage-Access: none\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://apinchofjoy.com/\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\naccept-ranges: bytes\r\ncontent-encoding: gzip\r\naccess-control-allow-origin: *\r\ncontent-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/hosted-libraries-pushers\r\ncross-origin-resource-policy: cross-origin\r\ncross-origin-opener-policy: same-origin; report-to=\"hosted-libraries-pushers\"\r\nreport-to: {\"group\":\"hosted-libraries-pushers\",\"max_age\":2592000,\"endpoints\":[{\"url\":\"https://csp.withgoogle.com/csp/report-to/hosted-libraries-pushers\"}]}\r\ntiming-allow-origin: *\r\ncontent-length: 30028\r\nx-content-type-options: nosniff\r\nserver: sffe\r\nx-xss-protection: 0\r\ndate: Tue, 25 Aug 2026 04:10:15 GMT\r\nexpires: Wed, 25 Aug 2027 04:10:15 GMT\r\ncache-control: public, max-age=31536000, stale-while-revalidate=2592000\r\nlast-modified: Tue, 03 Mar 2020 19:15:00 GMT\r\ncontent-type: text/javascript; charset=UTF-8\r\nvary: Accept-Encoding\r\nage: 107259\r\nalt-svc: h3=\":443\"; ma=2592000,h3-29=\":443\"; ma=2592000\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":null,"data":{"size":85578,"size_decoded":31012,"mime_type":"text/javascript; charset=UTF-8","magic":"JavaScript source, ASCII text, with very long lines (32065)","md5":"2f6b11a7e914718e0290410e85366fe9","sha1":"69bb69e25ca7d5ef0935317584e6153f3fd9a88c","sha256":"05b85d96f41fff14d8f608dad03ab71e2c1017c2da0914d7c59291bad7a54f8e","sha512":"0d40bccaa59fedecf7243d63b33c42592541d0330fefc78ec81a4c6b9689922d5b211011ca4be23ae22621cce4c658f52a1552c92d7ac3615241eb640f8514db","ssdeep":"1536:EYE1JVoiB9JqZdXXe2pD3PgoIiulrUndZ6a4tfOR7WpfWBZ2BJda4w9W3qG9a986:v4J+OlfOhWppCW6G9a98Hr2","tlshash":"1e83c6d9b2d6706297b734b850bf410bb17a98dab44c8c60f059d4e47eb4a8e507bf2c","first_seen":"2023-03-07T01:02:00Z","last_seen":"2026-08-26T12:36:16.981523Z","times_seen":295348,"resource_available":true,"data":null}},"time_used":60,"timings":{"blocked":-1,"dns":10,"connect":8,"send":0,"wait":11,"receive":8,"ssl":23},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"stackpath.bootstrapcdn.com/bootstrap/4.5.2/css/bootstrap.min.css","fqdn":"stackpath.bootstrapcdn.com","domain":"bootstrapcdn.com","tld":"com"},"ip":{"addr":"104.18.10.207","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://apinchofjoy.com/xibeldsdeals.html","date":"2026-08-26T09:57:54.642Z","timestamp":1787738274642,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"bootstrapcdn.com","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Wed, 01 Jul 2026 06:33:56 GMT","end":"Tue, 29 Sep 2026 07:33:46 GMT"},"fingerprint":{"sha1":"95:C5:B1:CC:FD:2D:A2:1D:9E:F8:29:11:70:8F:C2:32:DB:0A:16:D8","sha256":"67:23:C0:55:AC:EE:9D:BF:1F:32:F6:C6:31:3A:5A:3F:85:B5:50:88:71:96:38:D1:BB:37:21:B0:0C:CF:B9:EA"}}},"request":{"raw":"GET /bootstrap/4.5.2/css/bootstrap.min.css HTTP/1.1\r\nHost: stackpath.bootstrapcdn.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-Fetch-Storage-Access: none\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://apinchofjoy.com/\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPriority: u=2\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\ndate: Wed, 26 Aug 2026 09:57:54 GMT\r\ncontent-type: text/css; charset=utf-8\r\npriority: u=2,i=?0\r\nserver: cloudflare\r\ncdn-pullzone: 252412\r\ncdn-requestcountrycode: DE\r\nvary: Accept-Encoding\r\naccess-control-allow-origin: *\r\ncache-control: public, max-age=31919000\r\ncontent-encoding: br\r\netag: \"816af0eddd3b4822c2756227c7e7b7ee\"\r\nlast-modified: Mon, 25 Jan 2021 22:04:11 GMT\r\ncdn-cachedat: 08/01/2025 14:01:30\r\ncdn-proxyver: 1.33\r\ncdn-requestpullcode: 200\r\ncdn-requestpullsuccess: True\r\ncdn-edgestorageid: 1333\r\ntiming-allow-origin: *\r\ncross-origin-resource-policy: cross-origin\r\nx-content-type-options: nosniff\r\ncdn-status: 200\r\ncdn-requesttime: 0\r\ncdn-requestid: e13c975a97cf1d979719c9c3a6826594\r\ncdn-cache: HIT\r\nage: 140769\r\ncf-cache-status: HIT\r\nstrict-transport-security: max-age=31536000; includeSubDomains; preload\r\ncf-ray: a311f9989a7156bd-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":160302,"size_decoded":25819,"mime_type":"text/css; charset=utf-8","magic":"ASCII text, with very long lines (65326)","md5":"816af0eddd3b4822c2756227c7e7b7ee","sha1":"c470239d4c7db36d56dc3a74a080c62218c6edc4","sha256":"5b0fbe5b7ad705f6a937c4998ad02f73d8f0d976fe231b74aef0ec996990c93a","sha512":"32844d968c5b4ad05c0fccf733fd819a74feae0e08b0cc4f917686876cc3e8b18d34513cd16de89ec02145c30032b4a8c962fdc43ec4aedd267a7eef47c2d466","ssdeep":"1536:V47CIJ0T2r+ryEIA1pDEBi8yNcuSEcA1/uypq3SYiLENM6HN26b:S7VSGGq3SYiLENM6HN26b","tlshash":"0bf353a6f5a0312de4a7c61964d0bafd152f8245d7224bfbf827376487892c70a73e4c","first_seen":"2023-04-05T03:15:58Z","last_seen":"2026-08-26T09:58:30.244549Z","times_seen":14754,"resource_available":false,"data":null}},"time_used":59,"timings":{"blocked":5,"dns":0,"connect":0,"send":0,"wait":17,"receive":37,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"apinchofjoy.com/favicon.ico","fqdn":"apinchofjoy.com","domain":"apinchofjoy.com","tld":"com"},"ip":{"addr":"104.243.32.48","port":443,"asn":23470,"as":"RELIABLESITE","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://apinchofjoy.com/xibeldsdeals.html","date":"2026-08-26T09:57:54.748Z","timestamp":1787738274748,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"apinchofjoy.com","organization":""},"issuer":{"commonName":"YR1","organization":"Let's Encrypt"},"validity":{"start":"Wed, 15 Jul 2026 01:31:19 GMT","end":"Tue, 13 Oct 2026 01:31:18 GMT"},"fingerprint":{"sha1":"01:CB:1A:A3:7D:3F:5B:60:04:BC:0E:BE:A1:E7:72:6F:C5:E5:99:43","sha256":"98:38:15:CA:D7:D3:6E:6B:28:19:2F:3E:43:FD:9C:19:5B:20:FA:A3:CE:8A:CF:F3:87:71:BD:62:52:E6:51:BE"}}},"request":{"raw":"GET /favicon.ico HTTP/1.1\r\nHost: apinchofjoy.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://apinchofjoy.com/xibeldsdeals.html\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=6\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nlast-modified: Thu, 23 Jul 2020 12:37:26 GMT\r\naccept-ranges: bytes\r\ncache-control: max-age=31536000\r\nexpires: Thu, 26 Aug 2027 09:57:54 GMT\r\ncontent-encoding: gzip\r\nx-endurance-cache-level: 3\r\nx-nginx-cache: WordPress\r\ncontent-length: 895\r\ncontent-type: image/x-icon\r\ndate: Wed, 26 Aug 2026 09:57:54 GMT\r\nserver: Apache\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Apache HTTP Server","description":"Apache is a free and open-source cross-platform web server software.","website":"https://httpd.apache.org/","common_platform_enumeration":"cpe:2.3:a:apache:http_server:*:*:*:*:*:*:*:*","icon":"Apache.svg","categories":["Web servers"]},{"name":"Endurance Page Cache","description":"Endurance Page Cache adds basic file-based caching to WordPress.","website":"https://github.com/bluehost/endurance-page-cache","common_platform_enumeration":"","icon":"endurance-cache.png","categories":["WordPress plugins","Caching"]}],"data":{"size":1150,"size_decoded":1251,"mime_type":"image/x-icon","magic":"MS Windows icon resource - 1 icon, 16x16, 32 bits/pixel","md5":"ecd280e82296af8cdb574963511af731","sha1":"7573cfd72be08e43970116814f3daf306f5a59a2","sha256":"b9e83d3546424cc208f7b89c7a50af647e3dc5d270687575e56f3d4af7a70c3d","sha512":"2742acdbf7ef9567325885f97574a56e8699f4283b1127d301c33ea76a50e6621295a094a6f49c94e0f1047e6b901d330d49f88b46133bd9c9727a6cbb6c2f8c","ssdeep":"","tlshash":"c02154401544e836c88412b4c1376df39926cfb9c86505034d6a7ecd7c724a59be2d49","first_seen":"2023-09-26T17:43:58Z","last_seen":"2026-08-26T09:58:30.246564Z","times_seen":407,"resource_available":false,"data":null}},"time_used":90,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":90,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-08-26","alert":"Sinkholed","trigger":"apinchofjoy.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":[{"sensor_name":"urlquery","alert":"Phishing - Known Phishing Kit detected","verdict":"phishing","severity":"high","comment":"","tags":["phishing"],"meta":null}]}},{"url":{"schema":"https","addr":"apinchofjoy.com/xibeldsdeals.html","fqdn":"apinchofjoy.com","domain":"apinchofjoy.com","tld":"com"},"ip":{"addr":"104.243.32.48","port":443,"asn":23470,"as":"RELIABLESITE","country":"United States","country_code":"US"},"is_navigation_request":true,"resource_type":"document","requested_by":"","date":"2026-08-26T09:57:53.865Z","timestamp":1787738273865,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"apinchofjoy.com","organization":""},"issuer":{"commonName":"YR1","organization":"Let's Encrypt"},"validity":{"start":"Wed, 15 Jul 2026 01:31:19 GMT","end":"Tue, 13 Oct 2026 01:31:18 GMT"},"fingerprint":{"sha1":"01:CB:1A:A3:7D:3F:5B:60:04:BC:0E:BE:A1:E7:72:6F:C5:E5:99:43","sha256":"98:38:15:CA:D7:D3:6E:6B:28:19:2F:3E:43:FD:9C:19:5B:20:FA:A3:CE:8A:CF:F3:87:71:BD:62:52:E6:51:BE"}}},"request":{"raw":"GET /xibeldsdeals.html HTTP/1.1\r\nHost: apinchofjoy.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nUpgrade-Insecure-Requests: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: document\r\nSec-Fetch-Mode: navigate\r\nSec-Fetch-Site: none\r\nPriority: u=0, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nlast-modified: Mon, 24 Aug 2026 07:23:01 GMT\r\naccept-ranges: bytes\r\ncontent-encoding: gzip\r\nx-endurance-cache-level: 3\r\nx-nginx-cache: WordPress\r\ncontent-length: 20109\r\ncontent-type: text/html\r\ndate: Wed, 26 Aug 2026 09:57:54 GMT\r\nserver: Apache\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Google Hosted Libraries","description":"Google Hosted Libraries is a stable, reliable, high-speed, globally available content distribution network for the most popular, open-source JavaScript libraries.","website":"https://developers.google.com/speed/libraries","common_platform_enumeration":"","icon":"Google Developers.svg","categories":["CDN"]},{"name":"jQuery:2.2.4","description":"jQuery is a JavaScript library which is a free, open-source software designed to simplify HTML DOM tree traversal and manipulation, as well as event handling, CSS animation, and Ajax.","website":"https://jquery.com","common_platform_enumeration":"cpe:2.3:a:jquery:jquery:*:*:*:*:*:*:*:*","icon":"jQuery.svg","categories":["JavaScript libraries"]},{"name":"Apache HTTP Server","description":"Apache is a free and open-source cross-platform web server software.","website":"https://httpd.apache.org/","common_platform_enumeration":"cpe:2.3:a:apache:http_server:*:*:*:*:*:*:*:*","icon":"Apache.svg","categories":["Web servers"]},{"name":"Endurance Page Cache","description":"Endurance Page Cache adds basic file-based caching to WordPress.","website":"https://github.com/bluehost/endurance-page-cache","common_platform_enumeration":"","icon":"endurance-cache.png","categories":["WordPress plugins","Caching"]},{"name":"Bootstrap:4.5.2","description":"Bootstrap is a free and open-source CSS framework directed at responsive, mobile-first front-end web development. It contains CSS and JavaScript-based design templates for typography, forms, buttons, navigation, and other interface components.","website":"https://getbootstrap.com","common_platform_enumeration":"cpe:2.3:a:getbootstrap:bootstrap:*:*:*:*:*:*:*:*","icon":"Bootstrap.svg","categories":["UI frameworks"]}],"data":{"size":32713,"size_decoded":20391,"mime_type":"text/html","magic":"HTML document, ASCII text, with very long lines (21422), with CRLF line terminators","md5":"c280e13e890e590c5670251a395cfb42","sha1":"bb31635458db4b1f5568eb4da2b0e2cecce02311","sha256":"0ba038b9c97b343b7b0ebe5b6640de29364b155e5286876e0bad12118ee7fdae","sha512":"eb982d3c6901b70405a2eb31207a9039df4c682c6a2c29db6b9ad21cfff26ce0d6c2056cf7370c30211da9b2797df6980c8a0d2e05111fce9ccdfa59ff6300eb","ssdeep":"768:jhvSTTGja1vEwk4mEuglurKRoBZCGewOKVI:j0SjatEwDxlurxBZCSjVI","tlshash":"88e27d65a18d1e671133cae427744685ff9884334305cf6cbaec5180aff9b29a933b8c","first_seen":"2026-08-24T21:30:04.130298Z","last_seen":"2026-08-26T09:58:30.24828Z","times_seen":2,"resource_available":false,"data":null}},"time_used":358,"timings":{"blocked":-1,"dns":4,"connect":87,"send":0,"wait":173,"receive":2,"ssl":91},"alerts":{"ids":null,"analyzer":[{"sensor_name":"infosec_yara","sensor_type":"yara","title":"YARAhub by abuse.ch","description":"YARAhub by abuse.ch","scan_date":"2026-08-26","alert":"Detects file containing Telegram Bot API","trigger":"apinchofjoy.com/xibeldsdeals.html","verdict":"malware","severity":"medium","comment":"","link":"https://yaraify.abuse.ch/yarahub/","meta":{"author":"rectifyq","date":"2024-09-07","description":"Detects file containing Telegram Bot API","rule":"telegram_bot_api","yarahub_author_twitter":"@_rectifyq","yarahub_license":"CC0 1.0","yarahub_reference_md5":"9DA48D34DC999B4E05E0C6716A3B3B83","yarahub_rule_matching_tlp":"TLP:WHITE","yarahub_rule_sharing_tlp":"TLP:WHITE","yarahub_uuid":"58c9e4fe-d1e9-46ed-913c-dba943ac16d6"}},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-08-26","alert":"Sinkholed","trigger":"apinchofjoy.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":[{"sensor_name":"urlquery","alert":"Phishing - Generic phishing","verdict":"phishing","severity":"medium","comment":"","tags":["phishing"],"meta":null},{"sensor_name":"urlquery","alert":"Suspicious - Suspicious Javascript code","verdict":"suspicious","severity":"medium","comment":"","tags":["suspicious"],"meta":null},{"sensor_name":"urlquery","alert":"Phishing - Known Phishing Kit detected","verdict":"phishing","severity":"high","comment":"","tags":["phishing"],"meta":null}]}}]}