{"report_id":"f4eb1f0c-a436-49dc-b9eb-fd5fcb57aab9","version":0,"status":"done","tags":[],"date":"2026-07-26T14:09:20Z","url":{"schema":"http","addr":"xn--ckwllt-wc8bc8se.com","fqdn":"xn--ckwllt-wc8bc8se.com","domain":"xn--ckwllt-wc8bc8se.com","tld":"com"},"ip":{"addr":"178.16.53.154","port":0,"asn":40999,"as":"dus.net GmbH","country":"Germany","country_code":"DE"},"final":{"url":{"schema":"https","addr":"xn--ckwllt-wc8bc8se.com/index.php?event=pageview\u0026url=%2F\u0026t=1785074933870\u0026checked=1","fqdn":"xn--ckwllt-wc8bc8se.com","domain":"xn--ckwllt-wc8bc8se.com","tld":"com"},"title":"Cake Wallet: Security, Setup \u0026 Monero Wallet","dom":{"size":8163,"mime_type":"text/html; charset=utf-8","magic":"JavaScript source, Unicode text, UTF-8 text, with very long lines (4392)","md5":"1374d12e6e09c87e264b72aab7423230","sha1":"582342eb8bc658654d5697365b5a9ff9affb9482","sha256":"c79aed85bf7567e6cf2364e1683cff3e5cfbd107383a28bd4a2dfcaa5f6ab314","sha512":"fb7e2e8255cd34d7f9ee993a2db86d9d4383c75b06f68b209a45f107d4722d6d99a896212409459817824cbb7961bd7dfde4cb4da1c8df0bdcd5e17ecd861968","ssdeep":"192:4swke4shhcdsRqLhF7iBLFnewadT4rfsXgyRMy:UXIsRqhliBLxewcDP","tlshash":"75f1a317a355a736136742dab67227fcb663004fe3265c64b1fc228e9be4d9040637de","dom_hash":"domhashd8393cd933590848aacd1af30de24f02","first_seen":"","last_seen":"","times_seen":0,"resource_available":false,"data":null}},"submit":{"url":{"schema":"http","addr":"xn--ckwllt-wc8bc8se.com","fqdn":"xn--ckwllt-wc8bc8se.com","domain":"xn--ckwllt-wc8bc8se.com","tld":"com"},"ip":{"addr":"178.16.53.154","port":0,"asn":40999,"as":"dus.net GmbH","country":"Germany","country_code":"DE"},"tags":null,"meta":null},"settings":{"access":"public","device_type":"desktop","expires_at":"2027-08-30T14:09:20Z","useragent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0","referer":"","cookies":null,"exit_node":"qguvgzjxzsgb3vs"},"stats":{"alert_count":{"ids":0,"urlquery":0,"analyzer":1}},"detection":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-07-26","alert":"Sinkholed","trigger":"xn--ckwllt-wc8bc8se.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null},"summary":[{"fqdn":"xn--ckwllt-wc8bc8se.com","ip":{"addr":"178.16.53.154","port":443,"asn":40999,"as":"dus.net GmbH","country":"Germany","country_code":"DE"},"domain_registered":"2026-05-16","domain_rank":0,"first_seen":"2026-07-26T13:42:23.026573Z","last_seen":"2026-07-26T13:42:23.026573Z","alert_count":6,"request_count":6,"received_data":24713,"sent_data":4648,"comment":"","tags":null,"fingerprints":[{"name":"PHP:8.3.24","description":"PHP is a general-purpose scripting language used for web development.","website":"https://php.net","common_platform_enumeration":"cpe:2.3:a:php:php:*:*:*:*:*:*:*:*","icon":"PHP.svg","categories":["Programming languages"]},{"name":"Nginx:1.26.3","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}]}],"files":null,"artifacts":{"windows_shortcuts":null,"files":null,"telegram":null,"pdfs":null,"clipboard":null},"sensors":{"ids":null,"analyzer":null,"urlquery":null},"javascript":{"script":[{"url":{"schema":"https","addr":"xn--ckwllt-wc8bc8se.com/index.php?event=pageview\u0026url=%2F\u0026t=1785074933870\u0026checked=1","fqdn":"xn--ckwllt-wc8bc8se.com","domain":"xn--ckwllt-wc8bc8se.com","tld":"com"},"ip":{"addr":"178.16.53.154","port":443,"asn":40999,"as":"dus.net GmbH","country":"Germany","country_code":"DE"},"introduction_type":"scriptElement","is_inline":true,"md5":"65a2296b30c8c2b9b92d21be097dd1a4","sha1":"0fe2fad4ebcc8ab96f62e4579dc8c94b95c125c8","sha256":"62daeff86d0fa6f8a055d2c1a67ffab9af96cfc535cbf44498aa009eb2e0bbf9","sha512":"2097dc6f2c67d953d5a69ac33ba55423995e67aec0e7a72e3b68da5490f2f631ce4902c3f3360a30ea46796aae9e531f54d430670ba82d7855b83d1252570a4b","ssdeep":"","tlshash":"ab31ce2e6366122180d6d2396b815e18353b00ff334be951396c56c96ff1e564366eec","size":1585,"data":"","first_seen":"2026-07-26T13:42:26.206928Z","last_seen":"2026-07-26T14:09:20.973524Z","times_seen":2,"alerts":{"ids":null,"analyzer":null,"urlquery":null}}],"eval":null,"write":null,"console":null},"http":[{"url":{"schema":"https","addr":"xn--ckwllt-wc8bc8se.com/index.php?event=pageview\u0026url=%2F\u0026t=1785074933870\u0026checked=1","fqdn":"xn--ckwllt-wc8bc8se.com","domain":"xn--ckwllt-wc8bc8se.com","tld":"com"},"ip":{"addr":"178.16.53.154","port":443,"asn":40999,"as":"dus.net GmbH","country":"Germany","country_code":"DE"},"is_navigation_request":true,"resource_type":"document","requested_by":"","date":"2026-07-26T14:08:53.897Z","timestamp":1785074933897,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"xn--ckwllt-wc8bc8se.com","organization":""},"issuer":{"commonName":"YR1","organization":"Let's Encrypt"},"validity":{"start":"Fri, 17 Jul 2026 02:04:41 GMT","end":"Thu, 15 Oct 2026 02:04:40 GMT"},"fingerprint":{"sha1":"FE:06:54:0D:4B:96:B2:06:02:1A:49:58:06:7A:66:A1:BC:D8:76:41","sha256":"ED:9C:7E:34:9C:80:60:B2:30:B1:28:AC:C3:94:7A:2D:52:52:B1:F8:9E:92:59:63:D4:DF:45:4A:0A:DB:89:30"}}},"request":{"raw":"GET /index.php?event=pageview\u0026url=%2F\u0026t=1785074933870\u0026checked=1 HTTP/1.1\r\nHost: xn--ckwllt-wc8bc8se.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://xn--ckwllt-wc8bc8se.com/\r\nCookie: sess=eyJpdiI6IjBoRVkxR2hHY05jMzIyKzdJSVNVZUE9PSIsInZhbHVlIjoiTGl3Qk5PVXVtZ2VNczFQT1I2NnNXMVN4RUlHZkZjR1VpdDF6KzBZWTVaUDEzWk93ZXJkTkl5dTBuUTlYaU9DeSIsIm1hYyI6ImM0YmM4NTQ3OGI3ZTAzM2ZjNjE1YmRkOWNmNzFiYTk2Nzg2NDVkODY4ODQwZTZkMDE2Y2I4ZDViODdiMmY0MDEiLCJ0YWciOiIifQ%3D%3D\r\nUpgrade-Insecure-Requests: 1\r\nSec-Fetch-Dest: document\r\nSec-Fetch-Mode: navigate\r\nSec-Fetch-Site: same-origin\r\nPriority: u=0, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nServer: nginx/1.26.3\r\nDate: Sun, 26 Jul 2026 14:08:54 GMT\r\nContent-Type: text/html; charset=UTF-8\r\nTransfer-Encoding: chunked\r\nConnection: keep-alive\r\nX-Powered-By: PHP/8.3.24\r\nSet-Cookie: sess=eyJpdiI6ImNWVS9lWjd6VFFBOEFKL1Y3SnJuNGc9PSIsInZhbHVlIjoiMlBMcExnc09rVXpBV1NjeTNYbXVJQkZJWmY3UmFXQ2NBcnpqcmVZSUtpclpwL0hLNzdIditRM0pUTDhxa09NdyIsIm1hYyI6ImFlZTkwYzI4NDA0N2IyMWY5NmUwNTA3NjRiNzExYWExZmFkYmQ3N2UzMzNkYjJjMDhiYjE1M2I5YTkyZjZkYTciLCJ0YWciOiIifQ%3D%3D; expires=Wed, 23 Jul 2036 14:08:54 GMT; Max-Age=315360000\r\nCache-Control: no-store\r\nContent-Encoding: gzip\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"PHP:8.3.24","description":"PHP is a general-purpose scripting language used for web development.","website":"https://php.net","common_platform_enumeration":"cpe:2.3:a:php:php:*:*:*:*:*:*:*:*","icon":"PHP.svg","categories":["Programming languages"]},{"name":"Nginx:1.26.3","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":8120,"size_decoded":3573,"mime_type":"text/html; charset=UTF-8","magic":"HTML document, Unicode text, UTF-8 text, with very long lines (4392)","md5":"badcdbabc876007461f0e640c17a3bb8","sha1":"1e900279fe099a7b47475f80f9a28031d7a1b5a6","sha256":"53d4bd68de2daf09dae829e08598d8ea2507c37ae893745d55d41e7f005fe920","sha512":"249410a2525abe2049ba8c3de66f9e99549ef9a6e6e7647e31eff7f5e1854500624df27e5fa9a80db4ea5d37ee6cfaacea3000d7ac6ea2785f2cd2ef3e3f0fc3","ssdeep":"192:6TZkd4shhcdsRqLhF7iBLFnewadT4rfsXgyRMy:/XIsRqhliBLxewcDP","tlshash":"d4f1a417a355a736136742deb67227fcb6a3004ee3265c64b1bc228e9be4d9040637de","first_seen":"2026-07-26T13:42:26.194619Z","last_seen":"2026-07-26T14:09:20.970513Z","times_seen":2,"resource_available":true,"data":null}},"time_used":467,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":467,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-07-26","alert":"Sinkholed","trigger":"xn--ckwllt-wc8bc8se.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"xn--ckwllt-wc8bc8se.com/assets/styles.css","fqdn":"xn--ckwllt-wc8bc8se.com","domain":"xn--ckwllt-wc8bc8se.com","tld":"com"},"ip":{"addr":"178.16.53.154","port":443,"asn":40999,"as":"dus.net GmbH","country":"Germany","country_code":"DE"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://xn--ckwllt-wc8bc8se.com/index.php?event=pageview\u0026url=%2F\u0026t=1785074933870\u0026checked=1","date":"2026-07-26T14:08:54.400Z","timestamp":1785074934400,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"xn--ckwllt-wc8bc8se.com","organization":""},"issuer":{"commonName":"YR1","organization":"Let's Encrypt"},"validity":{"start":"Fri, 17 Jul 2026 02:04:41 GMT","end":"Thu, 15 Oct 2026 02:04:40 GMT"},"fingerprint":{"sha1":"FE:06:54:0D:4B:96:B2:06:02:1A:49:58:06:7A:66:A1:BC:D8:76:41","sha256":"ED:9C:7E:34:9C:80:60:B2:30:B1:28:AC:C3:94:7A:2D:52:52:B1:F8:9E:92:59:63:D4:DF:45:4A:0A:DB:89:30"}}},"request":{"raw":"GET /assets/styles.css HTTP/1.1\r\nHost: xn--ckwllt-wc8bc8se.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://xn--ckwllt-wc8bc8se.com/index.php?event=pageview\u0026url=%2F\u0026t=1785074933870\u0026checked=1\r\nCookie: sess=eyJpdiI6ImNWVS9lWjd6VFFBOEFKL1Y3SnJuNGc9PSIsInZhbHVlIjoiMlBMcExnc09rVXpBV1NjeTNYbXVJQkZJWmY3UmFXQ2NBcnpqcmVZSUtpclpwL0hLNzdIditRM0pUTDhxa09NdyIsIm1hYyI6ImFlZTkwYzI4NDA0N2IyMWY5NmUwNTA3NjRiNzExYWExZmFkYmQ3N2UzMzNkYjJjMDhiYjE1M2I5YTkyZjZkYTciLCJ0YWciOiIifQ%3D%3D\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=2\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nServer: nginx/1.26.3\r\nDate: Sun, 26 Jul 2026 14:08:54 GMT\r\nContent-Type: text/css\r\nLast-Modified: Sun, 17 May 2026 20:48:40 GMT\r\nTransfer-Encoding: chunked\r\nConnection: keep-alive\r\nETag: W/\"6a0a29a8-1113\"\r\nExpires: Mon, 27 Jul 2026 14:08:54 GMT\r\nCache-Control: max-age=86400\r\nContent-Encoding: gzip\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx:1.26.3","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":4371,"size_decoded":1991,"mime_type":"text/css","magic":"ASCII text, with very long lines (4369)","md5":"f23e21d6aec88f7dcde6c269b0c8f7a3","sha1":"246a6b0dd167e206bc9fee7f21cc88832dabb164","sha256":"be85a08c87013c0fcb3e1958eb1f496a483b9a39d206aca02cc93f6ae9510a2e","sha512":"fbac44ed4d4042e60b731043a54475ddc8242af2b6740968660b95728516f788606c74c9230511a4d74fbba5790e58df787ee2e2b27d1f854d4f7790d0351854","ssdeep":"48:S7ExrY3OdAadwU/06yAa9YV5vR9ZdTcpHnK2O8IQZg5PnkKRy5eVtD:S7EZN8TmZAprIQZWhpD","tlshash":"129175776f903138ea2be694a6e427dd62047059d81347f8dc9397b0d8cb3f30aa5e49","first_seen":"2026-07-26T13:42:26.199181Z","last_seen":"2026-07-26T14:09:20.971145Z","times_seen":2,"resource_available":false,"data":null}},"time_used":61,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":61,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-07-26","alert":"Sinkholed","trigger":"xn--ckwllt-wc8bc8se.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"xn--ckwllt-wc8bc8se.com/apple-touch-icon.png","fqdn":"xn--ckwllt-wc8bc8se.com","domain":"xn--ckwllt-wc8bc8se.com","tld":"com"},"ip":{"addr":"178.16.53.154","port":443,"asn":40999,"as":"dus.net GmbH","country":"Germany","country_code":"DE"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://xn--ckwllt-wc8bc8se.com/index.php?event=pageview\u0026url=%2F\u0026t=1785074933870\u0026checked=1","date":"2026-07-26T14:08:54.472Z","timestamp":1785074934472,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"xn--ckwllt-wc8bc8se.com","organization":""},"issuer":{"commonName":"YR1","organization":"Let's Encrypt"},"validity":{"start":"Fri, 17 Jul 2026 02:04:41 GMT","end":"Thu, 15 Oct 2026 02:04:40 GMT"},"fingerprint":{"sha1":"FE:06:54:0D:4B:96:B2:06:02:1A:49:58:06:7A:66:A1:BC:D8:76:41","sha256":"ED:9C:7E:34:9C:80:60:B2:30:B1:28:AC:C3:94:7A:2D:52:52:B1:F8:9E:92:59:63:D4:DF:45:4A:0A:DB:89:30"}}},"request":{"raw":"GET /apple-touch-icon.png HTTP/1.1\r\nHost: xn--ckwllt-wc8bc8se.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://xn--ckwllt-wc8bc8se.com/index.php?event=pageview\u0026url=%2F\u0026t=1785074933870\u0026checked=1\r\nCookie: sess=eyJpdiI6ImNWVS9lWjd6VFFBOEFKL1Y3SnJuNGc9PSIsInZhbHVlIjoiMlBMcExnc09rVXpBV1NjeTNYbXVJQkZJWmY3UmFXQ2NBcnpqcmVZSUtpclpwL0hLNzdIditRM0pUTDhxa09NdyIsIm1hYyI6ImFlZTkwYzI4NDA0N2IyMWY5NmUwNTA3NjRiNzExYWExZmFkYmQ3N2UzMzNkYjJjMDhiYjE1M2I5YTkyZjZkYTciLCJ0YWciOiIifQ%3D%3D\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=6\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nServer: nginx/1.26.3\r\nDate: Sun, 26 Jul 2026 14:08:54 GMT\r\nContent-Type: image/png\r\nContent-Length: 1908\r\nLast-Modified: Sun, 17 May 2026 20:48:40 GMT\r\nConnection: keep-alive\r\nETag: \"6a0a29a8-774\"\r\nExpires: Mon, 27 Jul 2026 14:08:54 GMT\r\nCache-Control: max-age=86400\r\nAccept-Ranges: bytes\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx:1.26.3","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":1908,"size_decoded":2217,"mime_type":"image/png","magic":"MS Windows icon resource - 1 icon, 256x256 with PNG image data, 256 x 256, 8-bit/color RGBA, non-interlaced, 32 bits/pixel","md5":"5d8a6e4c02950994ad628e983815e4c2","sha1":"8aece3d346dcf11db3fd472f132008ca42c79616","sha256":"87bde1373232f3246391f9f794c238bdad0bff5d6f9abfcf15a4dc54991eae14","sha512":"1f5340c11b3dfb64fba23207923034b73bf57cd24e49079da9df4b8a3a015a3177f2f38175fe2fc406c70136d9608d90e374aacb61d9fcbe2ea30ca646352ad4","ssdeep":"","tlshash":"f6410b930b7a4cdee8e3d2f6023eaa3a31365b650207f1d7a2219c011c5f83a4b525fd","first_seen":"2026-07-26T13:42:26.202623Z","last_seen":"2026-07-26T14:09:20.971758Z","times_seen":2,"resource_available":false,"data":null}},"time_used":60,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":60,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-07-26","alert":"Sinkholed","trigger":"xn--ckwllt-wc8bc8se.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"xn--ckwllt-wc8bc8se.com/favicon.svg","fqdn":"xn--ckwllt-wc8bc8se.com","domain":"xn--ckwllt-wc8bc8se.com","tld":"com"},"ip":{"addr":"178.16.53.154","port":443,"asn":40999,"as":"dus.net GmbH","country":"Germany","country_code":"DE"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://xn--ckwllt-wc8bc8se.com/index.php?event=pageview\u0026url=%2F\u0026t=1785074933870\u0026checked=1","date":"2026-07-26T14:08:54.474Z","timestamp":1785074934474,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"xn--ckwllt-wc8bc8se.com","organization":""},"issuer":{"commonName":"YR1","organization":"Let's Encrypt"},"validity":{"start":"Fri, 17 Jul 2026 02:04:41 GMT","end":"Thu, 15 Oct 2026 02:04:40 GMT"},"fingerprint":{"sha1":"FE:06:54:0D:4B:96:B2:06:02:1A:49:58:06:7A:66:A1:BC:D8:76:41","sha256":"ED:9C:7E:34:9C:80:60:B2:30:B1:28:AC:C3:94:7A:2D:52:52:B1:F8:9E:92:59:63:D4:DF:45:4A:0A:DB:89:30"}}},"request":{"raw":"GET /favicon.svg HTTP/1.1\r\nHost: xn--ckwllt-wc8bc8se.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://xn--ckwllt-wc8bc8se.com/index.php?event=pageview\u0026url=%2F\u0026t=1785074933870\u0026checked=1\r\nCookie: sess=eyJpdiI6ImNWVS9lWjd6VFFBOEFKL1Y3SnJuNGc9PSIsInZhbHVlIjoiMlBMcExnc09rVXpBV1NjeTNYbXVJQkZJWmY3UmFXQ2NBcnpqcmVZSUtpclpwL0hLNzdIditRM0pUTDhxa09NdyIsIm1hYyI6ImFlZTkwYzI4NDA0N2IyMWY5NmUwNTA3NjRiNzExYWExZmFkYmQ3N2UzMzNkYjJjMDhiYjE1M2I5YTkyZjZkYTciLCJ0YWciOiIifQ%3D%3D\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=6\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 404 Not Found\r\nServer: nginx/1.26.3\r\nDate: Sun, 26 Jul 2026 14:08:54 GMT\r\nContent-Type: text/html; charset=iso-8859-1\r\nTransfer-Encoding: chunked\r\nConnection: keep-alive\r\nContent-Encoding: gzip\r\n\r\n","headers":null,"cookies":null,"status_code":"404","status_text":"Not Found","fingerprints":[{"name":"Nginx:1.26.3","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":196,"size_decoded":379,"mime_type":"text/html; charset=iso-8859-1","magic":"HTML document, ASCII text","md5":"62962daa1b19bbcc2db10b7bfd531ea6","sha1":"d64bae91091eda6a7532ebec06aa70893b79e1f8","sha256":"80c3fe2ae1062abf56456f52518bd670f9ec3917b7f85e152b347ac6b6faf880","sha512":"9002a0475fdb38541e78048709006926655c726e93e823b84e2dbf5b53fd539a5342e7266447d23db0e5528e27a19961b115b180c94f2272ff124c7e5c8304e7","ssdeep":"","tlshash":"c0d0129e9183638b442225907ac211d2654d13a6b87645e82d82a48a951857dc5ca69d","first_seen":"2023-03-07T12:06:54Z","last_seen":"2026-07-26T20:29:00.201917Z","times_seen":110234,"resource_available":true,"data":null}},"time_used":127,"timings":{"blocked":-1,"dns":0,"connect":61,"send":0,"wait":68,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-07-26","alert":"Sinkholed","trigger":"xn--ckwllt-wc8bc8se.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"xn--ckwllt-wc8bc8se.com/","fqdn":"xn--ckwllt-wc8bc8se.com","domain":"xn--ckwllt-wc8bc8se.com","tld":"com"},"ip":{"addr":"178.16.53.154","port":443,"asn":40999,"as":"dus.net GmbH","country":"Germany","country_code":"DE"},"is_navigation_request":true,"resource_type":"document","requested_by":"","date":"2026-07-26T14:08:52.631Z","timestamp":1785074932631,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"xn--ckwllt-wc8bc8se.com","organization":""},"issuer":{"commonName":"YR1","organization":"Let's Encrypt"},"validity":{"start":"Fri, 17 Jul 2026 02:04:41 GMT","end":"Thu, 15 Oct 2026 02:04:40 GMT"},"fingerprint":{"sha1":"FE:06:54:0D:4B:96:B2:06:02:1A:49:58:06:7A:66:A1:BC:D8:76:41","sha256":"ED:9C:7E:34:9C:80:60:B2:30:B1:28:AC:C3:94:7A:2D:52:52:B1:F8:9E:92:59:63:D4:DF:45:4A:0A:DB:89:30"}}},"request":{"raw":"GET / HTTP/1.1\r\nHost: xn--ckwllt-wc8bc8se.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nUpgrade-Insecure-Requests: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: document\r\nSec-Fetch-Mode: navigate\r\nSec-Fetch-Site: none\r\nPriority: u=0, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nServer: nginx/1.26.3\r\nDate: Sun, 26 Jul 2026 14:08:53 GMT\r\nContent-Type: text/html; charset=UTF-8\r\nTransfer-Encoding: chunked\r\nConnection: keep-alive\r\nX-Powered-By: PHP/8.3.24\r\nSet-Cookie: sess=eyJpdiI6IjBoRVkxR2hHY05jMzIyKzdJSVNVZUE9PSIsInZhbHVlIjoiTGl3Qk5PVXVtZ2VNczFQT1I2NnNXMVN4RUlHZkZjR1VpdDF6KzBZWTVaUDEzWk93ZXJkTkl5dTBuUTlYaU9DeSIsIm1hYyI6ImM0YmM4NTQ3OGI3ZTAzM2ZjNjE1YmRkOWNmNzFiYTk2Nzg2NDVkODY4ODQwZTZkMDE2Y2I4ZDViODdiMmY0MDEiLCJ0YWciOiIifQ%3D%3D; expires=Wed, 23 Jul 2036 14:08:53 GMT; Max-Age=315360000\r\nCache-Control: no-store\r\nContent-Encoding: gzip\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx:1.26.3","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"PHP:8.3.24","description":"PHP is a general-purpose scripting language used for web development.","website":"https://php.net","common_platform_enumeration":"cpe:2.3:a:php:php:*:*:*:*:*:*:*:*","icon":"PHP.svg","categories":["Programming languages"]}],"data":{"size":8120,"size_decoded":3573,"mime_type":"text/html; charset=UTF-8","magic":"HTML document, Unicode text, UTF-8 text, with very long lines (4392)","md5":"badcdbabc876007461f0e640c17a3bb8","sha1":"1e900279fe099a7b47475f80f9a28031d7a1b5a6","sha256":"53d4bd68de2daf09dae829e08598d8ea2507c37ae893745d55d41e7f005fe920","sha512":"249410a2525abe2049ba8c3de66f9e99549ef9a6e6e7647e31eff7f5e1854500624df27e5fa9a80db4ea5d37ee6cfaacea3000d7ac6ea2785f2cd2ef3e3f0fc3","ssdeep":"192:6TZkd4shhcdsRqLhF7iBLFnewadT4rfsXgyRMy:/XIsRqhliBLxewcDP","tlshash":"d4f1a417a355a736136742deb67227fcb6a3004ee3265c64b1bc228e9be4d9040637de","first_seen":"2026-07-26T13:42:26.194619Z","last_seen":"2026-07-26T14:09:20.970513Z","times_seen":2,"resource_available":true,"data":null}},"time_used":943,"timings":{"blocked":-1,"dns":58,"connect":61,"send":0,"wait":698,"receive":0,"ssl":126},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-07-26","alert":"Sinkholed","trigger":"xn--ckwllt-wc8bc8se.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"xn--ckwllt-wc8bc8se.com/assets/styles.css","fqdn":"xn--ckwllt-wc8bc8se.com","domain":"xn--ckwllt-wc8bc8se.com","tld":"com"},"ip":{"addr":"178.16.53.154","port":443,"asn":40999,"as":"dus.net GmbH","country":"Germany","country_code":"DE"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://xn--ckwllt-wc8bc8se.com/","date":"2026-07-26T14:08:53.786Z","timestamp":1785074933786,"http_version":"HTTP/1.1","security_state":"secure","security_info":null,"request":{"raw":"GET /assets/styles.css HTTP/1.1\r\nHost: xn--ckwllt-wc8bc8se.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://xn--ckwllt-wc8bc8se.com/\r\nCookie: sess=eyJpdiI6IjBoRVkxR2hHY05jMzIyKzdJSVNVZUE9PSIsInZhbHVlIjoiTGl3Qk5PVXVtZ2VNczFQT1I2NnNXMVN4RUlHZkZjR1VpdDF6KzBZWTVaUDEzWk93ZXJkTkl5dTBuUTlYaU9DeSIsIm1hYyI6ImM0YmM4NTQ3OGI3ZTAzM2ZjNjE1YmRkOWNmNzFiYTk2Nzg2NDVkODY4ODQwZTZkMDE2Y2I4ZDViODdiMmY0MDEiLCJ0YWciOiIifQ%3D%3D\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=2\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":null,"data":{"size":0,"size_decoded":0,"mime_type":"","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-07-26T20:50:59.211778Z","times_seen":17549941,"resource_available":true,"data":null}},"time_used":0,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":0,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-07-26","alert":"Sinkholed","trigger":"xn--ckwllt-wc8bc8se.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}}]}