{"report_id":"e6008222-1e4f-4898-9b9c-82069cca3c20","version":0,"status":"done","tags":["suspicious","telegram_bot"],"date":"2026-09-11T17:08:27Z","url":{"schema":"http","addr":"media.valvewizard.uk/signin/login.html","fqdn":"media.valvewizard.uk","domain":"valvewizard.uk","tld":"uk"},"ip":{"addr":"107.189.18.119","port":0,"asn":14956,"as":"RouterHosting LLC","country":"The Netherlands","country_code":"NL"},"final":{"url":{"schema":"http","addr":"media.valvewizard.uk/signin/login.html","fqdn":"media.valvewizard.uk","domain":"valvewizard.uk","tld":"uk"},"title":"EasyWeb Login - TD Canada Trust","dom":{"size":20767,"mime_type":"text/html; charset=utf-8","magic":"HTML document, Unicode text, UTF-8 text, with very long lines (372)","md5":"000b5693e057d157c39f09e07ebb9268","sha1":"59876fdee3acb31086677716edf93784c646ebbd","sha256":"ba135195c07e4c772574ad263b79b7ff5f6e4477fcd69f677e71275b8dec61ea","sha512":"401de50b59c17dfcf9041b79dfe974ee7edb64447aa20f4ad3f23552949d425046956ffe1f272e6b5242f78c8b57a0a2e873b0e5c308654910b26d55cd1e71a8","ssdeep":"192:PjjFYVRMK3q4l+RBFRCp5vYrsu45pQk0z5oKklaki7QaaRfPlZk+FTYOiYWyJuHe:sa4QFeXTJuBTno+CRj+W1","tlshash":"ed92424b2af31411794764b93bfba7063234d013d20edd647eac53c8cf9aaa5996378c","dom_hash":"domhash194dd1679cae876c9a3dc2bfc825a7be","first_seen":"2026-09-11T17:08:31.13551Z","last_seen":"2026-09-11T17:11:53.648608Z","times_seen":4,"resource_available":false,"data":null}},"submit":{"url":{"schema":"http","addr":"media.valvewizard.uk/signin/login.html","fqdn":"media.valvewizard.uk","domain":"valvewizard.uk","tld":"uk"},"ip":{"addr":"107.189.18.119","port":0,"asn":14956,"as":"ROUTERHOSTING","country":"The Netherlands","country_code":"NL"},"tags":null,"meta":null},"settings":{"access":"public","device_type":"desktop","expires_at":"2027-10-16T17:08:27Z","useragent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0","referer":"","cookies":null,"exit_node":"qguvgzjxzsgb3vs"},"stats":{"alert_count":{"ids":0,"urlquery":1,"analyzer":3}},"detection":{"ids":null,"analyzer":[{"sensor_name":"infosec_yara","sensor_type":"yara","title":"YARAhub by abuse.ch","description":"YARAhub by abuse.ch","scan_date":"2026-09-11","alert":"Detects file containing Telegram Bot API","trigger":"media.valvewizard.uk/signin/login.html","verdict":"malware","severity":"medium","comment":"","link":"https://yaraify.abuse.ch/yarahub/","meta":{"author":"rectifyq","date":"2024-09-07","description":"Detects file containing Telegram Bot API","rule":"telegram_bot_api","yarahub_author_twitter":"@_rectifyq","yarahub_license":"CC0 1.0","yarahub_reference_md5":"9DA48D34DC999B4E05E0C6716A3B3B83","yarahub_rule_matching_tlp":"TLP:WHITE","yarahub_rule_sharing_tlp":"TLP:WHITE","yarahub_uuid":"58c9e4fe-d1e9-46ed-913c-dba943ac16d6"}},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-09-11","alert":"Phishing Block","trigger":"media.valvewizard.uk","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-11","alert":"Sinkholed","trigger":"media.valvewizard.uk","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":[{"sensor_name":"urlquery","alert":"Suspicious - Suspicious Javascript code","verdict":"suspicious","severity":"medium","comment":"","tags":["suspicious"],"meta":{"engine":"luna_v2","pattern_id":"suspicious_scripts.javascript.telegram_api_send_message"}}]},"summary":[{"fqdn":"media.valvewizard.uk","ip":{"addr":"107.189.18.119","port":80,"asn":14956,"as":"ROUTERHOSTING","country":"The Netherlands","country_code":"NL"},"domain_registered":"2024-06-05","domain_rank":0,"first_seen":"2026-09-11T17:08:27.570654Z","last_seen":"2026-09-11T17:08:27.570654Z","alert_count":15,"request_count":6,"received_data":1284238,"sent_data":2735,"comment":"","tags":null,"fingerprints":[{"name":"Apache HTTP Server:2.4.58","description":"Apache is a free and open-source cross-platform web server software.","website":"https://httpd.apache.org/","common_platform_enumeration":"cpe:2.3:a:apache:http_server:*:*:*:*:*:*:*:*","icon":"Apache.svg","categories":["Web servers"]},{"name":"Ubuntu","description":"Ubuntu is a free and open-source operating system on Linux for the enterprise server, desktop, cloud, and IoT.","website":"https://www.ubuntu.com/server","common_platform_enumeration":"cpe:2.3:o:canonical:ubuntu_linux:*:*:*:*:*:*:*:*","icon":"Ubuntu.svg","categories":["Operating systems"]}]}],"files":null,"artifacts":{"windows_shortcuts":null,"files":null,"telegram":[{"url":{"schema":"http","addr":"media.valvewizard.uk/signin/login.html","fqdn":"media.valvewizard.uk","domain":"valvewizard.uk","tld":"uk"},"ip":{"addr":"107.189.18.119","port":80,"asn":14956,"as":"ROUTERHOSTING","country":"The Netherlands","country_code":"NL"},"md5":"513d52f997976175fcf1a4d3d44c10d4","sha1":"6c462dd755ddfbc0cad67466c165aec2463207f1","sha256":"c13f77f6facb13f201ed0eadbe112474dfffa0d955e9b9598147b349421a1b19","sha512":"ab200dce623ca52538fdce4fc1c3869e378445a9a8a95eee4507692f57b50ec21f179881baa2ec55bdd9ccb9ee24ccb6f7509a86a8652863fc2aa1762683e1a6","size":6266,"token":"8137455134:AAH7b_9P1lg8t2S5jTmhA_0rUEmiqXmeA8E","is_revoked":false,"bot":{"token":"8137455134:AAH7b_9P1lg8t2S5jTmhA_0rUEmiqXmeA8E","user_id":"8137455134","username":"Nouchijuggbot","first_name":"KEYK","last_name":"","chat":{"chat_id":"7794344075","title":"","type":"private","bot_is":"member","total_users":2,"active_members":null,"admins":null},"pending_messages":1}}],"pdfs":null,"clipboard":null},"sensors":{"ids":null,"analyzer":null,"urlquery":[{"sensor_name":"urlquery","alert":"Suspicious - Suspicious Javascript code","verdict":"suspicious","severity":"medium","comment":"","tags":["suspicious"],"meta":{"engine":"luna_v2","pattern_id":"suspicious_scripts.javascript.telegram_api_send_message"}}]},"javascript":{"script":[{"url":{"schema":"http","addr":"media.valvewizard.uk/signin/login.html","fqdn":"media.valvewizard.uk","domain":"valvewizard.uk","tld":"uk"},"ip":{"addr":"107.189.18.119","port":80,"asn":14956,"as":"ROUTERHOSTING","country":"The Netherlands","country_code":"NL"},"introduction_type":"scriptElement","is_inline":true,"md5":"513d52f997976175fcf1a4d3d44c10d4","sha1":"6c462dd755ddfbc0cad67466c165aec2463207f1","sha256":"c13f77f6facb13f201ed0eadbe112474dfffa0d955e9b9598147b349421a1b19","sha512":"ab200dce623ca52538fdce4fc1c3869e378445a9a8a95eee4507692f57b50ec21f179881baa2ec55bdd9ccb9ee24ccb6f7509a86a8652863fc2aa1762683e1a6","ssdeep":"48:GYXEg2kmPoYOuZUFpgWB23HNy0RWKp/s+v4pujWN0cSpdOMucOzFGe1d+gzj4W/q:UoaY6NHXRWWE+v4NSzOMOBGe1d+SY","tlshash":"43d1eb992efb1824264370bb675bf2042134f0173509fc657eac83a61f19a79a473bed","size":6266,"data":"","first_seen":"2026-09-11T17:08:31.153403Z","last_seen":"2026-09-11T17:11:53.654681Z","times_seen":4,"alerts":{"ids":null,"analyzer":[{"sensor_name":"infosec_yara","sensor_type":"yara","title":"YARAhub by abuse.ch","description":"YARAhub by abuse.ch","scan_date":"2026-09-11","alert":"Detects file containing Telegram Bot API","trigger":"media.valvewizard.uk/signin/login.html","verdict":"malware","severity":"medium","comment":"","link":"https://yaraify.abuse.ch/yarahub/","meta":{"author":"rectifyq","date":"2024-09-07","description":"Detects file containing Telegram Bot API","rule":"telegram_bot_api","yarahub_author_twitter":"@_rectifyq","yarahub_license":"CC0 1.0","yarahub_reference_md5":"9DA48D34DC999B4E05E0C6716A3B3B83","yarahub_rule_matching_tlp":"TLP:WHITE","yarahub_rule_sharing_tlp":"TLP:WHITE","yarahub_uuid":"58c9e4fe-d1e9-46ed-913c-dba943ac16d6"}}],"urlquery":null}}],"eval":null,"write":null,"console":null},"http":[{"url":{"schema":"http","addr":"media.valvewizard.uk/favicon.ico","fqdn":"media.valvewizard.uk","domain":"valvewizard.uk","tld":"uk"},"ip":{"addr":"107.189.18.119","port":80,"asn":14956,"as":"ROUTERHOSTING","country":"The Netherlands","country_code":"NL"},"is_navigation_request":false,"resource_type":"img","requested_by":"http://media.valvewizard.uk/signin/login.html","date":"2026-09-11T17:07:59.316Z","timestamp":1789146479316,"http_version":"HTTP/1.1","security_state":"insecure","security_info":null,"request":{"raw":"GET /favicon.ico HTTP/1.1\r\nHost: media.valvewizard.uk\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: http://media.valvewizard.uk/signin/login.html\r\nPriority: u=6\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 404 Not Found\r\nDate: Fri, 11 Sep 2026 17:07:59 GMT\r\nServer: Apache/2.4.58 (Ubuntu)\r\nContent-Length: 282\r\nKeep-Alive: timeout=5, max=99\r\nConnection: Keep-Alive\r\nContent-Type: text/html; charset=iso-8859-1\r\n\r\n","headers":null,"cookies":null,"status_code":"404","status_text":"Not Found","fingerprints":[{"name":"Apache HTTP Server:2.4.58","description":"Apache is a free and open-source cross-platform web server software.","website":"https://httpd.apache.org/","common_platform_enumeration":"cpe:2.3:a:apache:http_server:*:*:*:*:*:*:*:*","icon":"Apache.svg","categories":["Web servers"]},{"name":"Ubuntu","description":"Ubuntu is a free and open-source operating system on Linux for the enterprise server, desktop, cloud, and IoT.","website":"https://www.ubuntu.com/server","common_platform_enumeration":"cpe:2.3:o:canonical:ubuntu_linux:*:*:*:*:*:*:*:*","icon":"Ubuntu.svg","categories":["Operating systems"]}],"data":{"size":282,"size_decoded":498,"mime_type":"text/html; charset=iso-8859-1","magic":"HTML document, ASCII text","md5":"35c09ed32cd03002e082420c48232785","sha1":"75a8ae0c75612dedae7182a68413dc1834e1e4c1","sha256":"c5f7ab35c9871c5edc89907795cee9e07cd1c680a6ca97f7038333951e50c03d","sha512":"55940799b54d48c4e09469cac6f87f206c4fd8e80d3d87b06ba61dfa5c19b78302ff404e01da7b53d12607f65b76d9290c77889c2ba81d48eafe3da9b26348b0","ssdeep":"","tlshash":"45d02b9e90477387491314a079c115c6278c23faa47e41ec2d86d48753a893ecedbdd8","first_seen":"2026-09-11T17:08:31.139761Z","last_seen":"2026-09-11T17:08:31.139761Z","times_seen":1,"resource_available":false,"data":null}},"time_used":33,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":33,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-09-11","alert":"Phishing Block","trigger":"media.valvewizard.uk","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-11","alert":"Sinkholed","trigger":"media.valvewizard.uk","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"media.valvewizard.uk/signin/login.html","fqdn":"media.valvewizard.uk","domain":"valvewizard.uk","tld":"uk"},"ip":{"addr":"","port":0,"asn":0,"as":"","country":"","country_code":"zz"},"is_navigation_request":true,"resource_type":"document","requested_by":"","date":"2026-09-11T17:07:58.749Z","timestamp":1789146478749,"http_version":"","security_state":"insecure","security_info":null,"request":{"raw":"GET /signin/login.html HTTP/1.1\r\nHost: media.valvewizard.uk\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nUpgrade-Insecure-Requests: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: document\r\nSec-Fetch-Mode: navigate\r\nSec-Fetch-Site: none\r\nPriority: u=0, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"","headers":null,"cookies":null,"status_code":"","status_text":"","fingerprints":null,"data":{"size":0,"size_decoded":0,"mime_type":"","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-09-11T19:24:36.300163Z","times_seen":18408721,"resource_available":true,"data":null}},"time_used":0,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":0,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-11","alert":"Sinkholed","trigger":"media.valvewizard.uk","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-09-11","alert":"Phishing Block","trigger":"media.valvewizard.uk","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null}],"urlquery":[{"sensor_name":"urlquery","alert":"Suspicious - Suspicious Javascript code","verdict":"suspicious","severity":"medium","comment":"","tags":["suspicious"],"meta":{"engine":"luna_v2","pattern_id":"suspicious_scripts.javascript.telegram_api_send_message"}}]}},{"url":{"schema":"http","addr":"media.valvewizard.uk/signin/login.html","fqdn":"media.valvewizard.uk","domain":"valvewizard.uk","tld":"uk"},"ip":{"addr":"107.189.18.119","port":80,"asn":14956,"as":"ROUTERHOSTING","country":"The Netherlands","country_code":"NL"},"is_navigation_request":true,"resource_type":"document","requested_by":"","date":"2026-09-11T17:07:58.832Z","timestamp":1789146478832,"http_version":"HTTP/1.1","security_state":"insecure","security_info":null,"request":{"raw":"GET /signin/login.html HTTP/1.1\r\nHost: media.valvewizard.uk\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nUpgrade-Insecure-Requests: 1\r\nPriority: u=0, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Fri, 11 Sep 2026 17:07:58 GMT\r\nServer: Apache/2.4.58 (Ubuntu)\r\nLast-Modified: Sun, 26 Oct 2025 13:10:14 GMT\r\nETag: \"53cd-6420f80da5980-gzip\"\r\nAccept-Ranges: bytes\r\nVary: Accept-Encoding\r\nContent-Encoding: gzip\r\nContent-Length: 4555\r\nKeep-Alive: timeout=5, max=100\r\nConnection: Keep-Alive\r\nContent-Type: text/html\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Apache HTTP Server:2.4.58","description":"Apache is a free and open-source cross-platform web server software.","website":"https://httpd.apache.org/","common_platform_enumeration":"cpe:2.3:a:apache:http_server:*:*:*:*:*:*:*:*","icon":"Apache.svg","categories":["Web servers"]},{"name":"Ubuntu","description":"Ubuntu is a free and open-source operating system on Linux for the enterprise server, desktop, cloud, and IoT.","website":"https://www.ubuntu.com/server","common_platform_enumeration":"cpe:2.3:o:canonical:ubuntu_linux:*:*:*:*:*:*:*:*","icon":"Ubuntu.svg","categories":["Operating systems"]}],"data":{"size":21453,"size_decoded":4894,"mime_type":"text/html","magic":"HTML document, Unicode text, UTF-8 text, with very long lines (372), with CRLF line terminators","md5":"08e822d00782926416f86a4706c15303","sha1":"f95dd8f9ac0349a008d21128dd5e82c2bbf7c51a","sha256":"b445a78dd5c9e0f6bc69056bf6d9d2715bcd9037c7e8bcbe2d85fed9e2d13c2e","sha512":"2e8b3eebbe8491c97dfc5ab447e5fe7a26abb7212d3deaee979168ab781f4be14980edaa6e86b1dade6dee8007f7a46290b4366a9382a2e499eb35e547f6824f","ssdeep":"192:XRzkEVHfmBjpYLiI1CMYRyPMK+uMathwxom27J9r1evDVCOxg:Iv/6/Rm+1iJng","tlshash":"53a2840aa9811401753363b9afb3971afb269023c307d6647efc53868fba9559523fcc","first_seen":"2026-09-11T17:08:31.144485Z","last_seen":"2026-09-11T17:11:53.652515Z","times_seen":4,"resource_available":false,"data":null}},"time_used":108,"timings":{"blocked":-1,"dns":6,"connect":36,"send":0,"wait":66,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"infosec_yara","sensor_type":"yara","title":"YARAhub by abuse.ch","description":"YARAhub by abuse.ch","scan_date":"2026-09-11","alert":"Detects file containing Telegram Bot API","trigger":"media.valvewizard.uk/signin/login.html","verdict":"malware","severity":"medium","comment":"","link":"https://yaraify.abuse.ch/yarahub/","meta":{"author":"rectifyq","date":"2024-09-07","description":"Detects file containing Telegram Bot API","rule":"telegram_bot_api","yarahub_author_twitter":"@_rectifyq","yarahub_license":"CC0 1.0","yarahub_reference_md5":"9DA48D34DC999B4E05E0C6716A3B3B83","yarahub_rule_matching_tlp":"TLP:WHITE","yarahub_rule_sharing_tlp":"TLP:WHITE","yarahub_uuid":"58c9e4fe-d1e9-46ed-913c-dba943ac16d6"}},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-09-11","alert":"Phishing Block","trigger":"media.valvewizard.uk","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-11","alert":"Sinkholed","trigger":"media.valvewizard.uk","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":[{"sensor_name":"urlquery","alert":"Suspicious - Suspicious Javascript code","verdict":"suspicious","severity":"medium","comment":"","tags":["suspicious"],"meta":{"engine":"luna_v2","pattern_id":"suspicious_scripts.javascript.telegram_api_send_message"}}]}},{"url":{"schema":"http","addr":"media.valvewizard.uk/signin/image3.png","fqdn":"media.valvewizard.uk","domain":"valvewizard.uk","tld":"uk"},"ip":{"addr":"107.189.18.119","port":80,"asn":14956,"as":"ROUTERHOSTING","country":"The Netherlands","country_code":"NL"},"is_navigation_request":false,"resource_type":"img","requested_by":"http://media.valvewizard.uk/signin/login.html","date":"2026-09-11T17:07:59.034Z","timestamp":1789146479034,"http_version":"HTTP/1.1","security_state":"insecure","security_info":null,"request":{"raw":"GET /signin/image3.png HTTP/1.1\r\nHost: media.valvewizard.uk\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: http://media.valvewizard.uk/signin/login.html\r\nPriority: u=4, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Fri, 11 Sep 2026 17:07:59 GMT\r\nServer: Apache/2.4.58 (Ubuntu)\r\nLast-Modified: Wed, 01 Oct 2025 18:54:05 GMT\r\nETag: \"ad78-6401d64860d40\"\r\nAccept-Ranges: bytes\r\nContent-Length: 44408\r\nKeep-Alive: timeout=5, max=99\r\nConnection: Keep-Alive\r\nContent-Type: image/png\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Apache HTTP Server:2.4.58","description":"Apache is a free and open-source cross-platform web server software.","website":"https://httpd.apache.org/","common_platform_enumeration":"cpe:2.3:a:apache:http_server:*:*:*:*:*:*:*:*","icon":"Apache.svg","categories":["Web servers"]},{"name":"Ubuntu","description":"Ubuntu is a free and open-source operating system on Linux for the enterprise server, desktop, cloud, and IoT.","website":"https://www.ubuntu.com/server","common_platform_enumeration":"cpe:2.3:o:canonical:ubuntu_linux:*:*:*:*:*:*:*:*","icon":"Ubuntu.svg","categories":["Operating systems"]}],"data":{"size":44408,"size_decoded":44695,"mime_type":"image/png","magic":"PNG image data, 2940 x 257, 8-bit/color RGBA, non-interlaced","md5":"889ea94f638f464ea2be3ec3faaa5c37","sha1":"9bda3678d3f6cd3d4e9a7700bd4a679416083021","sha256":"1fc06473eaaeedfe68118acafae5fe93cb5b621b07bccb7fdf831069a38615b7","sha512":"fa5f9d17c19e380ace17a8ba15bb70b9fb688b8b7567b1a7daea711f51e4f62c33b55abc6d7d13e2b4531d28e780fd75f51c0aa1e129f45039fbeaca8f9de5d5","ssdeep":"768:56MyghCEiaqwdLcbyQf9sOid5h+/I+YnrglkTjW3ShWeLtDvr:gMTgmdLLQfitd5gA9nekXXhrLZT","tlshash":"bf13e137041bc4c2df95e6376e175f381b8205350ab2476b7f36c44aa88566836de4a7","first_seen":"2026-09-11T17:08:31.147274Z","last_seen":"2026-09-11T17:11:53.653273Z","times_seen":4,"resource_available":false,"data":null}},"time_used":97,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":32,"receive":65,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-09-11","alert":"Phishing Block","trigger":"media.valvewizard.uk","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-11","alert":"Sinkholed","trigger":"media.valvewizard.uk","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"http","addr":"media.valvewizard.uk/signin/image1.jpg","fqdn":"media.valvewizard.uk","domain":"valvewizard.uk","tld":"uk"},"ip":{"addr":"107.189.18.119","port":80,"asn":14956,"as":"ROUTERHOSTING","country":"The Netherlands","country_code":"NL"},"is_navigation_request":false,"resource_type":"img","requested_by":"http://media.valvewizard.uk/signin/login.html","date":"2026-09-11T17:07:59.035Z","timestamp":1789146479035,"http_version":"HTTP/1.1","security_state":"insecure","security_info":null,"request":{"raw":"GET /signin/image1.jpg HTTP/1.1\r\nHost: media.valvewizard.uk\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: http://media.valvewizard.uk/signin/login.html\r\nPriority: u=4, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Fri, 11 Sep 2026 17:07:59 GMT\r\nServer: Apache/2.4.58 (Ubuntu)\r\nLast-Modified: Wed, 01 Oct 2025 18:42:05 GMT\r\nETag: \"f3f26-6401d399bb940\"\r\nAccept-Ranges: bytes\r\nContent-Length: 999206\r\nKeep-Alive: timeout=5, max=100\r\nConnection: Keep-Alive\r\nContent-Type: image/jpeg\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Ubuntu","description":"Ubuntu is a free and open-source operating system on Linux for the enterprise server, desktop, cloud, and IoT.","website":"https://www.ubuntu.com/server","common_platform_enumeration":"cpe:2.3:o:canonical:ubuntu_linux:*:*:*:*:*:*:*:*","icon":"Ubuntu.svg","categories":["Operating systems"]},{"name":"Apache HTTP Server:2.4.58","description":"Apache is a free and open-source cross-platform web server software.","website":"https://httpd.apache.org/","common_platform_enumeration":"cpe:2.3:a:apache:http_server:*:*:*:*:*:*:*:*","icon":"Apache.svg","categories":["Web servers"]}],"data":{"size":999206,"size_decoded":999497,"mime_type":"image/jpeg","magic":"PNG image data, 2375 x 550, 8-bit/color RGBA, non-interlaced","md5":"61deb373a514283cec4c99ca0c986f48","sha1":"e6d3c9560543aec6fddcbfd1dce844fc089dd038","sha256":"9938ef4d583ee28d3b8d9fca729634ceb30f66df2b6981ece5697b3fe0f348d6","sha512":"ce9194565f64de86c510fd49a8a4b316db735480c43af1c4599f400131a87e3b45356f21e592c33bd48c340128bdfd961ea1dee63d84fe96bd1149f481355434","ssdeep":"24576:r0BfcdZqEcnALJbCegITOnjJACgUclA5qDKAj+/x0GKzUqY7v:r0B0v3kaJbsI0jJAjDW6xvzUqY7v","tlshash":"ac2533562365376b8cbc5243a33afc457855e3b5e122f2dad7c6c7cca10c8924b6d2e4","first_seen":"2026-09-11T17:08:31.149242Z","last_seen":"2026-09-11T17:11:53.653985Z","times_seen":4,"resource_available":false,"data":null}},"time_used":269,"timings":{"blocked":-1,"dns":0,"connect":32,"send":0,"wait":33,"receive":204,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-11","alert":"Sinkholed","trigger":"media.valvewizard.uk","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-09-11","alert":"Phishing Block","trigger":"media.valvewizard.uk","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null}],"urlquery":null}},{"url":{"schema":"http","addr":"media.valvewizard.uk/signin/image2.png","fqdn":"media.valvewizard.uk","domain":"valvewizard.uk","tld":"uk"},"ip":{"addr":"107.189.18.119","port":80,"asn":14956,"as":"ROUTERHOSTING","country":"The Netherlands","country_code":"NL"},"is_navigation_request":false,"resource_type":"img","requested_by":"http://media.valvewizard.uk/signin/login.html","date":"2026-09-11T17:07:59.036Z","timestamp":1789146479036,"http_version":"HTTP/1.1","security_state":"insecure","security_info":null,"request":{"raw":"GET /signin/image2.png HTTP/1.1\r\nHost: media.valvewizard.uk\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: http://media.valvewizard.uk/signin/login.html\r\nPriority: u=4, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Fri, 11 Sep 2026 17:07:59 GMT\r\nServer: Apache/2.4.58 (Ubuntu)\r\nLast-Modified: Wed, 01 Oct 2025 18:50:09 GMT\r\nETag: \"3517a-6401d5674fa40\"\r\nAccept-Ranges: bytes\r\nContent-Length: 217466\r\nKeep-Alive: timeout=5, max=100\r\nConnection: Keep-Alive\r\nContent-Type: image/png\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Ubuntu","description":"Ubuntu is a free and open-source operating system on Linux for the enterprise server, desktop, cloud, and IoT.","website":"https://www.ubuntu.com/server","common_platform_enumeration":"cpe:2.3:o:canonical:ubuntu_linux:*:*:*:*:*:*:*:*","icon":"Ubuntu.svg","categories":["Operating systems"]},{"name":"Apache HTTP Server:2.4.58","description":"Apache is a free and open-source cross-platform web server software.","website":"https://httpd.apache.org/","common_platform_enumeration":"cpe:2.3:a:apache:http_server:*:*:*:*:*:*:*:*","icon":"Apache.svg","categories":["Web servers"]}],"data":{"size":217466,"size_decoded":217756,"mime_type":"image/png","magic":"PNG image data, 2938 x 839, 8-bit/color RGBA, non-interlaced","md5":"d43764a39b9e174af160161a5046bdc7","sha1":"55e5e790f80d9d34bbd7e8c7498abd1e31dca028","sha256":"55da9b27201237f6645ab08f9ec33b23a5c3af2c0bc07c9619c36cf03d1747b9","sha512":"c7397c80887aa9565e81ab6a64b3e6405e089f654ff6e3bddbefbed782fb011974c2105e55f435c4a11cee3267e768b99edbe4703c2c14add9a39df848f1b6e6","ssdeep":"3072:2vxw2VgAXzuPhUMckX7rULN52NZs4cg0QHQGsKjZcA9s3rMg0DY2kr:2GeTXzuGMckXKEy4cRQHNZcfM/Ur","tlshash":"072402589e1bc0dacc1f96ba2dd5786f5a9c28d546383b726ef58ccec86b50c343421b","first_seen":"2026-09-11T17:08:31.15141Z","last_seen":"2026-09-11T17:11:53.64972Z","times_seen":4,"resource_available":false,"data":null}},"time_used":193,"timings":{"blocked":-1,"dns":0,"connect":31,"send":0,"wait":33,"receive":128,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-09-11","alert":"Phishing Block","trigger":"media.valvewizard.uk","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-11","alert":"Sinkholed","trigger":"media.valvewizard.uk","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}}]}