{"report_id":"ef9ae9c5-51f2-449e-bbbc-595e4adb951e","version":0,"status":"done","tags":[],"date":"2026-09-14T19:15:45Z","url":{"schema":"http","addr":"ontwig.com/","fqdn":"ontwig.com","domain":"ontwig.com","tld":"com"},"ip":{"addr":"18.136.175.251","port":0,"asn":16509,"as":"Amazon.com, Inc.","country":"Singapore","country_code":"SG"},"final":{"url":{"schema":"https","addr":"ontwig.com/","fqdn":"ontwig.com","domain":"ontwig.com","tld":"com"},"title":"QR Code Generator, Short URLs \u0026 More | Ontwig Smart Links That Drive Insights","dom":{"size":51970,"mime_type":"text/html; charset=utf-8","magic":"HTML document, Unicode text, UTF-8 text, with very long lines (18241)","md5":"a5ba8d8b96ea53cc2252b94e4ead5741","sha1":"5c133e0bb5ce281fe80fcc6e22c5627ebf185d6c","sha256":"e8e925a8185dc8e73b0e12902b6798068d19a2340b348041b68787914c63a8d7","sha512":"050e20afee64cf8d681ca733d41ad77955eb35590ee3a92c87103d4a4aad53bb4558816c939d16d930103e01af9c53b2e23919cb6c73fc5f99e461024d318065","ssdeep":"768:scga7y1NcAGTPXydAGTPkEAo/m+EcJoUNwFk+wV+bH+wV+UzsJEKPTn4TT:sBecJexwYbewYUNy4X","tlshash":"6a3395315220193fa14742d8f260b72c52af9396c757946cb6bc43e62fc6ce9ee5f284","dom_hash":"domhash94e8860d282cd2f3d031fe9c5afa81ba","first_seen":"2026-09-14T18:56:50.893863Z","last_seen":"2026-09-14T19:15:50.820226Z","times_seen":2,"resource_available":false,"data":null}},"submit":{"url":{"schema":"http","addr":"ontwig.com/","fqdn":"ontwig.com","domain":"ontwig.com","tld":"com"},"ip":{"addr":"18.136.175.251","port":0,"asn":16509,"as":"Amazon.com, Inc.","country":"Singapore","country_code":"SG"},"tags":null,"meta":null},"settings":{"access":"public","device_type":"desktop","expires_at":"2027-10-19T19:15:45Z","useragent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0","referer":"","cookies":null,"exit_node":"qguvgzjxzsgb3vs"},"stats":{"alert_count":{"ids":0,"urlquery":0,"analyzer":3}},"detection":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-14","alert":"Sinkholed","trigger":"ontwig.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-09-14","alert":"Phishing Block","trigger":"ontwig.com","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-09-14","alert":"Sinkholed","trigger":"ontwig.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null},"summary":[{"fqdn":"fonts.googleapis.com","ip":{"addr":"142.250.178.42","port":443,"asn":15169,"as":"GOOGLE","country":"United States","country_code":"US"},"domain_registered":"2005-01-25","domain_rank":313,"first_seen":"2012-05-23T12:41:44Z","last_seen":"2026-09-13T22:43:30.72904Z","alert_count":0,"request_count":1,"received_data":508,"sent_data":521,"comment":"","tags":null,"fingerprints":null},{"fqdn":"ontwig.com","ip":{"addr":"18.136.175.251","port":443,"asn":16509,"as":"AMAZON-02","country":"Singapore","country_code":"SG"},"domain_registered":"2024-07-31","domain_rank":0,"first_seen":"2026-08-27T13:45:32.938716Z","last_seen":"2026-09-14T18:56:48.249037Z","alert_count":33,"request_count":11,"received_data":3242836,"sent_data":6533,"comment":"","tags":null,"fingerprints":[{"name":"Nginx:1.18.0","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"Ubuntu","description":"Ubuntu is a free and open-source operating system on Linux for the enterprise server, desktop, cloud, and IoT.","website":"https://www.ubuntu.com/server","common_platform_enumeration":"cpe:2.3:o:canonical:ubuntu_linux:*:*:*:*:*:*:*:*","icon":"Ubuntu.svg","categories":["Operating systems"]},{"name":"Express","description":"Express is a web application framework for Node.js, released as free and open-source software under the MIT License. It is designed for building web applications and APIs.","website":"https://expressjs.com","common_platform_enumeration":"cpe:2.3:a:expressjs:express:*:*:*:*:*:*:*:*","icon":"Express.svg","categories":["Web frameworks","Web servers"]},{"name":"Node.js","description":"Node.js is an open-source, cross-platform, JavaScript runtime environment that executes JavaScript code outside a web browser.","website":"https://nodejs.org","common_platform_enumeration":"cpe:2.3:a:nodejs:node.js:*:*:*:*:*:*:*:*","icon":"Node.js.svg","categories":["Programming languages"]},{"name":"React","description":"React is an open-source JavaScript library for building user interfaces or UI components.","website":"https://reactjs.org","common_platform_enumeration":"cpe:2.3:a:facebook:react:*:*:*:*:*:*:*:*","icon":"React.svg","categories":["JavaScript frameworks"]},{"name":"Google Analytics","description":"Google Analytics is a free web analytics service that tracks and reports website traffic.","website":"https://google.com/analytics","common_platform_enumeration":"","icon":"Google Analytics.svg","categories":["Analytics"]}]},{"fqdn":"www.googletagmanager.com","ip":{"addr":"142.250.178.40","port":443,"asn":15169,"as":"GOOGLE","country":"United States","country_code":"US"},"domain_registered":"2011-11-11","domain_rank":283,"first_seen":"2012-10-04T01:07:32Z","last_seen":"2026-09-13T22:44:45.310895Z","alert_count":0,"request_count":1,"received_data":594325,"sent_data":473,"comment":"","tags":null,"fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}]}],"files":null,"artifacts":{"windows_shortcuts":null,"files":null,"telegram":null,"pdfs":null,"clipboard":null},"sensors":{"ids":null,"analyzer":null,"urlquery":null},"javascript":{"script":[{"url":{"schema":"https","addr":"ontwig.com/","fqdn":"ontwig.com","domain":"ontwig.com","tld":"com"},"ip":{"addr":"18.136.175.251","port":443,"asn":16509,"as":"AMAZON-02","country":"Singapore","country_code":"SG"},"introduction_type":"scriptElement","is_inline":true,"md5":"8023d1e2ec9fabe9e1bd28320fbd0a8e","sha1":"8f0636d8ab93f6d0fc45237767d66830ddc632c7","sha256":"0e4f427298cebce907bf5ae8d054f148e728306f6e8a4f11e5876546477f8aed","sha512":"970385db75c03bed992771a1ba985931ee6a74f61ae7fd273e542819adc0660e411cf42a8ccaac7084d506d54e9bfdd51ece80c0bc1d241c222a76204d966bbc","ssdeep":"","tlshash":"f2c02b8d310b1c7061e72f450b7fb604b04b320294f05931190b7344df20d03df44814","size":155,"data":"","first_seen":"2026-09-14T18:56:50.931311Z","last_seen":"2026-09-14T19:15:50.838836Z","times_seen":2,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"www.googletagmanager.com/gtag/js?id=G-XWQ3KYKEH5","fqdn":"www.googletagmanager.com","domain":"googletagmanager.com","tld":"com"},"ip":{"addr":"142.250.178.40","port":443,"asn":15169,"as":"GOOGLE","country":"United States","country_code":"US"},"introduction_type":"scriptElement","is_inline":false,"md5":"92e58e33bf91c044ae9edb8ba72e71cd","sha1":"643c4be4ca927e53f5d15595cabde99e91f4ecad","sha256":"c9d307f702eb3ae046100fe718db292e7c21a8ff29aec0d09224152f5de60911","sha512":"f39a392d3653f07a719dcabbe6da6991bc4e46e06212f10aa4e12c8be76e1769c1736276df54a185d1d5a6bfeaf3e6eb31871e6bfab00b5b5218ba67e6c48198","ssdeep":"6144:b92Mf1L6SSxQhmgyyE3RdJl580ucTPbNELR3/jupWS3P+NJ3g2Z:bIm0yAy6PnpJP+Jn","tlshash":"ebc41ace73d674229796f078903f01cb697b29a2b49cc89af18edce02d3454a5167f78","size":593721,"data":"","first_seen":"2026-09-14T18:56:50.91738Z","last_seen":"2026-09-14T19:15:50.827478Z","times_seen":2,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"ontwig.com/assets/index-SknG5NUj.js","fqdn":"ontwig.com","domain":"ontwig.com","tld":"com"},"ip":{"addr":"18.136.175.251","port":443,"asn":16509,"as":"AMAZON-02","country":"Singapore","country_code":"SG"},"introduction_type":"scriptElement","is_inline":false,"md5":"69b7329bdf1b04b979d7ae435089aa19","sha1":"d1fc0aaeee24456c4f21137831d5aa5616290b54","sha256":"e174450cb79e8912258878755f259aeda7c5f7fedbe558ae70fc7784ee2ddab1","sha512":"139374fea2213b5af2fb7000f7da8b2d25d357a621353e2ed99c7cf3859614ac649ab91e9d4b8b01d10157d1f17dfc108d7904a68cdcc237726b0c63ad219080","ssdeep":"6144:jszKDhD6nhSUXgvQIWWQxw7RR/w4eIqfmwJmuoSbC+kQyIRclVgHBDRG0tTR3Kaz:y8Qxwnw4eMg7ZtpKhR/QJHokkCFhSQL","tlshash":"bfd45c18f154bbbf6e6305e4a45f6005b11e4a2adb3dc8a0f06cd42927f419a717bbec","size":624439,"data":"","first_seen":"2026-09-14T18:56:50.929272Z","last_seen":"2026-09-14T19:15:50.833522Z","times_seen":2,"alerts":{"ids":null,"analyzer":null,"urlquery":null}}],"eval":null,"write":null,"console":null},"http":[{"url":{"schema":"https","addr":"ontwig.com/home/homeshortenurl.png","fqdn":"ontwig.com","domain":"ontwig.com","tld":"com"},"ip":{"addr":"18.136.175.251","port":443,"asn":16509,"as":"AMAZON-02","country":"Singapore","country_code":"SG"},"is_navigation_request":false,"resource_type":"lazy-img","requested_by":"https://ontwig.com/","date":"2026-09-14T19:15:15.925Z","timestamp":1789413315925,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"ontwig.com","organization":""},"issuer":{"commonName":"YR1","organization":"Let's Encrypt"},"validity":{"start":"Mon, 27 Jul 2026 07:35:36 GMT","end":"Sun, 25 Oct 2026 07:35:35 GMT"},"fingerprint":{"sha1":"C9:85:9E:EB:B2:9E:F2:7A:EE:F3:E4:35:96:4A:78:37:E8:02:FE:A9","sha256":"0B:36:F3:B2:38:E1:DB:1E:1B:A4:94:D5:3F:78:7B:CF:A6:13:E7:1F:62:02:20:16:50:9B:89:4F:86:64:40:B7"}}},"request":{"raw":"GET /home/homeshortenurl.png HTTP/1.1\r\nHost: ontwig.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://ontwig.com/\r\nCookie: _ga_XWQ3KYKEH5=GS2.1.s1789413310$o1$g0$t1789413310$j60$l0$h0; _ga=GA1.1.1753496254.1789413310; _gcl_au=1.1.163490465.1789413310\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nServer: nginx/1.18.0 (Ubuntu)\r\nDate: Mon, 14 Sep 2026 19:15:16 GMT\r\nContent-Type: image/png\r\nContent-Length: 542289\r\nConnection: keep-alive\r\nX-Powered-By: Express\r\nAccept-Ranges: bytes\r\nCache-Control: public, max-age=0\r\nLast-Modified: Wed, 21 Jan 2026 04:29:00 GMT\r\nETag: W/\"84651-19bded0218d\"\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx:1.18.0","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"Ubuntu","description":"Ubuntu is a free and open-source operating system on Linux for the enterprise server, desktop, cloud, and IoT.","website":"https://www.ubuntu.com/server","common_platform_enumeration":"cpe:2.3:o:canonical:ubuntu_linux:*:*:*:*:*:*:*:*","icon":"Ubuntu.svg","categories":["Operating systems"]},{"name":"Express","description":"Express is a web application framework for Node.js, released as free and open-source software under the MIT License. It is designed for building web applications and APIs.","website":"https://expressjs.com","common_platform_enumeration":"cpe:2.3:a:expressjs:express:*:*:*:*:*:*:*:*","icon":"Express.svg","categories":["Web frameworks","Web servers"]},{"name":"Node.js","description":"Node.js is an open-source, cross-platform, JavaScript runtime environment that executes JavaScript code outside a web browser.","website":"https://nodejs.org","common_platform_enumeration":"cpe:2.3:a:nodejs:node.js:*:*:*:*:*:*:*:*","icon":"Node.js.svg","categories":["Programming languages"]}],"data":{"size":542289,"size_decoded":542603,"mime_type":"image/png","magic":"PNG image data, 1000 x 667, 8-bit/color RGBA, non-interlaced","md5":"e2b70f4e2fdcd84720d829b4862270f4","sha1":"47feac08ffb9c5386502bb354b0895a6341b171e","sha256":"df8d1439477a4e55c6056af6d49fb42b1a3a70f3620d87d277443dd52f85ba18","sha512":"9fc035d0e8f1d19faa212404732f79fe066e12164f6d9ca1d05bb7d42cdfa10537184f436e88358027ef2f632252cb661c51c38fa401b218f055408b2e7d17f3","ssdeep":"12288:vIDm0FfWlG1bpUZJ1tzunJS7c9DLrOElGvjGQK/SC/ndQQlUz9:vI1tpmJ16SgBlGbpKlVK9","tlshash":"68b4238dfff004830515ff6edb4e20b8485ab56a860c4a666d32d359c82d51f1a7fe3a","first_seen":"2026-09-14T18:56:50.921051Z","last_seen":"2026-09-14T19:15:50.823202Z","times_seen":2,"resource_available":false,"data":null}},"time_used":1497,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":384,"receive":1113,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-14","alert":"Sinkholed","trigger":"ontwig.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-09-14","alert":"Phishing Block","trigger":"ontwig.com","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-09-14","alert":"Sinkholed","trigger":"ontwig.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"ontwig.com/home/homeqrcode.png","fqdn":"ontwig.com","domain":"ontwig.com","tld":"com"},"ip":{"addr":"18.136.175.251","port":443,"asn":16509,"as":"AMAZON-02","country":"Singapore","country_code":"SG"},"is_navigation_request":false,"resource_type":"lazy-img","requested_by":"https://ontwig.com/","date":"2026-09-14T19:15:15.926Z","timestamp":1789413315926,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"ontwig.com","organization":""},"issuer":{"commonName":"YR1","organization":"Let's Encrypt"},"validity":{"start":"Mon, 27 Jul 2026 07:35:36 GMT","end":"Sun, 25 Oct 2026 07:35:35 GMT"},"fingerprint":{"sha1":"C9:85:9E:EB:B2:9E:F2:7A:EE:F3:E4:35:96:4A:78:37:E8:02:FE:A9","sha256":"0B:36:F3:B2:38:E1:DB:1E:1B:A4:94:D5:3F:78:7B:CF:A6:13:E7:1F:62:02:20:16:50:9B:89:4F:86:64:40:B7"}}},"request":{"raw":"GET /home/homeqrcode.png HTTP/1.1\r\nHost: ontwig.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://ontwig.com/\r\nCookie: _ga_XWQ3KYKEH5=GS2.1.s1789413310$o1$g0$t1789413310$j60$l0$h0; _ga=GA1.1.1753496254.1789413310; _gcl_au=1.1.163490465.1789413310\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nServer: nginx/1.18.0 (Ubuntu)\r\nDate: Mon, 14 Sep 2026 19:15:16 GMT\r\nContent-Type: image/png\r\nContent-Length: 613772\r\nConnection: keep-alive\r\nX-Powered-By: Express\r\nAccept-Ranges: bytes\r\nCache-Control: public, max-age=0\r\nLast-Modified: Wed, 21 Jan 2026 04:29:00 GMT\r\nETag: W/\"95d8c-19bded0218b\"\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Node.js","description":"Node.js is an open-source, cross-platform, JavaScript runtime environment that executes JavaScript code outside a web browser.","website":"https://nodejs.org","common_platform_enumeration":"cpe:2.3:a:nodejs:node.js:*:*:*:*:*:*:*:*","icon":"Node.js.svg","categories":["Programming languages"]},{"name":"Ubuntu","description":"Ubuntu is a free and open-source operating system on Linux for the enterprise server, desktop, cloud, and IoT.","website":"https://www.ubuntu.com/server","common_platform_enumeration":"cpe:2.3:o:canonical:ubuntu_linux:*:*:*:*:*:*:*:*","icon":"Ubuntu.svg","categories":["Operating systems"]},{"name":"Nginx:1.18.0","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"Express","description":"Express is a web application framework for Node.js, released as free and open-source software under the MIT License. It is designed for building web applications and APIs.","website":"https://expressjs.com","common_platform_enumeration":"cpe:2.3:a:expressjs:express:*:*:*:*:*:*:*:*","icon":"Express.svg","categories":["Web frameworks","Web servers"]}],"data":{"size":613772,"size_decoded":614086,"mime_type":"image/png","magic":"PNG image data, 1000 x 667, 8-bit/color RGBA, non-interlaced","md5":"946af0b13098c506ba855273196777ba","sha1":"41ca1dd85cd7f02df6430dcf9bd232b96fb4da25","sha256":"65cbc164b1333fdc415bf3478b9cb5595e9598727d7b942c687ef77c64e633a1","sha512":"ac5e97cbd5d81c77d26a38d28222a05f53a097a532dbe66d4f9e8ed599ac1d8d4334308918af95b26a97a4a908ab143858595d3db51b3aa381128572a8e16829","ssdeep":"12288:N+G+gXSLXT0myl+arI5aK7J97PnambYx/n+KccpVstM2:c1gXuj0JMMy1rfaeg+Z8VD2","tlshash":"afd42381b1397918e8267cb6ab5b0d5f9c4f4bc924a6af05ffdd9b5f810218a1c8c84d","first_seen":"2026-09-14T18:56:50.923498Z","last_seen":"2026-09-14T19:15:50.82423Z","times_seen":2,"resource_available":false,"data":null}},"time_used":1984,"timings":{"blocked":-1,"dns":0,"connect":181,"send":0,"wait":183,"receive":1660,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-09-14","alert":"Phishing Block","trigger":"ontwig.com","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-14","alert":"Sinkholed","trigger":"ontwig.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-09-14","alert":"Sinkholed","trigger":"ontwig.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"ontwig.com/","fqdn":"ontwig.com","domain":"ontwig.com","tld":"com"},"ip":{"addr":"18.136.175.251","port":443,"asn":16509,"as":"AMAZON-02","country":"Singapore","country_code":"SG"},"is_navigation_request":true,"resource_type":"document","requested_by":"","date":"2026-09-14T19:15:08.788Z","timestamp":1789413308788,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"ontwig.com","organization":""},"issuer":{"commonName":"YR1","organization":"Let's Encrypt"},"validity":{"start":"Mon, 27 Jul 2026 07:35:36 GMT","end":"Sun, 25 Oct 2026 07:35:35 GMT"},"fingerprint":{"sha1":"C9:85:9E:EB:B2:9E:F2:7A:EE:F3:E4:35:96:4A:78:37:E8:02:FE:A9","sha256":"0B:36:F3:B2:38:E1:DB:1E:1B:A4:94:D5:3F:78:7B:CF:A6:13:E7:1F:62:02:20:16:50:9B:89:4F:86:64:40:B7"}}},"request":{"raw":"GET / HTTP/1.1\r\nHost: ontwig.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nUpgrade-Insecure-Requests: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: document\r\nSec-Fetch-Mode: navigate\r\nSec-Fetch-Site: none\r\nPriority: u=0, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nServer: nginx/1.18.0 (Ubuntu)\r\nDate: Mon, 14 Sep 2026 19:15:09 GMT\r\nContent-Type: text/html; charset=utf-8\r\nTransfer-Encoding: chunked\r\nConnection: keep-alive\r\nX-Powered-By: Express\r\nCache-Control: public, max-age=0\r\nLast-Modified: Wed, 21 Jan 2026 04:29:01 GMT\r\nETag: W/\"e77-19bded02434\"\r\nContent-Encoding: gzip\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx:1.18.0","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"Express","description":"Express is a web application framework for Node.js, released as free and open-source software under the MIT License. It is designed for building web applications and APIs.","website":"https://expressjs.com","common_platform_enumeration":"cpe:2.3:a:expressjs:express:*:*:*:*:*:*:*:*","icon":"Express.svg","categories":["Web frameworks","Web servers"]},{"name":"Node.js","description":"Node.js is an open-source, cross-platform, JavaScript runtime environment that executes JavaScript code outside a web browser.","website":"https://nodejs.org","common_platform_enumeration":"cpe:2.3:a:nodejs:node.js:*:*:*:*:*:*:*:*","icon":"Node.js.svg","categories":["Programming languages"]},{"name":"Ubuntu","description":"Ubuntu is a free and open-source operating system on Linux for the enterprise server, desktop, cloud, and IoT.","website":"https://www.ubuntu.com/server","common_platform_enumeration":"cpe:2.3:o:canonical:ubuntu_linux:*:*:*:*:*:*:*:*","icon":"Ubuntu.svg","categories":["Operating systems"]},{"name":"React","description":"React is an open-source JavaScript library for building user interfaces or UI components.","website":"https://reactjs.org","common_platform_enumeration":"cpe:2.3:a:facebook:react:*:*:*:*:*:*:*:*","icon":"React.svg","categories":["JavaScript frameworks"]},{"name":"Google Analytics","description":"Google Analytics is a free web analytics service that tracks and reports website traffic.","website":"https://google.com/analytics","common_platform_enumeration":"","icon":"Google Analytics.svg","categories":["Analytics"]}],"data":{"size":3703,"size_decoded":1614,"mime_type":"text/html; charset=utf-8","magic":"HTML document, ASCII text","md5":"ddcedfb0bbf93c377f7ecf53238c6cce","sha1":"2c0ce147c8b3bc80ad1fd2f5a08016b9165361d1","sha256":"f97dc3aee424370a0809d00c5ee2a631a02a90860dc3220c49a3232e52925120","sha512":"3a072913cc56e9ede54b032e0ad9cfa5d23d9780747f5db8df907b73f2edd4cacf83314172456d2791a0cbd4c27a23ab69c1806d686db7ac603ce13a6ed0b538","ssdeep":"","tlshash":"497150974aa5c8131321412042d6f01cc7aa9503c394ad7935ed17ae5fc6fd6c3fbba6","first_seen":"2026-09-14T18:56:50.92711Z","last_seen":"2026-09-14T19:15:50.825379Z","times_seen":2,"resource_available":false,"data":null}},"time_used":774,"timings":{"blocked":-1,"dns":41,"connect":182,"send":0,"wait":185,"receive":0,"ssl":366},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-14","alert":"Sinkholed","trigger":"ontwig.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-09-14","alert":"Phishing Block","trigger":"ontwig.com","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-09-14","alert":"Sinkholed","trigger":"ontwig.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"www.googletagmanager.com/gtag/js?id=G-XWQ3KYKEH5","fqdn":"www.googletagmanager.com","domain":"googletagmanager.com","tld":"com"},"ip":{"addr":"142.250.178.40","port":443,"asn":15169,"as":"GOOGLE","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://ontwig.com/","date":"2026-09-14T19:15:09.948Z","timestamp":1789413309948,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.google-analytics.com","organization":""},"issuer":{"commonName":"WE2","organization":"Google Trust Services"},"validity":{"start":"Mon, 10 Aug 2026 08:37:41 GMT","end":"Mon, 02 Nov 2026 08:37:40 GMT"},"fingerprint":{"sha1":"DC:E6:38:9B:82:DB:20:21:19:E7:95:FC:30:E0:F0:F4:BC:CA:9A:1C","sha256":"2C:0E:42:66:EE:BA:84:59:3C:53:EB:87:C0:84:DD:32:F4:42:73:26:47:8C:4E:56:F9:5B:47:6C:AF:BA:C2:F9"}}},"request":{"raw":"GET /gtag/js?id=G-XWQ3KYKEH5 HTTP/1.1\r\nHost: www.googletagmanager.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-Fetch-Storage-Access: none\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://ontwig.com/\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\ncontent-type: application/javascript; charset=UTF-8\r\naccess-control-allow-origin: *\r\naccess-control-allow-credentials: true\r\naccess-control-allow-headers: Cache-Control\r\ncontent-encoding: zstd\r\nvary: Accept-Encoding\r\ndate: Mon, 14 Sep 2026 19:15:10 GMT\r\nexpires: Mon, 14 Sep 2026 19:15:10 GMT\r\ncache-control: private, max-age=900\r\nstrict-transport-security: max-age=31536000; includeSubDomains\r\ncross-origin-resource-policy: cross-origin\r\nserver: Google Tag Manager\r\ncontent-length: 193163\r\nx-xss-protection: 0\r\nalt-svc: h3=\":443\"; ma=2592000,h3-29=\":443\"; ma=2592000\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":593721,"size_decoded":193767,"mime_type":"application/javascript; charset=UTF-8","magic":"JavaScript source, ASCII text, with very long lines (6698)","md5":"92e58e33bf91c044ae9edb8ba72e71cd","sha1":"643c4be4ca927e53f5d15595cabde99e91f4ecad","sha256":"c9d307f702eb3ae046100fe718db292e7c21a8ff29aec0d09224152f5de60911","sha512":"f39a392d3653f07a719dcabbe6da6991bc4e46e06212f10aa4e12c8be76e1769c1736276df54a185d1d5a6bfeaf3e6eb31871e6bfab00b5b5218ba67e6c48198","ssdeep":"6144:b92Mf1L6SSxQhmgyyE3RdJl580ucTPbNELR3/jupWS3P+NJ3g2Z:bIm0yAy6PnpJP+Jn","tlshash":"ebc41ace73d674229796f078903f01cb697b29a2b49cc89af18edce02d3454a5167f78","first_seen":"2026-09-14T18:56:50.91738Z","last_seen":"2026-09-14T19:15:50.827478Z","times_seen":2,"resource_available":true,"data":null}},"time_used":154,"timings":{"blocked":-1,"dns":4,"connect":15,"send":0,"wait":40,"receive":62,"ssl":33},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"ontwig.com/assets/index-B1DO8bE1.css","fqdn":"ontwig.com","domain":"ontwig.com","tld":"com"},"ip":{"addr":"18.136.175.251","port":443,"asn":16509,"as":"AMAZON-02","country":"Singapore","country_code":"SG"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://ontwig.com/","date":"2026-09-14T19:15:09.952Z","timestamp":1789413309952,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"ontwig.com","organization":""},"issuer":{"commonName":"YR1","organization":"Let's Encrypt"},"validity":{"start":"Mon, 27 Jul 2026 07:35:36 GMT","end":"Sun, 25 Oct 2026 07:35:35 GMT"},"fingerprint":{"sha1":"C9:85:9E:EB:B2:9E:F2:7A:EE:F3:E4:35:96:4A:78:37:E8:02:FE:A9","sha256":"0B:36:F3:B2:38:E1:DB:1E:1B:A4:94:D5:3F:78:7B:CF:A6:13:E7:1F:62:02:20:16:50:9B:89:4F:86:64:40:B7"}}},"request":{"raw":"GET /assets/index-B1DO8bE1.css HTTP/1.1\r\nHost: ontwig.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://ontwig.com/\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=2\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nServer: nginx/1.18.0 (Ubuntu)\r\nDate: Mon, 14 Sep 2026 19:15:10 GMT\r\nContent-Type: text/css; charset=utf-8\r\nContent-Length: 89966\r\nConnection: keep-alive\r\nX-Powered-By: Express\r\nAccept-Ranges: bytes\r\nCache-Control: public, max-age=0\r\nLast-Modified: Wed, 21 Jan 2026 04:29:01 GMT\r\nETag: W/\"15f6e-19bded02434\"\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Ubuntu","description":"Ubuntu is a free and open-source operating system on Linux for the enterprise server, desktop, cloud, and IoT.","website":"https://www.ubuntu.com/server","common_platform_enumeration":"cpe:2.3:o:canonical:ubuntu_linux:*:*:*:*:*:*:*:*","icon":"Ubuntu.svg","categories":["Operating systems"]},{"name":"Express","description":"Express is a web application framework for Node.js, released as free and open-source software under the MIT License. It is designed for building web applications and APIs.","website":"https://expressjs.com","common_platform_enumeration":"cpe:2.3:a:expressjs:express:*:*:*:*:*:*:*:*","icon":"Express.svg","categories":["Web frameworks","Web servers"]},{"name":"Node.js","description":"Node.js is an open-source, cross-platform, JavaScript runtime environment that executes JavaScript code outside a web browser.","website":"https://nodejs.org","common_platform_enumeration":"cpe:2.3:a:nodejs:node.js:*:*:*:*:*:*:*:*","icon":"Node.js.svg","categories":["Programming languages"]},{"name":"Nginx:1.18.0","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":89966,"size_decoded":90293,"mime_type":"text/css; charset=utf-8","magic":"ASCII text, with very long lines (65536), with no line terminators","md5":"6166d078d2d967538f2eab6adadb2bab","sha1":"e323d0005e6cdda47eae7409235b13bc7f87f9a7","sha256":"c7bf4f6e5c09d1c22793116fb635ccec97e84bffebfb1ea3aab0ec97a73e1e30","sha512":"56dc13193bbfd6764846cb0d940ece5ce9203918c64dd5880555fcc266078c28bd7018a0ed97664702270b35040a6315fb40a3b9654af61838c47d9d08bf11d2","ssdeep":"1536:vP6hZZEqNtchRR4yVbN6Z2/X9uDF8oqus:vP6hZZEqNtchRR4yVJ6ZeX9uDqoqus","tlshash":"309350a0a2b1d97bfc27b0fd939cf41ca11ab096dd2657dcfe01a00267d6bf24c66614","first_seen":"2026-09-14T18:56:50.905335Z","last_seen":"2026-09-14T19:15:50.829554Z","times_seen":2,"resource_available":false,"data":null}},"time_used":1098,"timings":{"blocked":-1,"dns":0,"connect":182,"send":0,"wait":367,"receive":363,"ssl":186},"alerts":{"ids":null,"analyzer":[{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-09-14","alert":"Phishing Block","trigger":"ontwig.com","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-14","alert":"Sinkholed","trigger":"ontwig.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-09-14","alert":"Sinkholed","trigger":"ontwig.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"fonts.googleapis.com/css2?family=Poppins:wght@100..900\u0026display=swap","fqdn":"fonts.googleapis.com","domain":"fonts.googleapis.com","tld":"googleapis.com"},"ip":{"addr":"142.250.178.42","port":443,"asn":15169,"as":"GOOGLE","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://ontwig.com/","date":"2026-09-14T19:15:11.054Z","timestamp":1789413311054,"http_version":"HTTP/2","security_state":"","security_info":null,"request":{"raw":"GET /css2?family=Poppins:wght@100..900\u0026display=swap HTTP/1.1\r\nHost: fonts.googleapis.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-Fetch-Storage-Access: none\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://ontwig.com/\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPriority: u=2\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 400 \r\ncontent-type: text/html; charset=utf-8\r\ncache-control: no-cache, no-store, max-age=0, must-revalidate\r\npragma: no-cache\r\nexpires: Mon, 01 Jan 1990 00:00:00 GMT\r\ndate: Mon, 14 Sep 2026 19:15:11 GMT\r\ncross-origin-opener-policy: same-origin-allow-popups\r\ncross-origin-resource-policy: cross-origin\r\ncontent-encoding: gzip\r\nserver: ESF\r\nx-xss-protection: 0\r\nx-frame-options: SAMEORIGIN\r\nx-content-type-options: nosniff\r\nalt-svc: h3=\":443\"; ma=2592000,h3-29=\":443\"; ma=2592000\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"400","status_text":"Bad Request","fingerprints":null,"data":{"size":0,"size_decoded":0,"mime_type":"text/html; charset=utf-8","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-09-15T10:51:33.378108Z","times_seen":18474259,"resource_available":true,"data":null}},"time_used":0,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":0,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"ontwig.com/home/homebrandedomain.png","fqdn":"ontwig.com","domain":"ontwig.com","tld":"com"},"ip":{"addr":"18.136.175.251","port":443,"asn":16509,"as":"AMAZON-02","country":"Singapore","country_code":"SG"},"is_navigation_request":false,"resource_type":"lazy-img","requested_by":"https://ontwig.com/","date":"2026-09-14T19:15:15.927Z","timestamp":1789413315927,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"ontwig.com","organization":""},"issuer":{"commonName":"YR1","organization":"Let's Encrypt"},"validity":{"start":"Mon, 27 Jul 2026 07:35:36 GMT","end":"Sun, 25 Oct 2026 07:35:35 GMT"},"fingerprint":{"sha1":"C9:85:9E:EB:B2:9E:F2:7A:EE:F3:E4:35:96:4A:78:37:E8:02:FE:A9","sha256":"0B:36:F3:B2:38:E1:DB:1E:1B:A4:94:D5:3F:78:7B:CF:A6:13:E7:1F:62:02:20:16:50:9B:89:4F:86:64:40:B7"}}},"request":{"raw":"GET /home/homebrandedomain.png HTTP/1.1\r\nHost: ontwig.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://ontwig.com/\r\nCookie: _ga_XWQ3KYKEH5=GS2.1.s1789413310$o1$g0$t1789413310$j60$l0$h0; _ga=GA1.1.1753496254.1789413310; _gcl_au=1.1.163490465.1789413310\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nServer: nginx/1.18.0 (Ubuntu)\r\nDate: Mon, 14 Sep 2026 19:15:16 GMT\r\nContent-Type: image/png\r\nContent-Length: 645941\r\nConnection: keep-alive\r\nX-Powered-By: Express\r\nAccept-Ranges: bytes\r\nCache-Control: public, max-age=0\r\nLast-Modified: Wed, 21 Jan 2026 04:29:00 GMT\r\nETag: W/\"9db35-19bded0218a\"\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx:1.18.0","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"Express","description":"Express is a web application framework for Node.js, released as free and open-source software under the MIT License. It is designed for building web applications and APIs.","website":"https://expressjs.com","common_platform_enumeration":"cpe:2.3:a:expressjs:express:*:*:*:*:*:*:*:*","icon":"Express.svg","categories":["Web frameworks","Web servers"]},{"name":"Node.js","description":"Node.js is an open-source, cross-platform, JavaScript runtime environment that executes JavaScript code outside a web browser.","website":"https://nodejs.org","common_platform_enumeration":"cpe:2.3:a:nodejs:node.js:*:*:*:*:*:*:*:*","icon":"Node.js.svg","categories":["Programming languages"]},{"name":"Ubuntu","description":"Ubuntu is a free and open-source operating system on Linux for the enterprise server, desktop, cloud, and IoT.","website":"https://www.ubuntu.com/server","common_platform_enumeration":"cpe:2.3:o:canonical:ubuntu_linux:*:*:*:*:*:*:*:*","icon":"Ubuntu.svg","categories":["Operating systems"]}],"data":{"size":645941,"size_decoded":646255,"mime_type":"image/png","magic":"PNG image data, 1000 x 667, 8-bit/color RGBA, non-interlaced","md5":"56732791acfb976c9be03a4dd4d71a9d","sha1":"6e8cadd9d1451a7464c33b2e58b3a998eb1c5e96","sha256":"e1af8ca6e194e57d111445aa221b957a37cc91c16d9ddcde1642b19811609f7f","sha512":"bcb58b71db549f52d179afc6146fe961ea30ad4e7229435ad7f561112b57d3ff15eb4d349bb748afc4784a35b88e56c36758ddc2e53e911d541ab72c95d703ac","ssdeep":"12288:HmHqmOL/4NlGHr2LYXM68APTZRzaJGJS4l+R+LU0GrqEXD2EHqKcbxq7:HSqxSGHr20XM+PVRzaJqKxzCKctY","tlshash":"8ed42372f6842f2bf6658b87aa5b452e1c2251f9d82e3be03f0bca65d5d8d301f5490c","first_seen":"2026-09-14T18:56:50.901622Z","last_seen":"2026-09-14T19:15:50.832112Z","times_seen":2,"resource_available":false,"data":null}},"time_used":2755,"timings":{"blocked":-1,"dns":0,"connect":182,"send":0,"wait":378,"receive":2011,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-09-14","alert":"Phishing Block","trigger":"ontwig.com","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-14","alert":"Sinkholed","trigger":"ontwig.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-09-14","alert":"Sinkholed","trigger":"ontwig.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"ontwig.com/assets/index-SknG5NUj.js","fqdn":"ontwig.com","domain":"ontwig.com","tld":"com"},"ip":{"addr":"18.136.175.251","port":443,"asn":16509,"as":"AMAZON-02","country":"Singapore","country_code":"SG"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://ontwig.com/","date":"2026-09-14T19:15:09.951Z","timestamp":1789413309951,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"ontwig.com","organization":""},"issuer":{"commonName":"YR1","organization":"Let's Encrypt"},"validity":{"start":"Mon, 27 Jul 2026 07:35:36 GMT","end":"Sun, 25 Oct 2026 07:35:35 GMT"},"fingerprint":{"sha1":"C9:85:9E:EB:B2:9E:F2:7A:EE:F3:E4:35:96:4A:78:37:E8:02:FE:A9","sha256":"0B:36:F3:B2:38:E1:DB:1E:1B:A4:94:D5:3F:78:7B:CF:A6:13:E7:1F:62:02:20:16:50:9B:89:4F:86:64:40:B7"}}},"request":{"raw":"GET /assets/index-SknG5NUj.js HTTP/1.1\r\nHost: ontwig.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://ontwig.com/\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nServer: nginx/1.18.0 (Ubuntu)\r\nDate: Mon, 14 Sep 2026 19:15:10 GMT\r\nContent-Type: text/javascript; charset=utf-8\r\nContent-Length: 624439\r\nConnection: keep-alive\r\nX-Powered-By: Express\r\nAccept-Ranges: bytes\r\nCache-Control: public, max-age=0\r\nLast-Modified: Wed, 21 Jan 2026 04:29:01 GMT\r\nETag: W/\"98737-19bded02435\"\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx:1.18.0","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"Ubuntu","description":"Ubuntu is a free and open-source operating system on Linux for the enterprise server, desktop, cloud, and IoT.","website":"https://www.ubuntu.com/server","common_platform_enumeration":"cpe:2.3:o:canonical:ubuntu_linux:*:*:*:*:*:*:*:*","icon":"Ubuntu.svg","categories":["Operating systems"]},{"name":"Express","description":"Express is a web application framework for Node.js, released as free and open-source software under the MIT License. It is designed for building web applications and APIs.","website":"https://expressjs.com","common_platform_enumeration":"cpe:2.3:a:expressjs:express:*:*:*:*:*:*:*:*","icon":"Express.svg","categories":["Web frameworks","Web servers"]},{"name":"Node.js","description":"Node.js is an open-source, cross-platform, JavaScript runtime environment that executes JavaScript code outside a web browser.","website":"https://nodejs.org","common_platform_enumeration":"cpe:2.3:a:nodejs:node.js:*:*:*:*:*:*:*:*","icon":"Node.js.svg","categories":["Programming languages"]}],"data":{"size":624439,"size_decoded":624774,"mime_type":"text/javascript; charset=utf-8","magic":"JavaScript source, ASCII text, with very long lines (35561)","md5":"69b7329bdf1b04b979d7ae435089aa19","sha1":"d1fc0aaeee24456c4f21137831d5aa5616290b54","sha256":"e174450cb79e8912258878755f259aeda7c5f7fedbe558ae70fc7784ee2ddab1","sha512":"139374fea2213b5af2fb7000f7da8b2d25d357a621353e2ed99c7cf3859614ac649ab91e9d4b8b01d10157d1f17dfc108d7904a68cdcc237726b0c63ad219080","ssdeep":"6144:jszKDhD6nhSUXgvQIWWQxw7RR/w4eIqfmwJmuoSbC+kQyIRclVgHBDRG0tTR3Kaz:y8Qxwnw4eMg7ZtpKhR/QJHokkCFhSQL","tlshash":"bfd45c18f154bbbf6e6305e4a45f6005b11e4a2adb3dc8a0f06cd42927f419a717bbec","first_seen":"2026-09-14T18:56:50.929272Z","last_seen":"2026-09-14T19:15:50.833522Z","times_seen":2,"resource_available":true,"data":null}},"time_used":5817,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":365,"receive":5452,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-09-14","alert":"Phishing Block","trigger":"ontwig.com","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-14","alert":"Sinkholed","trigger":"ontwig.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-09-14","alert":"Sinkholed","trigger":"ontwig.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"ontwig.com/apple-touch-icon.png","fqdn":"ontwig.com","domain":"ontwig.com","tld":"com"},"ip":{"addr":"18.136.175.251","port":443,"asn":16509,"as":"AMAZON-02","country":"Singapore","country_code":"SG"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://ontwig.com/","date":"2026-09-14T19:15:12.363Z","timestamp":1789413312363,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"ontwig.com","organization":""},"issuer":{"commonName":"YR1","organization":"Let's Encrypt"},"validity":{"start":"Mon, 27 Jul 2026 07:35:36 GMT","end":"Sun, 25 Oct 2026 07:35:35 GMT"},"fingerprint":{"sha1":"C9:85:9E:EB:B2:9E:F2:7A:EE:F3:E4:35:96:4A:78:37:E8:02:FE:A9","sha256":"0B:36:F3:B2:38:E1:DB:1E:1B:A4:94:D5:3F:78:7B:CF:A6:13:E7:1F:62:02:20:16:50:9B:89:4F:86:64:40:B7"}}},"request":{"raw":"GET /apple-touch-icon.png HTTP/1.1\r\nHost: ontwig.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://ontwig.com/\r\nCookie: _ga_XWQ3KYKEH5=GS2.1.s1789413310$o1$g0$t1789413310$j60$l0$h0; _ga=GA1.1.1753496254.1789413310; _gcl_au=1.1.163490465.1789413310\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=6\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nServer: nginx/1.18.0 (Ubuntu)\r\nDate: Mon, 14 Sep 2026 19:15:12 GMT\r\nContent-Type: image/png\r\nContent-Length: 15252\r\nConnection: keep-alive\r\nX-Powered-By: Express\r\nAccept-Ranges: bytes\r\nCache-Control: public, max-age=0\r\nLast-Modified: Wed, 21 Jan 2026 04:29:00 GMT\r\nETag: W/\"3b94-19bded02188\"\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Node.js","description":"Node.js is an open-source, cross-platform, JavaScript runtime environment that executes JavaScript code outside a web browser.","website":"https://nodejs.org","common_platform_enumeration":"cpe:2.3:a:nodejs:node.js:*:*:*:*:*:*:*:*","icon":"Node.js.svg","categories":["Programming languages"]},{"name":"Nginx:1.18.0","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"Ubuntu","description":"Ubuntu is a free and open-source operating system on Linux for the enterprise server, desktop, cloud, and IoT.","website":"https://www.ubuntu.com/server","common_platform_enumeration":"cpe:2.3:o:canonical:ubuntu_linux:*:*:*:*:*:*:*:*","icon":"Ubuntu.svg","categories":["Operating systems"]},{"name":"Express","description":"Express is a web application framework for Node.js, released as free and open-source software under the MIT License. It is designed for building web applications and APIs.","website":"https://expressjs.com","common_platform_enumeration":"cpe:2.3:a:expressjs:express:*:*:*:*:*:*:*:*","icon":"Express.svg","categories":["Web frameworks","Web servers"]}],"data":{"size":15252,"size_decoded":15564,"mime_type":"image/png","magic":"PNG image data, 180 x 180, 8-bit/color RGBA, non-interlaced","md5":"f55643820bf381f37719c4baf5796d17","sha1":"671f2dcc9bcb83581bcb43c1f16069550b520916","sha256":"2ce8536689dba44b41b2b5f3bd9424847ed8abc4bec497c86e809c076473337c","sha512":"295fa112db41fba7d707e131abd8f6631bfcbf264a1c4950897f16ca89042744de35b1d055bc75be897c2e2ce9009e9707c842b017326f2785a54eb66e829079","ssdeep":"384:u0+R8JXBMdA2ViWUxi6nLejGhWObsAiJs6/v3zWDDPUpom:9XLAUxojGhWOXiJs8DWD7Ud","tlshash":"3662e16e81d0037ceb889f36d9da1ceaf49235e353469206f57ed29520e79d2d9f0a04","first_seen":"2026-09-14T18:56:50.896122Z","last_seen":"2026-09-14T19:15:50.83443Z","times_seen":2,"resource_available":false,"data":null}},"time_used":368,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":368,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-09-14","alert":"Sinkholed","trigger":"ontwig.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-09-14","alert":"Phishing Block","trigger":"ontwig.com","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-14","alert":"Sinkholed","trigger":"ontwig.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"ontwig.com/api/v1/f/previewQRCode","fqdn":"ontwig.com","domain":"ontwig.com","tld":"com"},"ip":{"addr":"18.136.175.251","port":443,"asn":16509,"as":"AMAZON-02","country":"Singapore","country_code":"SG"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"https://ontwig.com/","date":"2026-09-14T19:15:15.921Z","timestamp":1789413315921,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"ontwig.com","organization":""},"issuer":{"commonName":"YR1","organization":"Let's Encrypt"},"validity":{"start":"Mon, 27 Jul 2026 07:35:36 GMT","end":"Sun, 25 Oct 2026 07:35:35 GMT"},"fingerprint":{"sha1":"C9:85:9E:EB:B2:9E:F2:7A:EE:F3:E4:35:96:4A:78:37:E8:02:FE:A9","sha256":"0B:36:F3:B2:38:E1:DB:1E:1B:A4:94:D5:3F:78:7B:CF:A6:13:E7:1F:62:02:20:16:50:9B:89:4F:86:64:40:B7"}}},"request":{"raw":"POST /api/v1/f/previewQRCode HTTP/1.1\r\nHost: ontwig.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/json\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nContent-Type: application/json\r\nContent-Length: 146\r\nOrigin: https://ontwig.com\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://ontwig.com/\r\nCookie: _ga_XWQ3KYKEH5=GS2.1.s1789413310$o1$g0$t1789413310$j60$l0$h0; _ga=GA1.1.1753496254.1789413310; _gcl_au=1.1.163490465.1789413310\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"POST","post_data":{"size":146,"data":"{\"type\":\"1\",\"originUrl\":\"\",\"content\":{\"originUrl\":\"\"},\"qrPattern\":\"square\",\"qrEye\":\"square\",\"qrFrame\":\"none\",\"qrForeground\":\"#000000\",\"qrLogo\":\"\"}"}},"response":{"raw":"HTTP/1.1 200 OK\r\nServer: nginx/1.18.0 (Ubuntu)\r\nDate: Mon, 14 Sep 2026 19:15:16 GMT\r\nContent-Type: application/json; charset=utf-8\r\nContent-Length: 97166\r\nConnection: keep-alive\r\nX-Powered-By: Express\r\nAccess-Control-Allow-Origin: *\r\nETag: W/\"17b8e-dQmBO+cAvrl2l4B0o7S/i04Euu4\"\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx:1.18.0","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"Ubuntu","description":"Ubuntu is a free and open-source operating system on Linux for the enterprise server, desktop, cloud, and IoT.","website":"https://www.ubuntu.com/server","common_platform_enumeration":"cpe:2.3:o:canonical:ubuntu_linux:*:*:*:*:*:*:*:*","icon":"Ubuntu.svg","categories":["Operating systems"]},{"name":"Express","description":"Express is a web application framework for Node.js, released as free and open-source software under the MIT License. It is designed for building web applications and APIs.","website":"https://expressjs.com","common_platform_enumeration":"cpe:2.3:a:expressjs:express:*:*:*:*:*:*:*:*","icon":"Express.svg","categories":["Web frameworks","Web servers"]},{"name":"Node.js","description":"Node.js is an open-source, cross-platform, JavaScript runtime environment that executes JavaScript code outside a web browser.","website":"https://nodejs.org","common_platform_enumeration":"cpe:2.3:a:nodejs:node.js:*:*:*:*:*:*:*:*","icon":"Node.js.svg","categories":["Programming languages"]}],"data":{"size":97166,"size_decoded":97447,"mime_type":"application/json; charset=utf-8","magic":"JSON text data","md5":"54799c7f6fa1704dbae7eea49b7eeb9b","sha1":"7509813be700beb976978074a3b4bf8b4e04baee","sha256":"e3c5fbbd5ca47f500e4ecae07d3546d1e38692edcb95120c77e63002bbe1236e","sha512":"78c16677b4fe247cf1159ef097de65b3e1a63f3f10b01790d63f00e1ecac69d92d58be5a0b49ada8d9546b5d1c74489b866741d3d3c66098f5c6c678ed45e135","ssdeep":"768:j/rtnxrw7YJbtoNbtcN+bV+UUcVy7Z9N+f:mQV9G","tlshash":"9e93348f1b1627a9150f64924eb9ec10994b97f2cc5ee5b8e1d95ef420c8a037f8d393","first_seen":"2026-09-14T18:56:50.897688Z","last_seen":"2026-09-14T19:15:50.835251Z","times_seen":2,"resource_available":false,"data":null}},"time_used":764,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":388,"receive":376,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-14","alert":"Sinkholed","trigger":"ontwig.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-09-14","alert":"Sinkholed","trigger":"ontwig.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-09-14","alert":"Phishing Block","trigger":"ontwig.com","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"ontwig.com/home/homecampaignanalytics.png","fqdn":"ontwig.com","domain":"ontwig.com","tld":"com"},"ip":{"addr":"18.136.175.251","port":443,"asn":16509,"as":"AMAZON-02","country":"Singapore","country_code":"SG"},"is_navigation_request":false,"resource_type":"lazy-img","requested_by":"https://ontwig.com/","date":"2026-09-14T19:15:15.929Z","timestamp":1789413315929,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"ontwig.com","organization":""},"issuer":{"commonName":"YR1","organization":"Let's Encrypt"},"validity":{"start":"Mon, 27 Jul 2026 07:35:36 GMT","end":"Sun, 25 Oct 2026 07:35:35 GMT"},"fingerprint":{"sha1":"C9:85:9E:EB:B2:9E:F2:7A:EE:F3:E4:35:96:4A:78:37:E8:02:FE:A9","sha256":"0B:36:F3:B2:38:E1:DB:1E:1B:A4:94:D5:3F:78:7B:CF:A6:13:E7:1F:62:02:20:16:50:9B:89:4F:86:64:40:B7"}}},"request":{"raw":"GET /home/homecampaignanalytics.png HTTP/1.1\r\nHost: ontwig.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://ontwig.com/\r\nCookie: _ga_XWQ3KYKEH5=GS2.1.s1789413310$o1$g0$t1789413310$j60$l0$h0; _ga=GA1.1.1753496254.1789413310; _gcl_au=1.1.163490465.1789413310\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nServer: nginx/1.18.0 (Ubuntu)\r\nDate: Mon, 14 Sep 2026 19:15:16 GMT\r\nContent-Type: image/png\r\nContent-Length: 599748\r\nConnection: keep-alive\r\nX-Powered-By: Express\r\nAccept-Ranges: bytes\r\nCache-Control: public, max-age=0\r\nLast-Modified: Wed, 21 Jan 2026 04:29:00 GMT\r\nETag: W/\"926c4-19bded0218b\"\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx:1.18.0","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"Ubuntu","description":"Ubuntu is a free and open-source operating system on Linux for the enterprise server, desktop, cloud, and IoT.","website":"https://www.ubuntu.com/server","common_platform_enumeration":"cpe:2.3:o:canonical:ubuntu_linux:*:*:*:*:*:*:*:*","icon":"Ubuntu.svg","categories":["Operating systems"]},{"name":"Express","description":"Express is a web application framework for Node.js, released as free and open-source software under the MIT License. It is designed for building web applications and APIs.","website":"https://expressjs.com","common_platform_enumeration":"cpe:2.3:a:expressjs:express:*:*:*:*:*:*:*:*","icon":"Express.svg","categories":["Web frameworks","Web servers"]},{"name":"Node.js","description":"Node.js is an open-source, cross-platform, JavaScript runtime environment that executes JavaScript code outside a web browser.","website":"https://nodejs.org","common_platform_enumeration":"cpe:2.3:a:nodejs:node.js:*:*:*:*:*:*:*:*","icon":"Node.js.svg","categories":["Programming languages"]}],"data":{"size":599748,"size_decoded":600062,"mime_type":"image/png","magic":"PNG image data, 1000 x 667, 8-bit/color RGBA, non-interlaced","md5":"4b94087a50076d6cc5d5c0833f27178d","sha1":"2c8cee9e854ef6943314a9021fb1a88bae4fa5e9","sha256":"39686842a0ab47b3e8ecef18f1df22c3928aa8a017dceee9e0b538d89bbcb4b7","sha512":"f8df8e5cbf8c83d0500df367b0ef612a428831111ac0025825a26ea61f39fba856533d83e4b7b7d4d66acc33bb720d56139617aaf1f38f995b135e662da70aa4","ssdeep":"12288:fT8hFZxRNhweMN9DDAQCC4T/z6OlAvPT4Eb55dziNUqjmzv:fYhF1vJMHbCvT/Oa0ll5xSmzv","tlshash":"efd42303b07b06762e687145b977d0d7df0da9573f33a7926d8339340aeea618ac624c","first_seen":"2026-09-14T18:56:50.913647Z","last_seen":"2026-09-14T19:15:50.836258Z","times_seen":2,"resource_available":false,"data":null}},"time_used":2589,"timings":{"blocked":-1,"dns":0,"connect":182,"send":0,"wait":379,"receive":1842,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-14","alert":"Sinkholed","trigger":"ontwig.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-09-14","alert":"Phishing Block","trigger":"ontwig.com","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-09-14","alert":"Sinkholed","trigger":"ontwig.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"ontwig.com/favicon-16x16.png","fqdn":"ontwig.com","domain":"ontwig.com","tld":"com"},"ip":{"addr":"18.136.175.251","port":443,"asn":16509,"as":"AMAZON-02","country":"Singapore","country_code":"SG"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://ontwig.com/","date":"2026-09-14T19:15:12.365Z","timestamp":1789413312365,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"ontwig.com","organization":""},"issuer":{"commonName":"YR1","organization":"Let's Encrypt"},"validity":{"start":"Mon, 27 Jul 2026 07:35:36 GMT","end":"Sun, 25 Oct 2026 07:35:35 GMT"},"fingerprint":{"sha1":"C9:85:9E:EB:B2:9E:F2:7A:EE:F3:E4:35:96:4A:78:37:E8:02:FE:A9","sha256":"0B:36:F3:B2:38:E1:DB:1E:1B:A4:94:D5:3F:78:7B:CF:A6:13:E7:1F:62:02:20:16:50:9B:89:4F:86:64:40:B7"}}},"request":{"raw":"GET /favicon-16x16.png HTTP/1.1\r\nHost: ontwig.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://ontwig.com/\r\nCookie: _ga_XWQ3KYKEH5=GS2.1.s1789413310$o1$g0$t1789413310$j60$l0$h0; _ga=GA1.1.1753496254.1789413310; _gcl_au=1.1.163490465.1789413310\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=6\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nServer: nginx/1.18.0 (Ubuntu)\r\nDate: Mon, 14 Sep 2026 19:15:12 GMT\r\nContent-Type: image/png\r\nContent-Length: 651\r\nConnection: keep-alive\r\nX-Powered-By: Express\r\nAccept-Ranges: bytes\r\nCache-Control: public, max-age=0\r\nLast-Modified: Wed, 21 Jan 2026 04:29:00 GMT\r\nETag: W/\"28b-19bded02189\"\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx:1.18.0","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"Ubuntu","description":"Ubuntu is a free and open-source operating system on Linux for the enterprise server, desktop, cloud, and IoT.","website":"https://www.ubuntu.com/server","common_platform_enumeration":"cpe:2.3:o:canonical:ubuntu_linux:*:*:*:*:*:*:*:*","icon":"Ubuntu.svg","categories":["Operating systems"]},{"name":"Express","description":"Express is a web application framework for Node.js, released as free and open-source software under the MIT License. It is designed for building web applications and APIs.","website":"https://expressjs.com","common_platform_enumeration":"cpe:2.3:a:expressjs:express:*:*:*:*:*:*:*:*","icon":"Express.svg","categories":["Web frameworks","Web servers"]},{"name":"Node.js","description":"Node.js is an open-source, cross-platform, JavaScript runtime environment that executes JavaScript code outside a web browser.","website":"https://nodejs.org","common_platform_enumeration":"cpe:2.3:a:nodejs:node.js:*:*:*:*:*:*:*:*","icon":"Node.js.svg","categories":["Programming languages"]}],"data":{"size":651,"size_decoded":960,"mime_type":"image/png","magic":"PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced","md5":"0816af9fc4f8b12838f4828e96d2ed62","sha1":"c8b818c5290e0b86d590f39d57478706d1cf8f5b","sha256":"bd4d24d744986e33c913ef5324dec5aaa14374ceefa8cbaf762cbf25b9bb84b0","sha512":"a545781cba572b904452254ee7df614f47cb9fe81d3804f49ca80da83c665e570c9b177e930d83b9e640ac9d7b11a97353f429185458cf57dab9825560569af3","ssdeep":"","tlshash":"44f023d3e5381d6bf4f103630760a971d430364c2bc31819ed0955e234cd98ad4ec2d2","first_seen":"2026-09-14T18:56:50.908373Z","last_seen":"2026-09-14T19:15:50.837267Z","times_seen":2,"resource_available":false,"data":null}},"time_used":549,"timings":{"blocked":0,"dns":0,"connect":181,"send":0,"wait":183,"receive":0,"ssl":185},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-14","alert":"Sinkholed","trigger":"ontwig.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-09-14","alert":"Sinkholed","trigger":"ontwig.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-09-14","alert":"Phishing Block","trigger":"ontwig.com","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"ontwig.com/ontwiglogo.png","fqdn":"ontwig.com","domain":"ontwig.com","tld":"com"},"ip":{"addr":"18.136.175.251","port":443,"asn":16509,"as":"AMAZON-02","country":"Singapore","country_code":"SG"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://ontwig.com/","date":"2026-09-14T19:15:15.883Z","timestamp":1789413315883,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"ontwig.com","organization":""},"issuer":{"commonName":"YR1","organization":"Let's Encrypt"},"validity":{"start":"Mon, 27 Jul 2026 07:35:36 GMT","end":"Sun, 25 Oct 2026 07:35:35 GMT"},"fingerprint":{"sha1":"C9:85:9E:EB:B2:9E:F2:7A:EE:F3:E4:35:96:4A:78:37:E8:02:FE:A9","sha256":"0B:36:F3:B2:38:E1:DB:1E:1B:A4:94:D5:3F:78:7B:CF:A6:13:E7:1F:62:02:20:16:50:9B:89:4F:86:64:40:B7"}}},"request":{"raw":"GET /ontwiglogo.png HTTP/1.1\r\nHost: ontwig.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://ontwig.com/\r\nCookie: _ga_XWQ3KYKEH5=GS2.1.s1789413310$o1$g0$t1789413310$j60$l0$h0; _ga=GA1.1.1753496254.1789413310; _gcl_au=1.1.163490465.1789413310\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nServer: nginx/1.18.0 (Ubuntu)\r\nDate: Mon, 14 Sep 2026 19:15:15 GMT\r\nContent-Type: image/png\r\nContent-Length: 6445\r\nConnection: keep-alive\r\nX-Powered-By: Express\r\nAccept-Ranges: bytes\r\nCache-Control: public, max-age=0\r\nLast-Modified: Wed, 21 Jan 2026 04:29:00 GMT\r\nETag: W/\"192d-19bded021d2\"\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Node.js","description":"Node.js is an open-source, cross-platform, JavaScript runtime environment that executes JavaScript code outside a web browser.","website":"https://nodejs.org","common_platform_enumeration":"cpe:2.3:a:nodejs:node.js:*:*:*:*:*:*:*:*","icon":"Node.js.svg","categories":["Programming languages"]},{"name":"Ubuntu","description":"Ubuntu is a free and open-source operating system on Linux for the enterprise server, desktop, cloud, and IoT.","website":"https://www.ubuntu.com/server","common_platform_enumeration":"cpe:2.3:o:canonical:ubuntu_linux:*:*:*:*:*:*:*:*","icon":"Ubuntu.svg","categories":["Operating systems"]},{"name":"Nginx:1.18.0","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"Express","description":"Express is a web application framework for Node.js, released as free and open-source software under the MIT License. It is designed for building web applications and APIs.","website":"https://expressjs.com","common_platform_enumeration":"cpe:2.3:a:expressjs:express:*:*:*:*:*:*:*:*","icon":"Express.svg","categories":["Web frameworks","Web servers"]}],"data":{"size":6445,"size_decoded":6756,"mime_type":"image/png","magic":"PNG image data, 200 x 92, 8-bit/color RGBA, non-interlaced","md5":"8d122b1f6b6936592bc2fbc62069ea9a","sha1":"eaef7181862b69b15f48bee0e43f53a516f9ae7f","sha256":"c5aa78ea24473f8b13015df2872082e10fae468a60ebebaed73e996b1974f974","sha512":"9b32fe4a6daba22a54d32a2fa78d2f7b90a9e8c37a7ce1c699f4a31bf1203c2dfb4e49d93c94f69ba8a5e9733dcb2878039ecc1c5cf9ffa999ff9ad6a5a31f22","ssdeep":"192:iS3knrRd7uQLrtYMqXBmHez1DevzO6eq0d:90nrRQQ36Eq6kd","tlshash":"c9d15d2ad490ad049cc8fd84b8e8352b7b1b1664e180c5e4bcdc4c476d291f6bd7eb67","first_seen":"2026-09-14T18:56:50.910893Z","last_seen":"2026-09-14T19:15:50.838117Z","times_seen":2,"resource_available":false,"data":null}},"time_used":184,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":184,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-09-14","alert":"Phishing Block","trigger":"ontwig.com","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-14","alert":"Sinkholed","trigger":"ontwig.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-09-14","alert":"Sinkholed","trigger":"ontwig.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}}]}