{"report_id":"de2a80a5-0865-4b9d-8b5c-2adf38227a91","version":6,"status":"done","tags":[],"date":"2025-12-19T06:51:05Z","url":{"schema":"https","addr":"vormasia.sbs/","fqdn":"vormasia.sbs","domain":"vormasia.sbs","tld":"sbs"},"ip":{"addr":"46.151.182.165","port":0,"asn":44477,"as":"Stark Industries Solutions Ltd","country":"The Netherlands","country_code":"NL"},"final":{"url":{"schema":"https","addr":"vormasia.sbs/","fqdn":"vormasia.sbs","domain":"vormasia.sbs","tld":"sbs"},"title":"Giriş Yap","dom":{"size":976643,"mime_type":"text/html; charset=utf-8","magic":"HTML document, Unicode text, UTF-8 text","md5":"7af4b0dcb715efce702cdfad25f015bb","sha1":"86ef88a34e499832355a395c71d81ee4190970ef","sha256":"224b7eb21d138f2fc90d03e237e69c4aa013e44490fc48f10c9be026be6cf55d","sha512":"5d7ed13dca4b3c0bbe959b57e5b2dfb03d28475c5676feffb61ec54caeafaed764ee978a337976faf1b6e19b941923f91ba597d541100edf4a10cdbdfe12197d","ssdeep":"12288:XJ9b9NQo4XkaPh1Y0mVRGd03UgBAdzvzF0YYiX5MgLxY0VMakpihM4XkaPh1Y0m/:CY01Y0o","tlshash":"0425328f29a7110da993e12c5beb26443220d407ad5bdcadbf8d5358cf8e3d85ca178d","dom_hash":"domhash45ffb8e66a6d36fe5b564f064a9670b4","first_seen":"","last_seen":"","times_seen":0,"resource_available":false,"data":null}},"submit":{"url":{"schema":"https","addr":"vormasia.sbs/","fqdn":"vormasia.sbs","domain":"vormasia.sbs","tld":"sbs"},"ip":{"addr":"46.151.182.165","port":0,"asn":44477,"as":"Stark Industries Solutions Ltd","country":"The Netherlands","country_code":"NL"},"tags":["openphish"],"meta":null},"settings":{"access":"public","device_type":"desktop","expires_at":"2027-01-23T06:51:05Z","useragent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0","referer":"","cookies":null,"exit_node":"z0yflva4pidy47h"},"stats":{"alert_count":{"ids":0,"urlquery":0,"analyzer":8}},"detection":{"ids":null,"analyzer":[{"sensor_name":"openphish","sensor_type":"Blocklist","title":"OpenPhish","description":"OpenPhish","scan_date":"2025-12-19","alert":"Phishing - Binance","trigger":"vormasia.sbs","verdict":"phishing","severity":"medium","comment":"Binance","link":"https://openphish.com/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2025-12-19","alert":"Sinkholed","trigger":"vormasia.sbs","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2025-12-19","alert":"Phishing Block","trigger":"vormasia.sbs","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2025-12-19","alert":"Sinkholed","trigger":"vormasia.sbs","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2025-12-19","alert":"Sinkholed","trigger":"vormasia.sbs","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-12-19","alert":"Sinkholed","trigger":"vormasia.sbs","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2025-12-19","alert":"Sinkholed","trigger":"vormasia.sbs","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"openphish","sensor_type":"url","title":"OpenPhish","description":"OpenPhish","scan_date":"2025-12-19","alert":"Phishing - Binance","trigger":"vormasia.sbs/","verdict":"phishing","severity":"medium","comment":"Binance","link":"https://openphish.com","meta":null}],"urlquery":null},"summary":[{"fqdn":"code.jquery.com","ip":{"addr":"151.101.66.137","port":443,"asn":54113,"as":"FASTLY","country":"United States","country_code":"US"},"domain_registered":"2005-12-10","domain_rank":4915,"first_seen":"2012-05-21T17:28:02Z","last_seen":"2025-12-14T22:26:41.611695Z","alert_count":0,"request_count":1,"received_data":88168,"sent_data":420,"comment":"","tags":null,"fingerprints":[{"name":"Varnish","description":"Varnish is a reverse caching proxy.","website":"https://www.varnish-cache.org","common_platform_enumeration":"cpe:2.3:a:varnish-software:varnish_cache:*:*:*:*:*:*:*:*","icon":"Varnish.svg","categories":["Caching"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}]},{"fqdn":"vormasia.sbs","ip":{"addr":"46.151.182.165","port":443,"asn":44477,"as":"Stark Industries Solutions Ltd","country":"The Netherlands","country_code":"NL"},"domain_registered":"2025-12-17","domain_rank":0,"first_seen":"2025-12-19T06:51:05.586333Z","last_seen":"2025-12-19T06:51:05.586333Z","alert_count":112,"request_count":16,"received_data":1064031,"sent_data":9102,"comment":"","tags":null,"fingerprints":[{"name":"Plesk","description":"Plesk is a web hosting and server data centre automation software with a control panel developed for Linux and Windows-based retail hosting service providers.","website":"https://www.plesk.com","common_platform_enumeration":"cpe:2.3:a:parallels:parallels_plesk_panel:*:*:*:*:*:*:*:*","icon":"Plesk.svg","categories":["Hosting panels"]},{"name":"Apache HTTP Server","description":"Apache is a free and open-source cross-platform web server software.","website":"https://httpd.apache.org/","common_platform_enumeration":"cpe:2.3:a:apache:http_server:*:*:*:*:*:*:*:*","icon":"Apache.svg","categories":["Web servers"]},{"name":"PHP:8.4.15","description":"PHP is a general-purpose scripting language used for web development.","website":"https://php.net","common_platform_enumeration":"cpe:2.3:a:php:php:*:*:*:*:*:*:*:*","icon":"PHP.svg","categories":["Programming languages"]},{"name":"jQuery CDN","description":"jQuery CDN is a way to include jQuery in your website without actually downloading and keeping it your website's folder.","website":"https://code.jquery.com/","common_platform_enumeration":"","icon":"jQuery.svg","categories":["CDN"]},{"name":"Vue.js","description":"Vue.js is an open-source model–view–viewmodel JavaScript framework for building user interfaces and single-page applications.","website":"https://vuejs.org","common_platform_enumeration":"","icon":"vue.svg","categories":["JavaScript frameworks"]},{"name":"jQuery:3.7.1","description":"jQuery is a JavaScript library which is a free, open-source software designed to simplify HTML DOM tree traversal and manipulation, as well as event handling, CSS animation, and Ajax.","website":"https://jquery.com","common_platform_enumeration":"cpe:2.3:a:jquery:jquery:*:*:*:*:*:*:*:*","icon":"jQuery.svg","categories":["JavaScript libraries"]}]}],"files":null,"artifacts":{"windows_shortcuts":null,"files":null,"telegram":null,"pdfs":null,"clipboard":null},"sensors":{"ids":null,"analyzer":null,"urlquery":null},"javascript":{"script":[{"url":{"schema":"https","addr":"vormasia.sbs/","fqdn":"vormasia.sbs","domain":"vormasia.sbs","tld":"sbs"},"ip":{"addr":"46.151.182.165","port":443,"asn":44477,"as":"Stark Industries Solutions Ltd","country":"The Netherlands","country_code":"NL"},"introduction_type":"scriptElement","is_inline":true,"md5":"51916f6594b473fc2ad1ccfb653aa8cf","sha1":"29e0cbde24136a464b33d22b990122d4f76bb88d","sha256":"6baa3091b22e28c1b089f2fbf68a6a81e35a5c622810c002ac7bbaa8b02fc21a","sha512":"89e573c537b50d99911a08ff82ae20c4a4001e9ee486705e767b7057e8f3f545bea74be5f0c00090f83a1ec8b3a5887634ac0d8a24ead6f6fbb9a608ed85d4a1","ssdeep":"","tlshash":"eef0a35d3c66f55737f93638c2238b7b3755070175835525d645cc2878945c618c6d8d","size":444,"data":"","first_seen":"2025-12-17T07:07:42.636321Z","last_seen":"2025-12-21T06:42:35.262031Z","times_seen":6,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"vormasia.sbs/","fqdn":"vormasia.sbs","domain":"vormasia.sbs","tld":"sbs"},"ip":{"addr":"46.151.182.165","port":443,"asn":44477,"as":"Stark Industries Solutions Ltd","country":"The Netherlands","country_code":"NL"},"introduction_type":"scriptElement","is_inline":true,"md5":"f44fcfbb3be63a4c97ff34cd2e8a7dd1","sha1":"e8f7bbd3d4e33e187dda6a38bcf43ee28a93b241","sha256":"f7428ad93bfc0413b257c35c37a95747909417a832628c0a978e4c4015a72dbf","sha512":"988525f4302590be04fc58bb22b9898d6924c85353372f2798585791820ba991330424999fbb9264c553744f4ceb62b9d31ae889761fa0eae468de2d388521ba","ssdeep":"","tlshash":"92f0a39d3c66f45737f97534c2338b6f3365070176c39924c645cc24686458a1847d4d","size":445,"data":"","first_seen":"2025-12-17T07:07:42.637294Z","last_seen":"2025-12-22T20:05:15.731921Z","times_seen":7,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"vormasia.sbs/","fqdn":"vormasia.sbs","domain":"vormasia.sbs","tld":"sbs"},"ip":{"addr":"46.151.182.165","port":443,"asn":44477,"as":"Stark Industries Solutions Ltd","country":"The Netherlands","country_code":"NL"},"introduction_type":"scriptElement","is_inline":true,"md5":"460e6fc104075dcf75458ed9d4a3710c","sha1":"b0ad1adfedad799519fa9884fd3c635df9d60aeb","sha256":"f744e1f353a54fab64bf57e9c08aabe42440b277572231f8fe016b2a21869ef7","sha512":"d1509d10f9ea6c8ea6650fe2aabdbe136bbb4e0e14cc69f67ec7f4ce08e4f73d49a25b723ba2b54ab3c25cf80450f2f0297b08b2c025d18074ee4fdf8b4709a9","ssdeep":"","tlshash":"25f0a35d3c56b55737f97639c3238a7f3795070175c35524ca46cc3468744c61846d4e","size":445,"data":"","first_seen":"2025-12-17T07:07:42.638237Z","last_seen":"2025-12-22T20:05:15.733075Z","times_seen":7,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"vormasia.sbs/","fqdn":"vormasia.sbs","domain":"vormasia.sbs","tld":"sbs"},"ip":{"addr":"46.151.182.165","port":443,"asn":44477,"as":"Stark Industries Solutions Ltd","country":"The Netherlands","country_code":"NL"},"introduction_type":"scriptElement","is_inline":true,"md5":"102c1cca2c5881000df5304f721c13fe","sha1":"8dcaedfc46093475e12893b8d392b25cfc9604cb","sha256":"39e05390db18fc011b03742f5e0c6e0cfbe31ae713dfb7354be446c13f877995","sha512":"db1538a194e808c6fa29271ce34084248ab1ccd0e6006ed0905906d832a7a850ccd79c095e5cfd2c4c7b529c99bafd24804390fd837cf8cc7a87b7447266ed1f","ssdeep":"","tlshash":"17f0ab9d3ca6b46737f93638c2238a6f33a6070175839928c646cc2468649da1886d8e","size":445,"data":"","first_seen":"2025-12-17T07:07:42.639201Z","last_seen":"2025-12-22T20:05:15.738674Z","times_seen":7,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"code.jquery.com/jquery-3.7.1.min.js","fqdn":"code.jquery.com","domain":"jquery.com","tld":"com"},"ip":{"addr":"151.101.66.137","port":443,"asn":54113,"as":"FASTLY","country":"United States","country_code":"US"},"introduction_type":"scriptElement","is_inline":false,"md5":"2c872dbe60f4ba70fb85356113d8b35e","sha1":"ee48592d1fff952fcf06ce0b666ed4785493afdc","sha256":"fc9a93dd241f6b045cbff0481cf4e1901becd0e12fb45166a8f17f95823f0b1a","sha512":"bf6089ed4698cb8270a8b0c8ad9508ff886a7a842278e98064d5c1790ca3a36d5d69d9f047ef196882554fc104da2c88eb5395f1ee8cf0f3f6ff8869408350fe","ssdeep":"1536:0RUX9uDgwxcy2KVBNwchN6SLaHEk2BSrBESp+a/IEk4aAocVi8SMBQ47GKr:sHNwcv9VBQpLl88SMBQ47GKr","tlshash":"3983f8df77ca702247ab30b9006f550bf276199d684d4400f159d8e9bcb8a4a827bf7e","size":87533,"data":"","first_seen":"2023-08-31T16:03:19Z","last_seen":"2026-07-22T18:13:47.830141Z","times_seen":181316,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"vormasia.sbs/","fqdn":"vormasia.sbs","domain":"vormasia.sbs","tld":"sbs"},"ip":{"addr":"46.151.182.165","port":443,"asn":44477,"as":"Stark Industries Solutions Ltd","country":"The Netherlands","country_code":"NL"},"introduction_type":"scriptElement","is_inline":true,"md5":"d5fb8dde9b947f91a04508e8109acc34","sha1":"54bbcde3a418fef51872ff25b1c58f788db35fdb","sha256":"a39cb0be12585edade428fb724b97e58e6dfc565d06c59cfa36a0b8661b7f559","sha512":"80b38cf52da2f13f80bdff3977be7d20db4a82158342c9b564998a1ede52493dd126b8c166d4ddedb62f2de1ecfca687e89bea4fcf043d2ad8cfe76cbead24a9","ssdeep":"","tlshash":"27e026b714f1183404eff1af3b9e9a48301080a72148d942be6cab5c5f51ca04b62b72","size":333,"data":"","first_seen":"2025-12-19T06:51:10.810897Z","last_seen":"2025-12-19T06:51:10.810897Z","times_seen":1,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"vormasia.sbs/","fqdn":"vormasia.sbs","domain":"vormasia.sbs","tld":"sbs"},"ip":{"addr":"46.151.182.165","port":443,"asn":44477,"as":"Stark Industries Solutions Ltd","country":"The Netherlands","country_code":"NL"},"introduction_type":"scriptElement","is_inline":true,"md5":"16af02d312e75fa112da1be8bceb5090","sha1":"e84713be6bb86ce9dcb376f2d03d3b6a0846d94b","sha256":"da3aae71e5575330e4746a23c61c25777b2c3277f5f47ba6650365b0dee674e0","sha512":"96f0dccdcb09253d037db36eb5662eb007d24415a7fdb9ddf6f90b8e53d69d1dce66501b136e5921c34178e6a0ac8c1d6b7713dec18bbed07fe857dbe13bad29","ssdeep":"","tlshash":"0211dcbd227a2d3008328eb657cb605164f5f0032007c846773cdb481fabd824667eaf","size":981,"data":"","first_seen":"2025-09-11T02:01:27.602379Z","last_seen":"2026-04-10T01:16:16.166675Z","times_seen":10,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"vormasia.sbs/","fqdn":"vormasia.sbs","domain":"vormasia.sbs","tld":"sbs"},"ip":{"addr":"46.151.182.165","port":443,"asn":44477,"as":"Stark Industries Solutions Ltd","country":"The Netherlands","country_code":"NL"},"introduction_type":"scriptElement","is_inline":true,"md5":"cb0d209c5406a5f7f8e5d8a6795e3c4f","sha1":"c29c83fbd9c6497034ddb37aa17a913b5ecc604b","sha256":"847530ffa17324078526ffe8e87c4db09f2dfd0cf07e60c58d8af404dd4c8325","sha512":"b0acbbb12a4a23f60b8fd82aaf27882d41b25818d0a8886c2d20081860ef14eb953189954e9f952e509be6ac02a3691d3fa146f9c8996222be8d70b4fd421fe0","ssdeep":"96:YAXyknm7Tfj2NPd1Q40kNNTzAQyNNrbGKkT:YAXLmk/WG9","tlshash":"2c8155699cb3143553f7f1ac8387930cf6b080477806750679ac5780afb5c21a6afed9","size":4125,"data":"","first_seen":"2025-12-19T06:51:10.812702Z","last_seen":"2025-12-19T06:51:10.812702Z","times_seen":1,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"vormasia.sbs/","fqdn":"vormasia.sbs","domain":"vormasia.sbs","tld":"sbs"},"ip":{"addr":"46.151.182.165","port":443,"asn":44477,"as":"Stark Industries Solutions Ltd","country":"The Netherlands","country_code":"NL"},"introduction_type":"scriptElement","is_inline":true,"md5":"2077154294c25c06b0b5e01ba4252f37","sha1":"9bc96aab69e141ec70c7b91cd63fa1f93d383cca","sha256":"6ab4202a505927d77d4f486337df4a61a0bba845bee44cc2c2d95a4f48787a8b","sha512":"c2c458f770294e11db53bf4b846ee809fe6534c27d7f1ac38bb3aeb4274b8717c63b9032cea8063d7aa852ec61f99b65a5272162747323bf5dc300f8d13c054d","ssdeep":"","tlshash":"b9f026ae28f6304016b3306a99dfd809242395171a0abf203f8c95908f2df7dd18376c","size":478,"data":"","first_seen":"2023-09-03T02:03:13Z","last_seen":"2026-06-01T00:45:05.352219Z","times_seen":153,"alerts":{"ids":null,"analyzer":null,"urlquery":null}}],"eval":null,"write":null,"console":null},"http":[{"url":{"schema":"https","addr":"code.jquery.com/jquery-3.7.1.min.js","fqdn":"code.jquery.com","domain":"jquery.com","tld":"com"},"ip":{"addr":"151.101.66.137","port":443,"asn":54113,"as":"FASTLY","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://vormasia.sbs/","date":"2025-12-19T06:50:42.254Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.jquery.com","organization":""},"issuer":{"commonName":"Sectigo Public Server Authentication CA DV E36","organization":"Sectigo Limited"},"validity":{"start":"Thu, 12 Jun 2025 00:00:00 GMT","end":"Fri, 26 Jun 2026 23:59:59 GMT"},"fingerprint":{"sha1":"56:36:FB:D3:E0:9E:71:88:98:A4:C9:34:94:9B:43:3A:C4:C5:1E:BE","sha256":"9A:64:20:6F:F5:DC:F1:8A:D6:B2:D0:93:C2:7E:62:86:0B:1A:D5:24:CF:CE:4A:9F:4C:0D:F1:FB:F2:A0:A8:1E"}}},"request":{"raw":"GET /jquery-3.7.1.min.js HTTP/1.1\r\nHost: code.jquery.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://vormasia.sbs/\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ncontent-type: application/javascript; charset=utf-8\r\nlast-modified: Fri, 18 Oct 1991 12:00:00 GMT\r\netag: W/\"28feccc0-155ed\"\r\ncache-control: public, max-age=31536000, stale-while-revalidate=604800\r\naccess-control-allow-origin: *\r\ncross-origin-resource-policy: cross-origin\r\ncontent-encoding: gzip\r\nvia: 1.1 varnish, 1.1 varnish\r\naccept-ranges: bytes\r\ndate: Fri, 19 Dec 2025 06:50:42 GMT\r\nage: 2421020\r\nx-served-by: cache-lga21978-LGA, cache-hel1410027-HEL\r\nx-cache: HIT, HIT\r\nx-cache-hits: 27, 35597\r\nx-timer: S1766127042.339632,VS0,VE0\r\nvary: Accept-Encoding\r\ncontent-length: 30336\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Varnish","description":"Varnish is a reverse caching proxy.","website":"https://www.varnish-cache.org","common_platform_enumeration":"cpe:2.3:a:varnish-software:varnish_cache:*:*:*:*:*:*:*:*","icon":"Varnish.svg","categories":["Caching"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":87533,"size_decoded":0,"mime_type":"application/javascript; charset=utf-8","magic":"JavaScript source, ASCII text, with very long lines (65447)","md5":"2c872dbe60f4ba70fb85356113d8b35e","sha1":"ee48592d1fff952fcf06ce0b666ed4785493afdc","sha256":"fc9a93dd241f6b045cbff0481cf4e1901becd0e12fb45166a8f17f95823f0b1a","sha512":"bf6089ed4698cb8270a8b0c8ad9508ff886a7a842278e98064d5c1790ca3a36d5d69d9f047ef196882554fc104da2c88eb5395f1ee8cf0f3f6ff8869408350fe","ssdeep":"1536:0RUX9uDgwxcy2KVBNwchN6SLaHEk2BSrBESp+a/IEk4aAocVi8SMBQ47GKr:sHNwcv9VBQpLl88SMBQ47GKr","tlshash":"3983f8df77ca702247ab30b9006f550bf276199d684d4400f159d8e9bcb8a4a827bf7e","first_seen":"2023-08-31T16:03:19Z","last_seen":"2026-07-22T18:13:47.830141Z","times_seen":181316,"resource_available":true,"data":null}},"time_used":168,"timings":{"blocked":64,"dns":1,"connect":26,"send":0,"wait":27,"receive":8,"ssl":38},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"vormasia.sbs/fonts/BinancePlexV2/BinancePlex-SemiBold.otf","fqdn":"vormasia.sbs","domain":"vormasia.sbs","tld":"sbs"},"ip":{"addr":"46.151.182.165","port":443,"asn":44477,"as":"Stark Industries Solutions Ltd","country":"The Netherlands","country_code":"NL"},"is_navigation_request":false,"resource_type":"font","requested_by":"https://vormasia.sbs/","date":"2025-12-19T06:50:42.403Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"vormasia.sbs","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Wed, 17 Dec 2025 22:13:38 GMT","end":"Tue, 17 Mar 2026 22:13:37 GMT"},"fingerprint":{"sha1":"E6:06:F8:AD:31:38:2C:0C:FD:B0:DD:3E:6C:42:15:51:06:A1:43:B1","sha256":"56:88:6B:FD:90:AB:46:A6:47:F3:3F:DF:BD:B1:91:6B:CA:27:28:64:19:9D:DB:0E:89:7A:A9:A3:DE:CB:B5:A8"}}},"request":{"raw":"GET /fonts/BinancePlexV2/BinancePlex-SemiBold.otf HTTP/1.1\r\nHost: vormasia.sbs\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://vormasia.sbs/\r\nCookie: PHPSESSID=90c7d597a768a68819b75e518a21bfe8\r\nSec-Fetch-Dest: font\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 404 Not Found\r\nDate: Fri, 19 Dec 2025 06:50:42 GMT\r\nServer: Apache\r\nLast-Modified: Wed, 17 Dec 2025 23:01:55 GMT\r\nETag: \"328-6462dd4a6e7d2\"\r\nAccept-Ranges: bytes\r\nContent-Length: 808\r\nX-Powered-By: PleskLin\r\nKeep-Alive: timeout=5, max=99\r\nConnection: Keep-Alive\r\nContent-Type: text/html\r\n\r\n","headers":null,"cookies":null,"status_code":"404","status_text":"Not Found","fingerprints":[{"name":"Plesk","description":"Plesk is a web hosting and server data centre automation software with a control panel developed for Linux and Windows-based retail hosting service providers.","website":"https://www.plesk.com","common_platform_enumeration":"cpe:2.3:a:parallels:parallels_plesk_panel:*:*:*:*:*:*:*:*","icon":"Plesk.svg","categories":["Hosting panels"]},{"name":"Apache HTTP Server","description":"Apache is a free and open-source cross-platform web server software.","website":"https://httpd.apache.org/","common_platform_enumeration":"cpe:2.3:a:apache:http_server:*:*:*:*:*:*:*:*","icon":"Apache.svg","categories":["Web servers"]}],"data":{"size":808,"size_decoded":0,"mime_type":"text/html","magic":"HTML document, ASCII text","md5":"a943672a32297727bab01c3e76977550","sha1":"3a667c4b7a457ef6c586cc581d533c128737bf53","sha256":"b9347f234dc3c8d56e015e86d88a1400415db8f7a5ad91f02b6a2323c10a4187","sha512":"0965d415f3a0cef31953702fdae345d46fefd72ce3c4c7a0255aede74a76e10b856892700529a444453a622793e0257248c5c99fae17d5b0b9fd4118e208068c","ssdeep":"","tlshash":"2e01bd0a08e0501bc0d3915169a0f22dc9c2f997aa5b180079ed91c6cfd5f89c9d35ac","first_seen":"2023-03-08T11:42:06Z","last_seen":"2026-07-22T18:03:36.390847Z","times_seen":38430,"resource_available":true,"data":null}},"time_used":70,"timings":{"blocked":24,"dns":0,"connect":0,"send":0,"wait":45,"receive":1,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"openphish","sensor_type":"Blocklist","title":"OpenPhish","description":"OpenPhish","scan_date":"2025-12-19","alert":"Phishing - Binance","trigger":"vormasia.sbs","verdict":"phishing","severity":"medium","comment":"Binance","link":"https://openphish.com/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2025-12-19","alert":"Sinkholed","trigger":"vormasia.sbs","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2025-12-19","alert":"Phishing Block","trigger":"vormasia.sbs","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2025-12-19","alert":"Sinkholed","trigger":"vormasia.sbs","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2025-12-19","alert":"Sinkholed","trigger":"vormasia.sbs","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-12-19","alert":"Sinkholed","trigger":"vormasia.sbs","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2025-12-19","alert":"Sinkholed","trigger":"vormasia.sbs","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"vormasia.sbs/assets/favicon.ico","fqdn":"vormasia.sbs","domain":"vormasia.sbs","tld":"sbs"},"ip":{"addr":"46.151.182.165","port":443,"asn":44477,"as":"Stark Industries Solutions Ltd","country":"The Netherlands","country_code":"NL"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://vormasia.sbs/","date":"2025-12-19T06:50:42.617Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"vormasia.sbs","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Wed, 17 Dec 2025 22:13:38 GMT","end":"Tue, 17 Mar 2026 22:13:37 GMT"},"fingerprint":{"sha1":"E6:06:F8:AD:31:38:2C:0C:FD:B0:DD:3E:6C:42:15:51:06:A1:43:B1","sha256":"56:88:6B:FD:90:AB:46:A6:47:F3:3F:DF:BD:B1:91:6B:CA:27:28:64:19:9D:DB:0E:89:7A:A9:A3:DE:CB:B5:A8"}}},"request":{"raw":"GET /assets/favicon.ico HTTP/1.1\r\nHost: vormasia.sbs\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://vormasia.sbs/\r\nCookie: PHPSESSID=90c7d597a768a68819b75e518a21bfe8\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Fri, 19 Dec 2025 06:50:42 GMT\r\nServer: Apache\r\nLast-Modified: Fri, 28 Nov 2025 15:11:36 GMT\r\nETag: \"3c2e-644a90ba83a00\"\r\nAccept-Ranges: bytes\r\nContent-Length: 15406\r\nX-Powered-By: PleskLin\r\nKeep-Alive: timeout=5, max=96\r\nConnection: Keep-Alive\r\nContent-Type: image/vnd.microsoft.icon\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Plesk","description":"Plesk is a web hosting and server data centre automation software with a control panel developed for Linux and Windows-based retail hosting service providers.","website":"https://www.plesk.com","common_platform_enumeration":"cpe:2.3:a:parallels:parallels_plesk_panel:*:*:*:*:*:*:*:*","icon":"Plesk.svg","categories":["Hosting panels"]},{"name":"Apache HTTP Server","description":"Apache is a free and open-source cross-platform web server software.","website":"https://httpd.apache.org/","common_platform_enumeration":"cpe:2.3:a:apache:http_server:*:*:*:*:*:*:*:*","icon":"Apache.svg","categories":["Web servers"]}],"data":{"size":15406,"size_decoded":0,"mime_type":"image/vnd.microsoft.icon","magic":"MS Windows icon resource - 3 icons, 16x16, 32 bits/pixel, 32x32, 32 bits/pixel","md5":"e3381c658b97f22c37690173610c1ce7","sha1":"d0cb9c1d83e428428b8780870a1dd12493b7dba9","sha256":"67660a071f53b64eabe8e0a6855e65f35869dd803bbb4d04fdd002b0d948a30f","sha512":"783e7adba81ed002fcb93b512bb94fcd0718fb64147a9b1b3f11eef55ec55ddc152ee11c879e57bf7976aac72cbda17dfa870e481f0c42fddb140314e0ca99f4","ssdeep":"48:n669z3NAD656Kaq6+etnOHnH5GUc0MTPEWH5PDTjaaKNSSOxvfs3fSH+fTswfjiz:TuMKcssRm","tlshash":"15629fd63b127ae1e9281f768446b5d5e8a015908bd887f63ff1d2af34af02436c46c7","first_seen":"2024-12-10T13:05:08.196894Z","last_seen":"2026-04-10T01:16:16.142678Z","times_seen":71,"resource_available":false,"data":null}},"time_used":46,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":45,"receive":1,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2025-12-19","alert":"Sinkholed","trigger":"vormasia.sbs","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2025-12-19","alert":"Sinkholed","trigger":"vormasia.sbs","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2025-12-19","alert":"Sinkholed","trigger":"vormasia.sbs","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2025-12-19","alert":"Sinkholed","trigger":"vormasia.sbs","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2025-12-19","alert":"Phishing Block","trigger":"vormasia.sbs","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"openphish","sensor_type":"Blocklist","title":"OpenPhish","description":"OpenPhish","scan_date":"2025-12-19","alert":"Phishing - Binance","trigger":"vormasia.sbs","verdict":"phishing","severity":"medium","comment":"Binance","link":"https://openphish.com/","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-12-19","alert":"Sinkholed","trigger":"vormasia.sbs","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"vormasia.sbs/process","fqdn":"vormasia.sbs","domain":"vormasia.sbs","tld":"sbs"},"ip":{"addr":"46.151.182.165","port":443,"asn":44477,"as":"Stark Industries Solutions Ltd","country":"The Netherlands","country_code":"NL"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"https://vormasia.sbs/","date":"2025-12-19T06:50:46.479Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"vormasia.sbs","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Wed, 17 Dec 2025 22:13:38 GMT","end":"Tue, 17 Mar 2026 22:13:37 GMT"},"fingerprint":{"sha1":"E6:06:F8:AD:31:38:2C:0C:FD:B0:DD:3E:6C:42:15:51:06:A1:43:B1","sha256":"56:88:6B:FD:90:AB:46:A6:47:F3:3F:DF:BD:B1:91:6B:CA:27:28:64:19:9D:DB:0E:89:7A:A9:A3:DE:CB:B5:A8"}}},"request":{"raw":"POST /process HTTP/1.1\r\nHost: vormasia.sbs\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nContent-Type: application/x-www-form-urlencoded; charset=UTF-8\r\nX-Requested-With: XMLHttpRequest\r\nContent-Length: 43\r\nOrigin: https://vormasia.sbs\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://vormasia.sbs/\r\nCookie: PHPSESSID=90c7d597a768a68819b75e518a21bfe8\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"POST","post_data":{"size":43,"data":"ip=f81d80af9cbeb0011316fbba3da8002b32251f7a"}},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Fri, 19 Dec 2025 06:50:46 GMT\r\nServer: Apache\r\nExpires: Thu, 19 Nov 1981 08:52:00 GMT\r\nCache-Control: no-store, no-cache, must-revalidate\r\nPragma: no-cache\r\nX-Powered-By: PHP/8.4.15, PleskLin\r\nContent-Length: 0\r\nKeep-Alive: timeout=5, max=94\r\nConnection: Keep-Alive\r\nContent-Type: text/html; charset=UTF-8\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Apache HTTP Server","description":"Apache is a free and open-source cross-platform web server software.","website":"https://httpd.apache.org/","common_platform_enumeration":"cpe:2.3:a:apache:http_server:*:*:*:*:*:*:*:*","icon":"Apache.svg","categories":["Web servers"]},{"name":"PHP:8.4.15","description":"PHP is a general-purpose scripting language used for web development.","website":"https://php.net","common_platform_enumeration":"cpe:2.3:a:php:php:*:*:*:*:*:*:*:*","icon":"PHP.svg","categories":["Programming languages"]}],"data":{"size":0,"size_decoded":0,"mime_type":"text/html; charset=UTF-8","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-07-22T18:24:27.697275Z","times_seen":17457126,"resource_available":true,"data":null}},"time_used":59,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":58,"receive":1,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2025-12-19","alert":"Sinkholed","trigger":"vormasia.sbs","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2025-12-19","alert":"Sinkholed","trigger":"vormasia.sbs","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2025-12-19","alert":"Sinkholed","trigger":"vormasia.sbs","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2025-12-19","alert":"Sinkholed","trigger":"vormasia.sbs","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2025-12-19","alert":"Phishing Block","trigger":"vormasia.sbs","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"openphish","sensor_type":"Blocklist","title":"OpenPhish","description":"OpenPhish","scan_date":"2025-12-19","alert":"Phishing - Binance","trigger":"vormasia.sbs","verdict":"phishing","severity":"medium","comment":"Binance","link":"https://openphish.com/","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-12-19","alert":"Sinkholed","trigger":"vormasia.sbs","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"vormasia.sbs/","fqdn":"vormasia.sbs","domain":"vormasia.sbs","tld":"sbs"},"ip":{"addr":"46.151.182.165","port":443,"asn":44477,"as":"Stark Industries Solutions Ltd","country":"The Netherlands","country_code":"NL"},"is_navigation_request":true,"resource_type":"document","requested_by":"","date":"2025-12-19T06:50:41.335Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"vormasia.sbs","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Wed, 17 Dec 2025 22:13:38 GMT","end":"Tue, 17 Mar 2026 22:13:37 GMT"},"fingerprint":{"sha1":"E6:06:F8:AD:31:38:2C:0C:FD:B0:DD:3E:6C:42:15:51:06:A1:43:B1","sha256":"56:88:6B:FD:90:AB:46:A6:47:F3:3F:DF:BD:B1:91:6B:CA:27:28:64:19:9D:DB:0E:89:7A:A9:A3:DE:CB:B5:A8"}}},"request":{"raw":"GET / HTTP/1.1\r\nHost: vormasia.sbs\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nUpgrade-Insecure-Requests: 1\r\nSec-Fetch-Dest: document\r\nSec-Fetch-Mode: navigate\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Fri, 19 Dec 2025 06:50:41 GMT\r\nServer: Apache\r\nExpires: Thu, 19 Nov 1981 08:52:00 GMT\r\nCache-Control: no-store, no-cache, must-revalidate\r\nPragma: no-cache\r\nSet-Cookie: PHPSESSID=90c7d597a768a68819b75e518a21bfe8; path=/\r\nX-Powered-By: PHP/8.4.15, PleskLin\r\nContent-Length: 1008775\r\nKeep-Alive: timeout=5, max=100\r\nConnection: Keep-Alive\r\nContent-Type: text/html; charset=UTF-8\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"jQuery CDN","description":"jQuery CDN is a way to include jQuery in your website without actually downloading and keeping it your website's folder.","website":"https://code.jquery.com/","common_platform_enumeration":"","icon":"jQuery.svg","categories":["CDN"]},{"name":"PHP:8.4.15","description":"PHP is a general-purpose scripting language used for web development.","website":"https://php.net","common_platform_enumeration":"cpe:2.3:a:php:php:*:*:*:*:*:*:*:*","icon":"PHP.svg","categories":["Programming languages"]},{"name":"Apache HTTP Server","description":"Apache is a free and open-source cross-platform web server software.","website":"https://httpd.apache.org/","common_platform_enumeration":"cpe:2.3:a:apache:http_server:*:*:*:*:*:*:*:*","icon":"Apache.svg","categories":["Web servers"]},{"name":"Vue.js","description":"Vue.js is an open-source model–view–viewmodel JavaScript framework for building user interfaces and single-page applications.","website":"https://vuejs.org","common_platform_enumeration":"","icon":"vue.svg","categories":["JavaScript frameworks"]},{"name":"jQuery:3.7.1","description":"jQuery is a JavaScript library which is a free, open-source software designed to simplify HTML DOM tree traversal and manipulation, as well as event handling, CSS animation, and Ajax.","website":"https://jquery.com","common_platform_enumeration":"cpe:2.3:a:jquery:jquery:*:*:*:*:*:*:*:*","icon":"jQuery.svg","categories":["JavaScript libraries"]}],"data":{"size":1008775,"size_decoded":0,"mime_type":"text/html; charset=UTF-8","magic":"HTML document, Unicode text, UTF-8 text, with CRLF, LF line terminators","md5":"36a30439b367747f3601b86c1fafaba1","sha1":"026f504619053d2a5cd5ed00485ae4d9122cd62a","sha256":"5b99601a3c78be86f5842755d09bce3a274dedbe5b87f7dd1fda9013f57bb379","sha512":"2192e51b4a720d5b6c677dbfd56af3d04eb71f3b8331e1a72d0bab3a10dcb585d1fc3106e9660e4cba07228dd29de52d86597a76dc824d04bcc2734c862aa7cb","ssdeep":"3072:z9sXT8t9b9NQB5LXyMTd4tgP71Df6piPX3f2iyMTdYCgP71Df6piPX3f2w:z9H9b9NQB5TyMTdJ2iyMTdW2w","tlshash":"2725810fb902110d95b3e3289fa31648fb125527aa4350adffdd93648fba3889951fcd","first_seen":"2025-12-19T06:51:10.80545Z","last_seen":"2025-12-19T06:51:10.80545Z","times_seen":1,"resource_available":false,"data":null}},"time_used":1055,"timings":{"blocked":146,"dns":57,"connect":43,"send":0,"wait":439,"receive":319,"ssl":46},"alerts":{"ids":null,"analyzer":[{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2025-12-19","alert":"Phishing Block","trigger":"vormasia.sbs","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2025-12-19","alert":"Sinkholed","trigger":"vormasia.sbs","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2025-12-19","alert":"Sinkholed","trigger":"vormasia.sbs","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2025-12-19","alert":"Sinkholed","trigger":"vormasia.sbs","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2025-12-19","alert":"Sinkholed","trigger":"vormasia.sbs","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"openphish","sensor_type":"url","title":"OpenPhish","description":"OpenPhish","scan_date":"2025-12-19","alert":"Phishing - Binance","trigger":"vormasia.sbs/","verdict":"phishing","severity":"medium","comment":"Binance","link":"https://openphish.com","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-12-19","alert":"Sinkholed","trigger":"vormasia.sbs","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"vormasia.sbs/assets/img/footermobil.png","fqdn":"vormasia.sbs","domain":"vormasia.sbs","tld":"sbs"},"ip":{"addr":"46.151.182.165","port":443,"asn":44477,"as":"Stark Industries Solutions Ltd","country":"The Netherlands","country_code":"NL"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://vormasia.sbs/","date":"2025-12-19T06:50:42.251Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"vormasia.sbs","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Wed, 17 Dec 2025 22:13:38 GMT","end":"Tue, 17 Mar 2026 22:13:37 GMT"},"fingerprint":{"sha1":"E6:06:F8:AD:31:38:2C:0C:FD:B0:DD:3E:6C:42:15:51:06:A1:43:B1","sha256":"56:88:6B:FD:90:AB:46:A6:47:F3:3F:DF:BD:B1:91:6B:CA:27:28:64:19:9D:DB:0E:89:7A:A9:A3:DE:CB:B5:A8"}}},"request":{"raw":"GET /assets/img/footermobil.png HTTP/1.1\r\nHost: vormasia.sbs\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://vormasia.sbs/\r\nCookie: PHPSESSID=90c7d597a768a68819b75e518a21bfe8\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Fri, 19 Dec 2025 06:50:42 GMT\r\nServer: Apache\r\nLast-Modified: Fri, 28 Nov 2025 15:11:36 GMT\r\nETag: \"72dc-644a90ba83a00\"\r\nAccept-Ranges: bytes\r\nContent-Length: 29404\r\nX-Powered-By: PleskLin\r\nKeep-Alive: timeout=5, max=100\r\nConnection: Keep-Alive\r\nContent-Type: image/png\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Apache HTTP Server","description":"Apache is a free and open-source cross-platform web server software.","website":"https://httpd.apache.org/","common_platform_enumeration":"cpe:2.3:a:apache:http_server:*:*:*:*:*:*:*:*","icon":"Apache.svg","categories":["Web servers"]},{"name":"Plesk","description":"Plesk is a web hosting and server data centre automation software with a control panel developed for Linux and Windows-based retail hosting service providers.","website":"https://www.plesk.com","common_platform_enumeration":"cpe:2.3:a:parallels:parallels_plesk_panel:*:*:*:*:*:*:*:*","icon":"Plesk.svg","categories":["Hosting panels"]}],"data":{"size":29404,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 371 x 664, 8-bit/color RGBA, non-interlaced","md5":"dc0f1928a5c29cc4a951427ea3200f59","sha1":"0800ceddccae2e2713b044868717c99c0fd80a19","sha256":"805caeb738fd44789afaccddf66bc2d2df274d30aece6cc57c816341b9a3c6a5","sha512":"6fd3beb6e2d3063bacd4f285916859947d2974b43a91a9da50787cf37d1581b2fa6e5643d6cd2ac7ad95ec529f95a0d38597959b246e310669d5335b682b9595","ssdeep":"768:JnKKKKKurKKKKNKKQ3hKKKKKLQU2e04SYGFg7aKKK575SKKKtZKKKKK5NKNKKKK7:hKKKKKUKKKKNKKQ3hKKKKKLkN4SPrKKI","tlshash":"b5d29e8b0fa099bddd6a736112b86ed65f34f26128b3c7b0c0d7871c2612bf0e2b4651","first_seen":"2024-12-10T13:05:08.192953Z","last_seen":"2026-04-10T01:16:16.139014Z","times_seen":64,"resource_available":false,"data":null}},"time_used":268,"timings":{"blocked":90,"dns":2,"connect":41,"send":0,"wait":44,"receive":41,"ssl":47},"alerts":{"ids":null,"analyzer":[{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2025-12-19","alert":"Sinkholed","trigger":"vormasia.sbs","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2025-12-19","alert":"Phishing Block","trigger":"vormasia.sbs","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2025-12-19","alert":"Sinkholed","trigger":"vormasia.sbs","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2025-12-19","alert":"Sinkholed","trigger":"vormasia.sbs","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2025-12-19","alert":"Sinkholed","trigger":"vormasia.sbs","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"openphish","sensor_type":"Blocklist","title":"OpenPhish","description":"OpenPhish","scan_date":"2025-12-19","alert":"Phishing - Binance","trigger":"vormasia.sbs","verdict":"phishing","severity":"medium","comment":"Binance","link":"https://openphish.com/","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-12-19","alert":"Sinkholed","trigger":"vormasia.sbs","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"vormasia.sbs/process","fqdn":"vormasia.sbs","domain":"vormasia.sbs","tld":"sbs"},"ip":{"addr":"46.151.182.165","port":443,"asn":44477,"as":"Stark Industries Solutions Ltd","country":"The Netherlands","country_code":"NL"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"https://vormasia.sbs/","date":"2025-12-19T06:50:42.502Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"vormasia.sbs","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Wed, 17 Dec 2025 22:13:38 GMT","end":"Tue, 17 Mar 2026 22:13:37 GMT"},"fingerprint":{"sha1":"E6:06:F8:AD:31:38:2C:0C:FD:B0:DD:3E:6C:42:15:51:06:A1:43:B1","sha256":"56:88:6B:FD:90:AB:46:A6:47:F3:3F:DF:BD:B1:91:6B:CA:27:28:64:19:9D:DB:0E:89:7A:A9:A3:DE:CB:B5:A8"}}},"request":{"raw":"POST /process HTTP/1.1\r\nHost: vormasia.sbs\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nContent-Type: application/x-www-form-urlencoded; charset=UTF-8\r\nX-Requested-With: XMLHttpRequest\r\nContent-Length: 43\r\nOrigin: https://vormasia.sbs\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://vormasia.sbs/\r\nCookie: PHPSESSID=90c7d597a768a68819b75e518a21bfe8\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"POST","post_data":{"size":43,"data":"ip=f81d80af9cbeb0011316fbba3da8002b32251f7a"}},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Fri, 19 Dec 2025 06:50:42 GMT\r\nServer: Apache\r\nExpires: Thu, 19 Nov 1981 08:52:00 GMT\r\nCache-Control: no-store, no-cache, must-revalidate\r\nPragma: no-cache\r\nX-Powered-By: PHP/8.4.15, PleskLin\r\nContent-Length: 0\r\nKeep-Alive: timeout=5, max=97\r\nConnection: Keep-Alive\r\nContent-Type: text/html; charset=UTF-8\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Apache HTTP Server","description":"Apache is a free and open-source cross-platform web server software.","website":"https://httpd.apache.org/","common_platform_enumeration":"cpe:2.3:a:apache:http_server:*:*:*:*:*:*:*:*","icon":"Apache.svg","categories":["Web servers"]},{"name":"PHP:8.4.15","description":"PHP is a general-purpose scripting language used for web development.","website":"https://php.net","common_platform_enumeration":"cpe:2.3:a:php:php:*:*:*:*:*:*:*:*","icon":"PHP.svg","categories":["Programming languages"]}],"data":{"size":0,"size_decoded":0,"mime_type":"text/html; charset=UTF-8","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-07-22T18:24:27.697275Z","times_seen":17457126,"resource_available":true,"data":null}},"time_used":54,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":54,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2025-12-19","alert":"Sinkholed","trigger":"vormasia.sbs","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2025-12-19","alert":"Phishing Block","trigger":"vormasia.sbs","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2025-12-19","alert":"Sinkholed","trigger":"vormasia.sbs","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2025-12-19","alert":"Sinkholed","trigger":"vormasia.sbs","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2025-12-19","alert":"Sinkholed","trigger":"vormasia.sbs","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"openphish","sensor_type":"Blocklist","title":"OpenPhish","description":"OpenPhish","scan_date":"2025-12-19","alert":"Phishing - Binance","trigger":"vormasia.sbs","verdict":"phishing","severity":"medium","comment":"Binance","link":"https://openphish.com/","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-12-19","alert":"Sinkholed","trigger":"vormasia.sbs","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"vormasia.sbs/process","fqdn":"vormasia.sbs","domain":"vormasia.sbs","tld":"sbs"},"ip":{"addr":"46.151.182.165","port":443,"asn":44477,"as":"Stark Industries Solutions Ltd","country":"The Netherlands","country_code":"NL"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"https://vormasia.sbs/","date":"2025-12-19T06:50:44.479Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"vormasia.sbs","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Wed, 17 Dec 2025 22:13:38 GMT","end":"Tue, 17 Mar 2026 22:13:37 GMT"},"fingerprint":{"sha1":"E6:06:F8:AD:31:38:2C:0C:FD:B0:DD:3E:6C:42:15:51:06:A1:43:B1","sha256":"56:88:6B:FD:90:AB:46:A6:47:F3:3F:DF:BD:B1:91:6B:CA:27:28:64:19:9D:DB:0E:89:7A:A9:A3:DE:CB:B5:A8"}}},"request":{"raw":"POST /process HTTP/1.1\r\nHost: vormasia.sbs\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nContent-Type: application/x-www-form-urlencoded; charset=UTF-8\r\nX-Requested-With: XMLHttpRequest\r\nContent-Length: 43\r\nOrigin: https://vormasia.sbs\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://vormasia.sbs/\r\nCookie: PHPSESSID=90c7d597a768a68819b75e518a21bfe8\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"POST","post_data":{"size":43,"data":"ip=f81d80af9cbeb0011316fbba3da8002b32251f7a"}},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Fri, 19 Dec 2025 06:50:44 GMT\r\nServer: Apache\r\nExpires: Thu, 19 Nov 1981 08:52:00 GMT\r\nCache-Control: no-store, no-cache, must-revalidate\r\nPragma: no-cache\r\nX-Powered-By: PHP/8.4.15, PleskLin\r\nContent-Length: 0\r\nKeep-Alive: timeout=5, max=95\r\nConnection: Keep-Alive\r\nContent-Type: text/html; charset=UTF-8\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"PHP:8.4.15","description":"PHP is a general-purpose scripting language used for web development.","website":"https://php.net","common_platform_enumeration":"cpe:2.3:a:php:php:*:*:*:*:*:*:*:*","icon":"PHP.svg","categories":["Programming languages"]},{"name":"Apache HTTP Server","description":"Apache is a free and open-source cross-platform web server software.","website":"https://httpd.apache.org/","common_platform_enumeration":"cpe:2.3:a:apache:http_server:*:*:*:*:*:*:*:*","icon":"Apache.svg","categories":["Web servers"]}],"data":{"size":0,"size_decoded":0,"mime_type":"text/html; charset=UTF-8","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-07-22T18:24:27.697275Z","times_seen":17457126,"resource_available":true,"data":null}},"time_used":53,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":53,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2025-12-19","alert":"Sinkholed","trigger":"vormasia.sbs","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2025-12-19","alert":"Phishing Block","trigger":"vormasia.sbs","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2025-12-19","alert":"Sinkholed","trigger":"vormasia.sbs","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2025-12-19","alert":"Sinkholed","trigger":"vormasia.sbs","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2025-12-19","alert":"Sinkholed","trigger":"vormasia.sbs","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"openphish","sensor_type":"Blocklist","title":"OpenPhish","description":"OpenPhish","scan_date":"2025-12-19","alert":"Phishing - Binance","trigger":"vormasia.sbs","verdict":"phishing","severity":"medium","comment":"Binance","link":"https://openphish.com/","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-12-19","alert":"Sinkholed","trigger":"vormasia.sbs","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"vormasia.sbs/fonts/BinancePlexV2/BinancePlex-Regular.otf","fqdn":"vormasia.sbs","domain":"vormasia.sbs","tld":"sbs"},"ip":{"addr":"46.151.182.165","port":443,"asn":44477,"as":"Stark Industries Solutions Ltd","country":"The Netherlands","country_code":"NL"},"is_navigation_request":false,"resource_type":"font","requested_by":"https://vormasia.sbs/","date":"2025-12-19T06:50:42.401Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"vormasia.sbs","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Wed, 17 Dec 2025 22:13:38 GMT","end":"Tue, 17 Mar 2026 22:13:37 GMT"},"fingerprint":{"sha1":"E6:06:F8:AD:31:38:2C:0C:FD:B0:DD:3E:6C:42:15:51:06:A1:43:B1","sha256":"56:88:6B:FD:90:AB:46:A6:47:F3:3F:DF:BD:B1:91:6B:CA:27:28:64:19:9D:DB:0E:89:7A:A9:A3:DE:CB:B5:A8"}}},"request":{"raw":"GET /fonts/BinancePlexV2/BinancePlex-Regular.otf HTTP/1.1\r\nHost: vormasia.sbs\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://vormasia.sbs/\r\nCookie: PHPSESSID=90c7d597a768a68819b75e518a21bfe8\r\nSec-Fetch-Dest: font\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 404 Not Found\r\nDate: Fri, 19 Dec 2025 06:50:42 GMT\r\nServer: Apache\r\nLast-Modified: Wed, 17 Dec 2025 23:01:55 GMT\r\nETag: \"328-6462dd4a6e7d2\"\r\nAccept-Ranges: bytes\r\nContent-Length: 808\r\nX-Powered-By: PleskLin\r\nKeep-Alive: timeout=5, max=98\r\nConnection: Keep-Alive\r\nContent-Type: text/html\r\n\r\n","headers":null,"cookies":null,"status_code":"404","status_text":"Not Found","fingerprints":[{"name":"Apache HTTP Server","description":"Apache is a free and open-source cross-platform web server software.","website":"https://httpd.apache.org/","common_platform_enumeration":"cpe:2.3:a:apache:http_server:*:*:*:*:*:*:*:*","icon":"Apache.svg","categories":["Web servers"]},{"name":"Plesk","description":"Plesk is a web hosting and server data centre automation software with a control panel developed for Linux and Windows-based retail hosting service providers.","website":"https://www.plesk.com","common_platform_enumeration":"cpe:2.3:a:parallels:parallels_plesk_panel:*:*:*:*:*:*:*:*","icon":"Plesk.svg","categories":["Hosting panels"]}],"data":{"size":808,"size_decoded":0,"mime_type":"text/html","magic":"HTML document, ASCII text","md5":"a943672a32297727bab01c3e76977550","sha1":"3a667c4b7a457ef6c586cc581d533c128737bf53","sha256":"b9347f234dc3c8d56e015e86d88a1400415db8f7a5ad91f02b6a2323c10a4187","sha512":"0965d415f3a0cef31953702fdae345d46fefd72ce3c4c7a0255aede74a76e10b856892700529a444453a622793e0257248c5c99fae17d5b0b9fd4118e208068c","ssdeep":"","tlshash":"2e01bd0a08e0501bc0d3915169a0f22dc9c2f997aa5b180079ed91c6cfd5f89c9d35ac","first_seen":"2023-03-08T11:42:06Z","last_seen":"2026-07-22T18:03:36.390847Z","times_seen":38430,"resource_available":true,"data":null}},"time_used":46,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":46,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2025-12-19","alert":"Sinkholed","trigger":"vormasia.sbs","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2025-12-19","alert":"Sinkholed","trigger":"vormasia.sbs","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2025-12-19","alert":"Phishing Block","trigger":"vormasia.sbs","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2025-12-19","alert":"Sinkholed","trigger":"vormasia.sbs","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2025-12-19","alert":"Sinkholed","trigger":"vormasia.sbs","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"openphish","sensor_type":"Blocklist","title":"OpenPhish","description":"OpenPhish","scan_date":"2025-12-19","alert":"Phishing - Binance","trigger":"vormasia.sbs","verdict":"phishing","severity":"medium","comment":"Binance","link":"https://openphish.com/","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-12-19","alert":"Sinkholed","trigger":"vormasia.sbs","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"vormasia.sbs/process","fqdn":"vormasia.sbs","domain":"vormasia.sbs","tld":"sbs"},"ip":{"addr":"46.151.182.165","port":443,"asn":44477,"as":"Stark Industries Solutions Ltd","country":"The Netherlands","country_code":"NL"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"https://vormasia.sbs/","date":"2025-12-19T06:50:50.480Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"vormasia.sbs","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Wed, 17 Dec 2025 22:13:38 GMT","end":"Tue, 17 Mar 2026 22:13:37 GMT"},"fingerprint":{"sha1":"E6:06:F8:AD:31:38:2C:0C:FD:B0:DD:3E:6C:42:15:51:06:A1:43:B1","sha256":"56:88:6B:FD:90:AB:46:A6:47:F3:3F:DF:BD:B1:91:6B:CA:27:28:64:19:9D:DB:0E:89:7A:A9:A3:DE:CB:B5:A8"}}},"request":{"raw":"POST /process HTTP/1.1\r\nHost: vormasia.sbs\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nContent-Type: application/x-www-form-urlencoded; charset=UTF-8\r\nX-Requested-With: XMLHttpRequest\r\nContent-Length: 43\r\nOrigin: https://vormasia.sbs\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://vormasia.sbs/\r\nCookie: PHPSESSID=90c7d597a768a68819b75e518a21bfe8\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"POST","post_data":{"size":43,"data":"ip=f81d80af9cbeb0011316fbba3da8002b32251f7a"}},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Fri, 19 Dec 2025 06:50:50 GMT\r\nServer: Apache\r\nExpires: Thu, 19 Nov 1981 08:52:00 GMT\r\nCache-Control: no-store, no-cache, must-revalidate\r\nPragma: no-cache\r\nX-Powered-By: PHP/8.4.15, PleskLin\r\nContent-Length: 0\r\nKeep-Alive: timeout=5, max=92\r\nConnection: Keep-Alive\r\nContent-Type: text/html; charset=UTF-8\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"PHP:8.4.15","description":"PHP is a general-purpose scripting language used for web development.","website":"https://php.net","common_platform_enumeration":"cpe:2.3:a:php:php:*:*:*:*:*:*:*:*","icon":"PHP.svg","categories":["Programming languages"]},{"name":"Apache HTTP Server","description":"Apache is a free and open-source cross-platform web server software.","website":"https://httpd.apache.org/","common_platform_enumeration":"cpe:2.3:a:apache:http_server:*:*:*:*:*:*:*:*","icon":"Apache.svg","categories":["Web servers"]}],"data":{"size":0,"size_decoded":0,"mime_type":"text/html; charset=UTF-8","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-07-22T18:24:27.697275Z","times_seen":17457126,"resource_available":true,"data":null}},"time_used":53,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":53,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2025-12-19","alert":"Sinkholed","trigger":"vormasia.sbs","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2025-12-19","alert":"Sinkholed","trigger":"vormasia.sbs","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2025-12-19","alert":"Sinkholed","trigger":"vormasia.sbs","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2025-12-19","alert":"Sinkholed","trigger":"vormasia.sbs","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"openphish","sensor_type":"Blocklist","title":"OpenPhish","description":"OpenPhish","scan_date":"2025-12-19","alert":"Phishing - Binance","trigger":"vormasia.sbs","verdict":"phishing","severity":"medium","comment":"Binance","link":"https://openphish.com/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2025-12-19","alert":"Phishing Block","trigger":"vormasia.sbs","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-12-19","alert":"Sinkholed","trigger":"vormasia.sbs","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"vormasia.sbs/process","fqdn":"vormasia.sbs","domain":"vormasia.sbs","tld":"sbs"},"ip":{"addr":"46.151.182.165","port":443,"asn":44477,"as":"Stark Industries Solutions Ltd","country":"The Netherlands","country_code":"NL"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"https://vormasia.sbs/","date":"2025-12-19T06:50:54.479Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"vormasia.sbs","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Wed, 17 Dec 2025 22:13:38 GMT","end":"Tue, 17 Mar 2026 22:13:37 GMT"},"fingerprint":{"sha1":"E6:06:F8:AD:31:38:2C:0C:FD:B0:DD:3E:6C:42:15:51:06:A1:43:B1","sha256":"56:88:6B:FD:90:AB:46:A6:47:F3:3F:DF:BD:B1:91:6B:CA:27:28:64:19:9D:DB:0E:89:7A:A9:A3:DE:CB:B5:A8"}}},"request":{"raw":"POST /process HTTP/1.1\r\nHost: vormasia.sbs\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nContent-Type: application/x-www-form-urlencoded; charset=UTF-8\r\nX-Requested-With: XMLHttpRequest\r\nContent-Length: 43\r\nOrigin: https://vormasia.sbs\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://vormasia.sbs/\r\nCookie: PHPSESSID=90c7d597a768a68819b75e518a21bfe8\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"POST","post_data":{"size":43,"data":"ip=f81d80af9cbeb0011316fbba3da8002b32251f7a"}},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Fri, 19 Dec 2025 06:50:54 GMT\r\nServer: Apache\r\nExpires: Thu, 19 Nov 1981 08:52:00 GMT\r\nCache-Control: no-store, no-cache, must-revalidate\r\nPragma: no-cache\r\nX-Powered-By: PHP/8.4.15, PleskLin\r\nContent-Length: 0\r\nKeep-Alive: timeout=5, max=90\r\nConnection: Keep-Alive\r\nContent-Type: text/html; charset=UTF-8\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"PHP:8.4.15","description":"PHP is a general-purpose scripting language used for web development.","website":"https://php.net","common_platform_enumeration":"cpe:2.3:a:php:php:*:*:*:*:*:*:*:*","icon":"PHP.svg","categories":["Programming languages"]},{"name":"Apache HTTP Server","description":"Apache is a free and open-source cross-platform web server software.","website":"https://httpd.apache.org/","common_platform_enumeration":"cpe:2.3:a:apache:http_server:*:*:*:*:*:*:*:*","icon":"Apache.svg","categories":["Web servers"]}],"data":{"size":0,"size_decoded":0,"mime_type":"text/html; charset=UTF-8","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-07-22T18:24:27.697275Z","times_seen":17457126,"resource_available":true,"data":null}},"time_used":53,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":53,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2025-12-19","alert":"Sinkholed","trigger":"vormasia.sbs","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2025-12-19","alert":"Sinkholed","trigger":"vormasia.sbs","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2025-12-19","alert":"Sinkholed","trigger":"vormasia.sbs","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2025-12-19","alert":"Phishing Block","trigger":"vormasia.sbs","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2025-12-19","alert":"Sinkholed","trigger":"vormasia.sbs","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"openphish","sensor_type":"Blocklist","title":"OpenPhish","description":"OpenPhish","scan_date":"2025-12-19","alert":"Phishing - Binance","trigger":"vormasia.sbs","verdict":"phishing","severity":"medium","comment":"Binance","link":"https://openphish.com/","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-12-19","alert":"Sinkholed","trigger":"vormasia.sbs","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"vormasia.sbs/process","fqdn":"vormasia.sbs","domain":"vormasia.sbs","tld":"sbs"},"ip":{"addr":"46.151.182.165","port":443,"asn":44477,"as":"Stark Industries Solutions Ltd","country":"The Netherlands","country_code":"NL"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"https://vormasia.sbs/","date":"2025-12-19T06:50:56.479Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"vormasia.sbs","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Wed, 17 Dec 2025 22:13:38 GMT","end":"Tue, 17 Mar 2026 22:13:37 GMT"},"fingerprint":{"sha1":"E6:06:F8:AD:31:38:2C:0C:FD:B0:DD:3E:6C:42:15:51:06:A1:43:B1","sha256":"56:88:6B:FD:90:AB:46:A6:47:F3:3F:DF:BD:B1:91:6B:CA:27:28:64:19:9D:DB:0E:89:7A:A9:A3:DE:CB:B5:A8"}}},"request":{"raw":"POST /process HTTP/1.1\r\nHost: vormasia.sbs\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nContent-Type: application/x-www-form-urlencoded; charset=UTF-8\r\nX-Requested-With: XMLHttpRequest\r\nContent-Length: 43\r\nOrigin: https://vormasia.sbs\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://vormasia.sbs/\r\nCookie: PHPSESSID=90c7d597a768a68819b75e518a21bfe8\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"POST","post_data":{"size":43,"data":"ip=f81d80af9cbeb0011316fbba3da8002b32251f7a"}},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Fri, 19 Dec 2025 06:50:56 GMT\r\nServer: Apache\r\nExpires: Thu, 19 Nov 1981 08:52:00 GMT\r\nCache-Control: no-store, no-cache, must-revalidate\r\nPragma: no-cache\r\nX-Powered-By: PHP/8.4.15, PleskLin\r\nContent-Length: 0\r\nKeep-Alive: timeout=5, max=89\r\nConnection: Keep-Alive\r\nContent-Type: text/html; charset=UTF-8\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Apache HTTP Server","description":"Apache is a free and open-source cross-platform web server software.","website":"https://httpd.apache.org/","common_platform_enumeration":"cpe:2.3:a:apache:http_server:*:*:*:*:*:*:*:*","icon":"Apache.svg","categories":["Web servers"]},{"name":"PHP:8.4.15","description":"PHP is a general-purpose scripting language used for web development.","website":"https://php.net","common_platform_enumeration":"cpe:2.3:a:php:php:*:*:*:*:*:*:*:*","icon":"PHP.svg","categories":["Programming languages"]}],"data":{"size":0,"size_decoded":0,"mime_type":"text/html; charset=UTF-8","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-07-22T18:24:27.697275Z","times_seen":17457126,"resource_available":true,"data":null}},"time_used":53,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":53,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2025-12-19","alert":"Sinkholed","trigger":"vormasia.sbs","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2025-12-19","alert":"Sinkholed","trigger":"vormasia.sbs","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2025-12-19","alert":"Phishing Block","trigger":"vormasia.sbs","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2025-12-19","alert":"Sinkholed","trigger":"vormasia.sbs","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"openphish","sensor_type":"Blocklist","title":"OpenPhish","description":"OpenPhish","scan_date":"2025-12-19","alert":"Phishing - Binance","trigger":"vormasia.sbs","verdict":"phishing","severity":"medium","comment":"Binance","link":"https://openphish.com/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2025-12-19","alert":"Sinkholed","trigger":"vormasia.sbs","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-12-19","alert":"Sinkholed","trigger":"vormasia.sbs","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"vormasia.sbs/process","fqdn":"vormasia.sbs","domain":"vormasia.sbs","tld":"sbs"},"ip":{"addr":"46.151.182.165","port":443,"asn":44477,"as":"Stark Industries Solutions Ltd","country":"The Netherlands","country_code":"NL"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"https://vormasia.sbs/","date":"2025-12-19T06:50:58.480Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"vormasia.sbs","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Wed, 17 Dec 2025 22:13:38 GMT","end":"Tue, 17 Mar 2026 22:13:37 GMT"},"fingerprint":{"sha1":"E6:06:F8:AD:31:38:2C:0C:FD:B0:DD:3E:6C:42:15:51:06:A1:43:B1","sha256":"56:88:6B:FD:90:AB:46:A6:47:F3:3F:DF:BD:B1:91:6B:CA:27:28:64:19:9D:DB:0E:89:7A:A9:A3:DE:CB:B5:A8"}}},"request":{"raw":"POST /process HTTP/1.1\r\nHost: vormasia.sbs\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nContent-Type: application/x-www-form-urlencoded; charset=UTF-8\r\nX-Requested-With: XMLHttpRequest\r\nContent-Length: 43\r\nOrigin: https://vormasia.sbs\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://vormasia.sbs/\r\nCookie: PHPSESSID=90c7d597a768a68819b75e518a21bfe8\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"POST","post_data":{"size":43,"data":"ip=f81d80af9cbeb0011316fbba3da8002b32251f7a"}},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Fri, 19 Dec 2025 06:50:58 GMT\r\nServer: Apache\r\nExpires: Thu, 19 Nov 1981 08:52:00 GMT\r\nCache-Control: no-store, no-cache, must-revalidate\r\nPragma: no-cache\r\nX-Powered-By: PHP/8.4.15, PleskLin\r\nContent-Length: 0\r\nKeep-Alive: timeout=5, max=88\r\nConnection: Keep-Alive\r\nContent-Type: text/html; charset=UTF-8\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Apache HTTP Server","description":"Apache is a free and open-source cross-platform web server software.","website":"https://httpd.apache.org/","common_platform_enumeration":"cpe:2.3:a:apache:http_server:*:*:*:*:*:*:*:*","icon":"Apache.svg","categories":["Web servers"]},{"name":"PHP:8.4.15","description":"PHP is a general-purpose scripting language used for web development.","website":"https://php.net","common_platform_enumeration":"cpe:2.3:a:php:php:*:*:*:*:*:*:*:*","icon":"PHP.svg","categories":["Programming languages"]}],"data":{"size":0,"size_decoded":0,"mime_type":"text/html; charset=UTF-8","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-07-22T18:24:27.697275Z","times_seen":17457126,"resource_available":true,"data":null}},"time_used":53,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":53,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2025-12-19","alert":"Sinkholed","trigger":"vormasia.sbs","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2025-12-19","alert":"Phishing Block","trigger":"vormasia.sbs","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2025-12-19","alert":"Sinkholed","trigger":"vormasia.sbs","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2025-12-19","alert":"Sinkholed","trigger":"vormasia.sbs","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2025-12-19","alert":"Sinkholed","trigger":"vormasia.sbs","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"openphish","sensor_type":"Blocklist","title":"OpenPhish","description":"OpenPhish","scan_date":"2025-12-19","alert":"Phishing - Binance","trigger":"vormasia.sbs","verdict":"phishing","severity":"medium","comment":"Binance","link":"https://openphish.com/","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-12-19","alert":"Sinkholed","trigger":"vormasia.sbs","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"vormasia.sbs/process","fqdn":"vormasia.sbs","domain":"vormasia.sbs","tld":"sbs"},"ip":{"addr":"46.151.182.165","port":443,"asn":44477,"as":"Stark Industries Solutions Ltd","country":"The Netherlands","country_code":"NL"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"https://vormasia.sbs/","date":"2025-12-19T06:51:00.480Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"vormasia.sbs","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Wed, 17 Dec 2025 22:13:38 GMT","end":"Tue, 17 Mar 2026 22:13:37 GMT"},"fingerprint":{"sha1":"E6:06:F8:AD:31:38:2C:0C:FD:B0:DD:3E:6C:42:15:51:06:A1:43:B1","sha256":"56:88:6B:FD:90:AB:46:A6:47:F3:3F:DF:BD:B1:91:6B:CA:27:28:64:19:9D:DB:0E:89:7A:A9:A3:DE:CB:B5:A8"}}},"request":{"raw":"POST /process HTTP/1.1\r\nHost: vormasia.sbs\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nContent-Type: application/x-www-form-urlencoded; charset=UTF-8\r\nX-Requested-With: XMLHttpRequest\r\nContent-Length: 43\r\nOrigin: https://vormasia.sbs\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://vormasia.sbs/\r\nCookie: PHPSESSID=90c7d597a768a68819b75e518a21bfe8\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"POST","post_data":{"size":43,"data":"ip=f81d80af9cbeb0011316fbba3da8002b32251f7a"}},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Fri, 19 Dec 2025 06:51:00 GMT\r\nServer: Apache\r\nExpires: Thu, 19 Nov 1981 08:52:00 GMT\r\nCache-Control: no-store, no-cache, must-revalidate\r\nPragma: no-cache\r\nX-Powered-By: PHP/8.4.15, PleskLin\r\nContent-Length: 0\r\nKeep-Alive: timeout=5, max=87\r\nConnection: Keep-Alive\r\nContent-Type: text/html; charset=UTF-8\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"PHP:8.4.15","description":"PHP is a general-purpose scripting language used for web development.","website":"https://php.net","common_platform_enumeration":"cpe:2.3:a:php:php:*:*:*:*:*:*:*:*","icon":"PHP.svg","categories":["Programming languages"]},{"name":"Apache HTTP Server","description":"Apache is a free and open-source cross-platform web server software.","website":"https://httpd.apache.org/","common_platform_enumeration":"cpe:2.3:a:apache:http_server:*:*:*:*:*:*:*:*","icon":"Apache.svg","categories":["Web servers"]}],"data":{"size":0,"size_decoded":0,"mime_type":"text/html; charset=UTF-8","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-07-22T18:24:27.697275Z","times_seen":17457126,"resource_available":true,"data":null}},"time_used":54,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":54,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2025-12-19","alert":"Sinkholed","trigger":"vormasia.sbs","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2025-12-19","alert":"Phishing Block","trigger":"vormasia.sbs","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2025-12-19","alert":"Sinkholed","trigger":"vormasia.sbs","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2025-12-19","alert":"Sinkholed","trigger":"vormasia.sbs","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"openphish","sensor_type":"Blocklist","title":"OpenPhish","description":"OpenPhish","scan_date":"2025-12-19","alert":"Phishing - Binance","trigger":"vormasia.sbs","verdict":"phishing","severity":"medium","comment":"Binance","link":"https://openphish.com/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2025-12-19","alert":"Sinkholed","trigger":"vormasia.sbs","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-12-19","alert":"Sinkholed","trigger":"vormasia.sbs","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"vormasia.sbs/assets/img/headermobil.png","fqdn":"vormasia.sbs","domain":"vormasia.sbs","tld":"sbs"},"ip":{"addr":"46.151.182.165","port":443,"asn":44477,"as":"Stark Industries Solutions Ltd","country":"The Netherlands","country_code":"NL"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://vormasia.sbs/","date":"2025-12-19T06:50:42.249Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"vormasia.sbs","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Wed, 17 Dec 2025 22:13:38 GMT","end":"Tue, 17 Mar 2026 22:13:37 GMT"},"fingerprint":{"sha1":"E6:06:F8:AD:31:38:2C:0C:FD:B0:DD:3E:6C:42:15:51:06:A1:43:B1","sha256":"56:88:6B:FD:90:AB:46:A6:47:F3:3F:DF:BD:B1:91:6B:CA:27:28:64:19:9D:DB:0E:89:7A:A9:A3:DE:CB:B5:A8"}}},"request":{"raw":"GET /assets/img/headermobil.png HTTP/1.1\r\nHost: vormasia.sbs\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://vormasia.sbs/\r\nCookie: PHPSESSID=90c7d597a768a68819b75e518a21bfe8\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Fri, 19 Dec 2025 06:50:42 GMT\r\nServer: Apache\r\nLast-Modified: Fri, 28 Nov 2025 15:11:36 GMT\r\nETag: \"e1a-644a90ba83a00\"\r\nAccept-Ranges: bytes\r\nContent-Length: 3610\r\nX-Powered-By: PleskLin\r\nKeep-Alive: timeout=5, max=99\r\nConnection: Keep-Alive\r\nContent-Type: image/png\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Apache HTTP Server","description":"Apache is a free and open-source cross-platform web server software.","website":"https://httpd.apache.org/","common_platform_enumeration":"cpe:2.3:a:apache:http_server:*:*:*:*:*:*:*:*","icon":"Apache.svg","categories":["Web servers"]},{"name":"Plesk","description":"Plesk is a web hosting and server data centre automation software with a control panel developed for Linux and Windows-based retail hosting service providers.","website":"https://www.plesk.com","common_platform_enumeration":"cpe:2.3:a:parallels:parallels_plesk_panel:*:*:*:*:*:*:*:*","icon":"Plesk.svg","categories":["Hosting panels"]}],"data":{"size":3610,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 373 x 63, 8-bit/color RGBA, non-interlaced","md5":"62e0f63e92e600da6c504c952649053f","sha1":"8f5bafb0f961ef6a321a8069d26594b2ac8be3a5","sha256":"7cd9e895262415e01c2977ca7bc3a78af27d01d0cfb51b653a22aa247d7ba3b0","sha512":"74ac9ede0108e7f7effa4b22921fc2a783fce676367a7740e289f221dd7fe51e60e1801b43b5f83d3e3eeb2a3f2f5081798e3f7ebf14db22c44991597eaecbc4","ssdeep":"","tlshash":"98714caf65a286ebd76721e611bbf594d313704ac01b349c2c1da0624bdb3f24b342cb","first_seen":"2024-12-10T13:05:08.190197Z","last_seen":"2026-04-10T01:16:16.136735Z","times_seen":64,"resource_available":false,"data":null}},"time_used":48,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":48,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2025-12-19","alert":"Sinkholed","trigger":"vormasia.sbs","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2025-12-19","alert":"Sinkholed","trigger":"vormasia.sbs","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2025-12-19","alert":"Phishing Block","trigger":"vormasia.sbs","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2025-12-19","alert":"Sinkholed","trigger":"vormasia.sbs","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2025-12-19","alert":"Sinkholed","trigger":"vormasia.sbs","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"openphish","sensor_type":"Blocklist","title":"OpenPhish","description":"OpenPhish","scan_date":"2025-12-19","alert":"Phishing - Binance","trigger":"vormasia.sbs","verdict":"phishing","severity":"medium","comment":"Binance","link":"https://openphish.com/","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-12-19","alert":"Sinkholed","trigger":"vormasia.sbs","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"vormasia.sbs/process","fqdn":"vormasia.sbs","domain":"vormasia.sbs","tld":"sbs"},"ip":{"addr":"46.151.182.165","port":443,"asn":44477,"as":"Stark Industries Solutions Ltd","country":"The Netherlands","country_code":"NL"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"https://vormasia.sbs/","date":"2025-12-19T06:50:48.478Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"vormasia.sbs","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Wed, 17 Dec 2025 22:13:38 GMT","end":"Tue, 17 Mar 2026 22:13:37 GMT"},"fingerprint":{"sha1":"E6:06:F8:AD:31:38:2C:0C:FD:B0:DD:3E:6C:42:15:51:06:A1:43:B1","sha256":"56:88:6B:FD:90:AB:46:A6:47:F3:3F:DF:BD:B1:91:6B:CA:27:28:64:19:9D:DB:0E:89:7A:A9:A3:DE:CB:B5:A8"}}},"request":{"raw":"POST /process HTTP/1.1\r\nHost: vormasia.sbs\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nContent-Type: application/x-www-form-urlencoded; charset=UTF-8\r\nX-Requested-With: XMLHttpRequest\r\nContent-Length: 43\r\nOrigin: https://vormasia.sbs\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://vormasia.sbs/\r\nCookie: PHPSESSID=90c7d597a768a68819b75e518a21bfe8\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"POST","post_data":{"size":43,"data":"ip=f81d80af9cbeb0011316fbba3da8002b32251f7a"}},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Fri, 19 Dec 2025 06:50:48 GMT\r\nServer: Apache\r\nExpires: Thu, 19 Nov 1981 08:52:00 GMT\r\nCache-Control: no-store, no-cache, must-revalidate\r\nPragma: no-cache\r\nX-Powered-By: PHP/8.4.15, PleskLin\r\nContent-Length: 0\r\nKeep-Alive: timeout=5, max=93\r\nConnection: Keep-Alive\r\nContent-Type: text/html; charset=UTF-8\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Apache HTTP Server","description":"Apache is a free and open-source cross-platform web server software.","website":"https://httpd.apache.org/","common_platform_enumeration":"cpe:2.3:a:apache:http_server:*:*:*:*:*:*:*:*","icon":"Apache.svg","categories":["Web servers"]},{"name":"PHP:8.4.15","description":"PHP is a general-purpose scripting language used for web development.","website":"https://php.net","common_platform_enumeration":"cpe:2.3:a:php:php:*:*:*:*:*:*:*:*","icon":"PHP.svg","categories":["Programming languages"]}],"data":{"size":0,"size_decoded":0,"mime_type":"text/html; charset=UTF-8","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-07-22T18:24:27.697275Z","times_seen":17457126,"resource_available":true,"data":null}},"time_used":53,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":53,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2025-12-19","alert":"Phishing Block","trigger":"vormasia.sbs","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2025-12-19","alert":"Sinkholed","trigger":"vormasia.sbs","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2025-12-19","alert":"Sinkholed","trigger":"vormasia.sbs","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2025-12-19","alert":"Sinkholed","trigger":"vormasia.sbs","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2025-12-19","alert":"Sinkholed","trigger":"vormasia.sbs","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"openphish","sensor_type":"Blocklist","title":"OpenPhish","description":"OpenPhish","scan_date":"2025-12-19","alert":"Phishing - Binance","trigger":"vormasia.sbs","verdict":"phishing","severity":"medium","comment":"Binance","link":"https://openphish.com/","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-12-19","alert":"Sinkholed","trigger":"vormasia.sbs","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"vormasia.sbs/process","fqdn":"vormasia.sbs","domain":"vormasia.sbs","tld":"sbs"},"ip":{"addr":"46.151.182.165","port":443,"asn":44477,"as":"Stark Industries Solutions Ltd","country":"The Netherlands","country_code":"NL"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"https://vormasia.sbs/","date":"2025-12-19T06:50:52.484Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"vormasia.sbs","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Wed, 17 Dec 2025 22:13:38 GMT","end":"Tue, 17 Mar 2026 22:13:37 GMT"},"fingerprint":{"sha1":"E6:06:F8:AD:31:38:2C:0C:FD:B0:DD:3E:6C:42:15:51:06:A1:43:B1","sha256":"56:88:6B:FD:90:AB:46:A6:47:F3:3F:DF:BD:B1:91:6B:CA:27:28:64:19:9D:DB:0E:89:7A:A9:A3:DE:CB:B5:A8"}}},"request":{"raw":"POST /process HTTP/1.1\r\nHost: vormasia.sbs\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nContent-Type: application/x-www-form-urlencoded; charset=UTF-8\r\nX-Requested-With: XMLHttpRequest\r\nContent-Length: 43\r\nOrigin: https://vormasia.sbs\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://vormasia.sbs/\r\nCookie: PHPSESSID=90c7d597a768a68819b75e518a21bfe8\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"POST","post_data":{"size":43,"data":"ip=f81d80af9cbeb0011316fbba3da8002b32251f7a"}},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Fri, 19 Dec 2025 06:50:52 GMT\r\nServer: Apache\r\nExpires: Thu, 19 Nov 1981 08:52:00 GMT\r\nCache-Control: no-store, no-cache, must-revalidate\r\nPragma: no-cache\r\nX-Powered-By: PHP/8.4.15, PleskLin\r\nContent-Length: 0\r\nKeep-Alive: timeout=5, max=91\r\nConnection: Keep-Alive\r\nContent-Type: text/html; charset=UTF-8\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"PHP:8.4.15","description":"PHP is a general-purpose scripting language used for web development.","website":"https://php.net","common_platform_enumeration":"cpe:2.3:a:php:php:*:*:*:*:*:*:*:*","icon":"PHP.svg","categories":["Programming languages"]},{"name":"Apache HTTP Server","description":"Apache is a free and open-source cross-platform web server software.","website":"https://httpd.apache.org/","common_platform_enumeration":"cpe:2.3:a:apache:http_server:*:*:*:*:*:*:*:*","icon":"Apache.svg","categories":["Web servers"]}],"data":{"size":0,"size_decoded":0,"mime_type":"text/html; charset=UTF-8","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-07-22T18:24:27.697275Z","times_seen":17457126,"resource_available":true,"data":null}},"time_used":53,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":53,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2025-12-19","alert":"Sinkholed","trigger":"vormasia.sbs","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2025-12-19","alert":"Sinkholed","trigger":"vormasia.sbs","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2025-12-19","alert":"Phishing Block","trigger":"vormasia.sbs","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2025-12-19","alert":"Sinkholed","trigger":"vormasia.sbs","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2025-12-19","alert":"Sinkholed","trigger":"vormasia.sbs","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"openphish","sensor_type":"Blocklist","title":"OpenPhish","description":"OpenPhish","scan_date":"2025-12-19","alert":"Phishing - Binance","trigger":"vormasia.sbs","verdict":"phishing","severity":"medium","comment":"Binance","link":"https://openphish.com/","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-12-19","alert":"Sinkholed","trigger":"vormasia.sbs","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}}]}