{"report_id":"d1b73a82-36a7-42b3-9150-8185bf56a6a5","version":6,"status":"done","tags":[],"date":"2026-04-13T13:25:57Z","url":{"schema":"https","addr":"tiktokkptn3.pages.dev","fqdn":"tiktokkptn3.pages.dev","domain":"tiktokkptn3.pages.dev","tld":"pages.dev"},"ip":{"addr":"172.66.45.8","port":0,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"final":{"url":{"schema":"https","addr":"tiktokkptn3.pages.dev/","fqdn":"tiktokkptn3.pages.dev","domain":"tiktokkptn3.pages.dev","tld":"pages.dev"},"title":"JUAL SEPATU JORDAN TERLNGKAP!","dom":{"size":23382,"mime_type":"text/html; charset=utf-8","magic":"HTML document, Unicode text, UTF-8 text, with very long lines (6883)","md5":"6ae3fb940bf24e12a7a22129bf634e97","sha1":"eaf7637c8f861ff8c0e3ed15bc4fbbddb597bdc4","sha256":"a2d705e2b324969046f5118397b890b4f9a21b6d01e6337adc64f680109f3c34","sha512":"1bceec8e6b6ecfb8a4758a81a46dcda83c04420d866be6bcc6fbdb424a8157f2e1b71307ec020ae994134b9c2fe33fefa16804416aacf99e3b3aa71140657089","ssdeep":"192:Ad7L4UGeVroA5eLU+LMeLNVLsXyAab/ukjeibOJ8rCXE/AvCwpl/j/i/oF7a8Cqd:TW0A3XgBjUbU/3cCoIqCW2W3veskE","tlshash":"c4a26423b5c820ac6127c32694d2f77e2d38c84287320d6db91dbbe88f55bc6767354a","dom_hash":"domhash2c82b63799f83768770a7a8a39bebf35","first_seen":"","last_seen":"","times_seen":0,"resource_available":false,"data":null}},"submit":{"url":{"schema":"https","addr":"tiktokkptn3.pages.dev","fqdn":"tiktokkptn3.pages.dev","domain":"tiktokkptn3.pages.dev","tld":"pages.dev"},"ip":{"addr":"172.66.45.8","port":0,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"tags":null,"meta":null,"user":{"user_id":"akbkyowd9geqr98"}},"settings":{"access":"public","device_type":"desktop","expires_at":"2027-05-18T13:25:57Z","useragent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0","referer":"","cookies":null,"exit_node":"z0yflva4pidy47h"},"stats":{"alert_count":{"ids":1,"urlquery":0,"analyzer":1}},"detection":{"ids":[{"sensor_name":"suricata","title":"Suricata IDS","description":"Suricata /w Emerging Threats Pro","date":"2026-04-13T13:25:33Z","timestamp":1776086733,"ip_dst":{"addr":"188.114.97.1","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"ip_src":{"addr":"Client IP","port":46726,"asn":0,"as":"","country":"","country_code":"zz"},"severity":"low","alert":"ET INFO Observed Cloudflare Page Developer Domain (pages .dev in TLS SNI)","source":"{\"timestamp\":\"2026-04-13T13:25:33.121516+0000\",\"flow_id\":1876677081540707,\"in_iface\":\"br-31613a7ed13b\",\"event_type\":\"alert\",\"src_ip\":\"172.18.0.22\",\"src_port\":46726,\"dest_ip\":\"188.114.97.1\",\"dest_port\":443,\"proto\":\"TCP\",\"tx_id\":0,\"alert\":{\"action\":\"allowed\",\"gid\":1,\"signature_id\":2057746,\"rev\":1,\"signature\":\"ET INFO Observed Cloudflare Page Developer Domain (pages .dev in TLS SNI)\",\"category\":\"Misc activity\",\"severity\":3,\"metadata\":{\"attack_target\":[\"Client_Endpoint\"],\"confidence\":[\"High\"],\"created_at\":[\"2024_11_20\"],\"deployment\":[\"Perimeter\"],\"signature_severity\":[\"Informational\"],\"tag\":[\"Description_Generated_By_Proofpoint_Nexus\"],\"updated_at\":[\"2024_11_20\"]}},\"tls\":{\"sni\":\"tiktokkptn3.pages.dev\",\"version\":\"TLS 1.3\",\"ja3\":{\"hash\":\"650c82854aed91a22996035b295a0c3e\",\"string\":\"771,4865-4867-4866-49195-49199-52393-52392-49196-49200-49171-49172-156-157-47-53,0-23-65281-10-11-16-5-34-51-43-13-28-21,29-23-24-25-256-257,0\"},\"ja3s\":{\"hash\":\"eb1d94daa7e0344597e756a1fb6e7054\",\"string\":\"771,4865,51-43\"}},\"app_proto\":\"tls\",\"flow\":{\"pkts_toserver\":4,\"pkts_toclient\":5,\"bytes_toserver\":789,\"bytes_toclient\":3473,\"start\":\"2026-04-13T13:25:33.108643+0000\"}}"}],"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-04-13","alert":"Sinkholed","trigger":"iili.io","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null},"summary":[{"fqdn":"tiktokkptn3.pages.dev","ip":{"addr":"188.114.97.1","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"domain_registered":"unknown","domain_rank":0,"first_seen":"No data","last_seen":"No data","alert_count":0,"request_count":2,"received_data":22171,"sent_data":939,"comment":"","tags":null,"fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"AMP","description":"AMP, originally created by Google, is an open-source HTML framework developed by the AMP open-source Project. AMP is designed to help webpages load faster.","website":"https://www.amp.dev","common_platform_enumeration":"","icon":"Accelerated-Mobile-Pages.svg","categories":["JavaScript frameworks"]}]},{"fqdn":"iili.io","ip":{"addr":"172.67.139.137","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"domain_registered":"2018-10-09","domain_rank":46837,"first_seen":"2018-10-12T10:50:17Z","last_seen":"2026-04-11T17:27:48.946759Z","alert_count":1,"request_count":1,"received_data":16957,"sent_data":434,"comment":"","tags":null,"fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}]},{"fqdn":"cdn.ampproject.org","ip":{"addr":"172.217.20.161","port":443,"asn":15169,"as":"GOOGLE","country":"United States","country_code":"US"},"domain_registered":"2015-08-31","domain_rank":3289,"first_seen":"2015-10-09T04:27:01Z","last_seen":"2026-04-13T11:11:59.825186Z","alert_count":0,"request_count":3,"received_data":328589,"sent_data":1348,"comment":"","tags":null,"fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}]}],"files":null,"artifacts":{"windows_shortcuts":null,"files":null,"telegram":null,"pdfs":null,"clipboard":null},"sensors":{"ids":null,"analyzer":null,"urlquery":null},"javascript":{"script":[{"url":{"schema":"https","addr":"tiktokkptn3.pages.dev/","fqdn":"tiktokkptn3.pages.dev","domain":"tiktokkptn3.pages.dev","tld":"pages.dev"},"ip":{"addr":"188.114.97.1","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"scriptElement","is_inline":true,"md5":"9ffaebce14aa6688a9cf15f0a9eb74af","sha1":"dd4c1fd95ad07ed3e4c54412140fa8d99ed88ecf","sha256":"a4fed1317e4ab622aaa4334a5f6132e266756e1517508463f9b7558ea24a08d9","sha512":"60e809c9cca2c3475bca70fa3fc10ca78660b38da7332c1c4a9cdd44a1433ce677af267b690b8112a0593369a8698be143be82f587c130364cf67576ff1f00ff","ssdeep":"","tlshash":"d511206838ed689c83aa51aa373feb4c463d91170c40cc48f10dd5150f36f6ac441dab","size":1109,"data":"","first_seen":"2026-04-13T13:26:02.023969Z","last_seen":"2026-04-13T13:26:02.023969Z","times_seen":1,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"cdn.ampproject.org/v0/amp-sidebar-0.1.js","fqdn":"cdn.ampproject.org","domain":"ampproject.org","tld":"org"},"ip":{"addr":"172.217.20.161","port":443,"asn":15169,"as":"GOOGLE","country":"United States","country_code":"US"},"introduction_type":"scriptElement","is_inline":false,"md5":"b694f7ac7a2d25f27e3a5170934f767f","sha1":"25695ed09263529c3669752ca1c3165bf0bd5522","sha256":"a8233411b529c7deb0122e2adfc259fd12bcd1ca27551d064cdd900668b122fa","sha512":"5521f93daf0bf6a1e4c6559089dabb7529336e45b2fc984e2e0ab60126d7b26c6bc43b97d838ac114730847bf3c02f5f35c30c06dd16a209cc8ea1be37eee272","ssdeep":"384:QnXCVRcBmElj6eU6nWnxXsHfdujPJqSQybcmE0X3b6IZPLyEu5M8JSY7:QXC0lj6J4yI0b6IxLyEcMDY7","tlshash":"efe2c79cf292b0714693a4b580af550ea23b6555240b882cb06decc66d7ce8fb137f78","size":31363,"data":"","first_seen":"2026-03-18T14:43:08.917752Z","last_seen":"2026-05-12T13:06:36.384833Z","times_seen":454,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"cdn.ampproject.org/v0.js","fqdn":"cdn.ampproject.org","domain":"ampproject.org","tld":"org"},"ip":{"addr":"172.217.20.161","port":443,"asn":15169,"as":"GOOGLE","country":"United States","country_code":"US"},"introduction_type":"scriptElement","is_inline":false,"md5":"c54252d732bff78217cfbeff950b3476","sha1":"960deb0b579fba259aa9865d3b1deadff0538bff","sha256":"852bb88969e8e21c5f7403b97cdb69b072a54f60214690cee9f1dad4db2d6740","sha512":"e75fc0cc5405ac64ddce8e210062fda91bf50d668d8cbef548f54b22b311082da8d3830d9092375ab69a6d8def15d9889f195f03269ecc9f570ba7afbf77f7e2","ssdeep":"6144:ixUXfTWCOu6qiieuIbno1uzRePNS+7HYo:yqftp/0RENS+74o","tlshash":"e754949db286b0724793b075803f150aa33ba859244a812cf56de9d67cbcd89b137f7c","size":284617,"data":"","first_seen":"2026-03-17T22:15:38.805176Z","last_seen":"2026-05-25T13:50:55.996675Z","times_seen":2915,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"cdn.ampproject.org/rtv/012603032146000/v0/amp-auto-lightbox-0.1.js","fqdn":"cdn.ampproject.org","domain":"ampproject.org","tld":"org"},"ip":{"addr":"172.217.20.161","port":443,"asn":15169,"as":"GOOGLE","country":"United States","country_code":"US"},"introduction_type":"scriptElement","is_inline":false,"md5":"dfd43df9e3425f6077d3bd69d5928cfd","sha1":"d5b1138d94904e2ab07092a86614976e1c2f543c","sha256":"94922d1f912dea5b7dd68a1a62d746f58d44a0c8305607aca116d6f08ba46708","sha512":"1f42867fd9dce4ae9a17c2a13be535196920068b4ca5b52b256baa92c48150b0f725a5f977ac59bafe6187e06e25aa2ff2787c37e23485bb943cd05fd126b6f5","ssdeep":"96:jKoAosPGpV3yMDc0jGAM+G0mj1hVXxSZ4tqSKN0OV0TjLRkiGj0ldmq43bDjHI:jKqswV3yv0jGAFCPX/tqKyWp4M0rDTI","tlshash":"d7f196dc7ac2b83a5757b4b780af414fa63ba94624ad9120d120f0d83cb995ed633e5c","size":7798,"data":"","first_seen":"2026-03-17T22:15:38.806244Z","last_seen":"2026-05-25T13:50:56.000747Z","times_seen":2806,"alerts":{"ids":null,"analyzer":null,"urlquery":null}}],"eval":null,"write":null,"console":null},"http":[{"url":{"schema":"https","addr":"tiktokkptn3.pages.dev/","fqdn":"tiktokkptn3.pages.dev","domain":"tiktokkptn3.pages.dev","tld":"pages.dev"},"ip":{"addr":"188.114.97.1","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":true,"resource_type":"document","requested_by":"","date":"2026-04-13T13:25:33.094Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"tiktokkptn3.pages.dev","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Mon, 13 Apr 2026 11:58:59 GMT","end":"Sun, 12 Jul 2026 12:56:39 GMT"},"fingerprint":{"sha1":"63:51:38:7C:6C:A3:78:7E:59:32:3B:D3:02:55:EE:30:BB:41:44:F8","sha256":"2F:85:88:DC:CB:48:EB:68:09:03:29:55:36:6C:80:3C:DC:AA:9C:CF:A1:7D:45:0B:A4:12:67:BC:B4:D5:55:95"}}},"request":{"raw":"GET / HTTP/1.1\r\nHost: tiktokkptn3.pages.dev\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nUpgrade-Insecure-Requests: 1\r\nSec-Fetch-Dest: document\r\nSec-Fetch-Mode: navigate\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ndate: Mon, 13 Apr 2026 13:25:33 GMT\r\ncontent-type: text/html; charset=utf-8\r\naccess-control-allow-origin: *\r\ncache-control: public, max-age=0, must-revalidate\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nreferrer-policy: strict-origin-when-cross-origin\r\nx-content-type-options: nosniff\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=mW5vNciKjfCKBr%2Bmk7eucCLLfgr8ZWS39VH5PXQSiZuWwp%2BdBpasd71zEnFYyCxI7QO7mhDfD4AebdqlH1lvPkQ5SfAv8pwrN7VpN%2BEM3oEXxhlzQltPhLyFI%2FRC%2FoeqahSrLpdNfqg%3D\"}]}\r\ncontent-encoding: br\r\nserver: cloudflare\r\ncf-ray: 9ebacc221be3b4eb-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"AMP","description":"AMP, originally created by Google, is an open-source HTML framework developed by the AMP open-source Project. AMP is designed to help webpages load faster.","website":"https://www.amp.dev","common_platform_enumeration":"","icon":"Accelerated-Mobile-Pages.svg","categories":["JavaScript frameworks"]}],"data":{"size":10297,"size_decoded":0,"mime_type":"text/html; charset=utf-8","magic":"HTML document, Unicode text, UTF-8 text, with very long lines (6063), with CRLF line terminators","md5":"6aedff421bfcaf897a1dbed89aac90c5","sha1":"9e5d126a53ce8d8d4b86efef1ece7d8503b26d21","sha256":"d48b82678bb72400e03ef45c68630694a0b1356b051dbdc18a94f44962fa705d","sha512":"c1216285fc761b9cdc4b2da2ebc24d069c2af568cd576dcee698a41876ac35e391532754b5f40ae893805f82ff15842b88a88e2faed16515601ced6a791ab15b","ssdeep":"192:d6gkjei0OB8TV25/WvCkpl/j/i/3F7a8Cq2qpAjSdo3/hUt3v1A6E:WjPKw/1QC3IqCW2W3vM","tlshash":"4c22c73329c4243db337c0b664d2f64caa289053c50b4e79f56d72b75fa6ac242a3a5d","first_seen":"2026-04-13T13:26:02.007883Z","last_seen":"2026-04-13T13:26:02.007883Z","times_seen":1,"resource_available":false,"data":null}},"time_used":319,"timings":{"blocked":41,"dns":21,"connect":1,"send":0,"wait":231,"receive":0,"ssl":21},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"iili.io/2FfWOdb.jpg","fqdn":"iili.io","domain":"iili.io","tld":"io"},"ip":{"addr":"172.67.139.137","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://tiktokkptn3.pages.dev/","date":"2026-04-13T13:25:33.573Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"iili.io","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Thu, 12 Mar 2026 10:32:14 GMT","end":"Wed, 10 Jun 2026 11:30:21 GMT"},"fingerprint":{"sha1":"01:19:B9:C6:7D:DA:7F:8B:72:2C:30:7F:BB:91:71:BF:5F:63:82:CB","sha256":"29:59:72:7B:74:A7:42:67:9C:CB:34:EC:53:F7:7B:8C:29:F5:EF:1A:D6:68:EB:6B:C9:26:F5:9A:BD:10:81:F6"}}},"request":{"raw":"GET /2FfWOdb.jpg HTTP/1.1\r\nHost: iili.io\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://tiktokkptn3.pages.dev/\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ndate: Mon, 13 Apr 2026 13:25:33 GMT\r\ncontent-type: image/jpeg\r\ncontent-length: 16196\r\nserver: cloudflare\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nlast-modified: Mon, 21 Oct 2024 12:06:27 GMT\r\nexpires: Thu, 31 Dec 2037 23:55:55 GMT\r\ncache-control: public, max-age=315360000\r\naccess-control-allow-origin: *\r\naccess-control-allow-methods: GET, OPTIONS\r\naccept-ranges: bytes\r\ncf-cache-status: MISS\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=BeArk4AakxuznkQfD1xTIoMQHeuLx1MFrevn5quF9yeMK2ptzi3%2B1ihoz8WK4fpBa%2Fz72HemIHeWGUnAEKeZp10z8RIvqlM0x%2BLsvof3cJ4VJPky95tf2Gh1\"}]}\r\ncf-ray: 9ebacc251e085697-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":16196,"size_decoded":0,"mime_type":"image/jpeg","magic":"JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, comment: \"CREATOR: gd-jpeg v1.0 (using IJG JPEG v62), quality = 90\", baseline, precision 8, 221x228, components 3","md5":"a6cfbe9641f7479489b23cca6d4f2019","sha1":"ec436b9ea6098fe3f9686c6f1ad9f8096f2387db","sha256":"f64456794007aa6a129269eab77a3eb42e81b8208f959d8a78121bcad07b05ad","sha512":"3f205686c21a73ad12d2c1223234552870fe743598b365db614a720c45f9ff46c424d84484a37bf972483123cb6ff791464f8701cefcbf61c821271d4328e20a","ssdeep":"384:Cuk3XTQXq8QzAc36eMwVnhpToecCAHFULkNCRptNimD:CDAq8q37pVrHcNG4NcD","tlshash":"a572bfbcb5caf7f9fbe3986a9c31ad15b3ac41d184ac4112d3d20e81e3825370a5a74d","first_seen":"2026-04-13T13:26:02.011025Z","last_seen":"2026-04-13T13:26:02.011025Z","times_seen":1,"resource_available":false,"data":null}},"time_used":445,"timings":{"blocked":38,"dns":20,"connect":1,"send":0,"wait":248,"receive":116,"ssl":19},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-04-13","alert":"Sinkholed","trigger":"iili.io","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"cdn.ampproject.org/v0.js","fqdn":"cdn.ampproject.org","domain":"ampproject.org","tld":"org"},"ip":{"addr":"172.217.20.161","port":443,"asn":15169,"as":"GOOGLE","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://tiktokkptn3.pages.dev/","date":"2026-04-13T13:25:33.574Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"misc-sni.google.com","organization":""},"issuer":{"commonName":"WR2","organization":"Google Trust Services"},"validity":{"start":"Mon, 23 Mar 2026 08:37:20 GMT","end":"Mon, 15 Jun 2026 08:37:19 GMT"},"fingerprint":{"sha1":"88:CA:6A:61:EC:7A:80:F7:96:DC:26:BD:E0:1F:6A:EA:D3:7F:C8:EE","sha256":"79:87:0D:7E:25:31:4A:54:F4:72:07:3D:DF:E9:63:9B:CB:68:5D:95:AE:A1:C1:BF:73:BA:73:29:6D:D3:E1:41"}}},"request":{"raw":"GET /v0.js HTTP/1.1\r\nHost: cdn.ampproject.org\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://tiktokkptn3.pages.dev/\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\naccept-ranges: bytes\r\nvary: Accept-Encoding\r\ncontent-encoding: br\r\ncontent-type: text/javascript; charset=UTF-8\r\naccess-control-allow-origin: *\r\ncontent-security-policy: default-src * blob: data:; script-src blob: https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cdnjs.cloudflare.com/ajax/libs/font-awesome/ https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp\r\ncross-origin-resource-policy: cross-origin\r\ncross-origin-opener-policy-report-only: same-origin; report-to=\"amphtml-china-available\"\r\nreport-to: {\"group\":\"amphtml-china-available\",\"max_age\":2592000,\"endpoints\":[{\"url\":\"https://csp.withgoogle.com/csp/report-to/amphtml-china-available\"}]}\r\ntiming-allow-origin: *\r\ncontent-length: 73113\r\ndate: Mon, 13 Apr 2026 13:25:33 GMT\r\nexpires: Mon, 13 Apr 2026 13:25:33 GMT\r\ncache-control: private, max-age=3000, stale-while-revalidate=1206600\r\netag: \"5b239dc189f888b8\"\r\nstrict-transport-security: max-age=31536000; includeSubDomains; preload\r\nx-content-type-options: nosniff\r\nserver: sffe\r\nx-xss-protection: 0\r\nalt-svc: h3=\":443\"; ma=2592000,h3-29=\":443\"; ma=2592000\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":284617,"size_decoded":0,"mime_type":"text/javascript; charset=UTF-8","magic":"JavaScript source, Unicode text, UTF-8 text, with very long lines (64627)","md5":"c54252d732bff78217cfbeff950b3476","sha1":"960deb0b579fba259aa9865d3b1deadff0538bff","sha256":"852bb88969e8e21c5f7403b97cdb69b072a54f60214690cee9f1dad4db2d6740","sha512":"e75fc0cc5405ac64ddce8e210062fda91bf50d668d8cbef548f54b22b311082da8d3830d9092375ab69a6d8def15d9889f195f03269ecc9f570ba7afbf77f7e2","ssdeep":"6144:ixUXfTWCOu6qiieuIbno1uzRePNS+7HYo:yqftp/0RENS+74o","tlshash":"e754949db286b0724793b075803f150aa33ba859244a812cf56de9d67cbcd89b137f7c","first_seen":"2026-03-17T22:15:38.805176Z","last_seen":"2026-05-25T13:50:55.996675Z","times_seen":2915,"resource_available":true,"data":null}},"time_used":252,"timings":{"blocked":93,"dns":0,"connect":8,"send":0,"wait":30,"receive":34,"ssl":84},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"cdn.ampproject.org/v0/amp-sidebar-0.1.js","fqdn":"cdn.ampproject.org","domain":"ampproject.org","tld":"org"},"ip":{"addr":"172.217.20.161","port":443,"asn":15169,"as":"GOOGLE","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://tiktokkptn3.pages.dev/","date":"2026-04-13T13:25:33.576Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"misc-sni.google.com","organization":""},"issuer":{"commonName":"WR2","organization":"Google Trust Services"},"validity":{"start":"Mon, 23 Mar 2026 08:37:20 GMT","end":"Mon, 15 Jun 2026 08:37:19 GMT"},"fingerprint":{"sha1":"88:CA:6A:61:EC:7A:80:F7:96:DC:26:BD:E0:1F:6A:EA:D3:7F:C8:EE","sha256":"79:87:0D:7E:25:31:4A:54:F4:72:07:3D:DF:E9:63:9B:CB:68:5D:95:AE:A1:C1:BF:73:BA:73:29:6D:D3:E1:41"}}},"request":{"raw":"GET /v0/amp-sidebar-0.1.js HTTP/1.1\r\nHost: cdn.ampproject.org\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://tiktokkptn3.pages.dev/\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\naccept-ranges: bytes\r\nvary: Accept-Encoding\r\ncontent-encoding: br\r\ncontent-type: text/javascript; charset=UTF-8\r\naccess-control-allow-origin: *\r\ncontent-security-policy: default-src * blob: data:; script-src blob: https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cdnjs.cloudflare.com/ajax/libs/font-awesome/ https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp\r\ncross-origin-resource-policy: cross-origin\r\ncross-origin-opener-policy-report-only: same-origin; report-to=\"amphtml-china-available\"\r\nreport-to: {\"group\":\"amphtml-china-available\",\"max_age\":2592000,\"endpoints\":[{\"url\":\"https://csp.withgoogle.com/csp/report-to/amphtml-china-available\"}]}\r\ntiming-allow-origin: *\r\ncontent-length: 9647\r\ndate: Mon, 13 Apr 2026 13:25:33 GMT\r\nexpires: Mon, 13 Apr 2026 13:25:33 GMT\r\ncache-control: private, max-age=604800, stale-while-revalidate=604800\r\netag: \"0756320ec9148a95\"\r\nstrict-transport-security: max-age=31536000; includeSubDomains; preload\r\nx-content-type-options: nosniff\r\nserver: sffe\r\nx-xss-protection: 0\r\nalt-svc: h3=\":443\"; ma=2592000,h3-29=\":443\"; ma=2592000\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":31363,"size_decoded":0,"mime_type":"text/javascript; charset=UTF-8","magic":"JavaScript source, ASCII text, with very long lines (31247)","md5":"b694f7ac7a2d25f27e3a5170934f767f","sha1":"25695ed09263529c3669752ca1c3165bf0bd5522","sha256":"a8233411b529c7deb0122e2adfc259fd12bcd1ca27551d064cdd900668b122fa","sha512":"5521f93daf0bf6a1e4c6559089dabb7529336e45b2fc984e2e0ab60126d7b26c6bc43b97d838ac114730847bf3c02f5f35c30c06dd16a209cc8ea1be37eee272","ssdeep":"384:QnXCVRcBmElj6eU6nWnxXsHfdujPJqSQybcmE0X3b6IZPLyEu5M8JSY7:QXC0lj6J4yI0b6IxLyEcMDY7","tlshash":"efe2c79cf292b0714693a4b580af550ea23b6555240b882cb06decc66d7ce8fb137f78","first_seen":"2026-03-18T14:43:08.917752Z","last_seen":"2026-05-12T13:06:36.384833Z","times_seen":454,"resource_available":true,"data":null}},"time_used":206,"timings":{"blocked":82,"dns":0,"connect":22,"send":0,"wait":30,"receive":6,"ssl":64},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"tiktokkptn3.pages.dev/favicon.ico","fqdn":"tiktokkptn3.pages.dev","domain":"tiktokkptn3.pages.dev","tld":"pages.dev"},"ip":{"addr":"188.114.97.1","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://tiktokkptn3.pages.dev/","date":"2026-04-13T13:25:34.072Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"tiktokkptn3.pages.dev","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Mon, 13 Apr 2026 11:58:59 GMT","end":"Sun, 12 Jul 2026 12:56:39 GMT"},"fingerprint":{"sha1":"63:51:38:7C:6C:A3:78:7E:59:32:3B:D3:02:55:EE:30:BB:41:44:F8","sha256":"2F:85:88:DC:CB:48:EB:68:09:03:29:55:36:6C:80:3C:DC:AA:9C:CF:A1:7D:45:0B:A4:12:67:BC:B4:D5:55:95"}}},"request":{"raw":"GET /favicon.ico HTTP/1.1\r\nHost: tiktokkptn3.pages.dev\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://tiktokkptn3.pages.dev/\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\ndate: Mon, 13 Apr 2026 13:25:34 GMT\r\ncontent-type: text/html; charset=utf-8\r\naccess-control-allow-origin: *\r\ncache-control: public, max-age=0, must-revalidate\r\npriority: u=6,i=?0\r\nlink: \u003chttps://iili.io/2FfWOdb.jpg\u003e; rel=\"preload\"; as=image, \u003chttps://iili.io/2FfWOdb.jpg\u003e; rel=\"preload\"; as=image\r\nreferrer-policy: strict-origin-when-cross-origin\r\nx-content-type-options: nosniff\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=s7WiFmUJYiH3BX0xBxILuVEBX6sbEsg6AG2uaDL1I0nLaqvGgXH5%2BgjYp9d%2Fte3elByH8My69Mxr2Z%2Fy981u%2BdMWbVsjmAoJbO2wL1hwFlG%2FAaqzptwf8eRGPtaHpk7fE0cYg69wuvY%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncontent-encoding: br\r\nserver: cloudflare\r\ncf-ray: 9ebacc27ea330b61-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"AMP","description":"AMP, originally created by Google, is an open-source HTML framework developed by the AMP open-source Project. AMP is designed to help webpages load faster.","website":"https://www.amp.dev","common_platform_enumeration":"","icon":"Accelerated-Mobile-Pages.svg","categories":["JavaScript frameworks"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":10297,"size_decoded":0,"mime_type":"text/html; charset=utf-8","magic":"HTML document, Unicode text, UTF-8 text, with very long lines (6063), with CRLF line terminators","md5":"6aedff421bfcaf897a1dbed89aac90c5","sha1":"9e5d126a53ce8d8d4b86efef1ece7d8503b26d21","sha256":"d48b82678bb72400e03ef45c68630694a0b1356b051dbdc18a94f44962fa705d","sha512":"c1216285fc761b9cdc4b2da2ebc24d069c2af568cd576dcee698a41876ac35e391532754b5f40ae893805f82ff15842b88a88e2faed16515601ced6a791ab15b","ssdeep":"192:d6gkjei0OB8TV25/WvCkpl/j/i/3F7a8Cq2qpAjSdo3/hUt3v1A6E:WjPKw/1QC3IqCW2W3vM","tlshash":"4c22c73329c4243db337c0b664d2f64caa289053c50b4e79f56d72b75fa6ac242a3a5d","first_seen":"2026-04-13T13:26:02.007883Z","last_seen":"2026-04-13T13:26:02.007883Z","times_seen":1,"resource_available":false,"data":null}},"time_used":43,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":43,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"cdn.ampproject.org/rtv/012603032146000/v0/amp-auto-lightbox-0.1.js","fqdn":"cdn.ampproject.org","domain":"ampproject.org","tld":"org"},"ip":{"addr":"172.217.20.161","port":443,"asn":15169,"as":"GOOGLE","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://tiktokkptn3.pages.dev/","date":"2026-04-13T13:25:34.152Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"misc-sni.google.com","organization":""},"issuer":{"commonName":"WR2","organization":"Google Trust Services"},"validity":{"start":"Mon, 23 Mar 2026 08:37:20 GMT","end":"Mon, 15 Jun 2026 08:37:19 GMT"},"fingerprint":{"sha1":"88:CA:6A:61:EC:7A:80:F7:96:DC:26:BD:E0:1F:6A:EA:D3:7F:C8:EE","sha256":"79:87:0D:7E:25:31:4A:54:F4:72:07:3D:DF:E9:63:9B:CB:68:5D:95:AE:A1:C1:BF:73:BA:73:29:6D:D3:E1:41"}}},"request":{"raw":"GET /rtv/012603032146000/v0/amp-auto-lightbox-0.1.js HTTP/1.1\r\nHost: cdn.ampproject.org\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://tiktokkptn3.pages.dev/\r\nOrigin: https://tiktokkptn3.pages.dev\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\naccept-ranges: bytes\r\ncontent-encoding: br\r\naccess-control-allow-origin: *\r\ncontent-security-policy: default-src * blob: data:; script-src blob: https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cdnjs.cloudflare.com/ajax/libs/font-awesome/ https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp\r\ncross-origin-resource-policy: cross-origin\r\ncross-origin-opener-policy-report-only: same-origin; report-to=\"amphtml-china-available\"\r\nreport-to: {\"group\":\"amphtml-china-available\",\"max_age\":2592000,\"endpoints\":[{\"url\":\"https://csp.withgoogle.com/csp/report-to/amphtml-china-available\"}]}\r\ntiming-allow-origin: *\r\ncontent-length: 2972\r\nstrict-transport-security: max-age=31536000; includeSubDomains; preload\r\nx-content-type-options: nosniff\r\nserver: sffe\r\nx-xss-protection: 0\r\ndate: Thu, 09 Apr 2026 11:22:00 GMT\r\nexpires: Fri, 09 Apr 2027 11:22:00 GMT\r\ncache-control: public, max-age=31536000\r\nage: 353014\r\netag: \"74a8e6f749d364bb\"\r\ncontent-type: text/javascript; charset=UTF-8\r\nvary: Accept-Encoding\r\nalt-svc: h3=\":443\"; ma=2592000,h3-29=\":443\"; ma=2592000\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":7798,"size_decoded":0,"mime_type":"text/javascript; charset=UTF-8","magic":"JavaScript source, ASCII text, with very long lines (7676)","md5":"dfd43df9e3425f6077d3bd69d5928cfd","sha1":"d5b1138d94904e2ab07092a86614976e1c2f543c","sha256":"94922d1f912dea5b7dd68a1a62d746f58d44a0c8305607aca116d6f08ba46708","sha512":"1f42867fd9dce4ae9a17c2a13be535196920068b4ca5b52b256baa92c48150b0f725a5f977ac59bafe6187e06e25aa2ff2787c37e23485bb943cd05fd126b6f5","ssdeep":"96:jKoAosPGpV3yMDc0jGAM+G0mj1hVXxSZ4tqSKN0OV0TjLRkiGj0ldmq43bDjHI:jKqswV3yv0jGAFCPX/tqKyWp4M0rDTI","tlshash":"d7f196dc7ac2b83a5757b4b780af414fa63ba94624ad9120d120f0d83cb995ed633e5c","first_seen":"2026-03-17T22:15:38.806244Z","last_seen":"2026-05-25T13:50:56.000747Z","times_seen":2806,"resource_available":true,"data":null}},"time_used":58,"timings":{"blocked":46,"dns":1,"connect":0,"send":0,"wait":10,"receive":1,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}}]}