{"report_id":"fa97cf0d-ffe3-41cb-9e47-361372a19c68","version":0,"status":"done","tags":[],"date":"2026-06-22T14:48:25Z","url":{"schema":"http","addr":"safepal.com.mx/desktop-wallet.html","fqdn":"safepal.com.mx","domain":"safepal.com.mx","tld":"com.mx"},"ip":{"addr":"94.183.168.63","port":0,"asn":31549,"as":"Aria Shatel PJSC","country":"Iran","country_code":"IR"},"final":{"url":{"schema":"https","addr":"safepal.com.mx/desktop-wallet.html","fqdn":"safepal.com.mx","domain":"safepal.com.mx","tld":"com.mx"},"title":"Attention Required! | Cloudflare","dom":{"size":4259,"mime_type":"text/html; charset=utf-8","magic":"JavaScript source, Unicode text, UTF-8 text, with very long lines (396)","md5":"72eba5dffe69f70c305d594476a2bd92","sha1":"023c3be54f9a581aab33b87e17e50d868bf06d0c","sha256":"04625b987454231986294d8e451d9d9a5f1cc5a624617e4977e454b6003e5577","sha512":"ed3b1836966c815822ca5979597b308b48f71ac269f13083db990e7d24c8caf24e80b5e27ff21e92c267e34a8c30b0e2249aa17917d149f70fb5318f31202fcd","ssdeep":"96:lTkDa/D+DMFWC8kEYZqXKHvpIkdlenRJ3vaQxvbej:lsa/SoWnk4aHvFdlenv3Cejej","tlshash":"c29186277afd207e107381a266eda3497ab0d413c6b606a072acc2791f5ff56fd17284","dom_hash":"domhash084463aeaea97efe9f7843d91f2bade8","first_seen":"","last_seen":"","times_seen":0,"resource_available":false,"data":null}},"submit":{"url":{"schema":"http","addr":"safepal.com.mx/desktop-wallet.html","fqdn":"safepal.com.mx","domain":"safepal.com.mx","tld":"com.mx"},"ip":{"addr":"94.183.168.63","port":0,"asn":31549,"as":"Aria Shatel PJSC","country":"Iran","country_code":"IR"},"tags":null,"meta":null},"settings":{"access":"public","device_type":"desktop","expires_at":"2027-07-27T14:48:25Z","useragent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0","referer":"","cookies":null,"exit_node":"qguvgzjxzsgb3vs"},"stats":{"alert_count":{"ids":0,"urlquery":0,"analyzer":2}},"detection":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-06-22","alert":"Sinkholed","trigger":"safepal.com.mx","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-06-22","alert":"Sinkholed","trigger":"safepal.com.mx","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null},"summary":[{"fqdn":"safepal.com.mx","ip":{"addr":"94.183.168.63","port":443,"asn":31549,"as":"Aria Shatel PJSC","country":"Iran","country_code":"IR"},"domain_registered":"2026-04-17","domain_rank":0,"first_seen":"2026-04-20T06:50:46.167345Z","last_seen":"2026-04-20T06:50:46.167345Z","alert_count":6,"request_count":3,"received_data":14674,"sent_data":1620,"comment":"","tags":null,"fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}]}],"files":null,"artifacts":{"windows_shortcuts":null,"files":null,"telegram":null,"pdfs":null,"clipboard":null},"sensors":{"ids":null,"analyzer":null,"urlquery":null},"javascript":{"script":null,"eval":null,"write":null,"console":null},"http":[{"url":{"schema":"https","addr":"safepal.com.mx/desktop-wallet.html","fqdn":"safepal.com.mx","domain":"safepal.com.mx","tld":"com.mx"},"ip":{"addr":"94.183.168.63","port":443,"asn":31549,"as":"Aria Shatel PJSC","country":"Iran","country_code":"IR"},"is_navigation_request":true,"resource_type":"document","requested_by":"","date":"2026-06-22T14:47:59.006Z","timestamp":1782139679006,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"safepal.com.mx","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Thu, 18 Jun 2026 16:05:56 GMT","end":"Wed, 16 Sep 2026 16:05:55 GMT"},"fingerprint":{"sha1":"D9:EF:D3:43:CC:8C:9A:6E:94:65:80:C4:0E:F0:22:82:F2:51:29:DE","sha256":"4E:D9:25:3B:FD:29:BE:91:57:BC:E5:E2:EE:E9:7E:54:35:33:B7:BA:4A:EE:F0:DA:53:07:21:22:27:51:CC:10"}}},"request":{"raw":"GET /desktop-wallet.html HTTP/1.1\r\nHost: safepal.com.mx\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nUpgrade-Insecure-Requests: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: document\r\nSec-Fetch-Mode: navigate\r\nSec-Fetch-Site: none\r\nPriority: u=0, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\ncontent-encoding: gzip\r\ncontent-type: text/html; charset=UTF-8\r\ndate: Mon, 22 Jun 2026 14:48:04 GMT\r\nserver: wd\r\nset-cookie: wd_trust=; Path=/; Expires=Thu, 01-Jan-70 00:00:00 GMT; Domain=.safepal.com.mx; Priority=High; HttpOnly; Secure; SameSite=None\nwd_trust=AAAAAGo5SyQ0NjBFQURGNgG02glhp1JlYg; Path=/; Expires=Tue, 22 Jun 2027 14:48:04 GMT; Domain=.safepal.com.mx; Priority=High; HttpOnly; Secure; SameSite=None; Partitioned\r\nstrict-transport-security: max-age=31536000\r\nvary: Accept-Encoding\r\nwd-rid: wd-bbb5.432c73\r\ncontent-length: 1755\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":4524,"size_decoded":2333,"mime_type":"text/html; charset=UTF-8","magic":"JavaScript source, Unicode text, UTF-8 text, with very long lines (396)","md5":"a8bdc3b10cbc5ac06b24171ff636827c","sha1":"a27cc299d67f1011ebe6cbf39e8c6b385e70d3ca","sha256":"addd00f71d1e288cfeec6b07b2cb13c34cbba18aacf0ef5ccfe50cf579f6e399","sha512":"c74f88a70fc45da7ae8157c64be96dc07ec2f9b88dabb86d986d481f148ff3b0274e21056d6542a6216289aa39dceaef0dbc16b5e417a6c55c2a8c6e373620b1","ssdeep":"96:9j9jwIjOTkDa/D+DMFWC8kEYZqXKHvpIkdlenRJ3vaQxvbej:9j9jhjOsa/SoWnk4aHvFdlenv3Cejej","tlshash":"a3917426bafd207e10a3816226fc63487ab0c413d6a706a072acc2381f9ff55fd17180","first_seen":"2026-06-22T14:48:27.006695Z","last_seen":"2026-06-22T14:48:27.006695Z","times_seen":1,"resource_available":true,"data":null}},"time_used":5664,"timings":{"blocked":-1,"dns":4004,"connect":1170,"send":0,"wait":327,"receive":0,"ssl":163},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-06-22","alert":"Sinkholed","trigger":"safepal.com.mx","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-06-22","alert":"Sinkholed","trigger":"safepal.com.mx","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"safepal.com.mx/cdn-cgi/styles/cf.errors.css","fqdn":"safepal.com.mx","domain":"safepal.com.mx","tld":"com.mx"},"ip":{"addr":"94.183.168.63","port":443,"asn":31549,"as":"Aria Shatel PJSC","country":"Iran","country_code":"IR"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://safepal.com.mx/desktop-wallet.html","date":"2026-06-22T14:48:04.898Z","timestamp":1782139684898,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"safepal.com.mx","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Thu, 18 Jun 2026 16:05:56 GMT","end":"Wed, 16 Sep 2026 16:05:55 GMT"},"fingerprint":{"sha1":"D9:EF:D3:43:CC:8C:9A:6E:94:65:80:C4:0E:F0:22:82:F2:51:29:DE","sha256":"4E:D9:25:3B:FD:29:BE:91:57:BC:E5:E2:EE:E9:7E:54:35:33:B7:BA:4A:EE:F0:DA:53:07:21:22:27:51:CC:10"}}},"request":{"raw":"GET /cdn-cgi/styles/cf.errors.css HTTP/1.1\r\nHost: safepal.com.mx\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://safepal.com.mx/desktop-wallet.html\r\nCookie: wd_trust=AAAAAGo5SyQ0NjBFQURGNgG02glhp1JlYg\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=2\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\ncontent-encoding: gzip\r\ncontent-type: text/html; charset=UTF-8\r\ndate: Mon, 22 Jun 2026 14:48:05 GMT\r\nserver: wd\r\nstrict-transport-security: max-age=31536000\r\nvary: Accept-Encoding\r\nwd-rid: wd-bbb5.432c7a\r\ncontent-length: 1755\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":4524,"size_decoded":2017,"mime_type":"text/html; charset=UTF-8","magic":"JavaScript source, Unicode text, UTF-8 text, with very long lines (396)","md5":"a8bdc3b10cbc5ac06b24171ff636827c","sha1":"a27cc299d67f1011ebe6cbf39e8c6b385e70d3ca","sha256":"addd00f71d1e288cfeec6b07b2cb13c34cbba18aacf0ef5ccfe50cf579f6e399","sha512":"c74f88a70fc45da7ae8157c64be96dc07ec2f9b88dabb86d986d481f148ff3b0274e21056d6542a6216289aa39dceaef0dbc16b5e417a6c55c2a8c6e373620b1","ssdeep":"96:9j9jwIjOTkDa/D+DMFWC8kEYZqXKHvpIkdlenRJ3vaQxvbej:9j9jhjOsa/SoWnk4aHvFdlenv3Cejej","tlshash":"a3917426bafd207e10a3816226fc63487ab0c413d6a706a072acc2381f9ff55fd17180","first_seen":"2026-06-22T14:48:27.006695Z","last_seen":"2026-06-22T14:48:27.006695Z","times_seen":1,"resource_available":true,"data":null}},"time_used":328,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":328,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-06-22","alert":"Sinkholed","trigger":"safepal.com.mx","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-06-22","alert":"Sinkholed","trigger":"safepal.com.mx","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"safepal.com.mx/favicon.ico","fqdn":"safepal.com.mx","domain":"safepal.com.mx","tld":"com.mx"},"ip":{"addr":"94.183.168.63","port":443,"asn":31549,"as":"Aria Shatel PJSC","country":"Iran","country_code":"IR"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://safepal.com.mx/desktop-wallet.html","date":"2026-06-22T14:48:05.259Z","timestamp":1782139685259,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"safepal.com.mx","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Thu, 18 Jun 2026 16:05:56 GMT","end":"Wed, 16 Sep 2026 16:05:55 GMT"},"fingerprint":{"sha1":"D9:EF:D3:43:CC:8C:9A:6E:94:65:80:C4:0E:F0:22:82:F2:51:29:DE","sha256":"4E:D9:25:3B:FD:29:BE:91:57:BC:E5:E2:EE:E9:7E:54:35:33:B7:BA:4A:EE:F0:DA:53:07:21:22:27:51:CC:10"}}},"request":{"raw":"GET /favicon.ico HTTP/1.1\r\nHost: safepal.com.mx\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://safepal.com.mx/desktop-wallet.html\r\nCookie: wd_trust=AAAAAGo5SyQ0NjBFQURGNgG02glhp1JlYg\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=6\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\ncontent-encoding: gzip\r\ncontent-type: text/html; charset=UTF-8\r\ndate: Mon, 22 Jun 2026 14:48:05 GMT\r\nserver: wd\r\nstrict-transport-security: max-age=31536000\r\nvary: Accept-Encoding\r\nwd-rid: wd-bbb5.432c7c\r\ncontent-length: 1755\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":4524,"size_decoded":2017,"mime_type":"text/html; charset=UTF-8","magic":"JavaScript source, Unicode text, UTF-8 text, with very long lines (396)","md5":"a8bdc3b10cbc5ac06b24171ff636827c","sha1":"a27cc299d67f1011ebe6cbf39e8c6b385e70d3ca","sha256":"addd00f71d1e288cfeec6b07b2cb13c34cbba18aacf0ef5ccfe50cf579f6e399","sha512":"c74f88a70fc45da7ae8157c64be96dc07ec2f9b88dabb86d986d481f148ff3b0274e21056d6542a6216289aa39dceaef0dbc16b5e417a6c55c2a8c6e373620b1","ssdeep":"96:9j9jwIjOTkDa/D+DMFWC8kEYZqXKHvpIkdlenRJ3vaQxvbej:9j9jhjOsa/SoWnk4aHvFdlenv3Cejej","tlshash":"a3917426bafd207e10a3816226fc63487ab0c413d6a706a072acc2381f9ff55fd17180","first_seen":"2026-06-22T14:48:27.006695Z","last_seen":"2026-06-22T14:48:27.006695Z","times_seen":1,"resource_available":true,"data":null}},"time_used":325,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":325,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-06-22","alert":"Sinkholed","trigger":"safepal.com.mx","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-06-22","alert":"Sinkholed","trigger":"safepal.com.mx","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}}]}