{"report_id":"d11030ab-d3b6-4531-8ccb-3f8f1e0dc7dc","version":6,"status":"done","tags":[],"date":"2025-09-24T21:13:43Z","url":{"schema":"http","addr":"flowpanlive.com/go/39434a12-77cb-4219-a432-fd8929389c25?cost=0.001100\u0026visitor_id=994823928755003393\u0026zoneid=9549321\u0026campaignid=9903879\u0026bannerid=24467238\u0026language=es\u0026os=android\u0026browser=chrome\u0026connection.type=broadband\u0026user_activity=low\u0026subzone_id=1107253\u0026country=MX","fqdn":"flowpanlive.com","domain":"flowpanlive.com","tld":"com"},"ip":{"addr":"3.71.151.17","port":0,"asn":16509,"as":"AMAZON-02","country":"Germany","country_code":"DE"},"final":{"url":{"schema":"https","addr":"flowpanlive.com/go/39434a12-77cb-4219-a432-fd8929389c25?cost=0.001100\u0026visitor_id=994823928755003393\u0026zoneid=9549321\u0026campaignid=9903879\u0026bannerid=24467238\u0026language=es\u0026os=android\u0026browser=chrome\u0026connection.type=broadband\u0026user_activity=low\u0026subzone_id=1107253\u0026country=MX","fqdn":"flowpanlive.com","domain":"flowpanlive.com","tld":"com"},"title":"Please wait..."},"submit":{"url":{"schema":"http","addr":"flowpanlive.com/go/39434a12-77cb-4219-a432-fd8929389c25?cost=0.001100\u0026visitor_id=994823928755003393\u0026zoneid=9549321\u0026campaignid=9903879\u0026bannerid=24467238\u0026language=es\u0026os=android\u0026browser=chrome\u0026connection.type=broadband\u0026user_activity=low\u0026subzone_id=1107253\u0026country=MX","fqdn":"flowpanlive.com","domain":"flowpanlive.com","tld":"com"},"ip":{"addr":"3.71.151.17","port":0,"asn":16509,"as":"AMAZON-02","country":"Germany","country_code":"DE"},"tags":null,"meta":null},"settings":{"access":"public","device_type":"desktop","expires_at":"2026-10-29T21:13:43Z","useragent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0","referer":"","cookies":null,"exit_node":"z0yflva4pidy47h"},"stats":{"alert_count":{"ids":0,"urlquery":0,"analyzer":1}},"detection":{"ids":null,"analyzer":[{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-09-24","alert":"Sinkholed","trigger":"aff.trustofferlink.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null},"summary":[{"fqdn":"flowpanlive.com","ip":{"addr":"3.127.216.164","port":443,"asn":16509,"as":"AMAZON-02","country":"Germany","country_code":"DE"},"domain_registered":"2025-08-04","domain_rank":0,"first_seen":"2025-08-14T19:07:44.705218Z","last_seen":"2025-09-22T04:09:19.13834Z","alert_count":0,"request_count":1,"received_data":1291,"sent_data":731,"comment":"","tags":null,"fingerprints":[{"name":"OpenResty","description":"OpenResty is a web platform based on nginx which can run Lua scripts using its LuaJIT engine.","website":"https://openresty.org","common_platform_enumeration":"","icon":"OpenResty.svg","categories":["Web servers"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}]},{"fqdn":"aff.trustofferlink.com","ip":{"addr":"54.196.173.211","port":443,"asn":14618,"as":"AMAZON-AES","country":"United States","country_code":"US"},"domain_registered":"2025-08-25","domain_rank":0,"first_seen":"2025-09-24T08:47:10.454603Z","last_seen":"2025-09-24T08:47:10.454603Z","alert_count":1,"request_count":1,"received_data":206,"sent_data":588,"comment":"","tags":null,"fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}]}],"files":null,"artifacts":{"windows_shortcuts":null,"files":null,"telegram":null,"pdfs":null,"clipboard":null},"sensors":{"ids":[{"sensor_name":"suricata","description":"Suricata /w Emerging Threats Pro","alerts":null}],"analyzer":null,"urlquery":null},"javascript":{"script":null,"eval":null,"write":null,"console":null},"http":[{"url":{"schema":"https","addr":"flowpanlive.com/go/39434a12-77cb-4219-a432-fd8929389c25?cost=0.001100\u0026visitor_id=994823928755003393\u0026zoneid=9549321\u0026campaignid=9903879\u0026bannerid=24467238\u0026language=es\u0026os=android\u0026browser=chrome\u0026connection.type=broadband\u0026user_activity=low\u0026subzone_id=1107253\u0026country=MX","fqdn":"flowpanlive.com","domain":"flowpanlive.com","tld":"com"},"ip":{"addr":"3.127.216.164","port":443,"asn":16509,"as":"AMAZON-02","country":"Germany","country_code":"DE"},"is_navigation_request":true,"resource_type":"document","requested_by":"","date":"2025-09-24T21:13:21.370Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"flowpanlive.com","organization":""},"issuer":{"commonName":"R10","organization":"Let's Encrypt"},"validity":{"start":"Tue, 05 Aug 2025 05:46:56 GMT","end":"Mon, 03 Nov 2025 05:46:55 GMT"},"fingerprint":{"sha1":"C9:89:3B:0E:9D:64:62:84:BF:04:53:CD:EF:ED:57:68:55:CF:D3:4C","sha256":"60:15:55:0A:72:FB:F6:2A:9B:18:BC:A6:89:3D:DE:67:2A:24:D2:19:2A:20:87:1A:0E:CC:3A:98:88:0D:D4:7F"}}},"request":{"raw":"GET /go/39434a12-77cb-4219-a432-fd8929389c25?cost=0.001100\u0026visitor_id=994823928755003393\u0026zoneid=9549321\u0026campaignid=9903879\u0026bannerid=24467238\u0026language=es\u0026os=android\u0026browser=chrome\u0026connection.type=broadband\u0026user_activity=low\u0026subzone_id=1107253\u0026country=MX HTTP/1.1\r\nHost: flowpanlive.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nUpgrade-Insecure-Requests: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: document\r\nSec-Fetch-Mode: navigate\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: openresty\r\ndate: Wed, 24 Sep 2025 21:13:21 GMT\r\ncontent-type: text/html; charset=utf-8\r\nvary: Accept-Encoding\r\naccess-control-allow-origin: *\r\netag: W/\"10b-ROIsJfUXXeC3N6S0OTc+zl8ajqA\"\r\nset-cookie: bemob-viewer-id=524159d6-ef24-458a-828f-72409f0560b3; Domain=flowpanlive.com; Path=/; Expires=Thu, 24 Sep 2026 21:13:21 GMT; HttpOnly; Secure; SameSite=None\nbemob-uniq-visit:39434a12-77cb-4219-a432-fd8929389c25=1; Domain=flowpanlive.com; Path=/; Expires=Thu, 25 Sep 2025 21:13:21 GMT; HttpOnly; Secure; SameSite=None\nbemob-rotation:39434a12-77cb-4219-a432-fd8929389c25:random:e20e9d0a-53fa-418d-ac93-c82d7b37cca3=0-0-0; Domain=flowpanlive.com; Path=/; Expires=Thu, 25 Sep 2025 21:13:21 GMT; HttpOnly; Secure; SameSite=None\nbemob-click-id=AUSf5Y2PZB4PhFSzTQX1NT; Domain=flowpanlive.com; Path=/; Expires=Fri, 24 Oct 2025 21:13:21 GMT; HttpOnly; Secure; SameSite=None\r\nx-response-time: 9.345ms\r\nexpires: Thu, 01 Jan 1970 00:00:01 GMT\r\ncache-control: no-cache\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"OpenResty","description":"OpenResty is a web platform based on nginx which can run Lua scripts using its LuaJIT engine.","website":"https://openresty.org","common_platform_enumeration":"","icon":"OpenResty.svg","categories":["Web servers"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":267,"size_decoded":0,"mime_type":"text/html; charset=utf-8","magic":"HTML document, ASCII text, with no line terminators","md5":"a3274a7ae7c1266da4ddf497d59f3122","sha1":"44e22c25f5175de0b737a4b439373ece5f1a8ea0","sha256":"2ecc5c4d1dc2ddf7540c4b263bcf4dd668ce485466c81843f2adbbb2355dbc6f","sha512":"487e1e8f3af46b2a69f8d7af530f2f9a44a9047cab07c185145d90052ab98964ee79df0d443776c8883a105b7168dda51cebc2d67cf0e5a0123b9917b7c3748e","ssdeep":"","tlshash":"67d02bd6d4646569d6202ab084e421984d45c91869835224f9d429ba1db6a14cc42636","first_seen":"2025-09-24T21:13:44.189574Z","last_seen":"2025-09-24T21:13:44.189574Z","times_seen":1,"resource_available":false,"data":null}},"time_used":288,"timings":{"blocked":127,"dns":78,"connect":21,"send":0,"wait":33,"receive":0,"ssl":26},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"aff.trustofferlink.com/2JRNK2B/65WQCH3/?sub1=AUSf5Y2PZB4PhFSzTQX1NT\u0026source_id=2197_bb3e538a\u0026sub2=PropellerAds6\u0026sub3=2197","fqdn":"aff.trustofferlink.com","domain":"trustofferlink.com","tld":"com"},"ip":{"addr":"54.196.173.211","port":443,"asn":14618,"as":"AMAZON-AES","country":"United States","country_code":"US"},"is_navigation_request":true,"resource_type":"document","requested_by":"","date":"2025-09-24T21:13:21.700Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"aff.trustofferlink.com","organization":""},"issuer":{"commonName":"E8","organization":"Let's Encrypt"},"validity":{"start":"Tue, 02 Sep 2025 08:34:44 GMT","end":"Mon, 01 Dec 2025 08:34:43 GMT"},"fingerprint":{"sha1":"08:40:F7:47:81:78:1C:2C:62:8D:F5:B1:A5:1F:6B:1C:9B:86:59:1A","sha256":"AF:BC:22:53:2F:E3:25:4C:54:C0:F5:96:EF:71:CB:73:D7:85:AB:88:F5:9D:5E:4E:3C:9E:97:5F:BB:34:7E:BA"}}},"request":{"raw":"GET /2JRNK2B/65WQCH3/?sub1=AUSf5Y2PZB4PhFSzTQX1NT\u0026source_id=2197_bb3e538a\u0026sub2=PropellerAds6\u0026sub3=2197 HTTP/1.1\r\nHost: aff.trustofferlink.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nUpgrade-Insecure-Requests: 1\r\nSec-Fetch-Dest: document\r\nSec-Fetch-Mode: navigate\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 204 No Content\r\nserver: nginx\r\ndate: Wed, 24 Sep 2025 21:13:21 GMT\r\naccept-ch: Sec-Ch-Ua-Platform-Version,Sec-Ch-Ua-Model\r\nvary: Origin\r\nx-eflow-request-id: 54d09e30-af65-41fe-af5d-1f4ffe4734dc\r\n\r\n","headers":null,"cookies":null,"status_code":"204","status_text":"No Content","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":0,"size_decoded":0,"mime_type":"text/plain","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-06-10T02:14:21.808818Z","times_seen":16284503,"resource_available":true,"data":null}},"time_used":562,"timings":{"blocked":212,"dns":10,"connect":97,"send":0,"wait":137,"receive":0,"ssl":104},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-09-24","alert":"Sinkholed","trigger":"aff.trustofferlink.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}}]}