{"report_id":"f3673875-052f-474c-a92f-44633fadea8f","version":6,"status":"done","tags":["dhl","logistics","phishing"],"date":"2026-05-22T03:51:33Z","url":{"schema":"https","addr":"sourcefuel.co.zw/postInf3gmbh-delivery4879/amount.php","fqdn":"sourcefuel.co.zw","domain":"sourcefuel.co.zw","tld":"co.zw"},"ip":{"addr":"185.150.190.64","port":0,"asn":23470,"as":"RELIABLESITE","country":"United States","country_code":"US"},"final":{"url":{"schema":"https","addr":"sourcefuel.co.zw/postInf3gmbh-delivery4879/load.php","fqdn":"sourcefuel.co.zw","domain":"sourcefuel.co.zw","tld":"co.zw"},"title":"| DHL |","dom":{"size":0,"mime_type":"text/plain; charset=utf-8","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","dom_hash":"domhash1f07f384c75181c66badb60ab1ec770b","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-08-09T14:49:10.846265Z","times_seen":17800640,"resource_available":false,"data":null}},"submit":{"url":{"schema":"https","addr":"sourcefuel.co.zw/postInf3gmbh-delivery4879/amount.php","fqdn":"sourcefuel.co.zw","domain":"sourcefuel.co.zw","tld":"co.zw"},"ip":{"addr":"185.150.190.64","port":0,"asn":23470,"as":"RELIABLESITE","country":"United States","country_code":"US"},"tags":["openphish"],"meta":null},"settings":{"access":"public","device_type":"desktop","expires_at":"2027-06-26T03:51:33Z","useragent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0","referer":"","cookies":null,"exit_node":"z0yflva4pidy47h"},"stats":{"alert_count":{"ids":0,"urlquery":2,"analyzer":5}},"detection":{"ids":null,"analyzer":[{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-05-22","alert":"Phishing Block","trigger":"sourcefuel.co.zw","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-05-22","alert":"Sinkholed","trigger":"sourcefuel.co.zw","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-05-22","alert":"Sinkholed","trigger":"sourcefuel.co.zw","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-05-22","alert":"Sinkholed","trigger":"sourcefuel.co.zw","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-05-22","alert":"Sinkholed","trigger":"waust.at","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":[{"sensor_name":"urlquery","alert":"Phishing - DHL","verdict":"phishing","severity":"medium","comment":"Associated with DHL phishing","tags":["dhl","logistics","phishing"],"meta":null},{"sensor_name":"urlquery","alert":"Phishing - DHL","verdict":"phishing","severity":"medium","comment":"Associated with DHL phishing","tags":["dhl","logistics","phishing"],"meta":null}]},"summary":[{"fqdn":"p.mrktmtrcs.net","ip":{"addr":"104.26.15.100","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"domain_registered":"2025-04-04","domain_rank":63178,"first_seen":"2025-05-16T05:58:44.985071Z","last_seen":"2026-05-15T16:58:08.368846Z","alert_count":0,"request_count":1,"received_data":40597,"sent_data":410,"comment":"","tags":null,"fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}]},{"fqdn":"waust.at","ip":{"addr":"104.26.5.7","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"domain_registered":"unknown","domain_rank":36042,"first_seen":"2016-01-28T18:24:33Z","last_seen":"2026-05-15T20:14:54.844772Z","alert_count":1,"request_count":1,"received_data":8037,"sent_data":402,"comment":"","tags":null,"fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}]},{"fqdn":"t.dtscout.com","ip":{"addr":"104.26.10.2","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"domain_registered":"2013-11-01","domain_rank":54823,"first_seen":"2017-01-30T04:52:42Z","last_seen":"2026-05-15T16:58:09.112294Z","alert_count":0,"request_count":2,"received_data":3713,"sent_data":1024,"comment":"","tags":null,"fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}]},{"fqdn":"cdn.jsdelivr.net","ip":{"addr":"167.82.49.229","port":443,"asn":54113,"as":"FASTLY","country":"United States","country_code":"US"},"domain_registered":"2012-05-16","domain_rank":1678,"first_seen":"2012-09-30T00:15:09Z","last_seen":"2026-05-17T22:41:40.561616Z","alert_count":0,"request_count":1,"received_data":79534,"sent_data":457,"comment":"","tags":null,"fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}]},{"fqdn":"sourcefuel.co.zw","ip":{"addr":"185.150.190.64","port":443,"asn":23470,"as":"RELIABLESITE","country":"United States","country_code":"US"},"domain_registered":"unknown","domain_rank":0,"first_seen":"2026-04-02T23:16:20.385947Z","last_seen":"2026-05-20T08:50:37.303542Z","alert_count":230,"request_count":46,"received_data":3624028,"sent_data":27249,"comment":"","tags":null,"fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"PHP","description":"PHP is a general-purpose scripting language used for web development.","website":"https://php.net","common_platform_enumeration":"cpe:2.3:a:php:php:*:*:*:*:*:*:*:*","icon":"PHP.svg","categories":["Programming languages"]},{"name":"jQuery CDN","description":"jQuery CDN is a way to include jQuery in your website without actually downloading and keeping it your website's folder.","website":"https://code.jquery.com/","common_platform_enumeration":"","icon":"jQuery.svg","categories":["CDN"]},{"name":"jQuery:3.6.1","description":"jQuery is a JavaScript library which is a free, open-source software designed to simplify HTML DOM tree traversal and manipulation, as well as event handling, CSS animation, and Ajax.","website":"https://jquery.com","common_platform_enumeration":"cpe:2.3:a:jquery:jquery:*:*:*:*:*:*:*:*","icon":"jQuery.svg","categories":["JavaScript libraries"]},{"name":"cdnjs","description":"cdnjs is a free distributed JS library delivery service.","website":"https://cdnjs.com","common_platform_enumeration":"","icon":"cdnjs.svg","categories":["CDN"]},{"name":"Bootstrap:5.0.2","description":"Bootstrap is a free and open-source CSS framework directed at responsive, mobile-first front-end web development. It contains CSS and JavaScript-based design templates for typography, forms, buttons, navigation, and other interface components.","website":"https://getbootstrap.com","common_platform_enumeration":"cpe:2.3:a:getbootstrap:bootstrap:*:*:*:*:*:*:*:*","icon":"Bootstrap.svg","categories":["UI frameworks"]},{"name":"Font Awesome","description":"Font Awesome is a font and icon toolkit based on CSS and Less.","website":"https://fontawesome.com/","common_platform_enumeration":"","icon":"Font Awesome.svg","categories":["Font scripts"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"jsDelivr","description":"JSDelivr is a free public CDN for open-source projects. It can serve web files directly from the npm registry and GitHub repositories without any configuration.","website":"https://www.jsdelivr.com/","common_platform_enumeration":"","icon":"jsdelivr-icon.svg","categories":["CDN"]}]},{"fqdn":"code.jquery.com","ip":{"addr":"151.101.130.137","port":443,"asn":54113,"as":"FASTLY","country":"United States","country_code":"US"},"domain_registered":"2005-12-10","domain_rank":4915,"first_seen":"2012-05-21T17:28:02Z","last_seen":"2026-05-17T23:26:35.635145Z","alert_count":0,"request_count":1,"received_data":90254,"sent_data":424,"comment":"","tags":null,"fingerprints":[{"name":"Varnish","description":"Varnish is a reverse caching proxy.","website":"https://www.varnish-cache.org","common_platform_enumeration":"cpe:2.3:a:varnish-software:varnish_cache:*:*:*:*:*:*:*:*","icon":"Varnish.svg","categories":["Caching"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}]},{"fqdn":"flagsapi.com","ip":{"addr":"172.67.191.123","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"domain_registered":"2021-12-03","domain_rank":101354,"first_seen":"2021-12-03T19:30:00Z","last_seen":"2026-05-19T02:57:59.514653Z","alert_count":0,"request_count":1,"received_data":2736,"sent_data":438,"comment":"","tags":null,"fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}]},{"fqdn":"cdnjs.cloudflare.com","ip":{"addr":"104.17.25.14","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"domain_registered":"2009-02-17","domain_rank":1222,"first_seen":"2012-05-23T12:49:49Z","last_seen":"2026-05-17T22:36:28.748469Z","alert_count":0,"request_count":2,"received_data":1538706,"sent_data":910,"comment":"","tags":null,"fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}]}],"files":null,"artifacts":{"windows_shortcuts":null,"files":null,"telegram":null,"pdfs":null,"clipboard":null},"sensors":{"ids":null,"analyzer":null,"urlquery":[{"sensor_name":"urlquery","alert":"Phishing - DHL","verdict":"phishing","severity":"medium","comment":"Associated with DHL phishing","tags":["dhl","logistics","phishing"],"meta":null}]},"javascript":{"script":[{"url":{"schema":"https","addr":"t.dtscout.com/i/?l=https%3A%2F%2Fsourcefuel.co.zw%2FpostInf3gmbh-delivery4879%2Fload.php\u0026j=\u0026wk=italiauno1","fqdn":"t.dtscout.com","domain":"dtscout.com","tld":"com"},"ip":{"addr":"104.26.10.2","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"scriptElement","is_inline":false,"md5":"8450c234da2df92a0c33a47c5aabf6e6","sha1":"0ea50308805f927f1e9ce37a96d44f27e01cdf8e","sha256":"c67ad82f6fe5a742115d0d041e403c18df8da6486fa0dd5fc785d4bb58458ac9","sha512":"1ea70b0b047651af5f5496bdbfac4574dad62bef73132ad667c194c375382c36ea62c24f37a4c2882d6e644846f5b866720a8b33cad3e4e650fa6b9fa0331de8","ssdeep":"","tlshash":"1f41880bb5e5347803e2006965ff635fb5330928bc5784c08596dc04fd749fad1b6eaa","size":2292,"data":"","first_seen":"2025-11-28T22:59:20.195769Z","last_seen":"2026-08-05T10:25:07.128353Z","times_seen":3577,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"t.dtscout.com/pv/?_a=v\u0026_h=sourcefuel.co.zw\u0026_ss=3u176j6x43\u0026_pv=1\u0026_ls=0\u0026_u1=1\u0026_u3=1\u0026_cc=no\u0026_pl=d\u0026_cbid=it9q\u0026_cb=_dtspv.c","fqdn":"t.dtscout.com","domain":"dtscout.com","tld":"com"},"ip":{"addr":"104.26.10.2","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"scriptElement","is_inline":false,"md5":"b160a4c50083bbc13fd75df564dba428","sha1":"a70f0f7a6d2094fc32c541b3f9b5279197715d3c","sha256":"75c6120275574017abb457de6e109c8bb542a6c4e96a2d8ad7ec71b9e0ea6767","sha512":"7a3420967c7369cb1590420bc5917fef544696227dc095effe7a636dbfb23d587efd5dbc1ce60d8917d37f7b05c2eb49a1237dcfecc68244aae094691611b8e0","ssdeep":"","tlshash":"7390021864d180211ac9d744205a5644417207d095c0529584355534214d7c1965b9f8","size":52,"data":"","first_seen":"2026-05-22T03:51:39.148682Z","last_seen":"2026-05-22T03:51:39.148682Z","times_seen":1,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"cdnjs.cloudflare.com/ajax/libs/jquery.mask/1.14.16/jquery.mask.min.js","fqdn":"cdnjs.cloudflare.com","domain":"cloudflare.com","tld":"com"},"ip":{"addr":"104.17.25.14","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"scriptElement","is_inline":false,"md5":"cc290e6c3aeecf5021dd82ad8df2512a","sha1":"fb983aecd3940e8ebbfe5e74c8099cee9223c957","sha256":"2a0db34dc14ef4b5ce73b230701c7561e5012667a4c9cb274ecab646e1474995","sha512":"a47546a57ec5ff6ef267421263e5558f250b0296c3943d3f5f4ae019b4ea084ed6156e4c7b3353586fdd9e1b5b06e202cec7745903e0a44e111012eff94a8287","ssdeep":"192:cd227YJcI/iarixR4aCSfZrkiqVNReFevZA8A/A:cdaJ39e74boZrkVVjeFexA8AY","tlshash":"b502e8d5329670b253b371e901bf020bebb7afa156de4814d61a94e0ae74f890053f7e","size":8327,"data":"","first_seen":"2023-03-07T01:06:41Z","last_seen":"2026-08-09T14:42:31.227948Z","times_seen":12918,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"sourcefuel.co.zw/postInf3gmbh-delivery4879/load.php","fqdn":"sourcefuel.co.zw","domain":"sourcefuel.co.zw","tld":"co.zw"},"ip":{"addr":"185.150.190.64","port":443,"asn":23470,"as":"RELIABLESITE","country":"United States","country_code":"US"},"introduction_type":"scriptElement","is_inline":true,"md5":"93271ffeb9e616787c342186c2d7f72e","sha1":"a1839f065698eb6174a7d22834bac05da35812d1","sha256":"a1204b90129650e9164b9e9f3ae1c45ca4b4e7bd287df515e20cc012db4a2c1a","sha512":"1ea544120337901d911347b52d463db4dbdc4e622f5d28eb48baadb7a14772b58134a4bc9a7b06f48d6222208db94864f5e1759cd09bd83fbbd0ff4259595c18","ssdeep":"","tlshash":"43017d40bcf271e07a22307c8b5bb554a523810b260dcd25fb4d53808f6213d81675cb","size":766,"data":"","first_seen":"2024-01-05T04:51:49Z","last_seen":"2026-05-22T03:51:39.155611Z","times_seen":28,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"sourcefuel.co.zw/postInf3gmbh-delivery4879/load.php","fqdn":"sourcefuel.co.zw","domain":"sourcefuel.co.zw","tld":"co.zw"},"ip":{"addr":"185.150.190.64","port":443,"asn":23470,"as":"RELIABLESITE","country":"United States","country_code":"US"},"introduction_type":"scriptElement","is_inline":true,"md5":"ed2d2e6f5470706ecf8fda0eaac4f37c","sha1":"1777e3ce23b22aa8835f869e4d17790bf5895199","sha256":"bc8f37ca924d4fe87a6121f32712d36c7f576ded9c0def8cc26c0365df451988","sha512":"73df10740fbf3de359dbd2e8d48b755b1758378a85524c1bb036788bbe79e872df234ef85e2ae24ab429de8c1fd67c8bd5be28285f5b830c2f409d8e5dd42dd9","ssdeep":"","tlshash":"0111ef0a59ba2332beb33269870f90457132a42731a8eb11b90e83500f8033c96a37d9","size":1028,"data":"","first_seen":"2024-01-05T04:51:49Z","last_seen":"2026-05-22T03:51:39.156151Z","times_seen":27,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"cdn.jsdelivr.net/npm/bootstrap@5.0.2/dist/js/bootstrap.bundle.min.js","fqdn":"cdn.jsdelivr.net","domain":"jsdelivr.net","tld":"net"},"ip":{"addr":"167.82.49.229","port":443,"asn":54113,"as":"FASTLY","country":"United States","country_code":"US"},"introduction_type":"scriptElement","is_inline":false,"md5":"0aa8d64e726c4a57adb5c88f9115996b","sha1":"901169527507ff9e662cf64d8e361f359308970d","sha256":"7e1f1503df765cca5e099891b94e318a2ef95081ba2af1eb6d417cc884bfdbfe","sha512":"ef6583f7684bb3b4f91405e7def90d65f9561baa609540c3a66f3b4de4267d283c2a7af298bd86df447b6ace05993c2182ef47ede4b30c25f79a38ad49e70a9f","ssdeep":"1536:tp+1ZTPR2t4tXbih05ve8/pwgrEpc9t0vSAIAxCs:MFRIpk0vSAV","tlshash":"a573d6493254b87309ee55a68037460bf3255994b14b802cb9bdadde2b3dc8272b7f78","size":78743,"data":"","first_seen":"2023-03-07T01:03:37Z","last_seen":"2026-08-09T14:32:50.316315Z","times_seen":24382,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"waust.at/s.js","fqdn":"waust.at","domain":"waust.at","tld":"at"},"ip":{"addr":"104.26.5.7","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"scriptElement","is_inline":false,"md5":"7e1800d35725cb510d6ca600677a9669","sha1":"e4ba00dd620d7a4531a6a954c51b5d801f78520c","sha256":"d03635e64afffd465cd2c59e0bc850fecde2aa979e55240e4737094633f50391","sha512":"b5c00c9106750dec2b23e6207f49efeb62825c39b148f849015ae30453f1c76cc1c649083062b1d9e32214cad4a8f6249373ab17f92d662326350f004adb6c1d","ssdeep":"96:tLN7NgmG8j2svNuYMTX080ORDvckw9AVDx+llB9RmSK29tCq0jjaNrTBq92n/rQl:l94B70AjPVDx+9Rml29NBm2/MVpd","tlshash":"26e1c7b5325314b65ff650a5606f7345b831517b6f479001809e84b836acf0b91eaff7","size":7286,"data":"","first_seen":"2025-11-28T23:48:30.367069Z","last_seen":"2026-07-21T16:27:51.048442Z","times_seen":1688,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"cdnjs.cloudflare.com/ajax/libs/font-awesome/6.2.0/js/all.min.js","fqdn":"cdnjs.cloudflare.com","domain":"cloudflare.com","tld":"com"},"ip":{"addr":"104.17.25.14","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"scriptElement","is_inline":false,"md5":"d5beb8fa265f90be5ccadd6b32b8672f","sha1":"7bdc23c06b51e7e42c05de486680a3c18aa5ce5a","sha256":"6a769e18b06859751eaa2259044a6ff76e3ddcd6572a516d8ce3a2d7b8c7538e","sha512":"9daba447b23e364ea0a7ba794cc038c9c81fc5a64127b30ee620b7169eb2490c8a1473867e9912664615595e51eeeedc7c089cc5a9f0610e43d5ed7b11f25c30","ssdeep":"6144:JTrRrD1LXomaR3Ls8FBHHcKqgyjjGpGxcrK69aRYRMtsDo6ug+1MdZvdj/drgVFT:JCsqHSgyfB69ARYXDooYMdjdW/7jr","tlshash":"8065842cd365a3bc9da6c7f5ca2130b46d8f51ee71e09328a278c5b072621dcd5d9cca","size":1528342,"data":"","first_seen":"2023-03-09T05:04:22Z","last_seen":"2026-08-07T15:03:58.672793Z","times_seen":5804,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"sourcefuel.co.zw/postInf3gmbh-delivery4879/load.php","fqdn":"sourcefuel.co.zw","domain":"sourcefuel.co.zw","tld":"co.zw"},"ip":{"addr":"185.150.190.64","port":443,"asn":23470,"as":"RELIABLESITE","country":"United States","country_code":"US"},"introduction_type":"scriptElement","is_inline":true,"md5":"d074dc5f5dfbea1abb04b73c9158c7c9","sha1":"f05178bd3b7282dbfec425d9905c354a17de7958","sha256":"ef265617d1fb89157e3ed841b7f3d1c3fe2c2de945e9b54e0320b8ca8baf536e","sha512":"96fcc1513e0e6d69031223cecb09995e49e2a2f98cec78e9398d66f029acf14e0935e9a897410a39b185e3e5d6292a0eeabb4bb331c4b37bad61e6259ed1e361","ssdeep":"","tlshash":"65a0022816a5c07b4058a60474a90ad4a7b1795950f012513784af20429e56d24c5699","size":65,"data":"","first_seen":"2025-09-04T16:05:57.957862Z","last_seen":"2026-05-22T03:51:39.157511Z","times_seen":18,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"p.mrktmtrcs.net/mm.js","fqdn":"p.mrktmtrcs.net","domain":"mrktmtrcs.net","tld":"net"},"ip":{"addr":"104.26.15.100","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"scriptElement","is_inline":false,"md5":"67cda29c6b95cb5eb8c4960490502a19","sha1":"ac6700bfe19f0580cccf51bddf2a7310d31a833c","sha256":"6ed6986bfeafe3a3bab8174b435e96c3ca8e216c3c7941b20c3e4984087f9e0b","sha512":"c5d6bdfb04022d8f3ff82c95c1c938a3aec4246a9fefc40a2e96b12e42295fe8d578c983b399ca86493f3481b113f685d27e20e2cd19000efab176a6b7ab578f","ssdeep":"768:Iudg8MPdH/EeIO5V1gPk5Te1pCeKSreGdRY8ZqM0wTo:IHEelgvZnAVQo","tlshash":"9403192ee3a2761003abf19dd90b50003e35541bea41f8a4bdecb581ff958a512bf7b5","size":39952,"data":"","first_seen":"2025-07-17T20:43:49.34962Z","last_seen":"2026-08-05T10:25:07.103185Z","times_seen":3658,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"code.jquery.com/jquery-3.6.1.min.js","fqdn":"code.jquery.com","domain":"jquery.com","tld":"com"},"ip":{"addr":"151.101.130.137","port":443,"asn":54113,"as":"FASTLY","country":"United States","country_code":"US"},"introduction_type":"scriptElement","is_inline":false,"md5":"00727d1d5d9c90f7de826f1a4a9cc632","sha1":"ea61688671d0c3044f2c5b2f2c4af0a6620ac6c2","sha256":"a3cf00c109d907e543bc4f6dbc85eb31068f94515251347e9e57509b52ee3d74","sha512":"69528a4518bf43f615fb89a3a0a06c138c771fe0647a0a0cfde9b8e8d3650aa3539946000e305b78d79f371615ee0894a74571202b6a76b6ea53b89569e64d5c","ssdeep":"1536:SjjxXUHJnxDjoXEZxkMV4PYDt0zxxf6gP3f8cApoEGOzZTBvUsuy8WnKdXwhLQvg:SdeIygP3fulzcsz8jlvaDioQ47GKH","tlshash":"5393f8ddb2c6702247a770ba007f510bf236199d684d8450f269d8e9bc78a4e827bf7d","size":89664,"data":"","first_seen":"2023-03-07T01:28:27Z","last_seen":"2026-08-09T14:18:30.636609Z","times_seen":34193,"alerts":{"ids":null,"analyzer":null,"urlquery":null}}],"eval":null,"write":null,"console":null},"http":[{"url":{"schema":"https","addr":"sourcefuel.co.zw/postInf3gmbh-delivery4879/control/check_redirect.php?t=1779421879632","fqdn":"sourcefuel.co.zw","domain":"sourcefuel.co.zw","tld":"co.zw"},"ip":{"addr":"185.150.190.64","port":443,"asn":23470,"as":"RELIABLESITE","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"https://sourcefuel.co.zw/postInf3gmbh-delivery4879/load.php","date":"2026-05-22T03:51:19.635Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"sourcefuel.co.zw","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Sun, 22 Mar 2026 14:39:08 GMT","end":"Sat, 20 Jun 2026 14:39:07 GMT"},"fingerprint":{"sha1":"C0:74:92:37:D4:2A:03:BD:B8:21:45:7E:67:B0:BE:43:7D:A6:C9:B6","sha256":"96:9F:8C:03:B5:AA:16:88:A9:50:11:B8:81:3C:CA:C5:F2:9C:CD:A8:70:98:F5:7B:C1:CF:4A:68:97:2F:2C:04"}}},"request":{"raw":"GET /postInf3gmbh-delivery4879/control/check_redirect.php?t=1779421879632 HTTP/1.1\r\nHost: sourcefuel.co.zw\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://sourcefuel.co.zw/postInf3gmbh-delivery4879/load.php\r\nCookie: PHPSESSID=fe392b446f25471dbe4f2f80e6b968b4\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Fri, 22 May 2026 03:51:19 GMT\r\ncontent-type: text/html; charset=UTF-8\r\nvary: Accept-Encoding\r\ncontent-encoding: br\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":11,"size_decoded":0,"mime_type":"text/html; charset=UTF-8","magic":"ASCII text, with no line terminators","md5":"7c94333c07c9c06aee0bc239e4438255","sha1":"d3871bf7893d00a9ba1498cac8411b9334db7a72","sha256":"b21ff5b3f8ebc7f7e216a5edeb092283854a070391ae54a93a95c4e3650905cd","sha512":"4a1e794971f6e56c7aceca52375681bc5c4499898974ff157be7698f592eee14ce87bee7f09b5700a3b19b7462f547ce273e5c7cc8b75011a304c929e42b8ca5","ssdeep":"","tlshash":"6b50000c00330000c03300030000f0003c000c0030300c0000000cc00300000c000000","first_seen":"2024-01-05T04:51:49Z","last_seen":"2026-08-02T21:11:02.414751Z","times_seen":381,"resource_available":false,"data":null}},"time_used":170,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":170,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-05-22","alert":"Phishing Block","trigger":"sourcefuel.co.zw","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-05-22","alert":"Sinkholed","trigger":"sourcefuel.co.zw","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-05-22","alert":"Sinkholed","trigger":"sourcefuel.co.zw","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-05-22","alert":"Sinkholed","trigger":"sourcefuel.co.zw","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null}],"urlquery":[{"sensor_name":"urlquery","alert":"Phishing - DHL","verdict":"phishing","severity":"medium","comment":"Associated with DHL phishing","tags":["dhl","logistics","phishing"],"meta":null}]}},{"url":{"schema":"https","addr":"sourcefuel.co.zw/postInf3gmbh-delivery4879/control/check_redirect.php?t=1779421881632","fqdn":"sourcefuel.co.zw","domain":"sourcefuel.co.zw","tld":"co.zw"},"ip":{"addr":"185.150.190.64","port":443,"asn":23470,"as":"RELIABLESITE","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"https://sourcefuel.co.zw/postInf3gmbh-delivery4879/load.php","date":"2026-05-22T03:51:21.635Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"sourcefuel.co.zw","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Sun, 22 Mar 2026 14:39:08 GMT","end":"Sat, 20 Jun 2026 14:39:07 GMT"},"fingerprint":{"sha1":"C0:74:92:37:D4:2A:03:BD:B8:21:45:7E:67:B0:BE:43:7D:A6:C9:B6","sha256":"96:9F:8C:03:B5:AA:16:88:A9:50:11:B8:81:3C:CA:C5:F2:9C:CD:A8:70:98:F5:7B:C1:CF:4A:68:97:2F:2C:04"}}},"request":{"raw":"GET /postInf3gmbh-delivery4879/control/check_redirect.php?t=1779421881632 HTTP/1.1\r\nHost: sourcefuel.co.zw\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://sourcefuel.co.zw/postInf3gmbh-delivery4879/load.php\r\nCookie: PHPSESSID=fe392b446f25471dbe4f2f80e6b968b4\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Fri, 22 May 2026 03:51:21 GMT\r\ncontent-type: text/html; charset=UTF-8\r\nvary: Accept-Encoding\r\ncontent-encoding: br\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":11,"size_decoded":0,"mime_type":"text/html; charset=UTF-8","magic":"ASCII text, with no line terminators","md5":"7c94333c07c9c06aee0bc239e4438255","sha1":"d3871bf7893d00a9ba1498cac8411b9334db7a72","sha256":"b21ff5b3f8ebc7f7e216a5edeb092283854a070391ae54a93a95c4e3650905cd","sha512":"4a1e794971f6e56c7aceca52375681bc5c4499898974ff157be7698f592eee14ce87bee7f09b5700a3b19b7462f547ce273e5c7cc8b75011a304c929e42b8ca5","ssdeep":"","tlshash":"6b50000c00330000c03300030000f0003c000c0030300c0000000cc00300000c000000","first_seen":"2024-01-05T04:51:49Z","last_seen":"2026-08-02T21:11:02.414751Z","times_seen":381,"resource_available":false,"data":null}},"time_used":328,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":328,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-05-22","alert":"Phishing Block","trigger":"sourcefuel.co.zw","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-05-22","alert":"Sinkholed","trigger":"sourcefuel.co.zw","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-05-22","alert":"Sinkholed","trigger":"sourcefuel.co.zw","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-05-22","alert":"Sinkholed","trigger":"sourcefuel.co.zw","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":[{"sensor_name":"urlquery","alert":"Phishing - DHL","verdict":"phishing","severity":"medium","comment":"Associated with DHL phishing","tags":["dhl","logistics","phishing"],"meta":null}]}},{"url":{"schema":"https","addr":"sourcefuel.co.zw/postInf3gmbh-delivery4879/logs/imhere.php?location=%2FpostInf3gmbh-delivery4879%2Fload.php\u0026t=1779421882633","fqdn":"sourcefuel.co.zw","domain":"sourcefuel.co.zw","tld":"co.zw"},"ip":{"addr":"185.150.190.64","port":443,"asn":23470,"as":"RELIABLESITE","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"fetch","requested_by":"https://sourcefuel.co.zw/postInf3gmbh-delivery4879/load.php","date":"2026-05-22T03:51:22.636Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"sourcefuel.co.zw","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Sun, 22 Mar 2026 14:39:08 GMT","end":"Sat, 20 Jun 2026 14:39:07 GMT"},"fingerprint":{"sha1":"C0:74:92:37:D4:2A:03:BD:B8:21:45:7E:67:B0:BE:43:7D:A6:C9:B6","sha256":"96:9F:8C:03:B5:AA:16:88:A9:50:11:B8:81:3C:CA:C5:F2:9C:CD:A8:70:98:F5:7B:C1:CF:4A:68:97:2F:2C:04"}}},"request":{"raw":"GET /postInf3gmbh-delivery4879/logs/imhere.php?location=%2FpostInf3gmbh-delivery4879%2Fload.php\u0026t=1779421882633 HTTP/1.1\r\nHost: sourcefuel.co.zw\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://sourcefuel.co.zw/postInf3gmbh-delivery4879/load.php\r\nDNT: 1\r\nConnection: keep-alive\r\nCookie: PHPSESSID=fe392b446f25471dbe4f2f80e6b968b4\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Fri, 22 May 2026 03:51:22 GMT\r\ncontent-type: text/html; charset=UTF-8\r\nvary: Accept-Encoding\r\ncontent-encoding: br\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":24,"size_decoded":0,"mime_type":"text/html; charset=UTF-8","magic":"ASCII text, with no line terminators","md5":"f6530f8413fde8efecc930d6ef59f49e","sha1":"f208906bea70d0a717fd9c52f7a4c655bf7e1e5c","sha256":"b3d21470af59b4bbc88dad6d7a8b29c4b9e68b92ba797d502d69fc2f8adb4ae1","sha512":"1e8adc9424604a19aa3dafb80126aed94ec40982cfac18945c9d19f94b29ffc58cfaf0447cef6b656d729755b1c09789bde1a57caac94d35f45a2b79498aae5f","ssdeep":"","tlshash":"f87000a3208038082280a00028800aa82228f008208000808cbc280a30e22a808a3028","first_seen":"2024-01-05T04:51:49Z","last_seen":"2026-08-02T21:11:02.411686Z","times_seen":368,"resource_available":false,"data":null}},"time_used":153,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":153,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-05-22","alert":"Sinkholed","trigger":"sourcefuel.co.zw","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-05-22","alert":"Sinkholed","trigger":"sourcefuel.co.zw","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-05-22","alert":"Sinkholed","trigger":"sourcefuel.co.zw","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-05-22","alert":"Phishing Block","trigger":"sourcefuel.co.zw","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null}],"urlquery":[{"sensor_name":"urlquery","alert":"Phishing - DHL","verdict":"phishing","severity":"medium","comment":"Associated with DHL phishing","tags":["dhl","logistics","phishing"],"meta":null}]}},{"url":{"schema":"https","addr":"sourcefuel.co.zw/postInf3gmbh-delivery4879/control/check_redirect.php?t=1779421885633","fqdn":"sourcefuel.co.zw","domain":"sourcefuel.co.zw","tld":"co.zw"},"ip":{"addr":"185.150.190.64","port":443,"asn":23470,"as":"RELIABLESITE","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"https://sourcefuel.co.zw/postInf3gmbh-delivery4879/load.php","date":"2026-05-22T03:51:25.636Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"sourcefuel.co.zw","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Sun, 22 Mar 2026 14:39:08 GMT","end":"Sat, 20 Jun 2026 14:39:07 GMT"},"fingerprint":{"sha1":"C0:74:92:37:D4:2A:03:BD:B8:21:45:7E:67:B0:BE:43:7D:A6:C9:B6","sha256":"96:9F:8C:03:B5:AA:16:88:A9:50:11:B8:81:3C:CA:C5:F2:9C:CD:A8:70:98:F5:7B:C1:CF:4A:68:97:2F:2C:04"}}},"request":{"raw":"GET /postInf3gmbh-delivery4879/control/check_redirect.php?t=1779421885633 HTTP/1.1\r\nHost: sourcefuel.co.zw\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://sourcefuel.co.zw/postInf3gmbh-delivery4879/load.php\r\nCookie: PHPSESSID=fe392b446f25471dbe4f2f80e6b968b4\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Fri, 22 May 2026 03:51:25 GMT\r\ncontent-type: text/html; charset=UTF-8\r\nvary: Accept-Encoding\r\ncontent-encoding: br\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":11,"size_decoded":0,"mime_type":"text/html; charset=UTF-8","magic":"ASCII text, with no line terminators","md5":"7c94333c07c9c06aee0bc239e4438255","sha1":"d3871bf7893d00a9ba1498cac8411b9334db7a72","sha256":"b21ff5b3f8ebc7f7e216a5edeb092283854a070391ae54a93a95c4e3650905cd","sha512":"4a1e794971f6e56c7aceca52375681bc5c4499898974ff157be7698f592eee14ce87bee7f09b5700a3b19b7462f547ce273e5c7cc8b75011a304c929e42b8ca5","ssdeep":"","tlshash":"6b50000c00330000c03300030000f0003c000c0030300c0000000cc00300000c000000","first_seen":"2024-01-05T04:51:49Z","last_seen":"2026-08-02T21:11:02.414751Z","times_seen":381,"resource_available":false,"data":null}},"time_used":162,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":162,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-05-22","alert":"Sinkholed","trigger":"sourcefuel.co.zw","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-05-22","alert":"Sinkholed","trigger":"sourcefuel.co.zw","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-05-22","alert":"Sinkholed","trigger":"sourcefuel.co.zw","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-05-22","alert":"Phishing Block","trigger":"sourcefuel.co.zw","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null}],"urlquery":[{"sensor_name":"urlquery","alert":"Phishing - DHL","verdict":"phishing","severity":"medium","comment":"Associated with DHL phishing","tags":["dhl","logistics","phishing"],"meta":null}]}},{"url":{"schema":"https","addr":"sourcefuel.co.zw/postInf3gmbh-delivery4879/logs/imhere.php?location=%2FpostInf3gmbh-delivery4879%2Fload.php\u0026t=1779421887034","fqdn":"sourcefuel.co.zw","domain":"sourcefuel.co.zw","tld":"co.zw"},"ip":{"addr":"185.150.190.64","port":443,"asn":23470,"as":"RELIABLESITE","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"fetch","requested_by":"https://sourcefuel.co.zw/postInf3gmbh-delivery4879/load.php","date":"2026-05-22T03:51:27.037Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"sourcefuel.co.zw","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Sun, 22 Mar 2026 14:39:08 GMT","end":"Sat, 20 Jun 2026 14:39:07 GMT"},"fingerprint":{"sha1":"C0:74:92:37:D4:2A:03:BD:B8:21:45:7E:67:B0:BE:43:7D:A6:C9:B6","sha256":"96:9F:8C:03:B5:AA:16:88:A9:50:11:B8:81:3C:CA:C5:F2:9C:CD:A8:70:98:F5:7B:C1:CF:4A:68:97:2F:2C:04"}}},"request":{"raw":"GET /postInf3gmbh-delivery4879/logs/imhere.php?location=%2FpostInf3gmbh-delivery4879%2Fload.php\u0026t=1779421887034 HTTP/1.1\r\nHost: sourcefuel.co.zw\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://sourcefuel.co.zw/postInf3gmbh-delivery4879/load.php\r\nDNT: 1\r\nConnection: keep-alive\r\nCookie: PHPSESSID=fe392b446f25471dbe4f2f80e6b968b4\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Fri, 22 May 2026 03:51:27 GMT\r\ncontent-type: text/html; charset=UTF-8\r\nvary: Accept-Encoding\r\ncontent-encoding: br\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":24,"size_decoded":0,"mime_type":"text/html; charset=UTF-8","magic":"ASCII text, with no line terminators","md5":"f6530f8413fde8efecc930d6ef59f49e","sha1":"f208906bea70d0a717fd9c52f7a4c655bf7e1e5c","sha256":"b3d21470af59b4bbc88dad6d7a8b29c4b9e68b92ba797d502d69fc2f8adb4ae1","sha512":"1e8adc9424604a19aa3dafb80126aed94ec40982cfac18945c9d19f94b29ffc58cfaf0447cef6b656d729755b1c09789bde1a57caac94d35f45a2b79498aae5f","ssdeep":"","tlshash":"f87000a3208038082280a00028800aa82228f008208000808cbc280a30e22a808a3028","first_seen":"2024-01-05T04:51:49Z","last_seen":"2026-08-02T21:11:02.411686Z","times_seen":368,"resource_available":false,"data":null}},"time_used":815,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":815,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-05-22","alert":"Sinkholed","trigger":"sourcefuel.co.zw","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-05-22","alert":"Sinkholed","trigger":"sourcefuel.co.zw","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-05-22","alert":"Phishing Block","trigger":"sourcefuel.co.zw","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-05-22","alert":"Sinkholed","trigger":"sourcefuel.co.zw","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":[{"sensor_name":"urlquery","alert":"Phishing - DHL","verdict":"phishing","severity":"medium","comment":"Associated with DHL phishing","tags":["dhl","logistics","phishing"],"meta":null}]}},{"url":{"schema":"https","addr":"sourcefuel.co.zw/postInf3gmbh-delivery4879/amount.php","fqdn":"sourcefuel.co.zw","domain":"sourcefuel.co.zw","tld":"co.zw"},"ip":{"addr":"185.150.190.64","port":443,"asn":23470,"as":"RELIABLESITE","country":"United States","country_code":"US"},"is_navigation_request":true,"resource_type":"document","requested_by":"","date":"2026-05-22T03:51:07.969Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"sourcefuel.co.zw","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Sun, 22 Mar 2026 14:39:08 GMT","end":"Sat, 20 Jun 2026 14:39:07 GMT"},"fingerprint":{"sha1":"C0:74:92:37:D4:2A:03:BD:B8:21:45:7E:67:B0:BE:43:7D:A6:C9:B6","sha256":"96:9F:8C:03:B5:AA:16:88:A9:50:11:B8:81:3C:CA:C5:F2:9C:CD:A8:70:98:F5:7B:C1:CF:4A:68:97:2F:2C:04"}}},"request":{"raw":"GET /postInf3gmbh-delivery4879/amount.php HTTP/1.1\r\nHost: sourcefuel.co.zw\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nUpgrade-Insecure-Requests: 1\r\nSec-Fetch-Dest: document\r\nSec-Fetch-Mode: navigate\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 302 Found\r\nserver: nginx\r\ndate: Fri, 22 May 2026 03:51:08 GMT\r\ncontent-type: text/html; charset=UTF-8\r\ncontent-length: 0\r\nlocation: load.php\r\nexpires: Thu, 19 Nov 1981 08:52:00 GMT\r\ncache-control: no-store, no-cache, must-revalidate\r\npragma: no-cache\r\nset-cookie: PHPSESSID=fe392b446f25471dbe4f2f80e6b968b4; path=/\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"302","status_text":"Found","fingerprints":[{"name":"PHP","description":"PHP is a general-purpose scripting language used for web development.","website":"https://php.net","common_platform_enumeration":"cpe:2.3:a:php:php:*:*:*:*:*:*:*:*","icon":"PHP.svg","categories":["Programming languages"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":433936,"size_decoded":0,"mime_type":"text/html; charset=UTF-8","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-08-09T14:49:10.846265Z","times_seen":17800640,"resource_available":true,"data":null}},"time_used":849,"timings":{"blocked":245,"dns":1,"connect":120,"send":0,"wait":357,"receive":0,"ssl":123},"alerts":{"ids":null,"analyzer":[{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-05-22","alert":"Phishing Block","trigger":"sourcefuel.co.zw","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-05-22","alert":"Sinkholed","trigger":"sourcefuel.co.zw","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-05-22","alert":"Sinkholed","trigger":"sourcefuel.co.zw","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-05-22","alert":"Sinkholed","trigger":"sourcefuel.co.zw","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":[{"sensor_name":"urlquery","alert":"Phishing - DHL","verdict":"phishing","severity":"medium","comment":"Associated with DHL phishing","tags":["dhl","logistics","phishing"],"meta":null}]}},{"url":{"schema":"https","addr":"code.jquery.com/jquery-3.6.1.min.js","fqdn":"code.jquery.com","domain":"jquery.com","tld":"com"},"ip":{"addr":"151.101.130.137","port":443,"asn":54113,"as":"FASTLY","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://sourcefuel.co.zw/postInf3gmbh-delivery4879/load.php","date":"2026-05-22T03:51:09.890Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.jquery.com","organization":""},"issuer":{"commonName":"Sectigo Public Server Authentication CA DV E36","organization":"Sectigo Limited"},"validity":{"start":"Thu, 12 Jun 2025 00:00:00 GMT","end":"Fri, 26 Jun 2026 23:59:59 GMT"},"fingerprint":{"sha1":"56:36:FB:D3:E0:9E:71:88:98:A4:C9:34:94:9B:43:3A:C4:C5:1E:BE","sha256":"9A:64:20:6F:F5:DC:F1:8A:D6:B2:D0:93:C2:7E:62:86:0B:1A:D5:24:CF:CE:4A:9F:4C:0D:F1:FB:F2:A0:A8:1E"}}},"request":{"raw":"GET /jquery-3.6.1.min.js HTTP/1.1\r\nHost: code.jquery.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://sourcefuel.co.zw/\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ncontent-type: application/javascript; charset=utf-8\r\nlast-modified: Fri, 18 Oct 1991 12:00:00 GMT\r\netag: W/\"28feccc0-15e40\"\r\ncache-control: public, max-age=31536000, stale-while-revalidate=604800\r\naccess-control-allow-origin: *\r\ncontent-encoding: gzip\r\nvia: 1.1 varnish, 1.1 varnish\r\naccept-ranges: bytes\r\ndate: Fri, 22 May 2026 03:51:10 GMT\r\nage: 2664738\r\nx-served-by: cache-lga13629-LGA, cache-hel1410023-HEL\r\nx-cache: HIT, HIT\r\nx-cache-hits: 20, 7068\r\nx-timer: S1779421870.032762,VS0,VE0\r\nvary: Accept-Encoding\r\ncontent-length: 30957\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Varnish","description":"Varnish is a reverse caching proxy.","website":"https://www.varnish-cache.org","common_platform_enumeration":"cpe:2.3:a:varnish-software:varnish_cache:*:*:*:*:*:*:*:*","icon":"Varnish.svg","categories":["Caching"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":89664,"size_decoded":0,"mime_type":"application/javascript; charset=utf-8","magic":"JavaScript source, ASCII text, with very long lines (65447)","md5":"00727d1d5d9c90f7de826f1a4a9cc632","sha1":"ea61688671d0c3044f2c5b2f2c4af0a6620ac6c2","sha256":"a3cf00c109d907e543bc4f6dbc85eb31068f94515251347e9e57509b52ee3d74","sha512":"69528a4518bf43f615fb89a3a0a06c138c771fe0647a0a0cfde9b8e8d3650aa3539946000e305b78d79f371615ee0894a74571202b6a76b6ea53b89569e64d5c","ssdeep":"1536:SjjxXUHJnxDjoXEZxkMV4PYDt0zxxf6gP3f8cApoEGOzZTBvUsuy8WnKdXwhLQvg:SdeIygP3fulzcsz8jlvaDioQ47GKH","tlshash":"5393f8ddb2c6702247a770ba007f510bf236199d684d8450f269d8e9bc78a4e827bf7d","first_seen":"2023-03-07T01:28:27Z","last_seen":"2026-08-09T14:18:30.636609Z","times_seen":34193,"resource_available":true,"data":null}},"time_used":285,"timings":{"blocked":114,"dns":1,"connect":42,"send":0,"wait":40,"receive":12,"ssl":73},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"sourcefuel.co.zw/postInf3gmbh-delivery4879/files/assets/fonts/FedExSans_W-Regular.woff","fqdn":"sourcefuel.co.zw","domain":"sourcefuel.co.zw","tld":"co.zw"},"ip":{"addr":"185.150.190.64","port":443,"asn":23470,"as":"RELIABLESITE","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"font","requested_by":"https://sourcefuel.co.zw/postInf3gmbh-delivery4879/load.php","date":"2026-05-22T03:51:11.867Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"sourcefuel.co.zw","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Sun, 22 Mar 2026 14:39:08 GMT","end":"Sat, 20 Jun 2026 14:39:07 GMT"},"fingerprint":{"sha1":"C0:74:92:37:D4:2A:03:BD:B8:21:45:7E:67:B0:BE:43:7D:A6:C9:B6","sha256":"96:9F:8C:03:B5:AA:16:88:A9:50:11:B8:81:3C:CA:C5:F2:9C:CD:A8:70:98:F5:7B:C1:CF:4A:68:97:2F:2C:04"}}},"request":{"raw":"GET /postInf3gmbh-delivery4879/files/assets/fonts/FedExSans_W-Regular.woff HTTP/1.1\r\nHost: sourcefuel.co.zw\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: identity\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://sourcefuel.co.zw/postInf3gmbh-delivery4879/files/common-core_SHF.css\r\nCookie: PHPSESSID=fe392b446f25471dbe4f2f80e6b968b4\r\nSec-Fetch-Dest: font\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Fri, 22 May 2026 03:51:11 GMT\r\ncontent-type: text/html; charset=UTF-8\r\ncontent-length: 0\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":0,"size_decoded":0,"mime_type":"text/html; charset=UTF-8","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-08-09T14:49:10.846265Z","times_seen":17800640,"resource_available":true,"data":null}},"time_used":201,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":201,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-05-22","alert":"Phishing Block","trigger":"sourcefuel.co.zw","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-05-22","alert":"Sinkholed","trigger":"sourcefuel.co.zw","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-05-22","alert":"Sinkholed","trigger":"sourcefuel.co.zw","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-05-22","alert":"Sinkholed","trigger":"sourcefuel.co.zw","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null}],"urlquery":[{"sensor_name":"urlquery","alert":"Phishing - DHL","verdict":"phishing","severity":"medium","comment":"Associated with DHL phishing","tags":["dhl","logistics","phishing"],"meta":null}]}},{"url":{"schema":"https","addr":"sourcefuel.co.zw/postInf3gmbh-delivery4879/files/FedExSans_W-Italic.293f6c351bb0f40c453f.woff","fqdn":"sourcefuel.co.zw","domain":"sourcefuel.co.zw","tld":"co.zw"},"ip":{"addr":"185.150.190.64","port":443,"asn":23470,"as":"RELIABLESITE","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"font","requested_by":"https://sourcefuel.co.zw/postInf3gmbh-delivery4879/load.php","date":"2026-05-22T03:51:12.087Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"sourcefuel.co.zw","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Sun, 22 Mar 2026 14:39:08 GMT","end":"Sat, 20 Jun 2026 14:39:07 GMT"},"fingerprint":{"sha1":"C0:74:92:37:D4:2A:03:BD:B8:21:45:7E:67:B0:BE:43:7D:A6:C9:B6","sha256":"96:9F:8C:03:B5:AA:16:88:A9:50:11:B8:81:3C:CA:C5:F2:9C:CD:A8:70:98:F5:7B:C1:CF:4A:68:97:2F:2C:04"}}},"request":{"raw":"GET /postInf3gmbh-delivery4879/files/FedExSans_W-Italic.293f6c351bb0f40c453f.woff HTTP/1.1\r\nHost: sourcefuel.co.zw\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: identity\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://sourcefuel.co.zw/postInf3gmbh-delivery4879/files/styles.5b3e5351d5009950b08d.css\r\nCookie: PHPSESSID=fe392b446f25471dbe4f2f80e6b968b4\r\nSec-Fetch-Dest: font\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Fri, 22 May 2026 03:51:12 GMT\r\ncontent-type: text/html; charset=UTF-8\r\ncontent-length: 0\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":0,"size_decoded":0,"mime_type":"text/html; charset=UTF-8","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-08-09T14:49:10.846265Z","times_seen":17800640,"resource_available":true,"data":null}},"time_used":121,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":121,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-05-22","alert":"Phishing Block","trigger":"sourcefuel.co.zw","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-05-22","alert":"Sinkholed","trigger":"sourcefuel.co.zw","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-05-22","alert":"Sinkholed","trigger":"sourcefuel.co.zw","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-05-22","alert":"Sinkholed","trigger":"sourcefuel.co.zw","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":[{"sensor_name":"urlquery","alert":"Phishing - DHL","verdict":"phishing","severity":"medium","comment":"Associated with DHL phishing","tags":["dhl","logistics","phishing"],"meta":null}]}},{"url":{"schema":"https","addr":"sourcefuel.co.zw/postInf3gmbh-delivery4879/control/check_redirect.php?t=1779421883632","fqdn":"sourcefuel.co.zw","domain":"sourcefuel.co.zw","tld":"co.zw"},"ip":{"addr":"185.150.190.64","port":443,"asn":23470,"as":"RELIABLESITE","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"https://sourcefuel.co.zw/postInf3gmbh-delivery4879/load.php","date":"2026-05-22T03:51:23.635Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"sourcefuel.co.zw","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Sun, 22 Mar 2026 14:39:08 GMT","end":"Sat, 20 Jun 2026 14:39:07 GMT"},"fingerprint":{"sha1":"C0:74:92:37:D4:2A:03:BD:B8:21:45:7E:67:B0:BE:43:7D:A6:C9:B6","sha256":"96:9F:8C:03:B5:AA:16:88:A9:50:11:B8:81:3C:CA:C5:F2:9C:CD:A8:70:98:F5:7B:C1:CF:4A:68:97:2F:2C:04"}}},"request":{"raw":"GET /postInf3gmbh-delivery4879/control/check_redirect.php?t=1779421883632 HTTP/1.1\r\nHost: sourcefuel.co.zw\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://sourcefuel.co.zw/postInf3gmbh-delivery4879/load.php\r\nCookie: PHPSESSID=fe392b446f25471dbe4f2f80e6b968b4\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Fri, 22 May 2026 03:51:23 GMT\r\ncontent-type: text/html; charset=UTF-8\r\nvary: Accept-Encoding\r\ncontent-encoding: br\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":11,"size_decoded":0,"mime_type":"text/html; charset=UTF-8","magic":"ASCII text, with no line terminators","md5":"7c94333c07c9c06aee0bc239e4438255","sha1":"d3871bf7893d00a9ba1498cac8411b9334db7a72","sha256":"b21ff5b3f8ebc7f7e216a5edeb092283854a070391ae54a93a95c4e3650905cd","sha512":"4a1e794971f6e56c7aceca52375681bc5c4499898974ff157be7698f592eee14ce87bee7f09b5700a3b19b7462f547ce273e5c7cc8b75011a304c929e42b8ca5","ssdeep":"","tlshash":"6b50000c00330000c03300030000f0003c000c0030300c0000000cc00300000c000000","first_seen":"2024-01-05T04:51:49Z","last_seen":"2026-08-02T21:11:02.414751Z","times_seen":381,"resource_available":false,"data":null}},"time_used":134,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":134,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-05-22","alert":"Sinkholed","trigger":"sourcefuel.co.zw","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-05-22","alert":"Phishing Block","trigger":"sourcefuel.co.zw","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-05-22","alert":"Sinkholed","trigger":"sourcefuel.co.zw","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-05-22","alert":"Sinkholed","trigger":"sourcefuel.co.zw","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":[{"sensor_name":"urlquery","alert":"Phishing - DHL","verdict":"phishing","severity":"medium","comment":"Associated with DHL phishing","tags":["dhl","logistics","phishing"],"meta":null}]}},{"url":{"schema":"https","addr":"sourcefuel.co.zw/postInf3gmbh-delivery4879/logs/imhere.php?location=%2FpostInf3gmbh-delivery4879%2Fload.php\u0026t=1779421884834","fqdn":"sourcefuel.co.zw","domain":"sourcefuel.co.zw","tld":"co.zw"},"ip":{"addr":"185.150.190.64","port":443,"asn":23470,"as":"RELIABLESITE","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"fetch","requested_by":"https://sourcefuel.co.zw/postInf3gmbh-delivery4879/load.php","date":"2026-05-22T03:51:24.839Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"sourcefuel.co.zw","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Sun, 22 Mar 2026 14:39:08 GMT","end":"Sat, 20 Jun 2026 14:39:07 GMT"},"fingerprint":{"sha1":"C0:74:92:37:D4:2A:03:BD:B8:21:45:7E:67:B0:BE:43:7D:A6:C9:B6","sha256":"96:9F:8C:03:B5:AA:16:88:A9:50:11:B8:81:3C:CA:C5:F2:9C:CD:A8:70:98:F5:7B:C1:CF:4A:68:97:2F:2C:04"}}},"request":{"raw":"GET /postInf3gmbh-delivery4879/logs/imhere.php?location=%2FpostInf3gmbh-delivery4879%2Fload.php\u0026t=1779421884834 HTTP/1.1\r\nHost: sourcefuel.co.zw\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://sourcefuel.co.zw/postInf3gmbh-delivery4879/load.php\r\nDNT: 1\r\nConnection: keep-alive\r\nCookie: PHPSESSID=fe392b446f25471dbe4f2f80e6b968b4\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Fri, 22 May 2026 03:51:25 GMT\r\ncontent-type: text/html; charset=UTF-8\r\nvary: Accept-Encoding\r\ncontent-encoding: br\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":24,"size_decoded":0,"mime_type":"text/html; charset=UTF-8","magic":"ASCII text, with no line terminators","md5":"f6530f8413fde8efecc930d6ef59f49e","sha1":"f208906bea70d0a717fd9c52f7a4c655bf7e1e5c","sha256":"b3d21470af59b4bbc88dad6d7a8b29c4b9e68b92ba797d502d69fc2f8adb4ae1","sha512":"1e8adc9424604a19aa3dafb80126aed94ec40982cfac18945c9d19f94b29ffc58cfaf0447cef6b656d729755b1c09789bde1a57caac94d35f45a2b79498aae5f","ssdeep":"","tlshash":"f87000a3208038082280a00028800aa82228f008208000808cbc280a30e22a808a3028","first_seen":"2024-01-05T04:51:49Z","last_seen":"2026-08-02T21:11:02.411686Z","times_seen":368,"resource_available":false,"data":null}},"time_used":350,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":350,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-05-22","alert":"Sinkholed","trigger":"sourcefuel.co.zw","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-05-22","alert":"Phishing Block","trigger":"sourcefuel.co.zw","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-05-22","alert":"Sinkholed","trigger":"sourcefuel.co.zw","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-05-22","alert":"Sinkholed","trigger":"sourcefuel.co.zw","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":[{"sensor_name":"urlquery","alert":"Phishing - DHL","verdict":"phishing","severity":"medium","comment":"Associated with DHL phishing","tags":["dhl","logistics","phishing"],"meta":null}]}},{"url":{"schema":"https","addr":"sourcefuel.co.zw/postInf3gmbh-delivery4879/control/check_redirect.php?t=1779421887633","fqdn":"sourcefuel.co.zw","domain":"sourcefuel.co.zw","tld":"co.zw"},"ip":{"addr":"185.150.190.64","port":443,"asn":23470,"as":"RELIABLESITE","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"https://sourcefuel.co.zw/postInf3gmbh-delivery4879/load.php","date":"2026-05-22T03:51:27.636Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"sourcefuel.co.zw","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Sun, 22 Mar 2026 14:39:08 GMT","end":"Sat, 20 Jun 2026 14:39:07 GMT"},"fingerprint":{"sha1":"C0:74:92:37:D4:2A:03:BD:B8:21:45:7E:67:B0:BE:43:7D:A6:C9:B6","sha256":"96:9F:8C:03:B5:AA:16:88:A9:50:11:B8:81:3C:CA:C5:F2:9C:CD:A8:70:98:F5:7B:C1:CF:4A:68:97:2F:2C:04"}}},"request":{"raw":"GET /postInf3gmbh-delivery4879/control/check_redirect.php?t=1779421887633 HTTP/1.1\r\nHost: sourcefuel.co.zw\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://sourcefuel.co.zw/postInf3gmbh-delivery4879/load.php\r\nCookie: PHPSESSID=fe392b446f25471dbe4f2f80e6b968b4\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Fri, 22 May 2026 03:51:27 GMT\r\ncontent-type: text/html; charset=UTF-8\r\nvary: Accept-Encoding\r\ncontent-encoding: br\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":11,"size_decoded":0,"mime_type":"text/html; charset=UTF-8","magic":"ASCII text, with no line terminators","md5":"7c94333c07c9c06aee0bc239e4438255","sha1":"d3871bf7893d00a9ba1498cac8411b9334db7a72","sha256":"b21ff5b3f8ebc7f7e216a5edeb092283854a070391ae54a93a95c4e3650905cd","sha512":"4a1e794971f6e56c7aceca52375681bc5c4499898974ff157be7698f592eee14ce87bee7f09b5700a3b19b7462f547ce273e5c7cc8b75011a304c929e42b8ca5","ssdeep":"","tlshash":"6b50000c00330000c03300030000f0003c000c0030300c0000000cc00300000c000000","first_seen":"2024-01-05T04:51:49Z","last_seen":"2026-08-02T21:11:02.414751Z","times_seen":381,"resource_available":false,"data":null}},"time_used":333,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":333,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-05-22","alert":"Phishing Block","trigger":"sourcefuel.co.zw","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-05-22","alert":"Sinkholed","trigger":"sourcefuel.co.zw","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-05-22","alert":"Sinkholed","trigger":"sourcefuel.co.zw","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-05-22","alert":"Sinkholed","trigger":"sourcefuel.co.zw","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":[{"sensor_name":"urlquery","alert":"Phishing - DHL","verdict":"phishing","severity":"medium","comment":"Associated with DHL phishing","tags":["dhl","logistics","phishing"],"meta":null}]}},{"url":{"schema":"https","addr":"sourcefuel.co.zw/assets/fonts/FedExSans_W-Regular.woff?6wo4i3","fqdn":"sourcefuel.co.zw","domain":"sourcefuel.co.zw","tld":"co.zw"},"ip":{"addr":"185.150.190.64","port":443,"asn":23470,"as":"RELIABLESITE","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"font","requested_by":"https://sourcefuel.co.zw/postInf3gmbh-delivery4879/load.php","date":"2026-05-22T03:51:11.858Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"sourcefuel.co.zw","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Sun, 22 Mar 2026 14:39:08 GMT","end":"Sat, 20 Jun 2026 14:39:07 GMT"},"fingerprint":{"sha1":"C0:74:92:37:D4:2A:03:BD:B8:21:45:7E:67:B0:BE:43:7D:A6:C9:B6","sha256":"96:9F:8C:03:B5:AA:16:88:A9:50:11:B8:81:3C:CA:C5:F2:9C:CD:A8:70:98:F5:7B:C1:CF:4A:68:97:2F:2C:04"}}},"request":{"raw":"GET /assets/fonts/FedExSans_W-Regular.woff?6wo4i3 HTTP/1.1\r\nHost: sourcefuel.co.zw\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: identity\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://sourcefuel.co.zw/postInf3gmbh-delivery4879/files/styles.5b3e5351d5009950b08d.css\r\nCookie: PHPSESSID=fe392b446f25471dbe4f2f80e6b968b4\r\nSec-Fetch-Dest: font\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Fri, 22 May 2026 03:51:11 GMT\r\ncontent-type: text/html; charset=UTF-8\r\ncontent-length: 0\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":0,"size_decoded":0,"mime_type":"text/html; charset=UTF-8","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-08-09T14:49:10.846265Z","times_seen":17800640,"resource_available":true,"data":null}},"time_used":205,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":205,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-05-22","alert":"Phishing Block","trigger":"sourcefuel.co.zw","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-05-22","alert":"Sinkholed","trigger":"sourcefuel.co.zw","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-05-22","alert":"Sinkholed","trigger":"sourcefuel.co.zw","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-05-22","alert":"Sinkholed","trigger":"sourcefuel.co.zw","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":[{"sensor_name":"urlquery","alert":"Phishing - DHL","verdict":"phishing","severity":"medium","comment":"Associated with DHL phishing","tags":["dhl","logistics","phishing"],"meta":null}]}},{"url":{"schema":"https","addr":"sourcefuel.co.zw/postInf3gmbh-delivery4879/files/FedExSans_W-Bold.4659c1d4ddc84b4a3898.woff","fqdn":"sourcefuel.co.zw","domain":"sourcefuel.co.zw","tld":"co.zw"},"ip":{"addr":"185.150.190.64","port":443,"asn":23470,"as":"RELIABLESITE","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"font","requested_by":"https://sourcefuel.co.zw/postInf3gmbh-delivery4879/load.php","date":"2026-05-22T03:51:12.089Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"sourcefuel.co.zw","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Sun, 22 Mar 2026 14:39:08 GMT","end":"Sat, 20 Jun 2026 14:39:07 GMT"},"fingerprint":{"sha1":"C0:74:92:37:D4:2A:03:BD:B8:21:45:7E:67:B0:BE:43:7D:A6:C9:B6","sha256":"96:9F:8C:03:B5:AA:16:88:A9:50:11:B8:81:3C:CA:C5:F2:9C:CD:A8:70:98:F5:7B:C1:CF:4A:68:97:2F:2C:04"}}},"request":{"raw":"GET /postInf3gmbh-delivery4879/files/FedExSans_W-Bold.4659c1d4ddc84b4a3898.woff HTTP/1.1\r\nHost: sourcefuel.co.zw\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: identity\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://sourcefuel.co.zw/postInf3gmbh-delivery4879/files/styles.5b3e5351d5009950b08d.css\r\nCookie: PHPSESSID=fe392b446f25471dbe4f2f80e6b968b4\r\nSec-Fetch-Dest: font\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Fri, 22 May 2026 03:51:12 GMT\r\ncontent-type: text/html; charset=UTF-8\r\ncontent-length: 0\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":0,"size_decoded":0,"mime_type":"text/html; charset=UTF-8","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-08-09T14:49:10.846265Z","times_seen":17800640,"resource_available":true,"data":null}},"time_used":120,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":120,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-05-22","alert":"Sinkholed","trigger":"sourcefuel.co.zw","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-05-22","alert":"Phishing Block","trigger":"sourcefuel.co.zw","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-05-22","alert":"Sinkholed","trigger":"sourcefuel.co.zw","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-05-22","alert":"Sinkholed","trigger":"sourcefuel.co.zw","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null}],"urlquery":[{"sensor_name":"urlquery","alert":"Phishing - DHL","verdict":"phishing","severity":"medium","comment":"Associated with DHL phishing","tags":["dhl","logistics","phishing"],"meta":null}]}},{"url":{"schema":"https","addr":"sourcefuel.co.zw/postInf3gmbh-delivery4879/files/FedExSans_W-Light.774e3ae02978a9a76de6.woff","fqdn":"sourcefuel.co.zw","domain":"sourcefuel.co.zw","tld":"co.zw"},"ip":{"addr":"185.150.190.64","port":443,"asn":23470,"as":"RELIABLESITE","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"font","requested_by":"https://sourcefuel.co.zw/postInf3gmbh-delivery4879/load.php","date":"2026-05-22T03:51:12.100Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"sourcefuel.co.zw","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Sun, 22 Mar 2026 14:39:08 GMT","end":"Sat, 20 Jun 2026 14:39:07 GMT"},"fingerprint":{"sha1":"C0:74:92:37:D4:2A:03:BD:B8:21:45:7E:67:B0:BE:43:7D:A6:C9:B6","sha256":"96:9F:8C:03:B5:AA:16:88:A9:50:11:B8:81:3C:CA:C5:F2:9C:CD:A8:70:98:F5:7B:C1:CF:4A:68:97:2F:2C:04"}}},"request":{"raw":"GET /postInf3gmbh-delivery4879/files/FedExSans_W-Light.774e3ae02978a9a76de6.woff HTTP/1.1\r\nHost: sourcefuel.co.zw\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: identity\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://sourcefuel.co.zw/postInf3gmbh-delivery4879/files/styles.5b3e5351d5009950b08d.css\r\nCookie: PHPSESSID=fe392b446f25471dbe4f2f80e6b968b4\r\nSec-Fetch-Dest: font\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Fri, 22 May 2026 03:51:12 GMT\r\ncontent-type: text/html; charset=UTF-8\r\ncontent-length: 0\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":0,"size_decoded":0,"mime_type":"text/html; charset=UTF-8","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-08-09T14:49:10.846265Z","times_seen":17800640,"resource_available":true,"data":null}},"time_used":260,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":260,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-05-22","alert":"Phishing Block","trigger":"sourcefuel.co.zw","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-05-22","alert":"Sinkholed","trigger":"sourcefuel.co.zw","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-05-22","alert":"Sinkholed","trigger":"sourcefuel.co.zw","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-05-22","alert":"Sinkholed","trigger":"sourcefuel.co.zw","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":[{"sensor_name":"urlquery","alert":"Phishing - DHL","verdict":"phishing","severity":"medium","comment":"Associated with DHL phishing","tags":["dhl","logistics","phishing"],"meta":null}]}},{"url":{"schema":"https","addr":"sourcefuel.co.zw/postInf3gmbh-delivery4879/files/assets/fonts/FedExSans_W-Light.woff","fqdn":"sourcefuel.co.zw","domain":"sourcefuel.co.zw","tld":"co.zw"},"ip":{"addr":"185.150.190.64","port":443,"asn":23470,"as":"RELIABLESITE","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"font","requested_by":"https://sourcefuel.co.zw/postInf3gmbh-delivery4879/load.php","date":"2026-05-22T03:51:12.370Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"sourcefuel.co.zw","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Sun, 22 Mar 2026 14:39:08 GMT","end":"Sat, 20 Jun 2026 14:39:07 GMT"},"fingerprint":{"sha1":"C0:74:92:37:D4:2A:03:BD:B8:21:45:7E:67:B0:BE:43:7D:A6:C9:B6","sha256":"96:9F:8C:03:B5:AA:16:88:A9:50:11:B8:81:3C:CA:C5:F2:9C:CD:A8:70:98:F5:7B:C1:CF:4A:68:97:2F:2C:04"}}},"request":{"raw":"GET /postInf3gmbh-delivery4879/files/assets/fonts/FedExSans_W-Light.woff HTTP/1.1\r\nHost: sourcefuel.co.zw\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: identity\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://sourcefuel.co.zw/postInf3gmbh-delivery4879/files/common-core_SHF.css\r\nCookie: PHPSESSID=fe392b446f25471dbe4f2f80e6b968b4\r\nSec-Fetch-Dest: font\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Fri, 22 May 2026 03:51:12 GMT\r\ncontent-type: text/html; charset=UTF-8\r\ncontent-length: 0\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":0,"size_decoded":0,"mime_type":"text/html; charset=UTF-8","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-08-09T14:49:10.846265Z","times_seen":17800640,"resource_available":true,"data":null}},"time_used":132,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":132,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-05-22","alert":"Sinkholed","trigger":"sourcefuel.co.zw","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-05-22","alert":"Sinkholed","trigger":"sourcefuel.co.zw","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-05-22","alert":"Phishing Block","trigger":"sourcefuel.co.zw","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-05-22","alert":"Sinkholed","trigger":"sourcefuel.co.zw","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":[{"sensor_name":"urlquery","alert":"Phishing - DHL","verdict":"phishing","severity":"medium","comment":"Associated with DHL phishing","tags":["dhl","logistics","phishing"],"meta":null}]}},{"url":{"schema":"https","addr":"sourcefuel.co.zw/postInf3gmbh-delivery4879/files/favicon.ico","fqdn":"sourcefuel.co.zw","domain":"sourcefuel.co.zw","tld":"co.zw"},"ip":{"addr":"185.150.190.64","port":443,"asn":23470,"as":"RELIABLESITE","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://sourcefuel.co.zw/postInf3gmbh-delivery4879/load.php","date":"2026-05-22T03:51:12.677Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"sourcefuel.co.zw","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Sun, 22 Mar 2026 14:39:08 GMT","end":"Sat, 20 Jun 2026 14:39:07 GMT"},"fingerprint":{"sha1":"C0:74:92:37:D4:2A:03:BD:B8:21:45:7E:67:B0:BE:43:7D:A6:C9:B6","sha256":"96:9F:8C:03:B5:AA:16:88:A9:50:11:B8:81:3C:CA:C5:F2:9C:CD:A8:70:98:F5:7B:C1:CF:4A:68:97:2F:2C:04"}}},"request":{"raw":"GET /postInf3gmbh-delivery4879/files/favicon.ico HTTP/1.1\r\nHost: sourcefuel.co.zw\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://sourcefuel.co.zw/postInf3gmbh-delivery4879/load.php\r\nCookie: PHPSESSID=fe392b446f25471dbe4f2f80e6b968b4\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Fri, 22 May 2026 03:51:12 GMT\r\ncontent-type: image/x-icon\r\nvary: Accept-Encoding\r\nlast-modified: Fri, 11 Aug 2023 00:19:04 GMT\r\ncontent-encoding: br\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":1150,"size_decoded":0,"mime_type":"image/x-icon","magic":"MS Windows icon resource - 1 icon, 16x16, 32 bits/pixel","md5":"d8106bf3a1d00ab43b01e6e3c92500eb","sha1":"202b5e8654ab1b28351378293bca3b9d844cc29b","sha256":"9ada5709e264c31b04a05bd85448a9bd5e91925e8d83df5cef0762ec97cc283e","sha512":"3a77cbe48e27af035abcd70f0ae679195bb1b210eb02bbd86d3db270349fcc6f9b5ad8da10ff97f786865b18657531197d8a4e0d2ff1f08a2f117b2c1422ae89","ssdeep":"","tlshash":"78219a38ae408488ce98d135cdc2e5a20116af839e2119c763cc3f82764389ddfb3e06","first_seen":"2023-04-26T08:39:49Z","last_seen":"2026-08-08T08:21:07.036584Z","times_seen":3152,"resource_available":false,"data":null}},"time_used":130,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":130,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-05-22","alert":"Sinkholed","trigger":"sourcefuel.co.zw","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-05-22","alert":"Sinkholed","trigger":"sourcefuel.co.zw","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-05-22","alert":"Phishing Block","trigger":"sourcefuel.co.zw","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-05-22","alert":"Sinkholed","trigger":"sourcefuel.co.zw","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null}],"urlquery":[{"sensor_name":"urlquery","alert":"Phishing - DHL","verdict":"phishing","severity":"medium","comment":"Associated with DHL phishing","tags":["dhl","logistics","phishing"],"meta":null}]}},{"url":{"schema":"https","addr":"sourcefuel.co.zw/postInf3gmbh-delivery4879/load.php","fqdn":"sourcefuel.co.zw","domain":"sourcefuel.co.zw","tld":"co.zw"},"ip":{"addr":"185.150.190.64","port":443,"asn":23470,"as":"RELIABLESITE","country":"United States","country_code":"US"},"is_navigation_request":true,"resource_type":"document","requested_by":"","date":"2026-05-22T03:51:08.576Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"sourcefuel.co.zw","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Sun, 22 Mar 2026 14:39:08 GMT","end":"Sat, 20 Jun 2026 14:39:07 GMT"},"fingerprint":{"sha1":"C0:74:92:37:D4:2A:03:BD:B8:21:45:7E:67:B0:BE:43:7D:A6:C9:B6","sha256":"96:9F:8C:03:B5:AA:16:88:A9:50:11:B8:81:3C:CA:C5:F2:9C:CD:A8:70:98:F5:7B:C1:CF:4A:68:97:2F:2C:04"}}},"request":{"raw":"GET /postInf3gmbh-delivery4879/load.php HTTP/1.1\r\nHost: sourcefuel.co.zw\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nCookie: PHPSESSID=fe392b446f25471dbe4f2f80e6b968b4\r\nUpgrade-Insecure-Requests: 1\r\nSec-Fetch-Dest: document\r\nSec-Fetch-Mode: navigate\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Fri, 22 May 2026 03:51:08 GMT\r\ncontent-type: text/html; charset=UTF-8\r\nvary: Accept-Encoding\r\nexpires: Thu, 19 Nov 1981 08:52:00 GMT\r\ncache-control: no-store, no-cache, must-revalidate\r\npragma: no-cache\r\ncontent-encoding: br\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"jQuery CDN","description":"jQuery CDN is a way to include jQuery in your website without actually downloading and keeping it your website's folder.","website":"https://code.jquery.com/","common_platform_enumeration":"","icon":"jQuery.svg","categories":["CDN"]},{"name":"jQuery:3.6.1","description":"jQuery is a JavaScript library which is a free, open-source software designed to simplify HTML DOM tree traversal and manipulation, as well as event handling, CSS animation, and Ajax.","website":"https://jquery.com","common_platform_enumeration":"cpe:2.3:a:jquery:jquery:*:*:*:*:*:*:*:*","icon":"jQuery.svg","categories":["JavaScript libraries"]},{"name":"cdnjs","description":"cdnjs is a free distributed JS library delivery service.","website":"https://cdnjs.com","common_platform_enumeration":"","icon":"cdnjs.svg","categories":["CDN"]},{"name":"Bootstrap:5.0.2","description":"Bootstrap is a free and open-source CSS framework directed at responsive, mobile-first front-end web development. It contains CSS and JavaScript-based design templates for typography, forms, buttons, navigation, and other interface components.","website":"https://getbootstrap.com","common_platform_enumeration":"cpe:2.3:a:getbootstrap:bootstrap:*:*:*:*:*:*:*:*","icon":"Bootstrap.svg","categories":["UI frameworks"]},{"name":"Font Awesome","description":"Font Awesome is a font and icon toolkit based on CSS and Less.","website":"https://fontawesome.com/","common_platform_enumeration":"","icon":"Font Awesome.svg","categories":["Font scripts"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"jsDelivr","description":"JSDelivr is a free public CDN for open-source projects. It can serve web files directly from the npm registry and GitHub repositories without any configuration.","website":"https://www.jsdelivr.com/","common_platform_enumeration":"","icon":"jsdelivr-icon.svg","categories":["CDN"]}],"data":{"size":433936,"size_decoded":0,"mime_type":"text/html; charset=UTF-8","magic":"HTML document, Unicode text, UTF-8 text, with very long lines (48163)","md5":"b146ff9c3df7da20ed697878ce5e1c5b","sha1":"a6877f43cd820b7ef72c20c6d1db1972b3952bd7","sha256":"d83adad2bf1de76dcf60bdc5bd0bbca2a6a3e6b7e6b44100448013b507e3fb43","sha512":"3d4544210ad3fec2d786b6810d213582d43fa5f99b06116a17b12bd5d0b6f935ad9ba45e3a431d39d1720c4883cb865cc280333b2d5372805fc1bce2f9b4def6","ssdeep":"3072:lSLFGFFRc/m9sYPfXe27D4WA0H/CMvwD6QRdeOg3GlsoWzMoYjBgT++vriUlYcRk:lSL4iC2mMSPtbCt8Rs8a","tlshash":"4c94513d8364c37c698acbbcafb27071d05e90ded1e5838592b8c56062d38e9f95e8d4","first_seen":"2026-05-22T03:51:39.139306Z","last_seen":"2026-05-22T03:51:39.139306Z","times_seen":1,"resource_available":false,"data":null}},"time_used":439,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":439,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-05-22","alert":"Phishing Block","trigger":"sourcefuel.co.zw","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-05-22","alert":"Sinkholed","trigger":"sourcefuel.co.zw","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-05-22","alert":"Sinkholed","trigger":"sourcefuel.co.zw","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-05-22","alert":"Sinkholed","trigger":"sourcefuel.co.zw","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null}],"urlquery":[{"sensor_name":"urlquery","alert":"Phishing - DHL","verdict":"phishing","severity":"medium","comment":"Associated with DHL phishing","tags":["dhl","logistics","phishing"],"meta":null}]}},{"url":{"schema":"https","addr":"sourcefuel.co.zw/postInf3gmbh-delivery4879/files/X911.css","fqdn":"sourcefuel.co.zw","domain":"sourcefuel.co.zw","tld":"co.zw"},"ip":{"addr":"185.150.190.64","port":443,"asn":23470,"as":"RELIABLESITE","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://sourcefuel.co.zw/postInf3gmbh-delivery4879/load.php","date":"2026-05-22T03:51:09.184Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"sourcefuel.co.zw","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Sun, 22 Mar 2026 14:39:08 GMT","end":"Sat, 20 Jun 2026 14:39:07 GMT"},"fingerprint":{"sha1":"C0:74:92:37:D4:2A:03:BD:B8:21:45:7E:67:B0:BE:43:7D:A6:C9:B6","sha256":"96:9F:8C:03:B5:AA:16:88:A9:50:11:B8:81:3C:CA:C5:F2:9C:CD:A8:70:98:F5:7B:C1:CF:4A:68:97:2F:2C:04"}}},"request":{"raw":"GET /postInf3gmbh-delivery4879/files/X911.css HTTP/1.1\r\nHost: sourcefuel.co.zw\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://sourcefuel.co.zw/postInf3gmbh-delivery4879/load.php\r\nCookie: PHPSESSID=fe392b446f25471dbe4f2f80e6b968b4\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Fri, 22 May 2026 03:51:09 GMT\r\ncontent-type: text/css\r\nvary: Accept-Encoding\r\nlast-modified: Fri, 11 Aug 2023 00:19:04 GMT\r\ncontent-encoding: br\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":1157029,"size_decoded":0,"mime_type":"text/css","magic":"HTML document, ASCII text, with very long lines (65025), with CRLF line terminators","md5":"065048d1af2dce6ea3bfd9c95efcd946","sha1":"ce374ba85dd57fcfdb7ac3acf9ec648bd40c0090","sha256":"51e64d4affe60cd2fab99c3145c05491c676987e2322aef6edb23fa0770e197e","sha512":"705dfd3a34038b78b125f4066975fe9158a288d567f8e63daf491c066f1bad3c5958df83ca489e446177c889fe054271c7d02ab5c68217341e5ff3ed4d916d59","ssdeep":"1536:DRsc+ho7y7+Al9yXddZH4xCLSbxTN5g110XVqpIc19c4IzHDpl4VB/+/Wstp83Gl:ymVP1Ucdk93a77I","tlshash":"3b25ddabb4d1191ac28ac83290b12ff844ffb454f307994a99837b9d874fbcd1553a4b","first_seen":"2025-08-01T21:16:00.38154Z","last_seen":"2026-05-22T03:51:39.140316Z","times_seen":80,"resource_available":false,"data":null}},"time_used":1331,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":1331,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-05-22","alert":"Sinkholed","trigger":"sourcefuel.co.zw","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-05-22","alert":"Phishing Block","trigger":"sourcefuel.co.zw","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-05-22","alert":"Sinkholed","trigger":"sourcefuel.co.zw","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-05-22","alert":"Sinkholed","trigger":"sourcefuel.co.zw","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":[{"sensor_name":"urlquery","alert":"Phishing - DHL","verdict":"phishing","severity":"medium","comment":"Associated with DHL phishing","tags":["dhl","logistics","phishing"],"meta":null}]}},{"url":{"schema":"https","addr":"sourcefuel.co.zw/postInf3gmbh-delivery4879/files/LOGA.svg","fqdn":"sourcefuel.co.zw","domain":"sourcefuel.co.zw","tld":"co.zw"},"ip":{"addr":"185.150.190.64","port":443,"asn":23470,"as":"RELIABLESITE","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://sourcefuel.co.zw/postInf3gmbh-delivery4879/load.php","date":"2026-05-22T03:51:09.190Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"sourcefuel.co.zw","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Sun, 22 Mar 2026 14:39:08 GMT","end":"Sat, 20 Jun 2026 14:39:07 GMT"},"fingerprint":{"sha1":"C0:74:92:37:D4:2A:03:BD:B8:21:45:7E:67:B0:BE:43:7D:A6:C9:B6","sha256":"96:9F:8C:03:B5:AA:16:88:A9:50:11:B8:81:3C:CA:C5:F2:9C:CD:A8:70:98:F5:7B:C1:CF:4A:68:97:2F:2C:04"}}},"request":{"raw":"GET /postInf3gmbh-delivery4879/files/LOGA.svg HTTP/1.1\r\nHost: sourcefuel.co.zw\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://sourcefuel.co.zw/postInf3gmbh-delivery4879/load.php\r\nCookie: PHPSESSID=fe392b446f25471dbe4f2f80e6b968b4\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Fri, 22 May 2026 03:51:09 GMT\r\ncontent-type: image/svg+xml\r\nvary: Accept-Encoding\r\nlast-modified: Fri, 11 Aug 2023 00:19:04 GMT\r\ncontent-encoding: br\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":1469,"size_decoded":0,"mime_type":"image/svg+xml","magic":"SVG Scalable Vector Graphics image","md5":"4cdf5b1922fe350e679b7b616af21bd3","sha1":"2ea65118ec5e1e365791e38b8ebdc1cfe3ec2dbe","sha256":"304213033f2a03071409043919d5d27d9847e0fb96c8433871ddcd7ad93fcb39","sha512":"a4b97d48f58d32dff843b418655829fd0e8986e813c7d06d637d70a89cced81465095414e3fe543d6b6194b32057c0d4063736eb05c1cc3b7959432c9c033ce7","ssdeep":"","tlshash":"9e3185da632c967c5088239695f01e623b76696a65f2027dd30b3919e026fa12854b31","first_seen":"2023-08-15T00:20:01Z","last_seen":"2026-07-06T03:32:47.744912Z","times_seen":473,"resource_available":false,"data":null}},"time_used":1323,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":1323,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-05-22","alert":"Sinkholed","trigger":"sourcefuel.co.zw","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-05-22","alert":"Sinkholed","trigger":"sourcefuel.co.zw","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-05-22","alert":"Sinkholed","trigger":"sourcefuel.co.zw","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-05-22","alert":"Phishing Block","trigger":"sourcefuel.co.zw","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null}],"urlquery":[{"sensor_name":"urlquery","alert":"Phishing - DHL","verdict":"phishing","severity":"medium","comment":"Associated with DHL phishing","tags":["dhl","logistics","phishing"],"meta":null}]}},{"url":{"schema":"https","addr":"sourcefuel.co.zw/postInf3gmbh-delivery4879/files/assets/fonts/FedExSans_W-Light.woff","fqdn":"sourcefuel.co.zw","domain":"sourcefuel.co.zw","tld":"co.zw"},"ip":{"addr":"185.150.190.64","port":443,"asn":23470,"as":"RELIABLESITE","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"font","requested_by":"https://sourcefuel.co.zw/postInf3gmbh-delivery4879/load.php","date":"2026-05-22T03:51:11.606Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"sourcefuel.co.zw","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Sun, 22 Mar 2026 14:39:08 GMT","end":"Sat, 20 Jun 2026 14:39:07 GMT"},"fingerprint":{"sha1":"C0:74:92:37:D4:2A:03:BD:B8:21:45:7E:67:B0:BE:43:7D:A6:C9:B6","sha256":"96:9F:8C:03:B5:AA:16:88:A9:50:11:B8:81:3C:CA:C5:F2:9C:CD:A8:70:98:F5:7B:C1:CF:4A:68:97:2F:2C:04"}}},"request":{"raw":"GET /postInf3gmbh-delivery4879/files/assets/fonts/FedExSans_W-Light.woff HTTP/1.1\r\nHost: sourcefuel.co.zw\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: identity\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://sourcefuel.co.zw/postInf3gmbh-delivery4879/files/X911.css\r\nCookie: PHPSESSID=fe392b446f25471dbe4f2f80e6b968b4\r\nSec-Fetch-Dest: font\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Fri, 22 May 2026 03:51:11 GMT\r\ncontent-type: text/html; charset=UTF-8\r\ncontent-length: 0\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":0,"size_decoded":0,"mime_type":"text/html; charset=UTF-8","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-08-09T14:49:10.846265Z","times_seen":17800640,"resource_available":true,"data":null}},"time_used":451,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":451,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-05-22","alert":"Sinkholed","trigger":"sourcefuel.co.zw","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-05-22","alert":"Sinkholed","trigger":"sourcefuel.co.zw","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-05-22","alert":"Sinkholed","trigger":"sourcefuel.co.zw","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-05-22","alert":"Phishing Block","trigger":"sourcefuel.co.zw","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null}],"urlquery":[{"sensor_name":"urlquery","alert":"Phishing - DHL","verdict":"phishing","severity":"medium","comment":"Associated with DHL phishing","tags":["dhl","logistics","phishing"],"meta":null}]}},{"url":{"schema":"https","addr":"sourcefuel.co.zw/postInf3gmbh-delivery4879/files/FedExSans_W-Regular.475f432261db6051bb40.woff","fqdn":"sourcefuel.co.zw","domain":"sourcefuel.co.zw","tld":"co.zw"},"ip":{"addr":"185.150.190.64","port":443,"asn":23470,"as":"RELIABLESITE","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"font","requested_by":"https://sourcefuel.co.zw/postInf3gmbh-delivery4879/load.php","date":"2026-05-22T03:51:11.851Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"sourcefuel.co.zw","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Sun, 22 Mar 2026 14:39:08 GMT","end":"Sat, 20 Jun 2026 14:39:07 GMT"},"fingerprint":{"sha1":"C0:74:92:37:D4:2A:03:BD:B8:21:45:7E:67:B0:BE:43:7D:A6:C9:B6","sha256":"96:9F:8C:03:B5:AA:16:88:A9:50:11:B8:81:3C:CA:C5:F2:9C:CD:A8:70:98:F5:7B:C1:CF:4A:68:97:2F:2C:04"}}},"request":{"raw":"GET /postInf3gmbh-delivery4879/files/FedExSans_W-Regular.475f432261db6051bb40.woff HTTP/1.1\r\nHost: sourcefuel.co.zw\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: identity\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://sourcefuel.co.zw/postInf3gmbh-delivery4879/files/styles.5b3e5351d5009950b08d.css\r\nCookie: PHPSESSID=fe392b446f25471dbe4f2f80e6b968b4\r\nSec-Fetch-Dest: font\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Fri, 22 May 2026 03:51:11 GMT\r\ncontent-type: text/html; charset=UTF-8\r\ncontent-length: 0\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":0,"size_decoded":0,"mime_type":"text/html; charset=UTF-8","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-08-09T14:49:10.846265Z","times_seen":17800640,"resource_available":true,"data":null}},"time_used":209,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":209,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-05-22","alert":"Sinkholed","trigger":"sourcefuel.co.zw","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-05-22","alert":"Sinkholed","trigger":"sourcefuel.co.zw","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-05-22","alert":"Phishing Block","trigger":"sourcefuel.co.zw","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-05-22","alert":"Sinkholed","trigger":"sourcefuel.co.zw","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":[{"sensor_name":"urlquery","alert":"Phishing - DHL","verdict":"phishing","severity":"medium","comment":"Associated with DHL phishing","tags":["dhl","logistics","phishing"],"meta":null}]}},{"url":{"schema":"https","addr":"p.mrktmtrcs.net/mm.js","fqdn":"p.mrktmtrcs.net","domain":"mrktmtrcs.net","tld":"net"},"ip":{"addr":"104.26.15.100","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://sourcefuel.co.zw/postInf3gmbh-delivery4879/load.php","date":"2026-05-22T03:51:12.314Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"mrktmtrcs.net","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Wed, 25 Mar 2026 01:44:47 GMT","end":"Tue, 23 Jun 2026 02:44:46 GMT"},"fingerprint":{"sha1":"EE:46:68:4E:8E:32:9F:2F:CB:9B:3F:4D:7D:AE:C5:DA:DD:22:A1:04","sha256":"47:AF:41:1A:66:14:8A:03:45:1A:D0:54:B1:3D:69:90:CD:E7:38:DA:85:B0:E5:51:39:EB:DD:85:80:04:DD:E6"}}},"request":{"raw":"GET /mm.js HTTP/1.1\r\nHost: p.mrktmtrcs.net\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://sourcefuel.co.zw/\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ndate: Fri, 22 May 2026 03:51:12 GMT\r\ncontent-type: application/javascript\r\nserver: cloudflare\r\nlast-modified: Wed, 21 May 2025 20:03:03 GMT\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=2krkvK0V%2F7NqB914MelaXDaqD9XQUe3Fu2Vi8cX7YPK6RTTt0Hy%2B%2BTMWPtNyBU4jNxVVjDfhff5txgWQFB6FgDF2WhXnFV0sjZ314xQ4LSp8rAKMWcgc%2BdOl01AGCdG1Ng%3D%3D\"}]}\r\nage: 5077\r\ncache-control: max-age=14400\r\ncf-cache-status: HIT\r\netag: W/\"682e3177-9c10\"\r\ncontent-encoding: br\r\ncf-ray: 9ff8dc6e996b120a-OSL\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":39952,"size_decoded":0,"mime_type":"application/javascript","magic":"JavaScript source, ASCII text, with very long lines (30767)","md5":"67cda29c6b95cb5eb8c4960490502a19","sha1":"ac6700bfe19f0580cccf51bddf2a7310d31a833c","sha256":"6ed6986bfeafe3a3bab8174b435e96c3ca8e216c3c7941b20c3e4984087f9e0b","sha512":"c5d6bdfb04022d8f3ff82c95c1c938a3aec4246a9fefc40a2e96b12e42295fe8d578c983b399ca86493f3481b113f685d27e20e2cd19000efab176a6b7ab578f","ssdeep":"768:Iudg8MPdH/EeIO5V1gPk5Te1pCeKSreGdRY8ZqM0wTo:IHEelgvZnAVQo","tlshash":"9403192ee3a2761003abf19dd90b50003e35541bea41f8a4bdecb581ff958a512bf7b5","first_seen":"2025-07-17T20:43:49.34962Z","last_seen":"2026-08-05T10:25:07.103185Z","times_seen":3658,"resource_available":true,"data":null}},"time_used":202,"timings":{"blocked":81,"dns":0,"connect":33,"send":0,"wait":39,"receive":0,"ssl":45},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"sourcefuel.co.zw/postInf3gmbh-delivery4879/logs/imhere.php?location=%2FpostInf3gmbh-delivery4879%2Fload.php\u0026t=1779421880434","fqdn":"sourcefuel.co.zw","domain":"sourcefuel.co.zw","tld":"co.zw"},"ip":{"addr":"185.150.190.64","port":443,"asn":23470,"as":"RELIABLESITE","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"fetch","requested_by":"https://sourcefuel.co.zw/postInf3gmbh-delivery4879/load.php","date":"2026-05-22T03:51:20.436Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"sourcefuel.co.zw","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Sun, 22 Mar 2026 14:39:08 GMT","end":"Sat, 20 Jun 2026 14:39:07 GMT"},"fingerprint":{"sha1":"C0:74:92:37:D4:2A:03:BD:B8:21:45:7E:67:B0:BE:43:7D:A6:C9:B6","sha256":"96:9F:8C:03:B5:AA:16:88:A9:50:11:B8:81:3C:CA:C5:F2:9C:CD:A8:70:98:F5:7B:C1:CF:4A:68:97:2F:2C:04"}}},"request":{"raw":"GET /postInf3gmbh-delivery4879/logs/imhere.php?location=%2FpostInf3gmbh-delivery4879%2Fload.php\u0026t=1779421880434 HTTP/1.1\r\nHost: sourcefuel.co.zw\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://sourcefuel.co.zw/postInf3gmbh-delivery4879/load.php\r\nDNT: 1\r\nConnection: keep-alive\r\nCookie: PHPSESSID=fe392b446f25471dbe4f2f80e6b968b4\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Fri, 22 May 2026 03:51:20 GMT\r\ncontent-type: text/html; charset=UTF-8\r\nvary: Accept-Encoding\r\ncontent-encoding: br\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":24,"size_decoded":0,"mime_type":"text/html; charset=UTF-8","magic":"ASCII text, with no line terminators","md5":"f6530f8413fde8efecc930d6ef59f49e","sha1":"f208906bea70d0a717fd9c52f7a4c655bf7e1e5c","sha256":"b3d21470af59b4bbc88dad6d7a8b29c4b9e68b92ba797d502d69fc2f8adb4ae1","sha512":"1e8adc9424604a19aa3dafb80126aed94ec40982cfac18945c9d19f94b29ffc58cfaf0447cef6b656d729755b1c09789bde1a57caac94d35f45a2b79498aae5f","ssdeep":"","tlshash":"f87000a3208038082280a00028800aa82228f008208000808cbc280a30e22a808a3028","first_seen":"2024-01-05T04:51:49Z","last_seen":"2026-08-02T21:11:02.411686Z","times_seen":368,"resource_available":false,"data":null}},"time_used":162,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":162,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-05-22","alert":"Sinkholed","trigger":"sourcefuel.co.zw","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-05-22","alert":"Sinkholed","trigger":"sourcefuel.co.zw","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-05-22","alert":"Sinkholed","trigger":"sourcefuel.co.zw","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-05-22","alert":"Phishing Block","trigger":"sourcefuel.co.zw","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null}],"urlquery":[{"sensor_name":"urlquery","alert":"Phishing - DHL","verdict":"phishing","severity":"medium","comment":"Associated with DHL phishing","tags":["dhl","logistics","phishing"],"meta":null}]}},{"url":{"schema":"https","addr":"flagsapi.com/NO/shiny/64.png","fqdn":"flagsapi.com","domain":"flagsapi.com","tld":"com"},"ip":{"addr":"172.67.191.123","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://sourcefuel.co.zw/postInf3gmbh-delivery4879/load.php","date":"2026-05-22T03:51:09.889Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"flagsapi.com","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Tue, 05 May 2026 05:09:19 GMT","end":"Mon, 03 Aug 2026 06:09:06 GMT"},"fingerprint":{"sha1":"B4:7B:87:D4:0C:56:0F:0E:75:E6:4A:4B:F6:76:9C:DD:F5:6E:9C:8D","sha256":"DC:D0:B4:92:F7:1A:D5:07:2C:90:86:DD:DC:72:72:C3:97:34:AE:BA:70:55:5B:58:A0:94:45:BF:BA:D3:FF:69"}}},"request":{"raw":"GET /NO/shiny/64.png HTTP/1.1\r\nHost: flagsapi.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://sourcefuel.co.zw/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ndate: Fri, 22 May 2026 03:51:10 GMT\r\ncontent-type: image/png\r\ncontent-length: 1794\r\nserver: cloudflare\r\nx-frame-options: SAMEORIGIN\r\nx-content-type-options: nosniff\r\nreferrer-policy: strict-origin-when-cross-origin\r\npermissions-policy: camera=(), microphone=(), geolocation=()\r\nx-xss-protection: 1; mode=block\r\nexpires: Thu, 19 Nov 1981 08:52:00 GMT\r\ncache-control: max-age=31536000, must-revalidate\r\npragma: no-cache\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=FJ%2BaEi9DkRiaFaPKkSU7zRhpV51UTSnVQaz%2FA8nrkAWGh2KDIAIPs4krLG%2B06xxGy3HiYlmMjR8VHv0%2BpoDzsRHsMimdnMuO6AedgUGyeGX7Xz3j%2Bri4th5cc71N9Tg%3D\"}]}\r\nage: 620928\r\naccept-ranges: bytes\r\nlast-modified: Thu, 14 May 2026 23:22:21 GMT\r\ncf-cache-status: HIT\r\ncf-ray: 9ff8dc5f9c302efa-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":1794,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 64 x 64, 8-bit/color RGBA, non-interlaced","md5":"3dbe8de9a3ca4913aae01c04ffd448f3","sha1":"d2a32f5096705a129c09761e45e853a13ba05c12","sha256":"b2cadbfb405df91709ec0aabbe1dbe20f29d72458b3788496631a812449359be","sha512":"ee5b7cd504b35d1e8706a8579f249139190fcb2e4957748c26421e684160421e9202169ec5b4299e66398ec757fa30560c54f700f924a9fa5fdbd9adbe77463b","ssdeep":"","tlshash":"cc3109f917876856805abc2080857f59f1416cf323a19d8ac414af208b72674cb8f586","first_seen":"2024-02-01T03:47:08Z","last_seen":"2026-08-06T02:32:14.327017Z","times_seen":212,"resource_available":false,"data":null}},"time_used":236,"timings":{"blocked":99,"dns":1,"connect":29,"send":0,"wait":32,"receive":1,"ssl":69},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"waust.at/s.js","fqdn":"waust.at","domain":"waust.at","tld":"at"},"ip":{"addr":"104.26.5.7","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://sourcefuel.co.zw/postInf3gmbh-delivery4879/load.php","date":"2026-05-22T03:51:09.894Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"waust.at","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Sun, 12 Apr 2026 21:15:25 GMT","end":"Sat, 11 Jul 2026 22:15:10 GMT"},"fingerprint":{"sha1":"8F:1B:28:C1:C8:62:78:B0:61:56:D7:65:B0:33:60:23:87:F9:C5:02","sha256":"54:30:DF:F0:B8:32:47:C4:9B:E7:9A:1B:D4:D9:B6:0E:6B:48:F6:D7:B7:E0:92:06:58:AF:84:9F:9C:B7:E7:91"}}},"request":{"raw":"GET /s.js HTTP/1.1\r\nHost: waust.at\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://sourcefuel.co.zw/\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ndate: Fri, 22 May 2026 03:51:10 GMT\r\ncontent-type: application/x-javascript\r\nlast-modified: Sun, 17 May 2026 17:20:31 GMT\r\netag: \"6a09f8df-1c76\"\r\nexpires: Sat, 23 May 2026 03:35:20 GMT\r\ncache-control: max-age=86400\r\naccess-control-allow-origin: *\r\ncontent-encoding: gzip\r\nalt-svc: h3=\":443\"; ma=86400\r\nage: 949\r\ncf-cache-status: HIT\r\nvary: accept-encoding\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=Qj9FJR22Ut1f60FffESRGtRiH1Ok1i1kyTWngKRyD%2BLjW3TcxYBOuNXN2h%2F0TjCceLFwaDrNSrTTtBmkJAqgVE6UfT3CHcvh6fZ1vaGZRh0DfKlWHYjxnBFw\"}]}\r\nserver: cloudflare\r\ncf-ray: 9ff8dc5f9f2132fa-OSL\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":7286,"size_decoded":0,"mime_type":"application/x-javascript","magic":"JavaScript source, ASCII text, with very long lines (7286), with no line terminators","md5":"7e1800d35725cb510d6ca600677a9669","sha1":"e4ba00dd620d7a4531a6a954c51b5d801f78520c","sha256":"d03635e64afffd465cd2c59e0bc850fecde2aa979e55240e4737094633f50391","sha512":"b5c00c9106750dec2b23e6207f49efeb62825c39b148f849015ae30453f1c76cc1c649083062b1d9e32214cad4a8f6249373ab17f92d662326350f004adb6c1d","ssdeep":"96:tLN7NgmG8j2svNuYMTX080ORDvckw9AVDx+llB9RmSK29tCq0jjaNrTBq92n/rQl:l94B70AjPVDx+9Rml29NBm2/MVpd","tlshash":"26e1c7b5325314b65ff650a5606f7345b831517b6f479001809e84b836acf0b91eaff7","first_seen":"2025-11-28T23:48:30.367069Z","last_seen":"2026-07-21T16:27:51.048442Z","times_seen":1688,"resource_available":true,"data":null}},"time_used":236,"timings":{"blocked":101,"dns":0,"connect":35,"send":0,"wait":30,"receive":0,"ssl":67},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-05-22","alert":"Sinkholed","trigger":"waust.at","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"sourcefuel.co.zw/postInf3gmbh-delivery4879/files/assets/fonts/FedExSans_W-Bold.woff","fqdn":"sourcefuel.co.zw","domain":"sourcefuel.co.zw","tld":"co.zw"},"ip":{"addr":"185.150.190.64","port":443,"asn":23470,"as":"RELIABLESITE","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"font","requested_by":"https://sourcefuel.co.zw/postInf3gmbh-delivery4879/load.php","date":"2026-05-22T03:51:11.600Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"sourcefuel.co.zw","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Sun, 22 Mar 2026 14:39:08 GMT","end":"Sat, 20 Jun 2026 14:39:07 GMT"},"fingerprint":{"sha1":"C0:74:92:37:D4:2A:03:BD:B8:21:45:7E:67:B0:BE:43:7D:A6:C9:B6","sha256":"96:9F:8C:03:B5:AA:16:88:A9:50:11:B8:81:3C:CA:C5:F2:9C:CD:A8:70:98:F5:7B:C1:CF:4A:68:97:2F:2C:04"}}},"request":{"raw":"GET /postInf3gmbh-delivery4879/files/assets/fonts/FedExSans_W-Bold.woff HTTP/1.1\r\nHost: sourcefuel.co.zw\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: identity\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://sourcefuel.co.zw/postInf3gmbh-delivery4879/files/X911.css\r\nCookie: PHPSESSID=fe392b446f25471dbe4f2f80e6b968b4\r\nSec-Fetch-Dest: font\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Fri, 22 May 2026 03:51:11 GMT\r\ncontent-type: text/html; charset=UTF-8\r\ncontent-length: 0\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":0,"size_decoded":0,"mime_type":"text/html; charset=UTF-8","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-08-09T14:49:10.846265Z","times_seen":17800640,"resource_available":true,"data":null}},"time_used":459,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":459,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-05-22","alert":"Phishing Block","trigger":"sourcefuel.co.zw","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-05-22","alert":"Sinkholed","trigger":"sourcefuel.co.zw","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-05-22","alert":"Sinkholed","trigger":"sourcefuel.co.zw","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-05-22","alert":"Sinkholed","trigger":"sourcefuel.co.zw","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":[{"sensor_name":"urlquery","alert":"Phishing - DHL","verdict":"phishing","severity":"medium","comment":"Associated with DHL phishing","tags":["dhl","logistics","phishing"],"meta":null}]}},{"url":{"schema":"https","addr":"sourcefuel.co.zw/postInf3gmbh-delivery4879/files/assets/fonts/FedExSans_W-Bold-Italic.woff","fqdn":"sourcefuel.co.zw","domain":"sourcefuel.co.zw","tld":"co.zw"},"ip":{"addr":"185.150.190.64","port":443,"asn":23470,"as":"RELIABLESITE","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"font","requested_by":"https://sourcefuel.co.zw/postInf3gmbh-delivery4879/load.php","date":"2026-05-22T03:51:11.603Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"sourcefuel.co.zw","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Sun, 22 Mar 2026 14:39:08 GMT","end":"Sat, 20 Jun 2026 14:39:07 GMT"},"fingerprint":{"sha1":"C0:74:92:37:D4:2A:03:BD:B8:21:45:7E:67:B0:BE:43:7D:A6:C9:B6","sha256":"96:9F:8C:03:B5:AA:16:88:A9:50:11:B8:81:3C:CA:C5:F2:9C:CD:A8:70:98:F5:7B:C1:CF:4A:68:97:2F:2C:04"}}},"request":{"raw":"GET /postInf3gmbh-delivery4879/files/assets/fonts/FedExSans_W-Bold-Italic.woff HTTP/1.1\r\nHost: sourcefuel.co.zw\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: identity\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://sourcefuel.co.zw/postInf3gmbh-delivery4879/files/X911.css\r\nCookie: PHPSESSID=fe392b446f25471dbe4f2f80e6b968b4\r\nSec-Fetch-Dest: font\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Fri, 22 May 2026 03:51:11 GMT\r\ncontent-type: text/html; charset=UTF-8\r\ncontent-length: 0\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":0,"size_decoded":0,"mime_type":"text/html; charset=UTF-8","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-08-09T14:49:10.846265Z","times_seen":17800640,"resource_available":true,"data":null}},"time_used":453,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":453,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-05-22","alert":"Sinkholed","trigger":"sourcefuel.co.zw","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-05-22","alert":"Sinkholed","trigger":"sourcefuel.co.zw","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-05-22","alert":"Phishing Block","trigger":"sourcefuel.co.zw","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-05-22","alert":"Sinkholed","trigger":"sourcefuel.co.zw","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":[{"sensor_name":"urlquery","alert":"Phishing - DHL","verdict":"phishing","severity":"medium","comment":"Associated with DHL phishing","tags":["dhl","logistics","phishing"],"meta":null}]}},{"url":{"schema":"https","addr":"sourcefuel.co.zw/postInf3gmbh-delivery4879/files/FedExSans_W-Regular.475f432261db6051bb40.woff","fqdn":"sourcefuel.co.zw","domain":"sourcefuel.co.zw","tld":"co.zw"},"ip":{"addr":"185.150.190.64","port":443,"asn":23470,"as":"RELIABLESITE","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"font","requested_by":"https://sourcefuel.co.zw/postInf3gmbh-delivery4879/load.php","date":"2026-05-22T03:51:11.857Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"sourcefuel.co.zw","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Sun, 22 Mar 2026 14:39:08 GMT","end":"Sat, 20 Jun 2026 14:39:07 GMT"},"fingerprint":{"sha1":"C0:74:92:37:D4:2A:03:BD:B8:21:45:7E:67:B0:BE:43:7D:A6:C9:B6","sha256":"96:9F:8C:03:B5:AA:16:88:A9:50:11:B8:81:3C:CA:C5:F2:9C:CD:A8:70:98:F5:7B:C1:CF:4A:68:97:2F:2C:04"}}},"request":{"raw":"GET /postInf3gmbh-delivery4879/files/FedExSans_W-Regular.475f432261db6051bb40.woff HTTP/1.1\r\nHost: sourcefuel.co.zw\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: identity\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://sourcefuel.co.zw/postInf3gmbh-delivery4879/files/styles.5b3e5351d5009950b08d.css\r\nCookie: PHPSESSID=fe392b446f25471dbe4f2f80e6b968b4\r\nSec-Fetch-Dest: font\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Fri, 22 May 2026 03:51:11 GMT\r\ncontent-type: text/html; charset=UTF-8\r\ncontent-length: 0\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":0,"size_decoded":0,"mime_type":"text/html; charset=UTF-8","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-08-09T14:49:10.846265Z","times_seen":17800640,"resource_available":true,"data":null}},"time_used":207,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":207,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-05-22","alert":"Phishing Block","trigger":"sourcefuel.co.zw","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-05-22","alert":"Sinkholed","trigger":"sourcefuel.co.zw","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-05-22","alert":"Sinkholed","trigger":"sourcefuel.co.zw","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-05-22","alert":"Sinkholed","trigger":"sourcefuel.co.zw","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null}],"urlquery":[{"sensor_name":"urlquery","alert":"Phishing - DHL","verdict":"phishing","severity":"medium","comment":"Associated with DHL phishing","tags":["dhl","logistics","phishing"],"meta":null}]}},{"url":{"schema":"https","addr":"sourcefuel.co.zw/postInf3gmbh-delivery4879/files/styles.5b3e5351d5009950b08d.css","fqdn":"sourcefuel.co.zw","domain":"sourcefuel.co.zw","tld":"co.zw"},"ip":{"addr":"185.150.190.64","port":443,"asn":23470,"as":"RELIABLESITE","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://sourcefuel.co.zw/postInf3gmbh-delivery4879/load.php","date":"2026-05-22T03:51:09.183Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"sourcefuel.co.zw","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Sun, 22 Mar 2026 14:39:08 GMT","end":"Sat, 20 Jun 2026 14:39:07 GMT"},"fingerprint":{"sha1":"C0:74:92:37:D4:2A:03:BD:B8:21:45:7E:67:B0:BE:43:7D:A6:C9:B6","sha256":"96:9F:8C:03:B5:AA:16:88:A9:50:11:B8:81:3C:CA:C5:F2:9C:CD:A8:70:98:F5:7B:C1:CF:4A:68:97:2F:2C:04"}}},"request":{"raw":"GET /postInf3gmbh-delivery4879/files/styles.5b3e5351d5009950b08d.css HTTP/1.1\r\nHost: sourcefuel.co.zw\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://sourcefuel.co.zw/postInf3gmbh-delivery4879/load.php\r\nCookie: PHPSESSID=fe392b446f25471dbe4f2f80e6b968b4\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Fri, 22 May 2026 03:51:09 GMT\r\ncontent-type: text/css\r\nvary: Accept-Encoding\r\nlast-modified: Fri, 11 Aug 2023 00:19:04 GMT\r\ncontent-encoding: br\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":245195,"size_decoded":0,"mime_type":"text/css","magic":"ASCII text, with very long lines (65536), with no line terminators","md5":"0e7b316bbfa05ebb12f509c977ade596","sha1":"c7479dae05b1de9a6483cdbed90d9865afd06e2d","sha256":"e75b3d58f4a6de4da1072b4440dcc397e023a0c767a87cc115e1945de9e39833","sha512":"f4a564e2734e9345c33d2cef1b04c6e312d1806872e03d081714d454458fee229bd226253bf9b53c6a29aefc1dc76dc645a4aa6af9d66ac2c69937b8724e0691","ssdeep":"1536:yHigvaqYdoCOvCsIrzXZbjz5+BVPNH7qKikidmiJdkNlphYstnjZno2H6qr+a:+7UkNl/","tlshash":"3134fe61bda2280cb456447db1867a2c7e2e04615f1b05daefc0a539874f98a3f3fe35","first_seen":"2023-08-15T00:20:01Z","last_seen":"2026-05-22T03:51:39.142958Z","times_seen":363,"resource_available":false,"data":null}},"time_used":1221,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":1221,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-05-22","alert":"Phishing Block","trigger":"sourcefuel.co.zw","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-05-22","alert":"Sinkholed","trigger":"sourcefuel.co.zw","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-05-22","alert":"Sinkholed","trigger":"sourcefuel.co.zw","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-05-22","alert":"Sinkholed","trigger":"sourcefuel.co.zw","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":[{"sensor_name":"urlquery","alert":"Phishing - DHL","verdict":"phishing","severity":"medium","comment":"Associated with DHL phishing","tags":["dhl","logistics","phishing"],"meta":null}]}},{"url":{"schema":"https","addr":"sourcefuel.co.zw/postInf3gmbh-delivery4879/files/dhl-logo.svg","fqdn":"sourcefuel.co.zw","domain":"sourcefuel.co.zw","tld":"co.zw"},"ip":{"addr":"185.150.190.64","port":443,"asn":23470,"as":"RELIABLESITE","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://sourcefuel.co.zw/postInf3gmbh-delivery4879/load.php","date":"2026-05-22T03:51:09.189Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"sourcefuel.co.zw","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Sun, 22 Mar 2026 14:39:08 GMT","end":"Sat, 20 Jun 2026 14:39:07 GMT"},"fingerprint":{"sha1":"C0:74:92:37:D4:2A:03:BD:B8:21:45:7E:67:B0:BE:43:7D:A6:C9:B6","sha256":"96:9F:8C:03:B5:AA:16:88:A9:50:11:B8:81:3C:CA:C5:F2:9C:CD:A8:70:98:F5:7B:C1:CF:4A:68:97:2F:2C:04"}}},"request":{"raw":"GET /postInf3gmbh-delivery4879/files/dhl-logo.svg HTTP/1.1\r\nHost: sourcefuel.co.zw\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://sourcefuel.co.zw/postInf3gmbh-delivery4879/load.php\r\nCookie: PHPSESSID=fe392b446f25471dbe4f2f80e6b968b4\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Fri, 22 May 2026 03:51:09 GMT\r\ncontent-type: image/svg+xml\r\nvary: Accept-Encoding\r\nlast-modified: Fri, 11 Aug 2023 00:19:04 GMT\r\ncontent-encoding: br\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":1603,"size_decoded":0,"mime_type":"image/svg+xml","magic":"SVG Scalable Vector Graphics image","md5":"3fecc9db35d5d2a9e6e71ab4b02d22e5","sha1":"628ba2f505b480097445aaf08649a08242bd6847","sha256":"362bcaa42090e36611031bec6bdaa0600375ef847092cca195c58d3bae9b4419","sha512":"c0d70d0f914d3d9f29366c9886f174580675334ec79ba77158c4cf184075540dd7d25b3f35f7129c1fae764527574daec29f5fb8434817ccbef6951b332cdd5e","ssdeep":"","tlshash":"90317c570394e6ea9d018740473c52d922d1e9afc87064c8a9f33c27eb4cc5848b86d7","first_seen":"2023-04-30T18:39:16Z","last_seen":"2026-07-21T19:53:59.052342Z","times_seen":2812,"resource_available":false,"data":null}},"time_used":1325,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":1325,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-05-22","alert":"Sinkholed","trigger":"sourcefuel.co.zw","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-05-22","alert":"Sinkholed","trigger":"sourcefuel.co.zw","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-05-22","alert":"Phishing Block","trigger":"sourcefuel.co.zw","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-05-22","alert":"Sinkholed","trigger":"sourcefuel.co.zw","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":[{"sensor_name":"urlquery","alert":"Phishing - DHL","verdict":"phishing","severity":"medium","comment":"Associated with DHL phishing","tags":["dhl","logistics","phishing"],"meta":null}]}},{"url":{"schema":"https","addr":"cdnjs.cloudflare.com/ajax/libs/jquery.mask/1.14.16/jquery.mask.min.js","fqdn":"cdnjs.cloudflare.com","domain":"cloudflare.com","tld":"com"},"ip":{"addr":"104.17.25.14","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://sourcefuel.co.zw/postInf3gmbh-delivery4879/load.php","date":"2026-05-22T03:51:09.893Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"cdnjs.cloudflare.com","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Tue, 12 May 2026 03:46:57 GMT","end":"Mon, 10 Aug 2026 04:46:42 GMT"},"fingerprint":{"sha1":"95:12:1E:0A:F6:69:8B:FC:A0:08:DA:67:1A:A4:D1:9D:87:F5:E9:07","sha256":"F3:4A:39:63:C7:6A:CE:66:1A:B4:62:2C:E9:92:82:9A:81:78:1B:CC:3F:D5:2D:0A:6D:D6:89:D9:F6:66:7B:BC"}}},"request":{"raw":"GET /ajax/libs/jquery.mask/1.14.16/jquery.mask.min.js HTTP/1.1\r\nHost: cdnjs.cloudflare.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://sourcefuel.co.zw/\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ndate: Fri, 22 May 2026 03:51:10 GMT\r\ncontent-type: application/javascript; charset=utf-8\r\ncontent-length: 3074\r\nserver: cloudflare\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.01,\"max_age\":604800}\r\naccess-control-allow-origin: *\r\ncache-control: public, max-age=30672000\r\ncontent-encoding: br\r\netag: \"5eb03ec3-2087\"\r\nlast-modified: Mon, 04 May 2020 16:11:47 GMT\r\ncross-origin-resource-policy: cross-origin\r\ntiming-allow-origin: *\r\nx-content-type-options: nosniff\r\ncf-cdnjs-via: cfworker/kv\r\nvary: Accept-Encoding\r\ncf-cache-status: HIT\r\nage: 733282\r\nexpires: Wed, 12 May 2027 03:51:10 GMT\r\naccept-ranges: bytes\r\nstrict-transport-security: max-age=15780000\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=%2F9ffTNglGbcl7f2OQLk6fHYidc8e5PlzYEu2y%2FsINpiDd%2B1UQVDIFV%2FT6JUXPDTz0ISIHc7U9y9yjX7m8wJmRp2h0m1lvXzJgTcjcS9OjRRcX%2BOsdN3EXcJL%2Bop%2FM6lyBI5y4u%2FM\"}]}\r\ncf-ray: 9ff8dc5f9b095a0f-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":8327,"size_decoded":0,"mime_type":"application/javascript; charset=utf-8","magic":"JavaScript source, ASCII text, with very long lines (542)","md5":"cc290e6c3aeecf5021dd82ad8df2512a","sha1":"fb983aecd3940e8ebbfe5e74c8099cee9223c957","sha256":"2a0db34dc14ef4b5ce73b230701c7561e5012667a4c9cb274ecab646e1474995","sha512":"a47546a57ec5ff6ef267421263e5558f250b0296c3943d3f5f4ae019b4ea084ed6156e4c7b3353586fdd9e1b5b06e202cec7745903e0a44e111012eff94a8287","ssdeep":"192:cd227YJcI/iarixR4aCSfZrkiqVNReFevZA8A/A:cdaJ39e74boZrkVVjeFexA8AY","tlshash":"b502e8d5329670b253b371e901bf020bebb7afa156de4814d61a94e0ae74f890053f7e","first_seen":"2023-03-07T01:06:41Z","last_seen":"2026-08-09T14:42:31.227948Z","times_seen":12918,"resource_available":true,"data":null}},"time_used":231,"timings":{"blocked":96,"dns":1,"connect":30,"send":0,"wait":33,"receive":0,"ssl":67},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"sourcefuel.co.zw/postInf3gmbh-delivery4879/files/bootstrap-icons.woff2?856008caa5eb66df68595e734e59580d","fqdn":"sourcefuel.co.zw","domain":"sourcefuel.co.zw","tld":"co.zw"},"ip":{"addr":"185.150.190.64","port":443,"asn":23470,"as":"RELIABLESITE","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"font","requested_by":"https://sourcefuel.co.zw/postInf3gmbh-delivery4879/load.php","date":"2026-05-22T03:51:11.588Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"sourcefuel.co.zw","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Sun, 22 Mar 2026 14:39:08 GMT","end":"Sat, 20 Jun 2026 14:39:07 GMT"},"fingerprint":{"sha1":"C0:74:92:37:D4:2A:03:BD:B8:21:45:7E:67:B0:BE:43:7D:A6:C9:B6","sha256":"96:9F:8C:03:B5:AA:16:88:A9:50:11:B8:81:3C:CA:C5:F2:9C:CD:A8:70:98:F5:7B:C1:CF:4A:68:97:2F:2C:04"}}},"request":{"raw":"GET /postInf3gmbh-delivery4879/files/bootstrap-icons.woff2?856008caa5eb66df68595e734e59580d HTTP/1.1\r\nHost: sourcefuel.co.zw\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: identity\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://sourcefuel.co.zw/postInf3gmbh-delivery4879/files/bootstrap-icons.css\r\nCookie: PHPSESSID=fe392b446f25471dbe4f2f80e6b968b4\r\nSec-Fetch-Dest: font\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Fri, 22 May 2026 03:51:11 GMT\r\ncontent-type: font/woff2\r\ncontent-length: 85044\r\nlast-modified: Fri, 11 Aug 2023 00:19:04 GMT\r\naccept-ranges: bytes\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":85044,"size_decoded":0,"mime_type":"font/woff2","magic":"Web Open Font Format (Version 2), TrueType, length 85044, version 1.0","md5":"316400c09c0560b3812e58b3124bbf15","sha1":"2314d4d73dd9ed7aa2f9d18d45e71ca0440ac0a9","sha256":"856b3f9e0df4f7061c8948021c7cc6e6263d96c48161e7fe9e4fbefd0c69a085","sha512":"d410d293cbd3fc7198c171d72c137d3032d0d1d8c8108aaa20dd273e745ea3df928242cfa2fe5a095af36e43ef3883fadb3794295dba6403f61d575e659ffb81","ssdeep":"1536:zy8frvR5PzrH/MIF87QvPUJz7e9JWb81gImxOj+HX7jzjdO8MxZucXgApaZnCGOx:7frJ5P/H/MIzkzyJ3gImM4HJ90ucXg2t","tlshash":"12831285e754eebcb500e861f57770987a474e10eb9bf9101d18e0e9c8e1f698a8fb60","first_seen":"2023-05-03T14:41:05Z","last_seen":"2026-08-01T21:16:29.141521Z","times_seen":1190,"resource_available":false,"data":null}},"time_used":468,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":112,"receive":356,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-05-22","alert":"Phishing Block","trigger":"sourcefuel.co.zw","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-05-22","alert":"Sinkholed","trigger":"sourcefuel.co.zw","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-05-22","alert":"Sinkholed","trigger":"sourcefuel.co.zw","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-05-22","alert":"Sinkholed","trigger":"sourcefuel.co.zw","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":[{"sensor_name":"urlquery","alert":"Phishing - DHL","verdict":"phishing","severity":"medium","comment":"Associated with DHL phishing","tags":["dhl","logistics","phishing"],"meta":null}]}},{"url":{"schema":"https","addr":"sourcefuel.co.zw/postInf3gmbh-delivery4879/files/assets/fonts/FedExSans_W-Italic.woff","fqdn":"sourcefuel.co.zw","domain":"sourcefuel.co.zw","tld":"co.zw"},"ip":{"addr":"185.150.190.64","port":443,"asn":23470,"as":"RELIABLESITE","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"font","requested_by":"https://sourcefuel.co.zw/postInf3gmbh-delivery4879/load.php","date":"2026-05-22T03:51:11.597Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"sourcefuel.co.zw","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Sun, 22 Mar 2026 14:39:08 GMT","end":"Sat, 20 Jun 2026 14:39:07 GMT"},"fingerprint":{"sha1":"C0:74:92:37:D4:2A:03:BD:B8:21:45:7E:67:B0:BE:43:7D:A6:C9:B6","sha256":"96:9F:8C:03:B5:AA:16:88:A9:50:11:B8:81:3C:CA:C5:F2:9C:CD:A8:70:98:F5:7B:C1:CF:4A:68:97:2F:2C:04"}}},"request":{"raw":"GET /postInf3gmbh-delivery4879/files/assets/fonts/FedExSans_W-Italic.woff HTTP/1.1\r\nHost: sourcefuel.co.zw\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: identity\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://sourcefuel.co.zw/postInf3gmbh-delivery4879/files/X911.css\r\nCookie: PHPSESSID=fe392b446f25471dbe4f2f80e6b968b4\r\nSec-Fetch-Dest: font\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Fri, 22 May 2026 03:51:11 GMT\r\ncontent-type: text/html; charset=UTF-8\r\ncontent-length: 0\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":0,"size_decoded":0,"mime_type":"text/html; charset=UTF-8","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-08-09T14:49:10.846265Z","times_seen":17800640,"resource_available":true,"data":null}},"time_used":460,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":460,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-05-22","alert":"Phishing Block","trigger":"sourcefuel.co.zw","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-05-22","alert":"Sinkholed","trigger":"sourcefuel.co.zw","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-05-22","alert":"Sinkholed","trigger":"sourcefuel.co.zw","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-05-22","alert":"Sinkholed","trigger":"sourcefuel.co.zw","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null}],"urlquery":[{"sensor_name":"urlquery","alert":"Phishing - DHL","verdict":"phishing","severity":"medium","comment":"Associated with DHL phishing","tags":["dhl","logistics","phishing"],"meta":null}]}},{"url":{"schema":"https","addr":"sourcefuel.co.zw/postInf3gmbh-delivery4879/files/assets/fonts/FedExSans_W-Bold.woff","fqdn":"sourcefuel.co.zw","domain":"sourcefuel.co.zw","tld":"co.zw"},"ip":{"addr":"185.150.190.64","port":443,"asn":23470,"as":"RELIABLESITE","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"font","requested_by":"https://sourcefuel.co.zw/postInf3gmbh-delivery4879/load.php","date":"2026-05-22T03:51:12.098Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"sourcefuel.co.zw","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Sun, 22 Mar 2026 14:39:08 GMT","end":"Sat, 20 Jun 2026 14:39:07 GMT"},"fingerprint":{"sha1":"C0:74:92:37:D4:2A:03:BD:B8:21:45:7E:67:B0:BE:43:7D:A6:C9:B6","sha256":"96:9F:8C:03:B5:AA:16:88:A9:50:11:B8:81:3C:CA:C5:F2:9C:CD:A8:70:98:F5:7B:C1:CF:4A:68:97:2F:2C:04"}}},"request":{"raw":"GET /postInf3gmbh-delivery4879/files/assets/fonts/FedExSans_W-Bold.woff HTTP/1.1\r\nHost: sourcefuel.co.zw\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: identity\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://sourcefuel.co.zw/postInf3gmbh-delivery4879/files/common-core_SHF.css\r\nCookie: PHPSESSID=fe392b446f25471dbe4f2f80e6b968b4\r\nSec-Fetch-Dest: font\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Fri, 22 May 2026 03:51:12 GMT\r\ncontent-type: text/html; charset=UTF-8\r\ncontent-length: 0\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":0,"size_decoded":0,"mime_type":"text/html; charset=UTF-8","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-08-09T14:49:10.846265Z","times_seen":17800640,"resource_available":true,"data":null}},"time_used":262,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":262,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-05-22","alert":"Sinkholed","trigger":"sourcefuel.co.zw","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-05-22","alert":"Phishing Block","trigger":"sourcefuel.co.zw","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-05-22","alert":"Sinkholed","trigger":"sourcefuel.co.zw","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-05-22","alert":"Sinkholed","trigger":"sourcefuel.co.zw","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null}],"urlquery":[{"sensor_name":"urlquery","alert":"Phishing - DHL","verdict":"phishing","severity":"medium","comment":"Associated with DHL phishing","tags":["dhl","logistics","phishing"],"meta":null}]}},{"url":{"schema":"https","addr":"t.dtscout.com/pv/?_a=v\u0026_h=sourcefuel.co.zw\u0026_ss=3u176j6x43\u0026_pv=1\u0026_ls=0\u0026_u1=1\u0026_u3=1\u0026_cc=no\u0026_pl=d\u0026_cbid=it9q\u0026_cb=_dtspv.c","fqdn":"t.dtscout.com","domain":"dtscout.com","tld":"com"},"ip":{"addr":"104.26.10.2","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://sourcefuel.co.zw/postInf3gmbh-delivery4879/load.php","date":"2026-05-22T03:51:12.313Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"dtscout.com","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Fri, 24 Apr 2026 23:55:29 GMT","end":"Fri, 24 Jul 2026 00:55:25 GMT"},"fingerprint":{"sha1":"04:6E:9D:44:BE:FC:43:F3:92:FC:C8:C2:75:5B:05:47:96:D5:BF:D8","sha256":"92:CB:19:A4:B6:99:18:9D:B5:D7:DD:BA:A4:20:25:39:68:93:02:5A:57:5E:33:8D:1E:FA:DF:E4:79:F2:69:A1"}}},"request":{"raw":"GET /pv/?_a=v\u0026_h=sourcefuel.co.zw\u0026_ss=3u176j6x43\u0026_pv=1\u0026_ls=0\u0026_u1=1\u0026_u3=1\u0026_cc=no\u0026_pl=d\u0026_cbid=it9q\u0026_cb=_dtspv.c HTTP/1.1\r\nHost: t.dtscout.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://sourcefuel.co.zw/\r\nCookie: df=1779421872\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ndate: Fri, 22 May 2026 03:51:12 GMT\r\ncontent-type: application/javascript\r\nserver: cloudflare\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nx-t: 0.135\r\nx-c: 0\r\nexpires: Fri, 22 May 2026 03:51:11 GMT\r\ncache-control: no-cache\r\ncf-cache-status: DYNAMIC\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=b3MVtznJ8AByCbDB9bYV6HgAy2NqnzaRoImjNC3nfvIRRGVKUOYmbmYZBPZ9lcmAu39rVdffyaZae3bfrRZLTS%2FkayfGR340pK%2Bd%2B5BDZZaD6UIxRV9HGNDrTW6n7Lg%3D\"}]}\r\ncontent-encoding: br\r\ncf-ray: 9ff8dc6e1baa56c9-OSL\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":52,"size_decoded":0,"mime_type":"application/javascript","magic":"ASCII text, with no line terminators","md5":"b160a4c50083bbc13fd75df564dba428","sha1":"a70f0f7a6d2094fc32c541b3f9b5279197715d3c","sha256":"75c6120275574017abb457de6e109c8bb542a6c4e96a2d8ad7ec71b9e0ea6767","sha512":"7a3420967c7369cb1590420bc5917fef544696227dc095effe7a636dbfb23d587efd5dbc1ce60d8917d37f7b05c2eb49a1237dcfecc68244aae094691611b8e0","ssdeep":"","tlshash":"7390021864d180211ac9d744205a5644417207d095c0529584355534214d7c1965b9f8","first_seen":"2026-05-22T03:51:39.148682Z","last_seen":"2026-05-22T03:51:39.148682Z","times_seen":1,"resource_available":true,"data":null}},"time_used":262,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":262,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"sourcefuel.co.zw/postInf3gmbh-delivery4879/control/check_redirect.php?t=1779421873632","fqdn":"sourcefuel.co.zw","domain":"sourcefuel.co.zw","tld":"co.zw"},"ip":{"addr":"185.150.190.64","port":443,"asn":23470,"as":"RELIABLESITE","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"https://sourcefuel.co.zw/postInf3gmbh-delivery4879/load.php","date":"2026-05-22T03:51:13.635Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"sourcefuel.co.zw","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Sun, 22 Mar 2026 14:39:08 GMT","end":"Sat, 20 Jun 2026 14:39:07 GMT"},"fingerprint":{"sha1":"C0:74:92:37:D4:2A:03:BD:B8:21:45:7E:67:B0:BE:43:7D:A6:C9:B6","sha256":"96:9F:8C:03:B5:AA:16:88:A9:50:11:B8:81:3C:CA:C5:F2:9C:CD:A8:70:98:F5:7B:C1:CF:4A:68:97:2F:2C:04"}}},"request":{"raw":"GET /postInf3gmbh-delivery4879/control/check_redirect.php?t=1779421873632 HTTP/1.1\r\nHost: sourcefuel.co.zw\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://sourcefuel.co.zw/postInf3gmbh-delivery4879/load.php\r\nCookie: PHPSESSID=fe392b446f25471dbe4f2f80e6b968b4\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Fri, 22 May 2026 03:51:13 GMT\r\ncontent-type: text/html; charset=UTF-8\r\nvary: Accept-Encoding\r\ncontent-encoding: br\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":11,"size_decoded":0,"mime_type":"text/html; charset=UTF-8","magic":"ASCII text, with no line terminators","md5":"7c94333c07c9c06aee0bc239e4438255","sha1":"d3871bf7893d00a9ba1498cac8411b9334db7a72","sha256":"b21ff5b3f8ebc7f7e216a5edeb092283854a070391ae54a93a95c4e3650905cd","sha512":"4a1e794971f6e56c7aceca52375681bc5c4499898974ff157be7698f592eee14ce87bee7f09b5700a3b19b7462f547ce273e5c7cc8b75011a304c929e42b8ca5","ssdeep":"","tlshash":"6b50000c00330000c03300030000f0003c000c0030300c0000000cc00300000c000000","first_seen":"2024-01-05T04:51:49Z","last_seen":"2026-08-02T21:11:02.414751Z","times_seen":381,"resource_available":false,"data":null}},"time_used":247,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":247,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-05-22","alert":"Phishing Block","trigger":"sourcefuel.co.zw","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-05-22","alert":"Sinkholed","trigger":"sourcefuel.co.zw","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-05-22","alert":"Sinkholed","trigger":"sourcefuel.co.zw","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-05-22","alert":"Sinkholed","trigger":"sourcefuel.co.zw","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":[{"sensor_name":"urlquery","alert":"Phishing - DHL","verdict":"phishing","severity":"medium","comment":"Associated with DHL phishing","tags":["dhl","logistics","phishing"],"meta":null}]}},{"url":{"schema":"https","addr":"cdn.jsdelivr.net/npm/bootstrap@5.0.2/dist/js/bootstrap.bundle.min.js","fqdn":"cdn.jsdelivr.net","domain":"jsdelivr.net","tld":"net"},"ip":{"addr":"167.82.49.229","port":443,"asn":54113,"as":"FASTLY","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://sourcefuel.co.zw/postInf3gmbh-delivery4879/load.php","date":"2026-05-22T03:51:09.891Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"jsdelivr.net","organization":""},"issuer":{"commonName":"GlobalSign Atlas R3 DV TLS CA 2026 Q2","organization":"GlobalSign nv-sa"},"validity":{"start":"Wed, 20 May 2026 15:48:47 GMT","end":"Sat, 05 Dec 2026 14:48:47 GMT"},"fingerprint":{"sha1":"D4:05:C2:EC:C7:EE:2B:D0:08:68:0D:3D:33:77:48:78:43:E7:D1:E1","sha256":"ED:84:90:EE:71:BC:6B:5E:B3:D2:50:B0:23:3A:06:0D:E0:50:C6:B6:A9:09:36:E6:CE:FE:E8:66:89:EB:4E:C5"}}},"request":{"raw":"GET /npm/bootstrap@5.0.2/dist/js/bootstrap.bundle.min.js HTTP/1.1\r\nHost: cdn.jsdelivr.net\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://sourcefuel.co.zw/\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\naccess-control-allow-origin: *\r\naccess-control-expose-headers: *\r\ntiming-allow-origin: *\r\ncache-control: public, max-age=31536000, s-maxage=31536000, immutable\r\ncross-origin-resource-policy: cross-origin\r\nx-content-type-options: nosniff\r\nstrict-transport-security: max-age=31536000; includeSubDomains; preload\r\ncontent-type: application/javascript; charset=utf-8\r\nx-jsd-version: 5.0.2\r\nx-jsd-version-type: version\r\netag: W/\"13397-kBFpUnUH/55mLPZNjjYfNZMIlw0\"\r\ncontent-encoding: br\r\naccept-ranges: bytes\r\ndate: Fri, 22 May 2026 03:51:10 GMT\r\nage: 858571\r\nx-served-by: cache-fra-etou8220154-FRA, cache-hel1410033-HEL\r\nx-cache: HIT, HIT\r\nvary: Accept-Encoding\r\nalt-svc: h3=\":443\";ma=86400,h3-29=\":443\";ma=86400,h3-27=\":443\";ma=86400\r\ncontent-length: 23224\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":78743,"size_decoded":0,"mime_type":"application/javascript; charset=utf-8","magic":"JavaScript source, ASCII text, with very long lines (65299)","md5":"0aa8d64e726c4a57adb5c88f9115996b","sha1":"901169527507ff9e662cf64d8e361f359308970d","sha256":"7e1f1503df765cca5e099891b94e318a2ef95081ba2af1eb6d417cc884bfdbfe","sha512":"ef6583f7684bb3b4f91405e7def90d65f9561baa609540c3a66f3b4de4267d283c2a7af298bd86df447b6ace05993c2182ef47ede4b30c25f79a38ad49e70a9f","ssdeep":"1536:tp+1ZTPR2t4tXbih05ve8/pwgrEpc9t0vSAIAxCs:MFRIpk0vSAV","tlshash":"a573d6493254b87309ee55a68037460bf3255994b14b802cb9bdadde2b3dc8272b7f78","first_seen":"2023-03-07T01:03:37Z","last_seen":"2026-08-09T14:32:50.316315Z","times_seen":24382,"resource_available":true,"data":null}},"time_used":591,"timings":{"blocked":260,"dns":1,"connect":53,"send":0,"wait":55,"receive":11,"ssl":208},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"t.dtscout.com/i/?l=https%3A%2F%2Fsourcefuel.co.zw%2FpostInf3gmbh-delivery4879%2Fload.php\u0026j=\u0026wk=italiauno1","fqdn":"t.dtscout.com","domain":"dtscout.com","tld":"com"},"ip":{"addr":"104.26.10.2","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://sourcefuel.co.zw/postInf3gmbh-delivery4879/load.php","date":"2026-05-22T03:51:11.918Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"dtscout.com","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Fri, 24 Apr 2026 23:55:29 GMT","end":"Fri, 24 Jul 2026 00:55:25 GMT"},"fingerprint":{"sha1":"04:6E:9D:44:BE:FC:43:F3:92:FC:C8:C2:75:5B:05:47:96:D5:BF:D8","sha256":"92:CB:19:A4:B6:99:18:9D:B5:D7:DD:BA:A4:20:25:39:68:93:02:5A:57:5E:33:8D:1E:FA:DF:E4:79:F2:69:A1"}}},"request":{"raw":"GET /i/?l=https%3A%2F%2Fsourcefuel.co.zw%2FpostInf3gmbh-delivery4879%2Fload.php\u0026j=\u0026wk=italiauno1 HTTP/1.1\r\nHost: t.dtscout.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://sourcefuel.co.zw/\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ndate: Fri, 22 May 2026 03:51:12 GMT\r\ncontent-type: application/javascript\r\nserver: cloudflare\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nx-s: mtl2\r\nset-cookie: df=1779421872; Domain=dtscout.com; Expires=Sun, 30-Aug-2026 03:51:12 GMT; Max-Age=8640000; Path=/; SameSite=None; Secure\r\nx-t: 0.778\r\nexpires: Fri, 22 May 2026 03:51:11 GMT\r\ncache-control: no-cache\r\ncf-cache-status: DYNAMIC\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=NOfr2sCNmp%2BxYzhgTgrRV0RE6xWA3hcpH29wj9H%2Fwln1NnfzFfNaB61TY6rp2%2Bq5%2F5QWX1%2FhhjqtyO2P37MCVhtzinVy1DdfOQ66vD2xUyMDb4nDhLjmKvX29z5gGjk%3D\"}]}\r\ncontent-encoding: br\r\ncf-ray: 9ff8dc6c1b0d56c9-OSL\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":2292,"size_decoded":0,"mime_type":"application/javascript","magic":"JavaScript source, ASCII text, with very long lines (2077)","md5":"8450c234da2df92a0c33a47c5aabf6e6","sha1":"0ea50308805f927f1e9ce37a96d44f27e01cdf8e","sha256":"c67ad82f6fe5a742115d0d041e403c18df8da6486fa0dd5fc785d4bb58458ac9","sha512":"1ea70b0b047651af5f5496bdbfac4574dad62bef73132ad667c194c375382c36ea62c24f37a4c2882d6e644846f5b866720a8b33cad3e4e650fa6b9fa0331de8","ssdeep":"","tlshash":"1f41880bb5e5347803e2006965ff635fb5330928bc5784c08596dc04fd749fad1b6eaa","first_seen":"2025-11-28T22:59:20.195769Z","last_seen":"2026-08-05T10:25:07.128353Z","times_seen":3577,"resource_available":true,"data":null}},"time_used":419,"timings":{"blocked":73,"dns":1,"connect":28,"send":0,"wait":271,"receive":0,"ssl":43},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"sourcefuel.co.zw/postInf3gmbh-delivery4879/files/FedExSans_W-Condensed-Bold-Italic.4c1d6f58b86d3a9d2c37.woff","fqdn":"sourcefuel.co.zw","domain":"sourcefuel.co.zw","tld":"co.zw"},"ip":{"addr":"185.150.190.64","port":443,"asn":23470,"as":"RELIABLESITE","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"font","requested_by":"https://sourcefuel.co.zw/postInf3gmbh-delivery4879/load.php","date":"2026-05-22T03:51:12.092Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"sourcefuel.co.zw","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Sun, 22 Mar 2026 14:39:08 GMT","end":"Sat, 20 Jun 2026 14:39:07 GMT"},"fingerprint":{"sha1":"C0:74:92:37:D4:2A:03:BD:B8:21:45:7E:67:B0:BE:43:7D:A6:C9:B6","sha256":"96:9F:8C:03:B5:AA:16:88:A9:50:11:B8:81:3C:CA:C5:F2:9C:CD:A8:70:98:F5:7B:C1:CF:4A:68:97:2F:2C:04"}}},"request":{"raw":"GET /postInf3gmbh-delivery4879/files/FedExSans_W-Condensed-Bold-Italic.4c1d6f58b86d3a9d2c37.woff HTTP/1.1\r\nHost: sourcefuel.co.zw\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: identity\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://sourcefuel.co.zw/postInf3gmbh-delivery4879/files/styles.5b3e5351d5009950b08d.css\r\nCookie: PHPSESSID=fe392b446f25471dbe4f2f80e6b968b4\r\nSec-Fetch-Dest: font\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Fri, 22 May 2026 03:51:12 GMT\r\ncontent-type: text/html; charset=UTF-8\r\ncontent-length: 0\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":0,"size_decoded":0,"mime_type":"text/html; charset=UTF-8","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-08-09T14:49:10.846265Z","times_seen":17800640,"resource_available":true,"data":null}},"time_used":265,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":265,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-05-22","alert":"Phishing Block","trigger":"sourcefuel.co.zw","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-05-22","alert":"Sinkholed","trigger":"sourcefuel.co.zw","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-05-22","alert":"Sinkholed","trigger":"sourcefuel.co.zw","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-05-22","alert":"Sinkholed","trigger":"sourcefuel.co.zw","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":[{"sensor_name":"urlquery","alert":"Phishing - DHL","verdict":"phishing","severity":"medium","comment":"Associated with DHL phishing","tags":["dhl","logistics","phishing"],"meta":null}]}},{"url":{"schema":"https","addr":"sourcefuel.co.zw/postInf3gmbh-delivery4879/files/assets/fonts/FedExSans_W-Bold-Italic.woff","fqdn":"sourcefuel.co.zw","domain":"sourcefuel.co.zw","tld":"co.zw"},"ip":{"addr":"185.150.190.64","port":443,"asn":23470,"as":"RELIABLESITE","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"font","requested_by":"https://sourcefuel.co.zw/postInf3gmbh-delivery4879/load.php","date":"2026-05-22T03:51:12.096Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"sourcefuel.co.zw","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Sun, 22 Mar 2026 14:39:08 GMT","end":"Sat, 20 Jun 2026 14:39:07 GMT"},"fingerprint":{"sha1":"C0:74:92:37:D4:2A:03:BD:B8:21:45:7E:67:B0:BE:43:7D:A6:C9:B6","sha256":"96:9F:8C:03:B5:AA:16:88:A9:50:11:B8:81:3C:CA:C5:F2:9C:CD:A8:70:98:F5:7B:C1:CF:4A:68:97:2F:2C:04"}}},"request":{"raw":"GET /postInf3gmbh-delivery4879/files/assets/fonts/FedExSans_W-Bold-Italic.woff HTTP/1.1\r\nHost: sourcefuel.co.zw\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: identity\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://sourcefuel.co.zw/postInf3gmbh-delivery4879/files/common-core_SHF.css\r\nCookie: PHPSESSID=fe392b446f25471dbe4f2f80e6b968b4\r\nSec-Fetch-Dest: font\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Fri, 22 May 2026 03:51:12 GMT\r\ncontent-type: text/html; charset=UTF-8\r\ncontent-length: 0\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":0,"size_decoded":0,"mime_type":"text/html; charset=UTF-8","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-08-09T14:49:10.846265Z","times_seen":17800640,"resource_available":true,"data":null}},"time_used":263,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":263,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-05-22","alert":"Sinkholed","trigger":"sourcefuel.co.zw","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-05-22","alert":"Phishing Block","trigger":"sourcefuel.co.zw","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-05-22","alert":"Sinkholed","trigger":"sourcefuel.co.zw","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-05-22","alert":"Sinkholed","trigger":"sourcefuel.co.zw","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":[{"sensor_name":"urlquery","alert":"Phishing - DHL","verdict":"phishing","severity":"medium","comment":"Associated with DHL phishing","tags":["dhl","logistics","phishing"],"meta":null}]}},{"url":{"schema":"https","addr":"sourcefuel.co.zw/postInf3gmbh-delivery4879/logs/imhere.php?location=%2FpostInf3gmbh-delivery4879%2Fload.php\u0026t=1779421873833","fqdn":"sourcefuel.co.zw","domain":"sourcefuel.co.zw","tld":"co.zw"},"ip":{"addr":"185.150.190.64","port":443,"asn":23470,"as":"RELIABLESITE","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"fetch","requested_by":"https://sourcefuel.co.zw/postInf3gmbh-delivery4879/load.php","date":"2026-05-22T03:51:13.836Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"sourcefuel.co.zw","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Sun, 22 Mar 2026 14:39:08 GMT","end":"Sat, 20 Jun 2026 14:39:07 GMT"},"fingerprint":{"sha1":"C0:74:92:37:D4:2A:03:BD:B8:21:45:7E:67:B0:BE:43:7D:A6:C9:B6","sha256":"96:9F:8C:03:B5:AA:16:88:A9:50:11:B8:81:3C:CA:C5:F2:9C:CD:A8:70:98:F5:7B:C1:CF:4A:68:97:2F:2C:04"}}},"request":{"raw":"GET /postInf3gmbh-delivery4879/logs/imhere.php?location=%2FpostInf3gmbh-delivery4879%2Fload.php\u0026t=1779421873833 HTTP/1.1\r\nHost: sourcefuel.co.zw\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://sourcefuel.co.zw/postInf3gmbh-delivery4879/load.php\r\nDNT: 1\r\nConnection: keep-alive\r\nCookie: PHPSESSID=fe392b446f25471dbe4f2f80e6b968b4\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Fri, 22 May 2026 03:51:13 GMT\r\ncontent-type: text/html; charset=UTF-8\r\nvary: Accept-Encoding\r\ncontent-encoding: br\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":24,"size_decoded":0,"mime_type":"text/html; charset=UTF-8","magic":"ASCII text, with no line terminators","md5":"f6530f8413fde8efecc930d6ef59f49e","sha1":"f208906bea70d0a717fd9c52f7a4c655bf7e1e5c","sha256":"b3d21470af59b4bbc88dad6d7a8b29c4b9e68b92ba797d502d69fc2f8adb4ae1","sha512":"1e8adc9424604a19aa3dafb80126aed94ec40982cfac18945c9d19f94b29ffc58cfaf0447cef6b656d729755b1c09789bde1a57caac94d35f45a2b79498aae5f","ssdeep":"","tlshash":"f87000a3208038082280a00028800aa82228f008208000808cbc280a30e22a808a3028","first_seen":"2024-01-05T04:51:49Z","last_seen":"2026-08-02T21:11:02.411686Z","times_seen":368,"resource_available":false,"data":null}},"time_used":175,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":175,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-05-22","alert":"Sinkholed","trigger":"sourcefuel.co.zw","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-05-22","alert":"Phishing Block","trigger":"sourcefuel.co.zw","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-05-22","alert":"Sinkholed","trigger":"sourcefuel.co.zw","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-05-22","alert":"Sinkholed","trigger":"sourcefuel.co.zw","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null}],"urlquery":[{"sensor_name":"urlquery","alert":"Phishing - DHL","verdict":"phishing","severity":"medium","comment":"Associated with DHL phishing","tags":["dhl","logistics","phishing"],"meta":null}]}},{"url":{"schema":"https","addr":"sourcefuel.co.zw/postInf3gmbh-delivery4879/logs/imhere.php?location=%2FpostInf3gmbh-delivery4879%2Fload.php\u0026t=1779421876033","fqdn":"sourcefuel.co.zw","domain":"sourcefuel.co.zw","tld":"co.zw"},"ip":{"addr":"185.150.190.64","port":443,"asn":23470,"as":"RELIABLESITE","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"fetch","requested_by":"https://sourcefuel.co.zw/postInf3gmbh-delivery4879/load.php","date":"2026-05-22T03:51:16.037Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"sourcefuel.co.zw","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Sun, 22 Mar 2026 14:39:08 GMT","end":"Sat, 20 Jun 2026 14:39:07 GMT"},"fingerprint":{"sha1":"C0:74:92:37:D4:2A:03:BD:B8:21:45:7E:67:B0:BE:43:7D:A6:C9:B6","sha256":"96:9F:8C:03:B5:AA:16:88:A9:50:11:B8:81:3C:CA:C5:F2:9C:CD:A8:70:98:F5:7B:C1:CF:4A:68:97:2F:2C:04"}}},"request":{"raw":"GET /postInf3gmbh-delivery4879/logs/imhere.php?location=%2FpostInf3gmbh-delivery4879%2Fload.php\u0026t=1779421876033 HTTP/1.1\r\nHost: sourcefuel.co.zw\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://sourcefuel.co.zw/postInf3gmbh-delivery4879/load.php\r\nDNT: 1\r\nConnection: keep-alive\r\nCookie: PHPSESSID=fe392b446f25471dbe4f2f80e6b968b4\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Fri, 22 May 2026 03:51:16 GMT\r\ncontent-type: text/html; charset=UTF-8\r\nvary: Accept-Encoding\r\ncontent-encoding: br\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":24,"size_decoded":0,"mime_type":"text/html; charset=UTF-8","magic":"ASCII text, with no line terminators","md5":"f6530f8413fde8efecc930d6ef59f49e","sha1":"f208906bea70d0a717fd9c52f7a4c655bf7e1e5c","sha256":"b3d21470af59b4bbc88dad6d7a8b29c4b9e68b92ba797d502d69fc2f8adb4ae1","sha512":"1e8adc9424604a19aa3dafb80126aed94ec40982cfac18945c9d19f94b29ffc58cfaf0447cef6b656d729755b1c09789bde1a57caac94d35f45a2b79498aae5f","ssdeep":"","tlshash":"f87000a3208038082280a00028800aa82228f008208000808cbc280a30e22a808a3028","first_seen":"2024-01-05T04:51:49Z","last_seen":"2026-08-02T21:11:02.411686Z","times_seen":368,"resource_available":false,"data":null}},"time_used":335,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":335,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-05-22","alert":"Sinkholed","trigger":"sourcefuel.co.zw","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-05-22","alert":"Phishing Block","trigger":"sourcefuel.co.zw","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-05-22","alert":"Sinkholed","trigger":"sourcefuel.co.zw","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-05-22","alert":"Sinkholed","trigger":"sourcefuel.co.zw","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null}],"urlquery":[{"sensor_name":"urlquery","alert":"Phishing - DHL","verdict":"phishing","severity":"medium","comment":"Associated with DHL phishing","tags":["dhl","logistics","phishing"],"meta":null}]}},{"url":{"schema":"https","addr":"sourcefuel.co.zw/postInf3gmbh-delivery4879/control/check_redirect.php?t=1779421877632","fqdn":"sourcefuel.co.zw","domain":"sourcefuel.co.zw","tld":"co.zw"},"ip":{"addr":"185.150.190.64","port":443,"asn":23470,"as":"RELIABLESITE","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"https://sourcefuel.co.zw/postInf3gmbh-delivery4879/load.php","date":"2026-05-22T03:51:17.635Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"sourcefuel.co.zw","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Sun, 22 Mar 2026 14:39:08 GMT","end":"Sat, 20 Jun 2026 14:39:07 GMT"},"fingerprint":{"sha1":"C0:74:92:37:D4:2A:03:BD:B8:21:45:7E:67:B0:BE:43:7D:A6:C9:B6","sha256":"96:9F:8C:03:B5:AA:16:88:A9:50:11:B8:81:3C:CA:C5:F2:9C:CD:A8:70:98:F5:7B:C1:CF:4A:68:97:2F:2C:04"}}},"request":{"raw":"GET /postInf3gmbh-delivery4879/control/check_redirect.php?t=1779421877632 HTTP/1.1\r\nHost: sourcefuel.co.zw\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://sourcefuel.co.zw/postInf3gmbh-delivery4879/load.php\r\nCookie: PHPSESSID=fe392b446f25471dbe4f2f80e6b968b4\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Fri, 22 May 2026 03:51:17 GMT\r\ncontent-type: text/html; charset=UTF-8\r\nvary: Accept-Encoding\r\ncontent-encoding: br\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":11,"size_decoded":0,"mime_type":"text/html; charset=UTF-8","magic":"ASCII text, with no line terminators","md5":"7c94333c07c9c06aee0bc239e4438255","sha1":"d3871bf7893d00a9ba1498cac8411b9334db7a72","sha256":"b21ff5b3f8ebc7f7e216a5edeb092283854a070391ae54a93a95c4e3650905cd","sha512":"4a1e794971f6e56c7aceca52375681bc5c4499898974ff157be7698f592eee14ce87bee7f09b5700a3b19b7462f547ce273e5c7cc8b75011a304c929e42b8ca5","ssdeep":"","tlshash":"6b50000c00330000c03300030000f0003c000c0030300c0000000cc00300000c000000","first_seen":"2024-01-05T04:51:49Z","last_seen":"2026-08-02T21:11:02.414751Z","times_seen":381,"resource_available":false,"data":null}},"time_used":127,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":127,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-05-22","alert":"Phishing Block","trigger":"sourcefuel.co.zw","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-05-22","alert":"Sinkholed","trigger":"sourcefuel.co.zw","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-05-22","alert":"Sinkholed","trigger":"sourcefuel.co.zw","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-05-22","alert":"Sinkholed","trigger":"sourcefuel.co.zw","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null}],"urlquery":[{"sensor_name":"urlquery","alert":"Phishing - DHL","verdict":"phishing","severity":"medium","comment":"Associated with DHL phishing","tags":["dhl","logistics","phishing"],"meta":null}]}},{"url":{"schema":"https","addr":"sourcefuel.co.zw/postInf3gmbh-delivery4879/files/common-core_SHF.css","fqdn":"sourcefuel.co.zw","domain":"sourcefuel.co.zw","tld":"co.zw"},"ip":{"addr":"185.150.190.64","port":443,"asn":23470,"as":"RELIABLESITE","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://sourcefuel.co.zw/postInf3gmbh-delivery4879/load.php","date":"2026-05-22T03:51:09.179Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"sourcefuel.co.zw","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Sun, 22 Mar 2026 14:39:08 GMT","end":"Sat, 20 Jun 2026 14:39:07 GMT"},"fingerprint":{"sha1":"C0:74:92:37:D4:2A:03:BD:B8:21:45:7E:67:B0:BE:43:7D:A6:C9:B6","sha256":"96:9F:8C:03:B5:AA:16:88:A9:50:11:B8:81:3C:CA:C5:F2:9C:CD:A8:70:98:F5:7B:C1:CF:4A:68:97:2F:2C:04"}}},"request":{"raw":"GET /postInf3gmbh-delivery4879/files/common-core_SHF.css HTTP/1.1\r\nHost: sourcefuel.co.zw\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://sourcefuel.co.zw/postInf3gmbh-delivery4879/load.php\r\nCookie: PHPSESSID=fe392b446f25471dbe4f2f80e6b968b4\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Fri, 22 May 2026 03:51:09 GMT\r\ncontent-type: text/css\r\nvary: Accept-Encoding\r\nlast-modified: Fri, 11 Aug 2023 00:19:04 GMT\r\ncontent-encoding: br\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":1142942,"size_decoded":0,"mime_type":"text/css","magic":"ASCII text, with very long lines (65536), with no line terminators","md5":"dfa262bbe9f1c7084d522d2c20a73951","sha1":"e9dd4bbf689defdcb0cfc6602c758a7433104d61","sha256":"ed78640da66628c4b3c82f58c1b5ac1f98633d20252889415fb8f72aa741ef1f","sha512":"f2c060a20d92a5d5d4572f35cdc178f4022628649faf2fc117dcae13cb4b842258ff300e72ad85ab63c0535da1d17508200a021981593c830ccb018ce12a9d14","ssdeep":"1536:l+ho7vC9vvTtWr0xEFrRQz+nnK5mu5/c6uUO5IcRobtLV2lS:N65h9","tlshash":"e625d3aab7c11415e2ad882a90f12bfe44bf7c44b727984ae59b7b5c5e47fc91103c0b","first_seen":"2025-08-01T21:16:00.33036Z","last_seen":"2026-05-22T03:51:39.152128Z","times_seen":69,"resource_available":false,"data":null}},"time_used":702,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":702,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-05-22","alert":"Sinkholed","trigger":"sourcefuel.co.zw","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-05-22","alert":"Sinkholed","trigger":"sourcefuel.co.zw","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-05-22","alert":"Phishing Block","trigger":"sourcefuel.co.zw","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-05-22","alert":"Sinkholed","trigger":"sourcefuel.co.zw","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null}],"urlquery":[{"sensor_name":"urlquery","alert":"Phishing - DHL","verdict":"phishing","severity":"medium","comment":"Associated with DHL phishing","tags":["dhl","logistics","phishing"],"meta":null}]}},{"url":{"schema":"https","addr":"sourcefuel.co.zw/postInf3gmbh-delivery4879/files/font-awesome.min.css","fqdn":"sourcefuel.co.zw","domain":"sourcefuel.co.zw","tld":"co.zw"},"ip":{"addr":"185.150.190.64","port":443,"asn":23470,"as":"RELIABLESITE","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://sourcefuel.co.zw/postInf3gmbh-delivery4879/load.php","date":"2026-05-22T03:51:09.185Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"sourcefuel.co.zw","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Sun, 22 Mar 2026 14:39:08 GMT","end":"Sat, 20 Jun 2026 14:39:07 GMT"},"fingerprint":{"sha1":"C0:74:92:37:D4:2A:03:BD:B8:21:45:7E:67:B0:BE:43:7D:A6:C9:B6","sha256":"96:9F:8C:03:B5:AA:16:88:A9:50:11:B8:81:3C:CA:C5:F2:9C:CD:A8:70:98:F5:7B:C1:CF:4A:68:97:2F:2C:04"}}},"request":{"raw":"GET /postInf3gmbh-delivery4879/files/font-awesome.min.css HTTP/1.1\r\nHost: sourcefuel.co.zw\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://sourcefuel.co.zw/postInf3gmbh-delivery4879/load.php\r\nCookie: PHPSESSID=fe392b446f25471dbe4f2f80e6b968b4\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Fri, 22 May 2026 03:51:09 GMT\r\ncontent-type: text/css\r\nvary: Accept-Encoding\r\nlast-modified: Fri, 11 Aug 2023 00:19:04 GMT\r\ncontent-encoding: br\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":31000,"size_decoded":0,"mime_type":"text/css","magic":"ASCII text, with very long lines (30837)","md5":"269550530cc127b6aa5a35925a7de6ce","sha1":"512c7d79033e3028a9be61b540cf1a6870c896f8","sha256":"799aeb25cc0373fdee0e1b1db7ad6c2f6a0e058dfadaa3379689f583213190bd","sha512":"49f4e24e55fa924faa8ad7debe5ffb2e26d439e25696df6b6f20e7f766b50ea58ec3dbd61b6305a1acacd2c80e6e659accee4140f885b9c9e71008e9001fbf4b","ssdeep":"384:wHu5yWeTUKW+KlkJ5de2UYDyVfwYUas2l8yQ/8dwmaU8G:wwlr+Klk3Yi+fwYUf2l8yQ/e9vf","tlshash":"78d241e8e54c01d66731c48bff81b36862b6fb3dd5854da9f01f290c29d226522c5fba","first_seen":"2023-04-05T03:13:25Z","last_seen":"2026-08-09T14:49:16.3532Z","times_seen":307333,"resource_available":true,"data":null}},"time_used":1331,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":1331,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-05-22","alert":"Sinkholed","trigger":"sourcefuel.co.zw","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-05-22","alert":"Phishing Block","trigger":"sourcefuel.co.zw","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-05-22","alert":"Sinkholed","trigger":"sourcefuel.co.zw","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-05-22","alert":"Sinkholed","trigger":"sourcefuel.co.zw","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":[{"sensor_name":"urlquery","alert":"Phishing - DHL","verdict":"phishing","severity":"medium","comment":"Associated with DHL phishing","tags":["dhl","logistics","phishing"],"meta":null}]}},{"url":{"schema":"https","addr":"sourcefuel.co.zw/postInf3gmbh-delivery4879/files/bootstrap-icons.css","fqdn":"sourcefuel.co.zw","domain":"sourcefuel.co.zw","tld":"co.zw"},"ip":{"addr":"185.150.190.64","port":443,"asn":23470,"as":"RELIABLESITE","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://sourcefuel.co.zw/postInf3gmbh-delivery4879/load.php","date":"2026-05-22T03:51:09.187Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"sourcefuel.co.zw","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Sun, 22 Mar 2026 14:39:08 GMT","end":"Sat, 20 Jun 2026 14:39:07 GMT"},"fingerprint":{"sha1":"C0:74:92:37:D4:2A:03:BD:B8:21:45:7E:67:B0:BE:43:7D:A6:C9:B6","sha256":"96:9F:8C:03:B5:AA:16:88:A9:50:11:B8:81:3C:CA:C5:F2:9C:CD:A8:70:98:F5:7B:C1:CF:4A:68:97:2F:2C:04"}}},"request":{"raw":"GET /postInf3gmbh-delivery4879/files/bootstrap-icons.css HTTP/1.1\r\nHost: sourcefuel.co.zw\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://sourcefuel.co.zw/postInf3gmbh-delivery4879/load.php\r\nCookie: PHPSESSID=fe392b446f25471dbe4f2f80e6b968b4\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Fri, 22 May 2026 03:51:09 GMT\r\ncontent-type: text/css\r\nvary: Accept-Encoding\r\nlast-modified: Fri, 11 Aug 2023 00:19:04 GMT\r\ncontent-encoding: br\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":65680,"size_decoded":0,"mime_type":"text/css","magic":"ASCII text","md5":"1a264f8a938f1bafd771567199eb3662","sha1":"d0affd8c41b450d30d2bd71ae2b852ac073e960c","sha256":"db3bddf54dea690aa25839265e3ba48668aa86636da378edf0eba51fcd783daa","sha512":"1ca414337649b2d81fe5c58444f47d1af3e544f52e62765f0ea79b1d225940b22542e04fa74023ef487826a915a5ac1bc30eba49b532c0d134646e4e124c6b52","ssdeep":"384:fWqJVm8OAL1M+hQokEYm47U7yH2CuwZwmiQObdNJew4vM4+jQRe2p85seIwTcSx5:+qnm8OAL1Mzocm4KyH2CuwZwmij34k4M","tlshash":"c253ddbad18f05f59341e4d92743674293a9ba7ce1813c7ad342399ee3c46188ad73ec","first_seen":"2023-04-13T20:26:04Z","last_seen":"2026-05-22T03:51:39.153351Z","times_seen":514,"resource_available":false,"data":null}},"time_used":1330,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":1330,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-05-22","alert":"Sinkholed","trigger":"sourcefuel.co.zw","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-05-22","alert":"Phishing Block","trigger":"sourcefuel.co.zw","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-05-22","alert":"Sinkholed","trigger":"sourcefuel.co.zw","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-05-22","alert":"Sinkholed","trigger":"sourcefuel.co.zw","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null}],"urlquery":[{"sensor_name":"urlquery","alert":"Phishing - DHL","verdict":"phishing","severity":"medium","comment":"Associated with DHL phishing","tags":["dhl","logistics","phishing"],"meta":null}]}},{"url":{"schema":"https","addr":"sourcefuel.co.zw/postInf3gmbh-delivery4879/files/LOGAA.svg","fqdn":"sourcefuel.co.zw","domain":"sourcefuel.co.zw","tld":"co.zw"},"ip":{"addr":"185.150.190.64","port":443,"asn":23470,"as":"RELIABLESITE","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://sourcefuel.co.zw/postInf3gmbh-delivery4879/load.php","date":"2026-05-22T03:51:09.190Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"sourcefuel.co.zw","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Sun, 22 Mar 2026 14:39:08 GMT","end":"Sat, 20 Jun 2026 14:39:07 GMT"},"fingerprint":{"sha1":"C0:74:92:37:D4:2A:03:BD:B8:21:45:7E:67:B0:BE:43:7D:A6:C9:B6","sha256":"96:9F:8C:03:B5:AA:16:88:A9:50:11:B8:81:3C:CA:C5:F2:9C:CD:A8:70:98:F5:7B:C1:CF:4A:68:97:2F:2C:04"}}},"request":{"raw":"GET /postInf3gmbh-delivery4879/files/LOGAA.svg HTTP/1.1\r\nHost: sourcefuel.co.zw\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://sourcefuel.co.zw/postInf3gmbh-delivery4879/load.php\r\nCookie: PHPSESSID=fe392b446f25471dbe4f2f80e6b968b4\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Fri, 22 May 2026 03:51:09 GMT\r\ncontent-type: image/svg+xml\r\nvary: Accept-Encoding\r\nlast-modified: Fri, 11 Aug 2023 00:19:04 GMT\r\ncontent-encoding: br\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":2390,"size_decoded":0,"mime_type":"image/svg+xml","magic":"SVG Scalable Vector Graphics image","md5":"0308f4a1104011db933c61a3bd39023b","sha1":"33174699effe0d92a85be40846052c2ae482c4be","sha256":"3fbebbcc1ebf48ebe492e6080cf7c618c15b9a23d5ae6d771b0bce47ad5753eb","sha512":"93777e9cff90edde41eccacb1133c7e84858d5b44702bf3ed85b06d7eda31259f9a126f205d79e511ee107a3f8dd8a9b1425baa9e24c765d6210a88e29aff1ec","ssdeep":"","tlshash":"f84140466328e778eec0462d8170b45835a8dced66b0f2ccee9b0557e41d8e064ecbde","first_seen":"2023-08-15T00:20:01Z","last_seen":"2026-05-22T03:51:39.153868Z","times_seen":458,"resource_available":false,"data":null}},"time_used":1322,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":1322,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-05-22","alert":"Phishing Block","trigger":"sourcefuel.co.zw","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-05-22","alert":"Sinkholed","trigger":"sourcefuel.co.zw","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-05-22","alert":"Sinkholed","trigger":"sourcefuel.co.zw","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-05-22","alert":"Sinkholed","trigger":"sourcefuel.co.zw","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":[{"sensor_name":"urlquery","alert":"Phishing - DHL","verdict":"phishing","severity":"medium","comment":"Associated with DHL phishing","tags":["dhl","logistics","phishing"],"meta":null}]}},{"url":{"schema":"https","addr":"cdnjs.cloudflare.com/ajax/libs/font-awesome/6.2.0/js/all.min.js","fqdn":"cdnjs.cloudflare.com","domain":"cloudflare.com","tld":"com"},"ip":{"addr":"104.17.25.14","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://sourcefuel.co.zw/postInf3gmbh-delivery4879/load.php","date":"2026-05-22T03:51:09.892Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"cdnjs.cloudflare.com","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Tue, 12 May 2026 03:46:57 GMT","end":"Mon, 10 Aug 2026 04:46:42 GMT"},"fingerprint":{"sha1":"95:12:1E:0A:F6:69:8B:FC:A0:08:DA:67:1A:A4:D1:9D:87:F5:E9:07","sha256":"F3:4A:39:63:C7:6A:CE:66:1A:B4:62:2C:E9:92:82:9A:81:78:1B:CC:3F:D5:2D:0A:6D:D6:89:D9:F6:66:7B:BC"}}},"request":{"raw":"GET /ajax/libs/font-awesome/6.2.0/js/all.min.js HTTP/1.1\r\nHost: cdnjs.cloudflare.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://sourcefuel.co.zw/\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ndate: Fri, 22 May 2026 03:51:10 GMT\r\ncontent-type: application/javascript; charset=utf-8\r\ncontent-length: 418541\r\nserver: cloudflare\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.01,\"max_age\":604800}\r\naccess-control-allow-origin: *\r\ncache-control: public, max-age=30672000\r\ncontent-encoding: br\r\netag: \"630e6e62-662ed\"\r\nlast-modified: Tue, 30 Aug 2022 20:09:06 GMT\r\ncross-origin-resource-policy: cross-origin\r\ntiming-allow-origin: *\r\nx-content-type-options: nosniff\r\ncf-cdnjs-via: cfworker/kv\r\nvary: Accept-Encoding\r\ncf-cache-status: HIT\r\nage: 601519\r\nexpires: Wed, 12 May 2027 03:51:10 GMT\r\naccept-ranges: bytes\r\nstrict-transport-security: max-age=15780000\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=%2FZ99564rFidFQyKlo2hjW0XqFuxfJ37eToT9QRvJag70023%2FucUoJdw6u5fZsSX6UDQj9duvZpcEEixXWJc50m2YIjh%2BqhP2ev7oYwOhxfx0MdCeX6mgllAsByjlsPPeiDUCSvbG\"}]}\r\ncf-ray: 9ff8dc5f9b115a0f-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":1528342,"size_decoded":0,"mime_type":"application/javascript; charset=utf-8","magic":"JavaScript source, ASCII text, with very long lines (65317)","md5":"e930893a97a9ae1545bc1d4b7691ba57","sha1":"99c343b1d1c9331cd1a0778abfac9b7aeaffb108","sha256":"f648f1b49b22316288499e6f323156c4ccd9b0fd310bd58fddf482ec179d1016","sha512":"ef1e1641e478b378d6265daacddbdea5362221a45adbd6a993a1a416cba81740fc9de399f9bf1f45393657120f2a91a3f1710d13e7eb6589a0f178de3b187339","ssdeep":"6144:JTrRrD1LXomaR3Ls8FBHHcKqgyjjGpGxcrK69aRYRMtsDo6ug+H:JCsqHSgyfB69ARYXDooI","tlshash":"6425832cd36593bc9d9687f5ca2120b47d8f51ee75e0a328e278c5b0b2620dcd5d9cca","first_seen":"2025-07-26T17:28:19.15574Z","last_seen":"2026-08-07T15:03:58.664649Z","times_seen":967,"resource_available":false,"data":null}},"time_used":353,"timings":{"blocked":102,"dns":0,"connect":30,"send":0,"wait":36,"receive":110,"ssl":69},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"sourcefuel.co.zw/postInf3gmbh-delivery4879/files/assets/fonts/FedExSans_W-Regular.woff","fqdn":"sourcefuel.co.zw","domain":"sourcefuel.co.zw","tld":"co.zw"},"ip":{"addr":"185.150.190.64","port":443,"asn":23470,"as":"RELIABLESITE","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"font","requested_by":"https://sourcefuel.co.zw/postInf3gmbh-delivery4879/load.php","date":"2026-05-22T03:51:11.584Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"sourcefuel.co.zw","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Sun, 22 Mar 2026 14:39:08 GMT","end":"Sat, 20 Jun 2026 14:39:07 GMT"},"fingerprint":{"sha1":"C0:74:92:37:D4:2A:03:BD:B8:21:45:7E:67:B0:BE:43:7D:A6:C9:B6","sha256":"96:9F:8C:03:B5:AA:16:88:A9:50:11:B8:81:3C:CA:C5:F2:9C:CD:A8:70:98:F5:7B:C1:CF:4A:68:97:2F:2C:04"}}},"request":{"raw":"GET /postInf3gmbh-delivery4879/files/assets/fonts/FedExSans_W-Regular.woff HTTP/1.1\r\nHost: sourcefuel.co.zw\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: identity\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://sourcefuel.co.zw/postInf3gmbh-delivery4879/files/X911.css\r\nCookie: PHPSESSID=fe392b446f25471dbe4f2f80e6b968b4\r\nSec-Fetch-Dest: font\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Fri, 22 May 2026 03:51:11 GMT\r\ncontent-type: text/html; charset=UTF-8\r\ncontent-length: 0\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":0,"size_decoded":0,"mime_type":"text/html; charset=UTF-8","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-08-09T14:49:10.846265Z","times_seen":17800640,"resource_available":true,"data":null}},"time_used":111,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":111,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-05-22","alert":"Sinkholed","trigger":"sourcefuel.co.zw","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-05-22","alert":"Sinkholed","trigger":"sourcefuel.co.zw","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-05-22","alert":"Phishing Block","trigger":"sourcefuel.co.zw","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-05-22","alert":"Sinkholed","trigger":"sourcefuel.co.zw","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":[{"sensor_name":"urlquery","alert":"Phishing - DHL","verdict":"phishing","severity":"medium","comment":"Associated with DHL phishing","tags":["dhl","logistics","phishing"],"meta":null}]}},{"url":{"schema":"https","addr":"sourcefuel.co.zw/postInf3gmbh-delivery4879/files/assets/fonts/FedExSans_W-Italic.woff","fqdn":"sourcefuel.co.zw","domain":"sourcefuel.co.zw","tld":"co.zw"},"ip":{"addr":"185.150.190.64","port":443,"asn":23470,"as":"RELIABLESITE","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"font","requested_by":"https://sourcefuel.co.zw/postInf3gmbh-delivery4879/load.php","date":"2026-05-22T03:51:12.101Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"sourcefuel.co.zw","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Sun, 22 Mar 2026 14:39:08 GMT","end":"Sat, 20 Jun 2026 14:39:07 GMT"},"fingerprint":{"sha1":"C0:74:92:37:D4:2A:03:BD:B8:21:45:7E:67:B0:BE:43:7D:A6:C9:B6","sha256":"96:9F:8C:03:B5:AA:16:88:A9:50:11:B8:81:3C:CA:C5:F2:9C:CD:A8:70:98:F5:7B:C1:CF:4A:68:97:2F:2C:04"}}},"request":{"raw":"GET /postInf3gmbh-delivery4879/files/assets/fonts/FedExSans_W-Italic.woff HTTP/1.1\r\nHost: sourcefuel.co.zw\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: identity\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://sourcefuel.co.zw/postInf3gmbh-delivery4879/files/common-core_SHF.css\r\nCookie: PHPSESSID=fe392b446f25471dbe4f2f80e6b968b4\r\nSec-Fetch-Dest: font\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Fri, 22 May 2026 03:51:12 GMT\r\ncontent-type: text/html; charset=UTF-8\r\ncontent-length: 0\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":0,"size_decoded":0,"mime_type":"text/html; charset=UTF-8","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-08-09T14:49:10.846265Z","times_seen":17800640,"resource_available":true,"data":null}},"time_used":259,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":259,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-05-22","alert":"Phishing Block","trigger":"sourcefuel.co.zw","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-05-22","alert":"Sinkholed","trigger":"sourcefuel.co.zw","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-05-22","alert":"Sinkholed","trigger":"sourcefuel.co.zw","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-05-22","alert":"Sinkholed","trigger":"sourcefuel.co.zw","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":[{"sensor_name":"urlquery","alert":"Phishing - DHL","verdict":"phishing","severity":"medium","comment":"Associated with DHL phishing","tags":["dhl","logistics","phishing"],"meta":null}]}},{"url":{"schema":"https","addr":"sourcefuel.co.zw/postInf3gmbh-delivery4879/control/check_redirect.php?t=1779421875632","fqdn":"sourcefuel.co.zw","domain":"sourcefuel.co.zw","tld":"co.zw"},"ip":{"addr":"185.150.190.64","port":443,"asn":23470,"as":"RELIABLESITE","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"https://sourcefuel.co.zw/postInf3gmbh-delivery4879/load.php","date":"2026-05-22T03:51:15.636Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"sourcefuel.co.zw","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Sun, 22 Mar 2026 14:39:08 GMT","end":"Sat, 20 Jun 2026 14:39:07 GMT"},"fingerprint":{"sha1":"C0:74:92:37:D4:2A:03:BD:B8:21:45:7E:67:B0:BE:43:7D:A6:C9:B6","sha256":"96:9F:8C:03:B5:AA:16:88:A9:50:11:B8:81:3C:CA:C5:F2:9C:CD:A8:70:98:F5:7B:C1:CF:4A:68:97:2F:2C:04"}}},"request":{"raw":"GET /postInf3gmbh-delivery4879/control/check_redirect.php?t=1779421875632 HTTP/1.1\r\nHost: sourcefuel.co.zw\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://sourcefuel.co.zw/postInf3gmbh-delivery4879/load.php\r\nCookie: PHPSESSID=fe392b446f25471dbe4f2f80e6b968b4\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Fri, 22 May 2026 03:51:15 GMT\r\ncontent-type: text/html; charset=UTF-8\r\nvary: Accept-Encoding\r\ncontent-encoding: br\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":11,"size_decoded":0,"mime_type":"text/html; charset=UTF-8","magic":"ASCII text, with no line terminators","md5":"7c94333c07c9c06aee0bc239e4438255","sha1":"d3871bf7893d00a9ba1498cac8411b9334db7a72","sha256":"b21ff5b3f8ebc7f7e216a5edeb092283854a070391ae54a93a95c4e3650905cd","sha512":"4a1e794971f6e56c7aceca52375681bc5c4499898974ff157be7698f592eee14ce87bee7f09b5700a3b19b7462f547ce273e5c7cc8b75011a304c929e42b8ca5","ssdeep":"","tlshash":"6b50000c00330000c03300030000f0003c000c0030300c0000000cc00300000c000000","first_seen":"2024-01-05T04:51:49Z","last_seen":"2026-08-02T21:11:02.414751Z","times_seen":381,"resource_available":false,"data":null}},"time_used":288,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":288,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-05-22","alert":"Sinkholed","trigger":"sourcefuel.co.zw","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-05-22","alert":"Sinkholed","trigger":"sourcefuel.co.zw","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-05-22","alert":"Phishing Block","trigger":"sourcefuel.co.zw","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-05-22","alert":"Sinkholed","trigger":"sourcefuel.co.zw","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":[{"sensor_name":"urlquery","alert":"Phishing - DHL","verdict":"phishing","severity":"medium","comment":"Associated with DHL phishing","tags":["dhl","logistics","phishing"],"meta":null}]}},{"url":{"schema":"https","addr":"sourcefuel.co.zw/postInf3gmbh-delivery4879/files/style.css","fqdn":"sourcefuel.co.zw","domain":"sourcefuel.co.zw","tld":"co.zw"},"ip":{"addr":"185.150.190.64","port":443,"asn":23470,"as":"RELIABLESITE","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://sourcefuel.co.zw/postInf3gmbh-delivery4879/load.php","date":"2026-05-22T03:51:09.186Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"sourcefuel.co.zw","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Sun, 22 Mar 2026 14:39:08 GMT","end":"Sat, 20 Jun 2026 14:39:07 GMT"},"fingerprint":{"sha1":"C0:74:92:37:D4:2A:03:BD:B8:21:45:7E:67:B0:BE:43:7D:A6:C9:B6","sha256":"96:9F:8C:03:B5:AA:16:88:A9:50:11:B8:81:3C:CA:C5:F2:9C:CD:A8:70:98:F5:7B:C1:CF:4A:68:97:2F:2C:04"}}},"request":{"raw":"GET /postInf3gmbh-delivery4879/files/style.css HTTP/1.1\r\nHost: sourcefuel.co.zw\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://sourcefuel.co.zw/postInf3gmbh-delivery4879/load.php\r\nCookie: PHPSESSID=fe392b446f25471dbe4f2f80e6b968b4\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Fri, 22 May 2026 03:51:09 GMT\r\ncontent-type: text/css\r\nvary: Accept-Encoding\r\nlast-modified: Fri, 08 Dec 2023 07:25:54 GMT\r\ncontent-encoding: br\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":14180,"size_decoded":0,"mime_type":"text/css","magic":"ASCII text, with CRLF line terminators","md5":"f680a2f9d2ef9305e7ad7c3f5b8ba5b9","sha1":"79d273a3b50c4d03536bf3f3699e6a6064b0865e","sha256":"299ea0227274ba0b27241aa94a0fd7f65d31a5476bc5e84fff05b7e41dd22df0","sha512":"3032bffde7d80e1f5c044b44e28153dd3c700de94138279d4280674d5c4ba2e9aa83f9f474aaed3f762ff9294dc9d2aa47e35ac036ed7013fa56b768935b17f8","ssdeep":"192:B+vB4roN2AMkdxSKDkQOK9cEndxlQjfTYg6j+uu:6+EL1u","tlshash":"2852ee07c7240107597a9374dbb79665f66d0633e30ad2ec39ada698dfbc28481a0fdc","first_seen":"2024-01-05T04:51:49Z","last_seen":"2026-05-22T03:51:39.154892Z","times_seen":19,"resource_available":false,"data":null}},"time_used":1330,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":1330,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-05-22","alert":"Sinkholed","trigger":"sourcefuel.co.zw","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-05-22","alert":"Sinkholed","trigger":"sourcefuel.co.zw","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-05-22","alert":"Sinkholed","trigger":"sourcefuel.co.zw","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-05-22","alert":"Phishing Block","trigger":"sourcefuel.co.zw","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null}],"urlquery":[{"sensor_name":"urlquery","alert":"Phishing - DHL","verdict":"phishing","severity":"medium","comment":"Associated with DHL phishing","tags":["dhl","logistics","phishing"],"meta":null}]}},{"url":{"schema":"https","addr":"sourcefuel.co.zw/postInf3gmbh-delivery4879/logs/imhere.php?location=%2FpostInf3gmbh-delivery4879%2Fload.php\u0026t=1779421871633","fqdn":"sourcefuel.co.zw","domain":"sourcefuel.co.zw","tld":"co.zw"},"ip":{"addr":"185.150.190.64","port":443,"asn":23470,"as":"RELIABLESITE","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"fetch","requested_by":"https://sourcefuel.co.zw/postInf3gmbh-delivery4879/load.php","date":"2026-05-22T03:51:11.654Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"sourcefuel.co.zw","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Sun, 22 Mar 2026 14:39:08 GMT","end":"Sat, 20 Jun 2026 14:39:07 GMT"},"fingerprint":{"sha1":"C0:74:92:37:D4:2A:03:BD:B8:21:45:7E:67:B0:BE:43:7D:A6:C9:B6","sha256":"96:9F:8C:03:B5:AA:16:88:A9:50:11:B8:81:3C:CA:C5:F2:9C:CD:A8:70:98:F5:7B:C1:CF:4A:68:97:2F:2C:04"}}},"request":{"raw":"GET /postInf3gmbh-delivery4879/logs/imhere.php?location=%2FpostInf3gmbh-delivery4879%2Fload.php\u0026t=1779421871633 HTTP/1.1\r\nHost: sourcefuel.co.zw\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://sourcefuel.co.zw/postInf3gmbh-delivery4879/load.php\r\nDNT: 1\r\nConnection: keep-alive\r\nCookie: PHPSESSID=fe392b446f25471dbe4f2f80e6b968b4\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Fri, 22 May 2026 03:51:11 GMT\r\ncontent-type: text/html; charset=UTF-8\r\nvary: Accept-Encoding\r\ncontent-encoding: br\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":24,"size_decoded":0,"mime_type":"text/html; charset=UTF-8","magic":"ASCII text, with no line terminators","md5":"f6530f8413fde8efecc930d6ef59f49e","sha1":"f208906bea70d0a717fd9c52f7a4c655bf7e1e5c","sha256":"b3d21470af59b4bbc88dad6d7a8b29c4b9e68b92ba797d502d69fc2f8adb4ae1","sha512":"1e8adc9424604a19aa3dafb80126aed94ec40982cfac18945c9d19f94b29ffc58cfaf0447cef6b656d729755b1c09789bde1a57caac94d35f45a2b79498aae5f","ssdeep":"","tlshash":"f87000a3208038082280a00028800aa82228f008208000808cbc280a30e22a808a3028","first_seen":"2024-01-05T04:51:49Z","last_seen":"2026-08-02T21:11:02.411686Z","times_seen":368,"resource_available":false,"data":null}},"time_used":404,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":404,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-05-22","alert":"Phishing Block","trigger":"sourcefuel.co.zw","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-05-22","alert":"Sinkholed","trigger":"sourcefuel.co.zw","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-05-22","alert":"Sinkholed","trigger":"sourcefuel.co.zw","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-05-22","alert":"Sinkholed","trigger":"sourcefuel.co.zw","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null}],"urlquery":[{"sensor_name":"urlquery","alert":"Phishing - DHL","verdict":"phishing","severity":"medium","comment":"Associated with DHL phishing","tags":["dhl","logistics","phishing"],"meta":null}]}},{"url":{"schema":"https","addr":"sourcefuel.co.zw/postInf3gmbh-delivery4879/logs/imhere.php?location=%2FpostInf3gmbh-delivery4879%2Fload.php\u0026t=1779421878233","fqdn":"sourcefuel.co.zw","domain":"sourcefuel.co.zw","tld":"co.zw"},"ip":{"addr":"185.150.190.64","port":443,"asn":23470,"as":"RELIABLESITE","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"fetch","requested_by":"https://sourcefuel.co.zw/postInf3gmbh-delivery4879/load.php","date":"2026-05-22T03:51:18.237Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"sourcefuel.co.zw","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Sun, 22 Mar 2026 14:39:08 GMT","end":"Sat, 20 Jun 2026 14:39:07 GMT"},"fingerprint":{"sha1":"C0:74:92:37:D4:2A:03:BD:B8:21:45:7E:67:B0:BE:43:7D:A6:C9:B6","sha256":"96:9F:8C:03:B5:AA:16:88:A9:50:11:B8:81:3C:CA:C5:F2:9C:CD:A8:70:98:F5:7B:C1:CF:4A:68:97:2F:2C:04"}}},"request":{"raw":"GET /postInf3gmbh-delivery4879/logs/imhere.php?location=%2FpostInf3gmbh-delivery4879%2Fload.php\u0026t=1779421878233 HTTP/1.1\r\nHost: sourcefuel.co.zw\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://sourcefuel.co.zw/postInf3gmbh-delivery4879/load.php\r\nDNT: 1\r\nConnection: keep-alive\r\nCookie: PHPSESSID=fe392b446f25471dbe4f2f80e6b968b4\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Fri, 22 May 2026 03:51:18 GMT\r\ncontent-type: text/html; charset=UTF-8\r\nvary: Accept-Encoding\r\ncontent-encoding: br\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":24,"size_decoded":0,"mime_type":"text/html; charset=UTF-8","magic":"ASCII text, with no line terminators","md5":"f6530f8413fde8efecc930d6ef59f49e","sha1":"f208906bea70d0a717fd9c52f7a4c655bf7e1e5c","sha256":"b3d21470af59b4bbc88dad6d7a8b29c4b9e68b92ba797d502d69fc2f8adb4ae1","sha512":"1e8adc9424604a19aa3dafb80126aed94ec40982cfac18945c9d19f94b29ffc58cfaf0447cef6b656d729755b1c09789bde1a57caac94d35f45a2b79498aae5f","ssdeep":"","tlshash":"f87000a3208038082280a00028800aa82228f008208000808cbc280a30e22a808a3028","first_seen":"2024-01-05T04:51:49Z","last_seen":"2026-08-02T21:11:02.411686Z","times_seen":368,"resource_available":false,"data":null}},"time_used":153,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":153,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-05-22","alert":"Sinkholed","trigger":"sourcefuel.co.zw","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-05-22","alert":"Sinkholed","trigger":"sourcefuel.co.zw","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-05-22","alert":"Phishing Block","trigger":"sourcefuel.co.zw","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-05-22","alert":"Sinkholed","trigger":"sourcefuel.co.zw","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":[{"sensor_name":"urlquery","alert":"Phishing - DHL","verdict":"phishing","severity":"medium","comment":"Associated with DHL phishing","tags":["dhl","logistics","phishing"],"meta":null}]}}]}