{"report_id":"c9a53937-7fc1-4fef-a59f-7138c5186311","version":0,"status":"done","tags":[],"date":"2026-07-17T08:44:18Z","url":{"schema":"https","addr":"fortsk.cc/","fqdn":"fortsk.cc","domain":"fortsk.cc","tld":"cc"},"ip":{"addr":"193.187.110.3","port":0,"asn":7029,"as":"WINDSTREAM","country":"United States","country_code":"US"},"final":{"url":{"schema":"https","addr":"fortsk.cc/.rt/challenge?tier=captcha\u0026return_to=%2F","fqdn":"fortsk.cc","domain":"fortsk.cc","tld":"cc"},"title":"Loading","dom":{"size":2566585,"mime_type":"text/html; charset=utf-8","magic":"HTML document, Unicode text, UTF-8 text, with very long lines (51216)","md5":"af936c5db16af6b6f358f523f6562b90","sha1":"9eab8d9d4e5abaf26441aad8054c1eca427eafbb","sha256":"f5f00faa79f37c9098a56f56ca4e5b1523028b0b4a94bc5f20584e6c4b5cb5d3","sha512":"d310713eb5c13c2757abbcfcafb2ecf08d020b9a19c9d1d72311ce751e2cf599358c0d9cd71ded7198e5091dfac90a1e39fbfaa0dfedef5577515a4f9dc97d41","ssdeep":"12288:ZSzOzDcQ4NsLvOoy0QWslJhpe7LwRsYaB4GoBZzECp2eGdxXD6EjYc7oMmRd1SZT:ZzPcQ5DVy0MlJhpwLwWYaBizFM","tlshash":"cec5a4963991b65e00878b713a4e56f558bfc505c5cfa04df988aeecf0dceb229883c5","dom_hash":"domhashd9fedc4cc384579a446a5266c87bb20c","first_seen":"2026-07-17T08:46:11.63894Z","last_seen":"2026-07-17T08:46:11.63894Z","times_seen":1,"resource_available":false,"data":null}},"submit":{"url":{"schema":"https","addr":"fortsk.cc/","fqdn":"fortsk.cc","domain":"fortsk.cc","tld":"cc"},"ip":{"addr":"193.187.110.3","port":0,"asn":7029,"as":"WINDSTREAM","country":"United States","country_code":"US"},"tags":null,"meta":null},"settings":{"access":"public","device_type":"desktop","expires_at":"2027-08-21T08:44:18Z","useragent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0","referer":"","cookies":null,"exit_node":"qguvgzjxzsgb3vs"},"stats":{"alert_count":{"ids":0,"urlquery":0,"analyzer":2}},"detection":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-07-17","alert":"Sinkholed","trigger":"fortsk.cc","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-07-17","alert":"Sinkholed","trigger":"fortsk.cc","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null},"summary":[{"fqdn":"fortsk.cc","ip":{"addr":"193.187.110.3","port":443,"asn":7029,"as":"WINDSTREAM","country":"United States","country_code":"US"},"domain_registered":"2026-03-08","domain_rank":0,"first_seen":"2026-07-15T15:40:08.783714Z","last_seen":"2026-07-15T15:40:08.783714Z","alert_count":6,"request_count":3,"received_data":2351263,"sent_data":2390,"comment":"","tags":null,"fingerprints":null}],"files":null,"artifacts":{"windows_shortcuts":null,"files":null,"telegram":null,"pdfs":null,"clipboard":null},"sensors":{"ids":null,"analyzer":null,"urlquery":null},"javascript":{"script":[{"url":{"schema":"https","addr":"fortsk.cc/.rt/challenge?tier=captcha\u0026return_to=%2F","fqdn":"fortsk.cc","domain":"fortsk.cc","tld":"cc"},"ip":{"addr":"193.187.110.3","port":443,"asn":7029,"as":"WINDSTREAM","country":"United States","country_code":"US"},"introduction_type":"scriptElement","is_inline":true,"md5":"b60cebbe824595547aa42255815327e4","sha1":"4438ce6a7960932f8af110a4f35ab5d7288efe87","sha256":"9a29add76438a1d165822ccebdf5bcdf8bc9256384b38c01eb20f80ff44118d3","sha512":"842ce89862d77987e61bd7f4282e829ec6d0274c11dd2431f3bd74f36490aa454944763e728b53b5aad034ac00fea7fdeedfe8546dd7bf8d07c08613227f8ce0","ssdeep":"12288:CZzECp2eGdxXD6EjYc7oMmRd1SZFan8wH2IDDEsnoQdSQx96udQoatoSgFt:SzFt","tlshash":"0da531963991b65e00878b713a4e56f558bfc505c6cfa04df9889eecf0dceb229883c5","size":2246833,"data":"","first_seen":"2026-07-17T08:46:11.648387Z","last_seen":"2026-07-17T08:46:11.648387Z","times_seen":1,"alerts":{"ids":null,"analyzer":null,"urlquery":null}}],"eval":null,"write":null,"console":[{"level":"debug","text":"map[actor:server1.conn0.watcher14.process7//obj20 class:Object extensible:true frozen:false isError:false ownPropertyLength:0 preview:map[kind:Object ownProperties:map[] ownPropertiesLength:0] sealed:false type:object]","filename":"https://fortsk.cc/","line_number":746,"column_number":214},{"level":"debug","text":"","filename":"https://fortsk.cc/","line_number":750,"column_number":57}]},"http":[{"url":{"schema":"https","addr":"fortsk.cc/.rt/ce","fqdn":"fortsk.cc","domain":"fortsk.cc","tld":"cc"},"ip":{"addr":"193.187.110.3","port":443,"asn":7029,"as":"WINDSTREAM","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"fetch","requested_by":"https://fortsk.cc/.rt/challenge?tier=captcha\u0026return_to=%2F","date":"2026-07-17T08:43:50.616Z","timestamp":1784277830616,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"fortsk.cc","organization":""},"issuer":{"commonName":"E7","organization":"Let's Encrypt"},"validity":{"start":"Sun, 24 May 2026 09:20:17 GMT","end":"Sat, 22 Aug 2026 09:20:16 GMT"},"fingerprint":{"sha1":"36:37:C7:61:C3:44:F8:8B:9E:3B:DA:92:A6:CD:66:BB:B5:C0:F4:A0","sha256":"06:80:3F:8F:98:8B:B3:07:8B:6E:78:0B:7C:D0:31:48:AA:F0:F9:83:FA:8F:15:1D:7A:86:47:51:29:D9:74:D0"}}},"request":{"raw":"POST /.rt/ce HTTP/1.1\r\nHost: fortsk.cc\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nContent-Type: application/json\r\nReferer: https://fortsk.cc/.rt/challenge?tier=captcha\u0026return_to=%2F\r\nContent-Length: 139\r\nOrigin: https://fortsk.cc\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nCookie: sil_ses=b523c7f480afd582a91e9f7ff2ae1421; __Host-sil_ses=b523c7f480afd582a91e9f7ff2ae1421; sil_gate=ASBiNTIzYzdmNDgwYWZkNTgyYTkxZTlmN2ZmMmFlMTQyMQG8ts-lDe6THNNqWCQq.l4bZdrxij5PvWQVJDM_A3nK9Nzo0P3Xxp2A4batv2M47yEQkEPUcDorOny_TRhZoduLEV3SSuXajAjuCrEmyBw; __Host-sil_gate=ASBiNTIzYzdmNDgwYWZkNTgyYTkxZTlmN2ZmMmFlMTQyMQG8ts-lDe6THNNqWCQq.l4bZdrxij5PvWQVJDM_A3nK9Nzo0P3Xxp2A4batv2M47yEQkEPUcDorOny_TRhZoduLEV3SSuXajAjuCrEmyBw\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=4\r\n\r\n","headers":null,"cookies":null,"method":"POST","post_data":{"size":139,"data":"{\"p\":\"init\",\"cid\":\"7c3078f7601a18a91c1d658773d5cb3066d0e09b1b81f0443ee12f016abe9b23\",\"kind\":\"slide_puzzle\",\"subtle\":true,\"t\":1784277830615}"}},"response":{"raw":"HTTP/2 204 \r\ncontent-type: application/json\r\nx-incident-id: euwest1::1784277830-9U0azpJYYVJKCJmoRjoK7vSJ630omK5P\r\ndate: Fri, 17 Jul 2026 08:43:50 GMT\r\nalt-svc: clear\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"204","status_text":"","fingerprints":null,"data":{"size":0,"size_decoded":1256,"mime_type":"application/json","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-08-25T14:40:39.359248Z","times_seen":18097595,"resource_available":true,"data":null}},"time_used":16,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":16,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-07-17","alert":"Sinkholed","trigger":"fortsk.cc","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-07-17","alert":"Sinkholed","trigger":"fortsk.cc","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"fortsk.cc/","fqdn":"fortsk.cc","domain":"fortsk.cc","tld":"cc"},"ip":{"addr":"193.187.110.3","port":443,"asn":7029,"as":"WINDSTREAM","country":"United States","country_code":"US"},"is_navigation_request":true,"resource_type":"document","requested_by":"","date":"2026-07-17T08:43:48.440Z","timestamp":1784277828440,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"fortsk.cc","organization":""},"issuer":{"commonName":"E7","organization":"Let's Encrypt"},"validity":{"start":"Sun, 24 May 2026 09:20:17 GMT","end":"Sat, 22 Aug 2026 09:20:16 GMT"},"fingerprint":{"sha1":"36:37:C7:61:C3:44:F8:8B:9E:3B:DA:92:A6:CD:66:BB:B5:C0:F4:A0","sha256":"06:80:3F:8F:98:8B:B3:07:8B:6E:78:0B:7C:D0:31:48:AA:F0:F9:83:FA:8F:15:1D:7A:86:47:51:29:D9:74:D0"}}},"request":{"raw":"GET / HTTP/1.1\r\nHost: fortsk.cc\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nUpgrade-Insecure-Requests: 1\r\nSec-Fetch-Dest: document\r\nSec-Fetch-Mode: navigate\r\nSec-Fetch-Site: none\r\nPriority: u=0, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\ncontent-type: text/html; charset=utf-8\r\ncontent-length: 23850\r\ncache-control: no-store\r\nx-edge-action: challenge\r\nset-cookie: sil_ses=b523c7f480afd582a91e9f7ff2ae1421; Path=/; Domain=fortsk.cc; Max-Age=86400; HttpOnly; Secure; SameSite=None\n__Host-sil_ses=b523c7f480afd582a91e9f7ff2ae1421; Path=/; Max-Age=86400; HttpOnly; Secure; SameSite=None; Partitioned\nsil_gate=ASBiNTIzYzdmNDgwYWZkNTgyYTkxZTlmN2ZmMmFlMTQyMQC6ts-lDe6THNNqWCQq.dXj6wXSjzc3Dt7DU9CVWeCx9C6nGh5F5hZ_Y9UbdpsTV6vCDVojycC1iDHUJ9Vq_oiEbeNdgOijo6RQ0EiimAA; Path=/; Domain=fortsk.cc; Max-Age=600; HttpOnly; Secure; SameSite=None\n__Host-sil_gate=ASBiNTIzYzdmNDgwYWZkNTgyYTkxZTlmN2ZmMmFlMTQyMQC6ts-lDe6THNNqWCQq.dXj6wXSjzc3Dt7DU9CVWeCx9C6nGh5F5hZ_Y9UbdpsTV6vCDVojycC1iDHUJ9Vq_oiEbeNdgOijo6RQ0EiimAA; Path=/; Max-Age=600; HttpOnly; Secure; SameSite=None; Partitioned\r\ncontent-encoding: br\r\nvary: Accept-Encoding\r\ndate: Fri, 17 Jul 2026 08:43:49 GMT\r\nalt-svc: clear\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":null,"data":{"size":86227,"size_decoded":24810,"mime_type":"text/html; charset=utf-8","magic":"HTML document, Unicode text, UTF-8 text, with very long lines (12636)","md5":"c2ce8ad092fa9c4a85ccf311f949ed1c","sha1":"4661d94ceac5febb7d5a9200aae9b665ae4e5f78","sha256":"67333d275c7f98b1dac7d010e96b5f5c05267bece8d1b81c8e772a5f07d52c8d","sha512":"4fce09b8570bd070cbc64c14c0557fb7d1f305b34160e6861a390d0e9fc1f49e8a579a80062765582f4f7727a09b130ff3199f533443982e500d0ef886ab55f7","ssdeep":"768:GUAQ/p6WajPgGY+w66cTPR+16Tom5BSIi+3QkVDizYBcbNUYUHVGL1xIpmK66YGm:w20IMo2dRTOHTcxBKUB3uRfd","tlshash":"dc83b7f523b1305dc2730a7d369e11451abe8461cc8a94ccf96cfae467ea9132fa47d8","first_seen":"2026-07-17T08:46:11.64313Z","last_seen":"2026-07-17T08:46:11.64313Z","times_seen":1,"resource_available":true,"data":null}},"time_used":667,"timings":{"blocked":-1,"dns":237,"connect":14,"send":0,"wait":386,"receive":4,"ssl":25},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-07-17","alert":"Sinkholed","trigger":"fortsk.cc","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-07-17","alert":"Sinkholed","trigger":"fortsk.cc","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"fortsk.cc/.rt/challenge?tier=captcha\u0026return_to=%2F","fqdn":"fortsk.cc","domain":"fortsk.cc","tld":"cc"},"ip":{"addr":"193.187.110.3","port":443,"asn":7029,"as":"WINDSTREAM","country":"United States","country_code":"US"},"is_navigation_request":true,"resource_type":"document","requested_by":"","date":"2026-07-17T08:43:49.901Z","timestamp":1784277829901,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"fortsk.cc","organization":""},"issuer":{"commonName":"E7","organization":"Let's Encrypt"},"validity":{"start":"Sun, 24 May 2026 09:20:17 GMT","end":"Sat, 22 Aug 2026 09:20:16 GMT"},"fingerprint":{"sha1":"36:37:C7:61:C3:44:F8:8B:9E:3B:DA:92:A6:CD:66:BB:B5:C0:F4:A0","sha256":"06:80:3F:8F:98:8B:B3:07:8B:6E:78:0B:7C:D0:31:48:AA:F0:F9:83:FA:8F:15:1D:7A:86:47:51:29:D9:74:D0"}}},"request":{"raw":"GET /.rt/challenge?tier=captcha\u0026return_to=%2F HTTP/1.1\r\nHost: fortsk.cc\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://fortsk.cc/\r\nCookie: sil_ses=b523c7f480afd582a91e9f7ff2ae1421; __Host-sil_ses=b523c7f480afd582a91e9f7ff2ae1421; sil_gate=ASBiNTIzYzdmNDgwYWZkNTgyYTkxZTlmN2ZmMmFlMTQyMQC6ts-lDe6THNNqWCQq.dXj6wXSjzc3Dt7DU9CVWeCx9C6nGh5F5hZ_Y9UbdpsTV6vCDVojycC1iDHUJ9Vq_oiEbeNdgOijo6RQ0EiimAA; __Host-sil_gate=ASBiNTIzYzdmNDgwYWZkNTgyYTkxZTlmN2ZmMmFlMTQyMQC6ts-lDe6THNNqWCQq.dXj6wXSjzc3Dt7DU9CVWeCx9C6nGh5F5hZ_Y9UbdpsTV6vCDVojycC1iDHUJ9Vq_oiEbeNdgOijo6RQ0EiimAA\r\nUpgrade-Insecure-Requests: 1\r\nSec-Fetch-Dest: document\r\nSec-Fetch-Mode: navigate\r\nSec-Fetch-Site: same-origin\r\nPriority: u=0, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\ncontent-type: text/html; charset=utf-8\r\ncontent-length: 668369\r\ncache-control: no-store, no-cache, must-revalidate\r\nset-cookie: sil_ses=b523c7f480afd582a91e9f7ff2ae1421; Path=/; Domain=fortsk.cc; Max-Age=86400; HttpOnly; Secure; SameSite=None\n__Host-sil_ses=b523c7f480afd582a91e9f7ff2ae1421; Path=/; Max-Age=86400; HttpOnly; Secure; SameSite=None; Partitioned\nsil_gate=ASBiNTIzYzdmNDgwYWZkNTgyYTkxZTlmN2ZmMmFlMTQyMQG8ts-lDe6THNNqWCQq.l4bZdrxij5PvWQVJDM_A3nK9Nzo0P3Xxp2A4batv2M47yEQkEPUcDorOny_TRhZoduLEV3SSuXajAjuCrEmyBw; Path=/; Domain=fortsk.cc; Max-Age=600; HttpOnly; Secure; SameSite=None\n__Host-sil_gate=ASBiNTIzYzdmNDgwYWZkNTgyYTkxZTlmN2ZmMmFlMTQyMQG8ts-lDe6THNNqWCQq.l4bZdrxij5PvWQVJDM_A3nK9Nzo0P3Xxp2A4batv2M47yEQkEPUcDorOny_TRhZoduLEV3SSuXajAjuCrEmyBw; Path=/; Max-Age=600; HttpOnly; Secure; SameSite=None; Partitioned\r\nx-edge-action: captcha\r\ncontent-encoding: br\r\nvary: Accept-Encoding\r\ndate: Fri, 17 Jul 2026 08:43:50 GMT\r\nalt-svc: clear\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":null,"data":{"size":2262901,"size_decoded":669355,"mime_type":"text/html; charset=utf-8","magic":"HTML document, Unicode text, UTF-8 text, with very long lines (49175)","md5":"14fc9dc750ebb7a7c96bf23518b715a2","sha1":"80f96785b97f1fcd6fce86b9ed225cf745111942","sha256":"b791f26c2e7401aca3552ee5b97b4df9b10ec57858226ff78d565a9039b3519e","sha512":"ae8df705683396560bbd4ea654f89bc9cfd2798bd27fe38e271272799f1227d84e06172d3da69411f5f503142480c89d0561a83554f325e9867b80ec3ca01714","ssdeep":"6144:Jhg9yhTZGiZiC43Fg2tFH+3+Dcn0Td8OnTR8ERNp1qVpjK+datf6jaq6TPqA4wN:VZzECp2eGdxXD6EjN","tlshash":"0625cd963a92f66e048787713a4a56f558bfc505c6cf604df9889eecf0dceb225883c1","first_seen":"2026-07-17T08:46:11.645654Z","last_seen":"2026-07-17T08:46:11.645654Z","times_seen":1,"resource_available":true,"data":null}},"time_used":482,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":422,"receive":60,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-07-17","alert":"Sinkholed","trigger":"fortsk.cc","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-07-17","alert":"Sinkholed","trigger":"fortsk.cc","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}}]}