{"report_id":"de8d6ba3-1714-4dde-8c64-6b55d5fe625b","version":0,"status":"done","tags":[],"date":"2026-08-12T01:18:47Z","url":{"schema":"http","addr":"alliedmiddleeast.com/wp/digitalloginfull-page/l_ogin.php","fqdn":"alliedmiddleeast.com","domain":"alliedmiddleeast.com","tld":"com"},"ip":{"addr":"57.129.90.15","port":0,"asn":16276,"as":"OVH SAS","country":"Germany","country_code":"DE"},"final":{"url":{"schema":"https","addr":"alliedmiddleeast.com/wp/digitalloginfull-page/l_ogin.php","fqdn":"alliedmiddleeast.com","domain":"alliedmiddleeast.com","tld":"com"},"title":"F­­i­­d­­e­­l­­i­­t­­y -","dom":{"size":18435,"mime_type":"text/html; charset=utf-8","magic":"HTML document, Unicode text, UTF-8 text, with very long lines (7631)","md5":"90799a98dbf5d32935355c8fa6bbe96f","sha1":"f687d4368d3e4d26e071e9720ec7b4185cc8d02c","sha256":"39c76e5c1729074d1e9f54ead947260f1cbe6dfc12005f7bd7c678fbdf4f48e0","sha512":"1fc3bbcb10d1735713a603ef867883c85105ac93f3a3948549efd47a235890243dc8216e6698accbb8e5f8fdacf96d556a7233ad91bcd97f1b738ffc1ef33b3a","ssdeep":"384:5uQ1h5fQgts+zj6BB4JNLam0aRK7kQooF0K/Xs9B+/Aq:551fjzOjQkv+K7k2F0aX5Yq","tlshash":"d78209ad2da710712607d2a62fbf0f881a64d883c907d51d7edc11c0ef89ad45d1bbb8","dom_hash":"domhash5422d5b2f0b51ca8d157eec56261eb92","first_seen":"2026-08-12T01:18:50.552483Z","last_seen":"2026-08-12T01:18:50.552483Z","times_seen":1,"resource_available":false,"data":null}},"submit":{"url":{"schema":"http","addr":"alliedmiddleeast.com/wp/digitalloginfull-page/l_ogin.php","fqdn":"alliedmiddleeast.com","domain":"alliedmiddleeast.com","tld":"com"},"ip":{"addr":"57.129.90.15","port":0,"asn":16276,"as":"OVH SAS","country":"Germany","country_code":"DE"},"tags":null,"meta":null},"settings":{"access":"public","device_type":"desktop","expires_at":"2027-09-16T01:18:47Z","useragent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0","referer":"","cookies":null,"exit_node":"qguvgzjxzsgb3vs"},"stats":{"alert_count":{"ids":0,"urlquery":0,"analyzer":1}},"detection":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-08-12","alert":"Sinkholed","trigger":"alliedmiddleeast.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null},"summary":[{"fqdn":"alliedmiddleeast.com","ip":{"addr":"57.129.90.15","port":443,"asn":16276,"as":"OVH SAS","country":"Germany","country_code":"DE"},"domain_registered":"2007-05-27","domain_rank":0,"first_seen":"2026-08-12T01:18:47.470312Z","last_seen":"2026-08-12T01:18:47.470312Z","alert_count":3,"request_count":3,"received_data":89639,"sent_data":1814,"comment":"","tags":null,"fingerprints":[{"name":"PHP:8.1.34","description":"PHP is a general-purpose scripting language used for web development.","website":"https://php.net","common_platform_enumeration":"cpe:2.3:a:php:php:*:*:*:*:*:*:*:*","icon":"PHP.svg","categories":["Programming languages"]},{"name":"LiteSpeed","description":"LiteSpeed is a high-scalability web server.","website":"https://litespeedtech.com","common_platform_enumeration":"cpe:2.3:a:litespeedtech:litespeed_web_server:*:*:*:*:*:*:*:*","icon":"LiteSpeed.svg","categories":["Web servers"]}]}],"files":null,"artifacts":{"windows_shortcuts":null,"files":null,"telegram":null,"pdfs":null,"clipboard":null},"sensors":{"ids":null,"analyzer":null,"urlquery":null},"javascript":{"script":[{"url":{"schema":"https","addr":"alliedmiddleeast.com/wp/digitalloginfull-page/l_ogin.php","fqdn":"alliedmiddleeast.com","domain":"alliedmiddleeast.com","tld":"com"},"ip":{"addr":"57.129.90.15","port":443,"asn":16276,"as":"OVH SAS","country":"Germany","country_code":"DE"},"introduction_type":"scriptElement","is_inline":true,"md5":"968ee89fdbb379a2abb470d08f5545dd","sha1":"da7e8e8e99e7e09bfc26a3b801c1643a6b7b8b48","sha256":"c41598fc407f7ea6b38a39a0be848b10252f2230df4871dbf47fe592bd27edd6","sha512":"d1b50264f15f1149a13f5ae350be43883755f5fd76234737a8be837c39d7fc2e70d6afd613d0ca0a55506b80267cf256cb9a55d643d32633263fdedaec743f5e","ssdeep":"192:gk4tsJafzj6BB4FLNLam0aRK7kQkdoFj8HXOoKl/HMBDaXs9B/G924+C/fYT:cts+zj6BB4JNLam0aRK7kQooF0K/Xs97","tlshash":"88f1b8ac3d5d20b9135b57d71e660da88e98ecd7a5a7219e811c50c4bc60ed49f0ffb0","size":7631,"data":"","first_seen":"2026-08-12T01:18:50.568663Z","last_seen":"2026-08-12T01:18:50.568663Z","times_seen":1,"alerts":{"ids":null,"analyzer":null,"urlquery":null}}],"eval":null,"write":null,"console":null},"http":[{"url":{"schema":"https","addr":"alliedmiddleeast.com/wp/digitalloginfull-page/l_ogin.php","fqdn":"alliedmiddleeast.com","domain":"alliedmiddleeast.com","tld":"com"},"ip":{"addr":"57.129.90.15","port":443,"asn":16276,"as":"OVH SAS","country":"Germany","country_code":"DE"},"is_navigation_request":true,"resource_type":"document","requested_by":"","date":"2026-08-12T01:18:20.742Z","timestamp":1786497500742,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.alliedmiddleeast.com","organization":""},"issuer":{"commonName":"YR1","organization":"Let's Encrypt"},"validity":{"start":"Tue, 11 Aug 2026 21:57:30 GMT","end":"Mon, 09 Nov 2026 21:57:29 GMT"},"fingerprint":{"sha1":"0C:81:98:08:2E:CB:DE:5E:D8:ED:B6:7E:C1:CF:B4:03:7F:A0:D6:D9","sha256":"B8:BA:DD:54:79:7E:03:BD:21:5C:DE:82:6B:C1:60:D6:DC:32:3D:29:AF:1B:19:62:94:A2:6D:1A:7C:17:E7:BE"}}},"request":{"raw":"GET /wp/digitalloginfull-page/l_ogin.php HTTP/1.1\r\nHost: alliedmiddleeast.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nUpgrade-Insecure-Requests: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: document\r\nSec-Fetch-Mode: navigate\r\nSec-Fetch-Site: none\r\nPriority: u=0, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nx-powered-by: PHP/8.1.34\r\nset-cookie: PHPSESSID=s9ej3ls51dtvcik25779hn8hmf; path=/; secure\r\nexpires: Thu, 19 Nov 1981 08:52:00 GMT\r\ncache-control: no-store, no-cache, must-revalidate\r\npragma: no-cache\r\ncontent-type: text/html; charset=UTF-8\r\ncontent-encoding: br\r\nvary: Accept-Encoding\r\ndate: Wed, 12 Aug 2026 01:18:20 GMT\r\nserver: LiteSpeed\r\nx-content-type-options: nosniff\r\nx-xss-protection: 1; mode=block\r\nalt-svc: h3=\":443\"; ma=2592000, h3-29=\":443\"; ma=2592000, h3-Q050=\":443\"; ma=2592000, h3-Q046=\":443\"; ma=2592000, h3-Q043=\":443\"; ma=2592000, quic=\":443\"; ma=2592000; v=\"43,46\"\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"PHP:8.1.34","description":"PHP is a general-purpose scripting language used for web development.","website":"https://php.net","common_platform_enumeration":"cpe:2.3:a:php:php:*:*:*:*:*:*:*:*","icon":"PHP.svg","categories":["Programming languages"]},{"name":"LiteSpeed","description":"LiteSpeed is a high-scalability web server.","website":"https://litespeedtech.com","common_platform_enumeration":"cpe:2.3:a:litespeedtech:litespeed_web_server:*:*:*:*:*:*:*:*","icon":"LiteSpeed.svg","categories":["Web servers"]}],"data":{"size":18934,"size_decoded":6553,"mime_type":"text/html; charset=UTF-8","magic":"HTML document, Unicode text, UTF-8 text, with very long lines (7631), with CRLF, CR line terminators","md5":"5dbaeb5d61a48bdda83a909ba1ea3564","sha1":"d22cbded257728593295099c39c89e6a78494ff2","sha256":"c8450790c8aa948bce67baa35d4e490a8d274392993aab663f4d69ae84b20d96","sha512":"8c93b927a28494fee238c5f9bdf7ba16244509c071d52d9f58905b201e1ab255d54c137143ee7e823b109b1aaf0b42be5849c72489003796c261a1ad2427a1d2","ssdeep":"384:2PYS7ivtts+zj6BB4JNLam0aRK7kQooF0K/Xs9B+/A+:MY1jzOjQkv+K7k2F0aX5Y+","tlshash":"a782e75d6d051062123793e62f7a4e5defd5c893c203116dbadc2280afb5e948e1bfb8","first_seen":"2026-08-12T01:18:50.557536Z","last_seen":"2026-08-12T01:18:50.557536Z","times_seen":1,"resource_available":false,"data":null}},"time_used":215,"timings":{"blocked":-1,"dns":68,"connect":32,"send":0,"wait":47,"receive":0,"ssl":68},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-08-12","alert":"Sinkholed","trigger":"alliedmiddleeast.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"alliedmiddleeast.com/wp/digitalloginfull-page/images/image_3d4a7de4a4a1471d9d1747d2e9eeaaa4.png","fqdn":"alliedmiddleeast.com","domain":"alliedmiddleeast.com","tld":"com"},"ip":{"addr":"57.129.90.15","port":443,"asn":16276,"as":"OVH SAS","country":"Germany","country_code":"DE"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://alliedmiddleeast.com/wp/digitalloginfull-page/l_ogin.php","date":"2026-08-12T01:18:21.124Z","timestamp":1786497501124,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.alliedmiddleeast.com","organization":""},"issuer":{"commonName":"YR1","organization":"Let's Encrypt"},"validity":{"start":"Tue, 11 Aug 2026 21:57:30 GMT","end":"Mon, 09 Nov 2026 21:57:29 GMT"},"fingerprint":{"sha1":"0C:81:98:08:2E:CB:DE:5E:D8:ED:B6:7E:C1:CF:B4:03:7F:A0:D6:D9","sha256":"B8:BA:DD:54:79:7E:03:BD:21:5C:DE:82:6B:C1:60:D6:DC:32:3D:29:AF:1B:19:62:94:A2:6D:1A:7C:17:E7:BE"}}},"request":{"raw":"GET /wp/digitalloginfull-page/images/image_3d4a7de4a4a1471d9d1747d2e9eeaaa4.png HTTP/1.1\r\nHost: alliedmiddleeast.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://alliedmiddleeast.com/wp/digitalloginfull-page/l_ogin.php\r\nCookie: PHPSESSID=s9ej3ls51dtvcik25779hn8hmf\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=4, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\ncache-control: public, max-age=604800\r\nexpires: Wed, 19 Aug 2026 01:18:20 GMT\r\ncontent-type: image/png\r\nlast-modified: Sun, 01 Mar 2026 19:53:00 GMT\r\naccept-ranges: bytes\r\ncontent-length: 68732\r\ndate: Wed, 12 Aug 2026 01:18:20 GMT\r\nserver: LiteSpeed\r\nx-content-type-options: nosniff\r\nx-xss-protection: 1; mode=block\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"LiteSpeed","description":"LiteSpeed is a high-scalability web server.","website":"https://litespeedtech.com","common_platform_enumeration":"cpe:2.3:a:litespeedtech:litespeed_web_server:*:*:*:*:*:*:*:*","icon":"LiteSpeed.svg","categories":["Web servers"]}],"data":{"size":68732,"size_decoded":69084,"mime_type":"image/png","magic":"PNG image data, 800 x 400, 8-bit/color RGB, non-interlaced","md5":"28f4c7126f7d2a225a81c89a2db5c0c5","sha1":"80f5814e6a3f0e560764b20d8290ca78c2ce888e","sha256":"6991ebdbefd711672ece63d69252b8e7d61b1eb3b9b226da80a9080d6d7ef51c","sha512":"d002825a2bbbcde99f64bac5ff409a60612e704d6dd8a18720e41e4bb9c3613d4aaea8506a9370fcc4daaed89911b1e5d5a87df21a6cab3781d455f5e44e0e40","ssdeep":"1536:ZnMbLv056CAOPkE01P93NpIuVpOaj85y3Ue8HARsu:ZnE0518N1P/DOu3UV7u","tlshash":"9563df4d46976ec612c134a30fa24217acb7362fe35610d0fcbb999e1967bc225ccd6b","first_seen":"2026-03-19T20:41:07.875935Z","last_seen":"2026-08-12T01:18:50.56109Z","times_seen":3,"resource_available":false,"data":null}},"time_used":114,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":52,"receive":62,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-08-12","alert":"Sinkholed","trigger":"alliedmiddleeast.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"alliedmiddleeast.com/wp/digitalloginfull-page/images/icons.png","fqdn":"alliedmiddleeast.com","domain":"alliedmiddleeast.com","tld":"com"},"ip":{"addr":"57.129.90.15","port":443,"asn":16276,"as":"OVH SAS","country":"Germany","country_code":"DE"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://alliedmiddleeast.com/wp/digitalloginfull-page/l_ogin.php","date":"2026-08-12T01:18:21.242Z","timestamp":1786497501242,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.alliedmiddleeast.com","organization":""},"issuer":{"commonName":"YR1","organization":"Let's Encrypt"},"validity":{"start":"Tue, 11 Aug 2026 21:57:30 GMT","end":"Mon, 09 Nov 2026 21:57:29 GMT"},"fingerprint":{"sha1":"0C:81:98:08:2E:CB:DE:5E:D8:ED:B6:7E:C1:CF:B4:03:7F:A0:D6:D9","sha256":"B8:BA:DD:54:79:7E:03:BD:21:5C:DE:82:6B:C1:60:D6:DC:32:3D:29:AF:1B:19:62:94:A2:6D:1A:7C:17:E7:BE"}}},"request":{"raw":"GET /wp/digitalloginfull-page/images/icons.png HTTP/1.1\r\nHost: alliedmiddleeast.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://alliedmiddleeast.com/wp/digitalloginfull-page/l_ogin.php\r\nCookie: PHPSESSID=s9ej3ls51dtvcik25779hn8hmf\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=6\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\ncache-control: public, max-age=604800\r\nexpires: Wed, 19 Aug 2026 01:18:20 GMT\r\ncontent-type: image/png\r\nlast-modified: Mon, 02 Mar 2026 01:33:48 GMT\r\naccept-ranges: bytes\r\ncontent-length: 649\r\ndate: Wed, 12 Aug 2026 01:18:20 GMT\r\nserver: LiteSpeed\r\nx-content-type-options: nosniff\r\nx-xss-protection: 1; mode=block\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"LiteSpeed","description":"LiteSpeed is a high-scalability web server.","website":"https://litespeedtech.com","common_platform_enumeration":"cpe:2.3:a:litespeedtech:litespeed_web_server:*:*:*:*:*:*:*:*","icon":"LiteSpeed.svg","categories":["Web servers"]}],"data":{"size":649,"size_decoded":999,"mime_type":"image/png","magic":"PNG image data, 28 x 28, 8-bit colormap, non-interlaced","md5":"78b1a4e71282097e8a359d94f4dfd247","sha1":"3a58339016490d726ebcc5581138f3ce6f504c19","sha256":"d15c1719b26f4fb6d1efa397fbca8db88e1841038e1af162c7bd7db2f14188e1","sha512":"f4f812f2d58dec617c4dc807db906cb7a694b43f66ea985702aeaff3dd26de271f1f0d6f53742de09ff5754be92e8f680723027c0d9e974bd1c8c34951972d56","ssdeep":"","tlshash":"3bf02dca23f8f158adab8223405b1a43b4357da2d771f0c9d946a9b627a3272c08588d","first_seen":"2026-03-19T20:41:07.877364Z","last_seen":"2026-08-12T01:18:50.565477Z","times_seen":3,"resource_available":false,"data":null}},"time_used":39,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":39,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-08-12","alert":"Sinkholed","trigger":"alliedmiddleeast.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}}]}