{"report_id":"fe85d730-0e7c-49de-98f2-eb141f5d856a","version":6,"status":"done","tags":[],"date":"2026-03-24T07:00:36Z","url":{"schema":"https","addr":"www.amweqe.help/pages/team/register?invite_code=180962","fqdn":"www.amweqe.help","domain":"amweqe.help","tld":"help"},"ip":{"addr":"104.168.22.92","port":0,"asn":36352,"as":"AS-COLOCROSSING","country":"United States","country_code":"US"},"final":{"url":{"schema":"https","addr":"www.amweqe.help/pages/team/register?invite_code=180962","fqdn":"www.amweqe.help","domain":"amweqe.help","tld":"help"},"title":"Register","dom":{"size":716965,"mime_type":"text/html; charset=utf-8","magic":"HTML document, Unicode text, UTF-8 text, with very long lines (40058)","md5":"1e0e2df1cd8ebf7f0d2ae659f1a4980b","sha1":"4dcdffbcbe7821e0816023d1ea5f463bf2d77f3e","sha256":"674d093c50299242351329fdd437c3e2fdbced65194bfc3dbcca2e0a613ccd65","sha512":"baf9b93d71d057c08a31452d14cd7041c469f7548d44c4d659898f9d48370b6666904db4f01d350cc5daa5f5c9d71e7ac4fd0da51cc8480345ef03f795c8f55a","ssdeep":"6144:C7AojxjZ8d830NtqVCSn9urlJtxA3ALUrEpr9l9S0i5X9uja:EAGcxA3cpJlsXJ","tlshash":"46e4e965bb80303de55bc732d0d2f6a5a9359613c62f9dabf3507f184fc658602e2e0a","dom_hash":"domhash04f6426faa9559281e5779eb3439597e","first_seen":"2026-03-24T07:00:43.237204Z","last_seen":"2026-03-24T07:00:43.237204Z","times_seen":1,"resource_available":false,"data":null}},"submit":{"url":{"schema":"https","addr":"www.amweqe.help/pages/team/register?invite_code=180962","fqdn":"www.amweqe.help","domain":"amweqe.help","tld":"help"},"ip":{"addr":"104.168.22.92","port":0,"asn":36352,"as":"AS-COLOCROSSING","country":"United States","country_code":"US"},"tags":null,"meta":null},"settings":{"access":"public","device_type":"desktop","expires_at":"2027-04-28T07:00:36Z","useragent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0","referer":"","cookies":null,"exit_node":"z0yflva4pidy47h"},"stats":{"alert_count":{"ids":0,"urlquery":0,"analyzer":6}},"detection":{"ids":null,"analyzer":[{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-03-24","alert":"Sinkholed","trigger":"www.amweqe.help","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-03-24","alert":"Sinkholed","trigger":"www.amweqe.help","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-03-24","alert":"Sinkholed","trigger":"www.amweqe.help","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-03-24","alert":"Sinkholed","trigger":"www.amweqe.help","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-03-24","alert":"Phishing Block","trigger":"ecos.eopyyu.help","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-03-24","alert":"Sinkholed","trigger":"ecos.eopyyu.help","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null},"summary":[{"fqdn":"www.amweqe.help","ip":{"addr":"104.168.22.92","port":443,"asn":36352,"as":"AS-COLOCROSSING","country":"United States","country_code":"US"},"domain_registered":"2025-10-15","domain_rank":0,"first_seen":"2026-03-24T07:00:39.590528Z","last_seen":"2026-03-24T07:00:39.590528Z","alert_count":56,"request_count":14,"received_data":4543551,"sent_data":6774,"comment":"","tags":null,"fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}]},{"fqdn":"ecos.eopyyu.help","ip":{"addr":"104.168.22.92","port":443,"asn":36352,"as":"AS-COLOCROSSING","country":"United States","country_code":"US"},"domain_registered":"2025-10-29","domain_rank":0,"first_seen":"2026-03-11T10:18:23.009487Z","last_seen":"2026-03-11T10:18:23.009487Z","alert_count":8,"request_count":4,"received_data":8427,"sent_data":2193,"comment":"","tags":null,"fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}]},{"fqdn":"cdn.dcloud.net.cn","ip":{"addr":"124.220.205.65","port":443,"asn":45090,"as":"Shenzhen Tencent Computer Systems Company Limited","country":"China","country_code":"CN"},"domain_registered":"2013-07-17","domain_rank":296858,"first_seen":"2018-09-15T09:18:08Z","last_seen":"2026-03-18T19:09:37.145299Z","alert_count":0,"request_count":1,"received_data":579,"sent_data":446,"comment":"","tags":null,"fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}]},{"fqdn":"cdn.jsdelivr.net","ip":{"addr":"104.16.174.226","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"domain_registered":"2012-05-16","domain_rank":1678,"first_seen":"2012-09-30T00:15:09Z","last_seen":"2026-03-22T22:34:23.857339Z","alert_count":0,"request_count":1,"received_data":61943,"sent_data":469,"comment":"","tags":null,"fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}]}],"files":null,"artifacts":{"windows_shortcuts":null,"files":null,"telegram":null,"pdfs":null,"clipboard":null},"sensors":{"ids":null,"analyzer":null,"urlquery":null},"javascript":{"script":[{"url":{"schema":"https","addr":"www.amweqe.help/static/common/js/touch-emulator.js","fqdn":"www.amweqe.help","domain":"amweqe.help","tld":"help"},"ip":{"addr":"104.168.22.92","port":443,"asn":36352,"as":"AS-COLOCROSSING","country":"United States","country_code":"US"},"introduction_type":"scriptElement","is_inline":false,"md5":"96c7c37960578939b67613c9bb430d2b","sha1":"6d8c9b333553e6af1ff091efdcc3283c349f6f32","sha256":"393dedb6966352528116b078a3f3cb7e431da2a14dd3d5ba5ebaf3082070baa6","sha512":"8067a337f5b73c7df6a1ad8479470d2503fdd2054302f55672328661a81b96c2c3873db99df075ceb5607bfd3dced7bc65b45a4a295358c2dfb045f05335b43a","ssdeep":"96:XRg+viJuC/N6pCQ/2XVNPTNjtQ+tkrs3oCPRT7uT9W2fTtiTy5kuGtR/eCHF6Etg:Xaui+CZQHIOxZfAz/eCtg","tlshash":"111275eb734f236b02fa3315b2fed586f5bdc4a0110222aef8e45e69306897547584dd","size":9681,"data":"","first_seen":"2025-08-29T05:58:51.08327Z","last_seen":"2026-05-01T14:21:25.174084Z","times_seen":10,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"www.amweqe.help/pages/team/register?invite_code=180962","fqdn":"www.amweqe.help","domain":"amweqe.help","tld":"help"},"ip":{"addr":"104.168.22.92","port":443,"asn":36352,"as":"AS-COLOCROSSING","country":"United States","country_code":"US"},"introduction_type":"scriptElement","is_inline":true,"md5":"6cff8ddf621a867fd2b76d2fbd2a3eee","sha1":"5553720f2133ea3400d351191833b2758c6d3429","sha256":"ed16e0e794144d1785860f7e57edbbb8eb7d2ff7ee18555c539106f01e7ea4a7","sha512":"4594d221301ab1eac5898c2e4daf60ab34dc50b4c4d49426870147986ad2bea84d4cd9e77e75927b0e9312710b413fc4f4a407a6553b308a8aff923f512f76d2","ssdeep":"","tlshash":"94c04cb4761d59305659a22d723de7d83dbb501130437547901c158d0cf4f945671ea9","size":160,"data":"","first_seen":"2025-08-29T05:58:51.135016Z","last_seen":"2026-05-01T14:21:25.184278Z","times_seen":12,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"www.amweqe.help/static/js/index.dc1b4e8b.js","fqdn":"www.amweqe.help","domain":"amweqe.help","tld":"help"},"ip":{"addr":"104.168.22.92","port":443,"asn":36352,"as":"AS-COLOCROSSING","country":"United States","country_code":"US"},"introduction_type":"scriptElement","is_inline":false,"md5":"7635eeaa1f3a681568e7c83bcd3bf22c","sha1":"471e84e5d63ae708b2feb7632233df0bd00e1fca","sha256":"5e2a69c1f3cf39ca1f379b2d76be547a820fa460b00ecb895c0b2521052fb873","sha512":"20235260fee65a60317126edff659ae2a3125d6aa19bfe27d3706e47e58952a92b89c7661a53e07d3c543ca310adcff64a26a81434fbc9c5f9043c9f6acf2d1a","ssdeep":"768:xU48JrZjtSIFTWPwKA8CymAwKOIQndg9YVrxj/gXxR8Bt5xgD4Png36z7EsjFwRr:BT7Wdg9Arxj/gXxRMKr9R13+w3CRPs","tlshash":"9e34b887f99b874e951e3d56e45fa7b2b5e72ca2098ef0c3d3a56f355f0e1824720208","size":230684,"data":"","first_seen":"2026-03-11T10:18:29.030575Z","last_seen":"2026-03-24T07:02:06.130578Z","times_seen":4,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"www.amweqe.help/static/js/pages-team-register.35774d36.js","fqdn":"www.amweqe.help","domain":"amweqe.help","tld":"help"},"ip":{"addr":"104.168.22.92","port":443,"asn":36352,"as":"AS-COLOCROSSING","country":"United States","country_code":"US"},"introduction_type":"scriptElement","is_inline":false,"md5":"0ddd971dec98f37109e3e631647e8012","sha1":"24f1c2ab3b48e66a483c43f8a37d087083fa5418","sha256":"d19bb353c13727bbbff0947276dec6ec0149b0ae8d15caf11a977d0a992d3b93","sha512":"9fdeb21c44e9eb75acd01fc9c2d047fea19493dcc8078881987087f1162ad7973a4a80614912c4aa32a33325d23d6d443fbc2d80c7c96be06d58711df5fa78b8","ssdeep":"192:bMjjXeqRsiyhDtpSw3wGjyPe89mFJFvw9L9u5/7RM/2W:43ehDnSwFWmFJFe5u1NW","tlshash":"05e109af70d6f84a101bc28c2597007932826617951a5c71cb74dbfd29f6ebb1722b4d","size":7135,"data":"","first_seen":"2026-03-11T10:18:29.03231Z","last_seen":"2026-03-24T07:00:43.241043Z","times_seen":2,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"www.amweqe.help/static/js/chunk-vendors.fd1d24e5.js","fqdn":"www.amweqe.help","domain":"amweqe.help","tld":"help"},"ip":{"addr":"104.168.22.92","port":443,"asn":36352,"as":"AS-COLOCROSSING","country":"United States","country_code":"US"},"introduction_type":"scriptElement","is_inline":false,"md5":"b10d014852c2f87148f9e77668e4ef08","sha1":"1eb8ce028d3485407379cfa494cddc7d8a1dcfa8","sha256":"fcb8e1b05b095bdc7ed251e6d4f84809f93b2d241aafe78d67bc6e1b86c678fc","sha512":"20b1511e2118082669f786c933001bb027ab676439feb653d4d52d30faef97d2ef985ce5d6744928be5414cbf6c066d0a553b8024ea3f9d7f071816e0e20e277","ssdeep":"49152:XXLB7KZcUxYZAA/2lUxv4BwjQ9a4lY39p98Tvmm0f9khu1Cm4Pa739Ffn2sm598d:XgZwAg9jn3L98rmVUe","tlshash":"6b065b9872c0b07956d383b4803f2006a23b5d6da40eb958f3b5e8d4af6998d5277f3d","size":3957545,"data":"","first_seen":"2026-03-11T10:18:29.070118Z","last_seen":"2026-03-24T07:02:06.147824Z","times_seen":4,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"www.amweqe.help/pages/team/register?invite_code=180962","fqdn":"www.amweqe.help","domain":"amweqe.help","tld":"help"},"ip":{"addr":"104.168.22.92","port":443,"asn":36352,"as":"AS-COLOCROSSING","country":"United States","country_code":"US"},"introduction_type":"scriptElement","is_inline":true,"md5":"e18ac2a0e7d21ad6d4a1ca628fc84e7d","sha1":"e3554d137896b9b9d1e8e6e17160c38db16cace3","sha256":"50d588d7a9190e62f5c551e827ecf0c2056546213b706f07b246d047d056e433","sha512":"385cc442818f4df848cb1a939741f1fae5f9e54befa97b7d5ff10eabc2522f537c071c3545c7aa31be970a01e8e5e223f3bdfc5fb1aaa804d00daf8e75fddf8f","ssdeep":"","tlshash":"4e6000000000fc0c00c3000cc0f033c000c0c003000c0c00303f0000330000c0f3f00f","size":16,"data":"","first_seen":"2025-08-29T05:58:51.13947Z","last_seen":"2026-05-01T14:21:25.185456Z","times_seen":12,"alerts":{"ids":null,"analyzer":null,"urlquery":null}}],"eval":null,"write":null,"console":null},"http":[{"url":{"schema":"https","addr":"www.amweqe.help/pages/team/node_modules/amfe-flexible/index.js","fqdn":"www.amweqe.help","domain":"amweqe.help","tld":"help"},"ip":{"addr":"104.168.22.92","port":443,"asn":36352,"as":"AS-COLOCROSSING","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://www.amweqe.help/pages/team/register?invite_code=180962","date":"2026-03-24T07:00:15.241Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"android.ahdmnb.help","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Mon, 16 Mar 2026 12:14:31 GMT","end":"Sun, 14 Jun 2026 12:14:30 GMT"},"fingerprint":{"sha1":"F6:7D:BA:4E:6C:C6:A4:C1:34:A0:65:54:AA:E0:4B:9D:47:7C:D3:9F","sha256":"C5:BB:CC:52:64:D3:42:4E:8A:E7:97:A5:E6:1A:88:EA:97:2E:81:86:47:CA:F9:7C:27:81:A9:51:59:48:4D:F7"}}},"request":{"raw":"GET /pages/team/node_modules/amfe-flexible/index.js HTTP/1.1\r\nHost: www.amweqe.help\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://www.amweqe.help/pages/team/register?invite_code=180962\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 404 Not Found\r\nserver: nginx\r\ndate: Tue, 24 Mar 2026 07:00:15 GMT\r\ncontent-type: text/html\r\nvary: Accept-Encoding\r\netag: W/\"69a454a1-49a\"\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"404","status_text":"Not Found","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":1178,"size_decoded":0,"mime_type":"text/html","magic":"HTML document, ASCII text, with very long lines (714), with CRLF line terminators","md5":"685fe5e11edf70ed7f80e8c03729ff4b","sha1":"58ef3beb37c26fb1e2b4559f0595e5ff21a9fbe0","sha256":"2e55b5143571651efd85cdfbc4f53075a97dce7e037e5d144d7b0be58bcad71a","sha512":"eeeb1725c170f36fbbff59e7a7d16659a501f94e89f8ec3d88edcd6a3028d3a487643bd427e18c5ce20a23d424cae7421a2175bd44120f70208c47322c21e4ec","ssdeep":"","tlshash":"06211e933d14e45a1b20aa5db47af11cd4ebc5642871d891e8dc1cad4ce0fcd0bbe52a","first_seen":"2026-03-11T10:18:29.041344Z","last_seen":"2026-03-24T07:02:06.136139Z","times_seen":4,"resource_available":false,"data":null}},"time_used":146,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":146,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-03-24","alert":"Sinkholed","trigger":"www.amweqe.help","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-03-24","alert":"Sinkholed","trigger":"www.amweqe.help","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-03-24","alert":"Sinkholed","trigger":"www.amweqe.help","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-03-24","alert":"Sinkholed","trigger":"www.amweqe.help","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"www.amweqe.help/static/js/index.dc1b4e8b.js","fqdn":"www.amweqe.help","domain":"amweqe.help","tld":"help"},"ip":{"addr":"104.168.22.92","port":443,"asn":36352,"as":"AS-COLOCROSSING","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://www.amweqe.help/pages/team/register?invite_code=180962","date":"2026-03-24T07:00:15.252Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"android.ahdmnb.help","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Mon, 16 Mar 2026 12:14:31 GMT","end":"Sun, 14 Jun 2026 12:14:30 GMT"},"fingerprint":{"sha1":"F6:7D:BA:4E:6C:C6:A4:C1:34:A0:65:54:AA:E0:4B:9D:47:7C:D3:9F","sha256":"C5:BB:CC:52:64:D3:42:4E:8A:E7:97:A5:E6:1A:88:EA:97:2E:81:86:47:CA:F9:7C:27:81:A9:51:59:48:4D:F7"}}},"request":{"raw":"GET /static/js/index.dc1b4e8b.js HTTP/1.1\r\nHost: www.amweqe.help\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://www.amweqe.help/pages/team/register?invite_code=180962\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Tue, 24 Mar 2026 07:00:15 GMT\r\ncontent-type: application/javascript\r\nlast-modified: Sun, 01 Mar 2026 15:00:49 GMT\r\nvary: Accept-Encoding\r\netag: W/\"69a454a1-3851c\"\r\nexpires: Tue, 24 Mar 2026 19:00:15 GMT\r\ncache-control: max-age=43200\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: quic=\":443\"; h3=\":443\"; h3-29=\":443\"; h3-27=\":443\";h3-25=\":443\"; h3-T050=\":443\"; h3-Q050=\":443\";h3-Q049=\":443\";h3-Q048=\":443\"; h3-Q046=\":443\"; h3-Q043=\":443\"\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":230684,"size_decoded":0,"mime_type":"application/javascript","magic":"JavaScript source, Unicode text, UTF-8 text, with very long lines (65466), with no line terminators","md5":"7635eeaa1f3a681568e7c83bcd3bf22c","sha1":"471e84e5d63ae708b2feb7632233df0bd00e1fca","sha256":"5e2a69c1f3cf39ca1f379b2d76be547a820fa460b00ecb895c0b2521052fb873","sha512":"20235260fee65a60317126edff659ae2a3125d6aa19bfe27d3706e47e58952a92b89c7661a53e07d3c543ca310adcff64a26a81434fbc9c5f9043c9f6acf2d1a","ssdeep":"768:xU48JrZjtSIFTWPwKA8CymAwKOIQndg9YVrxj/gXxR8Bt5xgD4Png36z7EsjFwRr:BT7Wdg9Arxj/gXxRMKr9R13+w3CRPs","tlshash":"9e34b887f99b874e951e3d56e45fa7b2b5e72ca2098ef0c3d3a56f355f0e1824720208","first_seen":"2026-03-11T10:18:29.030575Z","last_seen":"2026-03-24T07:02:06.130578Z","times_seen":4,"resource_available":true,"data":null}},"time_used":577,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":577,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-03-24","alert":"Sinkholed","trigger":"www.amweqe.help","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-03-24","alert":"Sinkholed","trigger":"www.amweqe.help","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-03-24","alert":"Sinkholed","trigger":"www.amweqe.help","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-03-24","alert":"Sinkholed","trigger":"www.amweqe.help","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"www.amweqe.help/static/js/pages-team-register.35774d36.js","fqdn":"www.amweqe.help","domain":"amweqe.help","tld":"help"},"ip":{"addr":"104.168.22.92","port":443,"asn":36352,"as":"AS-COLOCROSSING","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://www.amweqe.help/pages/team/register?invite_code=180962","date":"2026-03-24T07:00:17.171Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"android.ahdmnb.help","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Mon, 16 Mar 2026 12:14:31 GMT","end":"Sun, 14 Jun 2026 12:14:30 GMT"},"fingerprint":{"sha1":"F6:7D:BA:4E:6C:C6:A4:C1:34:A0:65:54:AA:E0:4B:9D:47:7C:D3:9F","sha256":"C5:BB:CC:52:64:D3:42:4E:8A:E7:97:A5:E6:1A:88:EA:97:2E:81:86:47:CA:F9:7C:27:81:A9:51:59:48:4D:F7"}}},"request":{"raw":"GET /static/js/pages-team-register.35774d36.js HTTP/1.1\r\nHost: www.amweqe.help\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://www.amweqe.help/pages/team/register?invite_code=180962\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Tue, 24 Mar 2026 07:00:17 GMT\r\ncontent-type: application/javascript\r\nlast-modified: Sun, 01 Mar 2026 15:00:49 GMT\r\nvary: Accept-Encoding\r\netag: W/\"69a454a1-1bdf\"\r\nexpires: Tue, 24 Mar 2026 19:00:17 GMT\r\ncache-control: max-age=43200\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: quic=\":443\"; h3=\":443\"; h3-29=\":443\"; h3-27=\":443\";h3-25=\":443\"; h3-T050=\":443\"; h3-Q050=\":443\";h3-Q049=\":443\";h3-Q048=\":443\"; h3-Q046=\":443\"; h3-Q043=\":443\"\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":7135,"size_decoded":0,"mime_type":"application/javascript","magic":"JavaScript source, Unicode text, UTF-8 text, with very long lines (6463), with no line terminators","md5":"0ddd971dec98f37109e3e631647e8012","sha1":"24f1c2ab3b48e66a483c43f8a37d087083fa5418","sha256":"d19bb353c13727bbbff0947276dec6ec0149b0ae8d15caf11a977d0a992d3b93","sha512":"9fdeb21c44e9eb75acd01fc9c2d047fea19493dcc8078881987087f1162ad7973a4a80614912c4aa32a33325d23d6d443fbc2d80c7c96be06d58711df5fa78b8","ssdeep":"192:bMjjXeqRsiyhDtpSw3wGjyPe89mFJFvw9L9u5/7RM/2W:43ehDnSwFWmFJFe5u1NW","tlshash":"05e109af70d6f84a101bc28c2597007932826617951a5c71cb74dbfd29f6ebb1722b4d","first_seen":"2026-03-11T10:18:29.03231Z","last_seen":"2026-03-24T07:00:43.241043Z","times_seen":2,"resource_available":true,"data":null}},"time_used":147,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":147,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-03-24","alert":"Sinkholed","trigger":"www.amweqe.help","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-03-24","alert":"Sinkholed","trigger":"www.amweqe.help","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-03-24","alert":"Sinkholed","trigger":"www.amweqe.help","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-03-24","alert":"Sinkholed","trigger":"www.amweqe.help","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"ecos.eopyyu.help/api/index/config","fqdn":"ecos.eopyyu.help","domain":"eopyyu.help","tld":"help"},"ip":{"addr":"104.168.22.92","port":443,"asn":36352,"as":"AS-COLOCROSSING","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"https://www.amweqe.help/pages/team/register?invite_code=180962","date":"2026-03-24T07:00:17.816Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"ecos.eopyyu.help","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Mon, 16 Mar 2026 07:16:56 GMT","end":"Sun, 14 Jun 2026 07:16:55 GMT"},"fingerprint":{"sha1":"BC:9A:D7:FB:8D:B4:DC:51:83:CB:77:9D:28:3B:1E:1D:09:AD:B6:E3","sha256":"A0:88:3B:E7:75:73:F3:C6:A1:96:A5:61:A7:05:63:D1:E9:D2:BE:D5:F4:2E:0A:85:12:67:70:60:A0:A1:02:6F"}}},"request":{"raw":"POST /api/index/config HTTP/1.1\r\nHost: ecos.eopyyu.help\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en\r\nAccept-Encoding: gzip, deflate, br\r\nApi-Name: wap\r\nApi-Token: -\r\nContent-Type: application/x-www-form-urlencoded\r\ntoken: -\r\nContent-Length: 0\r\nOrigin: https://www.amweqe.help\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://www.amweqe.help/\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"POST"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Tue, 24 Mar 2026 07:00:17 GMT\r\ncontent-type: application/json; charset=utf-8\r\nvary: Accept-Encoding\r\naccess-control-allow-origin: https://www.amweqe.help\r\naccess-control-allow-credentials: true\r\naccess-control-max-age: 86400\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: quic=\":443\"; h3=\":443\"; h3-29=\":443\"; h3-27=\":443\";h3-25=\":443\"; h3-T050=\":443\"; h3-Q050=\":443\";h3-Q049=\":443\";h3-Q048=\":443\"; h3-Q046=\":443\"; h3-Q043=\":443\"\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":6061,"size_decoded":0,"mime_type":"application/json; charset=utf-8","magic":"JSON text data","md5":"760d71c6edc00584b748452e71b459c5","sha1":"703e6c9bcf4839cd45e0761c2ffa5387a8a43241","sha256":"f2278a133f9c93e965fb00a717aa9f19856edfbef49cc16d5f1f7fddd32dadcf","sha512":"26d8f35cda1ad5aff50a51b42ad6599ac7e9cf3a939aa537f05d3aa0892475d43165483e8f8fceb7091ae3fb9e2b2e5c5b544f7f9359123e9e21c207930a09f7","ssdeep":"96:ekPwyCy6X1OFRcqIAZGx47P5E+iF7hfYeYiImcEl46YaLuM+Yxq1sICCpq1sICCd:emvo0FRcqIAZGxUP5ETXf1EmcEl467L7","tlshash":"a8c1726ab338d5105c2f84c830ee232f518af219fb0a48d9ab6c877895dd27576b0396","first_seen":"2026-03-24T07:00:43.242188Z","last_seen":"2026-03-24T07:00:43.242188Z","times_seen":1,"resource_available":false,"data":null}},"time_used":160,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":160,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-03-24","alert":"Phishing Block","trigger":"ecos.eopyyu.help","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-03-24","alert":"Sinkholed","trigger":"ecos.eopyyu.help","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"cdn.dcloud.net.cn/img/shadow-grey.png","fqdn":"cdn.dcloud.net.cn","domain":"dcloud.net.cn","tld":"net.cn"},"ip":{"addr":"124.220.205.65","port":443,"asn":45090,"as":"Shenzhen Tencent Computer Systems Company Limited","country":"China","country_code":"CN"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://www.amweqe.help/pages/team/register?invite_code=180962","date":"2026-03-24T07:00:18.591Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.dcloud.net.cn","organization":""},"issuer":{"commonName":"Certum Domain Validation CA SHA2","organization":"Unizeto Technologies S.A."},"validity":{"start":"Tue, 26 Aug 2025 11:47:17 GMT","end":"Fri, 25 Sep 2026 11:47:16 GMT"},"fingerprint":{"sha1":"47:A7:6C:09:6B:1D:CA:2D:7D:39:2E:C1:7F:15:DE:5D:F2:C4:0F:77","sha256":"EA:73:37:83:D0:38:44:D9:3C:0B:26:F0:DD:D1:22:2F:36:F7:F2:86:A1:B0:58:52:DE:4E:0A:21:D6:89:E7:3E"}}},"request":{"raw":"GET /img/shadow-grey.png HTTP/1.1\r\nHost: cdn.dcloud.net.cn\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://www.amweqe.help/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Tue, 24 Mar 2026 07:00:19 GMT\r\ncontent-type: image/png\r\ncontent-length: 136\r\nlast-modified: Thu, 06 Jun 2019 06:42:07 GMT\r\netag: \"5cf8b5bf-88\"\r\nexpires: Tue, 24 Mar 2026 15:00:19 GMT\r\ncache-control: max-age=28800\r\nset-cookie: __uni__uid=rBEQRWnCNoMY6yNqAwQbAg==; expires=Thu, 31-Dec-37 23:55:55 GMT; domain=dcloud.net.cn; path=/; secure; httponly; samesite=none\r\naccept-ranges: bytes\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":136,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 1 x 6, 4-bit colormap, non-interlaced","md5":"5a962adf74d92ae702467b3f47976547","sha1":"36f74049375584e3fa69b5ef87e9572336ff9e7a","sha256":"ad4ebea1c3496dd2924789ee009174a2c6289d1200e9811f458fd46f172d1d6f","sha512":"4ace23fe7ec6c7271710030fd423aace13eafac68ac3e76366ce4ce9bdc702caf71c9bdc2fb6a32c8e9791546098617cc0259decd8bb8489afdbce43e1b53a73","ssdeep":"","tlshash":"47c09bf3a615dc754a0d153b42e98271f429511e07046d0e5a13c216741e3448d56793","first_seen":"2023-04-15T10:50:30Z","last_seen":"2026-08-10T05:13:29.731905Z","times_seen":20176,"resource_available":false,"data":null}},"time_used":1272,"timings":{"blocked":519,"dns":1,"connect":235,"send":0,"wait":234,"receive":0,"ssl":278},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"www.amweqe.help/pages/team/register?invite_code=180962","fqdn":"www.amweqe.help","domain":"amweqe.help","tld":"help"},"ip":{"addr":"104.168.22.92","port":443,"asn":36352,"as":"AS-COLOCROSSING","country":"United States","country_code":"US"},"is_navigation_request":true,"resource_type":"document","requested_by":"","date":"2026-03-24T07:00:14.519Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"android.ahdmnb.help","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Mon, 16 Mar 2026 12:14:31 GMT","end":"Sun, 14 Jun 2026 12:14:30 GMT"},"fingerprint":{"sha1":"F6:7D:BA:4E:6C:C6:A4:C1:34:A0:65:54:AA:E0:4B:9D:47:7C:D3:9F","sha256":"C5:BB:CC:52:64:D3:42:4E:8A:E7:97:A5:E6:1A:88:EA:97:2E:81:86:47:CA:F9:7C:27:81:A9:51:59:48:4D:F7"}}},"request":{"raw":"GET /pages/team/register?invite_code=180962 HTTP/1.1\r\nHost: www.amweqe.help\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nUpgrade-Insecure-Requests: 1\r\nSec-Fetch-Dest: document\r\nSec-Fetch-Mode: navigate\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Tue, 24 Mar 2026 07:00:15 GMT\r\ncontent-type: text/html\r\nlast-modified: Sun, 01 Mar 2026 15:00:49 GMT\r\nvary: Accept-Encoding\r\netag: W/\"69a454a1-49a\"\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: quic=\":443\"; h3=\":443\"; h3-29=\":443\"; h3-27=\":443\";h3-25=\":443\"; h3-T050=\":443\"; h3-Q050=\":443\";h3-Q049=\":443\";h3-Q048=\":443\"; h3-Q046=\":443\"; h3-Q043=\":443\"\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":1178,"size_decoded":0,"mime_type":"text/html","magic":"HTML document, ASCII text, with very long lines (714), with CRLF line terminators","md5":"685fe5e11edf70ed7f80e8c03729ff4b","sha1":"58ef3beb37c26fb1e2b4559f0595e5ff21a9fbe0","sha256":"2e55b5143571651efd85cdfbc4f53075a97dce7e037e5d144d7b0be58bcad71a","sha512":"eeeb1725c170f36fbbff59e7a7d16659a501f94e89f8ec3d88edcd6a3028d3a487643bd427e18c5ce20a23d424cae7421a2175bd44120f70208c47322c21e4ec","ssdeep":"","tlshash":"06211e933d14e45a1b20aa5db47af11cd4ebc5642871d891e8dc1cad4ce0fcd0bbe52a","first_seen":"2026-03-11T10:18:29.041344Z","last_seen":"2026-03-24T07:02:06.136139Z","times_seen":4,"resource_available":false,"data":null}},"time_used":981,"timings":{"blocked":416,"dns":119,"connect":145,"send":0,"wait":146,"receive":0,"ssl":152},"alerts":{"ids":null,"analyzer":[{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-03-24","alert":"Sinkholed","trigger":"www.amweqe.help","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-03-24","alert":"Sinkholed","trigger":"www.amweqe.help","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-03-24","alert":"Sinkholed","trigger":"www.amweqe.help","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-03-24","alert":"Sinkholed","trigger":"www.amweqe.help","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"www.amweqe.help/static/index.css","fqdn":"www.amweqe.help","domain":"amweqe.help","tld":"help"},"ip":{"addr":"104.168.22.92","port":443,"asn":36352,"as":"AS-COLOCROSSING","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://www.amweqe.help/pages/team/register?invite_code=180962","date":"2026-03-24T07:00:15.249Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"android.ahdmnb.help","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Mon, 16 Mar 2026 12:14:31 GMT","end":"Sun, 14 Jun 2026 12:14:30 GMT"},"fingerprint":{"sha1":"F6:7D:BA:4E:6C:C6:A4:C1:34:A0:65:54:AA:E0:4B:9D:47:7C:D3:9F","sha256":"C5:BB:CC:52:64:D3:42:4E:8A:E7:97:A5:E6:1A:88:EA:97:2E:81:86:47:CA:F9:7C:27:81:A9:51:59:48:4D:F7"}}},"request":{"raw":"GET /static/index.css HTTP/1.1\r\nHost: www.amweqe.help\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://www.amweqe.help/pages/team/register?invite_code=180962\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Tue, 24 Mar 2026 07:00:15 GMT\r\ncontent-type: text/css\r\nlast-modified: Sun, 01 Mar 2026 15:00:49 GMT\r\nvary: Accept-Encoding\r\netag: W/\"69a454a1-1794e\"\r\nexpires: Tue, 24 Mar 2026 19:00:15 GMT\r\ncache-control: max-age=43200\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: quic=\":443\"; h3=\":443\"; h3-29=\":443\"; h3-27=\":443\";h3-25=\":443\"; h3-T050=\":443\"; h3-Q050=\":443\";h3-Q049=\":443\";h3-Q048=\":443\"; h3-Q046=\":443\"; h3-Q043=\":443\"\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":96590,"size_decoded":0,"mime_type":"text/css","magic":"ASCII text, with very long lines (65536), with no line terminators","md5":"d2c05a28c7f2113821d909b7b5b918a3","sha1":"ccac94311f6ac6f580b64f47f7705318f1d226a3","sha256":"695bdbeea38a126c139158967cdd4f3a435e9936b9dff5b002e5f20a10fc7907","sha512":"3b96fbd1a89be8ae0b7479705cd4a2958ffe7f2f3f57ec23f407ad51ed8b447b9960728d77502e8fd8b2b19bf0971682030117559df250ea11c9bc1802364c3c","ssdeep":"1536:qlIApuK7hmVmb2RS1Wu3xdynGJ7eh/nrhlvbc:hApuK7hmVrS1Wu3iG41nrPI","tlshash":"4493f73719012e39e52bcd26b6c1ab5a1e61c033e15307adfba47628cbcf9c9167b345","first_seen":"2025-10-16T12:28:28.877032Z","last_seen":"2026-08-07T20:03:32.998814Z","times_seen":1815,"resource_available":false,"data":null}},"time_used":290,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":290,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-03-24","alert":"Sinkholed","trigger":"www.amweqe.help","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-03-24","alert":"Sinkholed","trigger":"www.amweqe.help","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-03-24","alert":"Sinkholed","trigger":"www.amweqe.help","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-03-24","alert":"Sinkholed","trigger":"www.amweqe.help","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"www.amweqe.help/static/team/rg6.png","fqdn":"www.amweqe.help","domain":"amweqe.help","tld":"help"},"ip":{"addr":"104.168.22.92","port":443,"asn":36352,"as":"AS-COLOCROSSING","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://www.amweqe.help/pages/team/register?invite_code=180962","date":"2026-03-24T07:00:17.205Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"android.ahdmnb.help","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Mon, 16 Mar 2026 12:14:31 GMT","end":"Sun, 14 Jun 2026 12:14:30 GMT"},"fingerprint":{"sha1":"F6:7D:BA:4E:6C:C6:A4:C1:34:A0:65:54:AA:E0:4B:9D:47:7C:D3:9F","sha256":"C5:BB:CC:52:64:D3:42:4E:8A:E7:97:A5:E6:1A:88:EA:97:2E:81:86:47:CA:F9:7C:27:81:A9:51:59:48:4D:F7"}}},"request":{"raw":"GET /static/team/rg6.png HTTP/1.1\r\nHost: www.amweqe.help\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://www.amweqe.help/pages/team/register?invite_code=180962\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Tue, 24 Mar 2026 07:00:17 GMT\r\ncontent-type: image/png\r\nlast-modified: Sun, 01 Mar 2026 15:00:49 GMT\r\nvary: Accept-Encoding\r\netag: W/\"69a454a1-a6d4\"\r\nexpires: Thu, 23 Apr 2026 07:00:17 GMT\r\ncache-control: max-age=2592000\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: quic=\":443\"; h3=\":443\"; h3-29=\":443\"; h3-27=\":443\";h3-25=\":443\"; h3-T050=\":443\"; h3-Q050=\":443\";h3-Q049=\":443\";h3-Q048=\":443\"; h3-Q046=\":443\"; h3-Q043=\":443\"\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":42708,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 200 x 200, 8-bit/color RGBA, non-interlaced","md5":"af42eff7c725201cefcd7eea0d7a2ba5","sha1":"a72f82b95728dee9cc9ac96dbefe03fbc4521ffc","sha256":"e6462bc4009b4b3059628ff79f96ed238baa223945e11ddf4b6bbfed843211f7","sha512":"a46ac2b7fed05e205315eaa908d3479418c406a8a3ddec15176ea36cc6f3df63abffc5baf2b09533bc6c55fb029f8ffa49b9d786e8ad48c7e3b0edf8e04e2c89","ssdeep":"768:EihsrI3pj5j7iNxsScXt3xHxNEbMFirU1flw4TTESpFGSHXVNxbzKCKuH6bqPewe:EiurIp5fifsN3RiSw4vESpt5LKuIqP5e","tlshash":"7e130289ae80d5749cfbfd1f65ca2f11a88c5a23b9165b5508c80b1df473330ae1f174","first_seen":"2026-03-11T10:18:29.01833Z","last_seen":"2026-05-01T14:21:25.167387Z","times_seen":6,"resource_available":false,"data":null}},"time_used":148,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":148,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-03-24","alert":"Sinkholed","trigger":"www.amweqe.help","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-03-24","alert":"Sinkholed","trigger":"www.amweqe.help","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-03-24","alert":"Sinkholed","trigger":"www.amweqe.help","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-03-24","alert":"Sinkholed","trigger":"www.amweqe.help","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"www.amweqe.help/static/team/rg8.png","fqdn":"www.amweqe.help","domain":"amweqe.help","tld":"help"},"ip":{"addr":"104.168.22.92","port":443,"asn":36352,"as":"AS-COLOCROSSING","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://www.amweqe.help/pages/team/register?invite_code=180962","date":"2026-03-24T07:00:17.216Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"android.ahdmnb.help","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Mon, 16 Mar 2026 12:14:31 GMT","end":"Sun, 14 Jun 2026 12:14:30 GMT"},"fingerprint":{"sha1":"F6:7D:BA:4E:6C:C6:A4:C1:34:A0:65:54:AA:E0:4B:9D:47:7C:D3:9F","sha256":"C5:BB:CC:52:64:D3:42:4E:8A:E7:97:A5:E6:1A:88:EA:97:2E:81:86:47:CA:F9:7C:27:81:A9:51:59:48:4D:F7"}}},"request":{"raw":"GET /static/team/rg8.png HTTP/1.1\r\nHost: www.amweqe.help\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://www.amweqe.help/pages/team/register?invite_code=180962\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Tue, 24 Mar 2026 07:00:17 GMT\r\ncontent-type: image/png\r\nlast-modified: Sun, 01 Mar 2026 15:00:49 GMT\r\nvary: Accept-Encoding\r\netag: W/\"69a454a1-c662\"\r\nexpires: Thu, 23 Apr 2026 07:00:17 GMT\r\ncache-control: max-age=2592000\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: quic=\":443\"; h3=\":443\"; h3-29=\":443\"; h3-27=\":443\";h3-25=\":443\"; h3-T050=\":443\"; h3-Q050=\":443\";h3-Q049=\":443\";h3-Q048=\":443\"; h3-Q046=\":443\"; h3-Q043=\":443\"\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":50786,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 200 x 200, 8-bit/color RGBA, non-interlaced","md5":"0ae38b45ef05f09ad8f9ea73098c6616","sha1":"d30f955684f1e15328d4316bc5121e3fae377460","sha256":"65649f32a63958c8b9ac49703c278fb56cd7bad667e01cad4a89f3a4e8c47544","sha512":"63becd0660a33a8a6c2b1c509192f7bf46f945d5294f533e9f48f92fceaf4591dfa231a5b6750607421764f2cdbf3b266f922795332789731fa40b5a71763b67","ssdeep":"768:bDDOkjvYnqIfX7hjghB9xH5nJOKnCctHdsyDtBGUPT2aPPSWyWaa+JU1:bDDOYAqeqvxHlDj9htBB5PbDZ+JE","tlshash":"5a33022dfdeb2a5576af1bbe0448da14a085408b0da1fe12306cd56c7245cfdafeaf04","first_seen":"2026-03-11T10:18:29.039139Z","last_seen":"2026-05-01T14:21:25.177044Z","times_seen":6,"resource_available":false,"data":null}},"time_used":147,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":147,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-03-24","alert":"Sinkholed","trigger":"www.amweqe.help","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-03-24","alert":"Sinkholed","trigger":"www.amweqe.help","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-03-24","alert":"Sinkholed","trigger":"www.amweqe.help","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-03-24","alert":"Sinkholed","trigger":"www.amweqe.help","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"www.amweqe.help/static/team/rg9.png","fqdn":"www.amweqe.help","domain":"amweqe.help","tld":"help"},"ip":{"addr":"104.168.22.92","port":443,"asn":36352,"as":"AS-COLOCROSSING","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://www.amweqe.help/pages/team/register?invite_code=180962","date":"2026-03-24T07:00:17.219Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"android.ahdmnb.help","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Mon, 16 Mar 2026 12:14:31 GMT","end":"Sun, 14 Jun 2026 12:14:30 GMT"},"fingerprint":{"sha1":"F6:7D:BA:4E:6C:C6:A4:C1:34:A0:65:54:AA:E0:4B:9D:47:7C:D3:9F","sha256":"C5:BB:CC:52:64:D3:42:4E:8A:E7:97:A5:E6:1A:88:EA:97:2E:81:86:47:CA:F9:7C:27:81:A9:51:59:48:4D:F7"}}},"request":{"raw":"GET /static/team/rg9.png HTTP/1.1\r\nHost: www.amweqe.help\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://www.amweqe.help/pages/team/register?invite_code=180962\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Tue, 24 Mar 2026 07:00:17 GMT\r\ncontent-type: image/png\r\nlast-modified: Sun, 01 Mar 2026 15:00:49 GMT\r\nvary: Accept-Encoding\r\netag: W/\"69a454a1-a3b2\"\r\nexpires: Thu, 23 Apr 2026 07:00:17 GMT\r\ncache-control: max-age=2592000\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: quic=\":443\"; h3=\":443\"; h3-29=\":443\"; h3-27=\":443\";h3-25=\":443\"; h3-T050=\":443\"; h3-Q050=\":443\";h3-Q049=\":443\";h3-Q048=\":443\"; h3-Q046=\":443\"; h3-Q043=\":443\"\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":41906,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 200 x 200, 8-bit/color RGBA, non-interlaced","md5":"3fc54df17e7460ea4af30cf8ce67670d","sha1":"584432ec677dc31cecbc5920917ad3081133cc88","sha256":"126423e9bfc88240041a91c584d1151c7beb69d1c65eba75adb8d8024676aeb5","sha512":"ee263c34090153aa91789d5ca79c6b3539b231790e0383d39cb5bc3fe6b0371005b917e4c897b2c499a308364b1bb1617a1ffe39aa1dbb12e73b88697225a323","ssdeep":"768:oJrfZ91wx3TD0kKyUDxZMFTRDNpZhLn4uQX2DdbqJ3kSHsV2:qrfZUj4XyUXMFTpNpfjC21QUZI","tlshash":"5a13f2fadc28164e74ead8a7a1f2c210654972f72ff45e7d259218f806263b563cf0c6","first_seen":"2026-03-11T10:18:29.021695Z","last_seen":"2026-05-01T14:21:25.168542Z","times_seen":6,"resource_available":false,"data":null}},"time_used":147,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":147,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-03-24","alert":"Sinkholed","trigger":"www.amweqe.help","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-03-24","alert":"Sinkholed","trigger":"www.amweqe.help","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-03-24","alert":"Sinkholed","trigger":"www.amweqe.help","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-03-24","alert":"Sinkholed","trigger":"www.amweqe.help","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"www.amweqe.help/static/team/rg10.png","fqdn":"www.amweqe.help","domain":"amweqe.help","tld":"help"},"ip":{"addr":"104.168.22.92","port":443,"asn":36352,"as":"AS-COLOCROSSING","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://www.amweqe.help/pages/team/register?invite_code=180962","date":"2026-03-24T07:00:17.221Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"android.ahdmnb.help","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Mon, 16 Mar 2026 12:14:31 GMT","end":"Sun, 14 Jun 2026 12:14:30 GMT"},"fingerprint":{"sha1":"F6:7D:BA:4E:6C:C6:A4:C1:34:A0:65:54:AA:E0:4B:9D:47:7C:D3:9F","sha256":"C5:BB:CC:52:64:D3:42:4E:8A:E7:97:A5:E6:1A:88:EA:97:2E:81:86:47:CA:F9:7C:27:81:A9:51:59:48:4D:F7"}}},"request":{"raw":"GET /static/team/rg10.png HTTP/1.1\r\nHost: www.amweqe.help\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://www.amweqe.help/pages/team/register?invite_code=180962\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Tue, 24 Mar 2026 07:00:17 GMT\r\ncontent-type: image/png\r\nlast-modified: Sun, 01 Mar 2026 15:00:49 GMT\r\nvary: Accept-Encoding\r\netag: W/\"69a454a1-8f80\"\r\nexpires: Thu, 23 Apr 2026 07:00:17 GMT\r\ncache-control: max-age=2592000\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: quic=\":443\"; h3=\":443\"; h3-29=\":443\"; h3-27=\":443\";h3-25=\":443\"; h3-T050=\":443\"; h3-Q050=\":443\";h3-Q049=\":443\";h3-Q048=\":443\"; h3-Q046=\":443\"; h3-Q043=\":443\"\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":36736,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 200 x 200, 8-bit/color RGBA, non-interlaced","md5":"d255945fde5886ff3944c9a2d0e2c6fc","sha1":"cbb8a9ad28fcaa1d3ee384358178652e50ca9adc","sha256":"336c29c187c712d6bd1ffc65471896f5374127217b9d2b934b9cf62945f026b2","sha512":"5ab3735cad90eaee0f0d34a3b600263873483c20b1a7079c7509c4b563cae4f94703f95ba71ca2ef12ae5f73ce052039fac3dbd95d21044bae88ce473822a1f7","ssdeep":"768:+DknAAOQohYDgYcYjTQ3dZRzuLJiJQuLPALjRQ:Vn1OQ6ScYjE34LJiuuLoL6","tlshash":"aff2f124be2ddeba69a3084744a3432d05307efa062d5a86250fddc34455d69bfe78f3","first_seen":"2026-03-11T10:18:29.043505Z","last_seen":"2026-05-01T14:21:25.178857Z","times_seen":6,"resource_available":false,"data":null}},"time_used":150,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":150,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-03-24","alert":"Sinkholed","trigger":"www.amweqe.help","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-03-24","alert":"Sinkholed","trigger":"www.amweqe.help","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-03-24","alert":"Sinkholed","trigger":"www.amweqe.help","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-03-24","alert":"Sinkholed","trigger":"www.amweqe.help","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"cdn.jsdelivr.net/npm/bootstrap-icons@1.3.0/font/bootstrap-icons.css","fqdn":"cdn.jsdelivr.net","domain":"jsdelivr.net","tld":"net"},"ip":{"addr":"104.16.174.226","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://www.amweqe.help/pages/team/register?invite_code=180962","date":"2026-03-24T07:00:15.243Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.jsdelivr.net","organization":""},"issuer":{"commonName":"Sectigo RSA Domain Validation Secure Server CA","organization":"Sectigo Limited"},"validity":{"start":"Fri, 25 Apr 2025 00:00:00 GMT","end":"Mon, 04 May 2026 23:59:59 GMT"},"fingerprint":{"sha1":"A6:DD:A1:61:65:41:D0:8F:18:9A:2F:B3:5C:A4:20:AA:B2:8C:AD:1F","sha256":"20:CE:80:8C:8A:B7:48:3B:0B:A0:F2:AC:61:42:83:EC:54:84:A8:FA:4C:2D:98:10:FF:8B:FA:A5:1D:F5:21:28"}}},"request":{"raw":"GET /npm/bootstrap-icons@1.3.0/font/bootstrap-icons.css HTTP/1.1\r\nHost: cdn.jsdelivr.net\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://www.amweqe.help/\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ndate: Tue, 24 Mar 2026 07:00:15 GMT\r\ncontent-type: text/css; charset=utf-8\r\ncontent-length: 8018\r\naccess-control-allow-origin: *\r\naccess-control-expose-headers: *\r\ntiming-allow-origin: *\r\ncache-control: public, max-age=31536000, s-maxage=31536000, immutable\r\ncross-origin-resource-policy: cross-origin\r\nx-content-type-options: nosniff\r\nstrict-transport-security: max-age=31536000; includeSubDomains; preload\r\nx-jsd-version: 1.3.0\r\nx-jsd-version-type: version\r\netag: W/\"edbb-Du3MPQ7GnRobCfGvnAP4Uqb5QVI\"\r\ncontent-encoding: br\r\naccept-ranges: bytes\r\nx-served-by: cache-fra-etou8220103-FRA\r\nx-cache: HIT\r\nvary: Accept-Encoding\r\nalt-svc: h3=\":443\"; ma=86400\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.01,\"max_age\":604800}\r\nage: 2942224\r\ncf-cache-status: HIT\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=iwprX9BZv1j%2FB5bHw%2BOMvA%2BjqRvxm8G7DhVpnHyxsJAad7XdcuTK4jKdTdNVPKzDjgXPlx1by2ASn6OPkbdkXXzNDYYDHcQ%2FTIo4HzGB%2Fw%3D%3D\"}]}\r\nserver: cloudflare\r\ncf-ray: 9e13cc3b683035a6-OSL\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":60859,"size_decoded":0,"mime_type":"text/css; charset=utf-8","magic":"ASCII text","md5":"dbf1248779dc682a91ba529b5efe0ffc","sha1":"0eedcc3d0ec69d1a1b09f1af9c03f852a6f94152","sha256":"32cc4a47b370e278072a6440249872e681efa1d992600420c03a9631da885d70","sha512":"2e96320bb785273c91c136a4aba02268e2c9ebcc92998c24160331ec14f0f902132d21f4ac4cb130771dd20758bef407d589b1f8e3175796622edb162a517098","ssdeep":"384:vaqJVm8OAL1M+hQokEYm47U7yH2CYEjOnm4zH7fZ6aXoso1v/:Sqnm8OAL1Mzocm4KyH2CYEjOnm874soh","tlshash":"2c53cebad18f05f59341e4d92743674293a9ba7ce1817c7ad342399ee3c06188ad73ec","first_seen":"2023-04-05T06:29:21Z","last_seen":"2026-08-09T18:30:59.357991Z","times_seen":15182,"resource_available":false,"data":null}},"time_used":51,"timings":{"blocked":13,"dns":1,"connect":1,"send":0,"wait":18,"receive":1,"ssl":15},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"www.amweqe.help/static/common/js/touch-emulator.js","fqdn":"www.amweqe.help","domain":"amweqe.help","tld":"help"},"ip":{"addr":"104.168.22.92","port":443,"asn":36352,"as":"AS-COLOCROSSING","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://www.amweqe.help/pages/team/register?invite_code=180962","date":"2026-03-24T07:00:15.246Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"android.ahdmnb.help","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Mon, 16 Mar 2026 12:14:31 GMT","end":"Sun, 14 Jun 2026 12:14:30 GMT"},"fingerprint":{"sha1":"F6:7D:BA:4E:6C:C6:A4:C1:34:A0:65:54:AA:E0:4B:9D:47:7C:D3:9F","sha256":"C5:BB:CC:52:64:D3:42:4E:8A:E7:97:A5:E6:1A:88:EA:97:2E:81:86:47:CA:F9:7C:27:81:A9:51:59:48:4D:F7"}}},"request":{"raw":"GET /static/common/js/touch-emulator.js HTTP/1.1\r\nHost: www.amweqe.help\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://www.amweqe.help/pages/team/register?invite_code=180962\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Tue, 24 Mar 2026 07:00:15 GMT\r\ncontent-type: application/javascript\r\nlast-modified: Sun, 01 Mar 2026 15:00:49 GMT\r\nvary: Accept-Encoding\r\netag: W/\"69a454a1-25d1\"\r\nexpires: Tue, 24 Mar 2026 19:00:15 GMT\r\ncache-control: max-age=43200\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: quic=\":443\"; h3=\":443\"; h3-29=\":443\"; h3-27=\":443\";h3-25=\":443\"; h3-T050=\":443\"; h3-Q050=\":443\";h3-Q049=\":443\";h3-Q048=\":443\"; h3-Q046=\":443\"; h3-Q043=\":443\"\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":9681,"size_decoded":0,"mime_type":"application/javascript","magic":"JavaScript source, Unicode text, UTF-8 text, with CRLF, LF line terminators","md5":"96c7c37960578939b67613c9bb430d2b","sha1":"6d8c9b333553e6af1ff091efdcc3283c349f6f32","sha256":"393dedb6966352528116b078a3f3cb7e431da2a14dd3d5ba5ebaf3082070baa6","sha512":"8067a337f5b73c7df6a1ad8479470d2503fdd2054302f55672328661a81b96c2c3873db99df075ceb5607bfd3dced7bc65b45a4a295358c2dfb045f05335b43a","ssdeep":"96:XRg+viJuC/N6pCQ/2XVNPTNjtQ+tkrs3oCPRT7uT9W2fTtiTy5kuGtR/eCHF6Etg:Xaui+CZQHIOxZfAz/eCtg","tlshash":"111275eb734f236b02fa3315b2fed586f5bdc4a0110222aef8e45e69306897547584dd","first_seen":"2025-08-29T05:58:51.08327Z","last_seen":"2026-05-01T14:21:25.174084Z","times_seen":10,"resource_available":true,"data":null}},"time_used":146,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":146,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-03-24","alert":"Sinkholed","trigger":"www.amweqe.help","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-03-24","alert":"Sinkholed","trigger":"www.amweqe.help","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-03-24","alert":"Sinkholed","trigger":"www.amweqe.help","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-03-24","alert":"Sinkholed","trigger":"www.amweqe.help","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"www.amweqe.help/static/app_logo.png","fqdn":"www.amweqe.help","domain":"amweqe.help","tld":"help"},"ip":{"addr":"104.168.22.92","port":443,"asn":36352,"as":"AS-COLOCROSSING","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://www.amweqe.help/pages/team/register?invite_code=180962","date":"2026-03-24T07:00:16.862Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"android.ahdmnb.help","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Mon, 16 Mar 2026 12:14:31 GMT","end":"Sun, 14 Jun 2026 12:14:30 GMT"},"fingerprint":{"sha1":"F6:7D:BA:4E:6C:C6:A4:C1:34:A0:65:54:AA:E0:4B:9D:47:7C:D3:9F","sha256":"C5:BB:CC:52:64:D3:42:4E:8A:E7:97:A5:E6:1A:88:EA:97:2E:81:86:47:CA:F9:7C:27:81:A9:51:59:48:4D:F7"}}},"request":{"raw":"GET /static/app_logo.png HTTP/1.1\r\nHost: www.amweqe.help\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://www.amweqe.help/pages/team/register?invite_code=180962\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Tue, 24 Mar 2026 07:00:16 GMT\r\ncontent-type: image/png\r\nlast-modified: Sun, 01 Mar 2026 15:00:49 GMT\r\nvary: Accept-Encoding\r\netag: W/\"69a454a1-6fb3\"\r\nexpires: Thu, 23 Apr 2026 07:00:16 GMT\r\ncache-control: max-age=2592000\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: quic=\":443\"; h3=\":443\"; h3-29=\":443\"; h3-27=\":443\";h3-25=\":443\"; h3-T050=\":443\"; h3-Q050=\":443\";h3-Q049=\":443\";h3-Q048=\":443\"; h3-Q046=\":443\"; h3-Q043=\":443\"\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":28595,"size_decoded":0,"mime_type":"image/png","magic":"JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, progressive, precision 8, 1024x1024, components 3","md5":"84c3e9a357316fab02a55e3137c849fd","sha1":"2a5c417c763fa8e096486cdec2787cc6f9b6e5d1","sha256":"a6ef4d24df890121b84cbaa9d40079a6fd557133bec8a78b756383521f40765a","sha512":"bf9f16f359a6fa25b9d23a953d5dc09730b09468d0e72e0b17616ed3c2cb16965ff83c995ebe5da4afbb6488fd4c07038baa45b53131e58a993661f977f45c21","ssdeep":"768:B7JJkeSKrYsdppsgtFyl6/wYC49qyhmRDd:rJ3ppHb/wYzMymd","tlshash":"f9d2d08ba9c7035be9ace234649b4905db093f760c39e75d9ea05a81702265dbcff034","first_seen":"2026-03-11T10:18:29.05764Z","last_seen":"2026-05-01T14:21:25.156612Z","times_seen":6,"resource_available":false,"data":null}},"time_used":147,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":147,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-03-24","alert":"Sinkholed","trigger":"www.amweqe.help","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-03-24","alert":"Sinkholed","trigger":"www.amweqe.help","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-03-24","alert":"Sinkholed","trigger":"www.amweqe.help","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-03-24","alert":"Sinkholed","trigger":"www.amweqe.help","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"www.amweqe.help/static/favicon.ico","fqdn":"www.amweqe.help","domain":"amweqe.help","tld":"help"},"ip":{"addr":"104.168.22.92","port":443,"asn":36352,"as":"AS-COLOCROSSING","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://www.amweqe.help/pages/team/register?invite_code=180962","date":"2026-03-24T07:00:16.864Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"android.ahdmnb.help","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Mon, 16 Mar 2026 12:14:31 GMT","end":"Sun, 14 Jun 2026 12:14:30 GMT"},"fingerprint":{"sha1":"F6:7D:BA:4E:6C:C6:A4:C1:34:A0:65:54:AA:E0:4B:9D:47:7C:D3:9F","sha256":"C5:BB:CC:52:64:D3:42:4E:8A:E7:97:A5:E6:1A:88:EA:97:2E:81:86:47:CA:F9:7C:27:81:A9:51:59:48:4D:F7"}}},"request":{"raw":"GET /static/favicon.ico HTTP/1.1\r\nHost: www.amweqe.help\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://www.amweqe.help/pages/team/register?invite_code=180962\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Tue, 24 Mar 2026 07:00:16 GMT\r\ncontent-type: image/x-icon\r\ncontent-length: 894\r\nlast-modified: Sun, 01 Mar 2026 15:00:49 GMT\r\netag: \"69a454a1-37e\"\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: quic=\":443\"; h3=\":443\"; h3-29=\":443\"; h3-27=\":443\";h3-25=\":443\"; h3-T050=\":443\"; h3-Q050=\":443\";h3-Q049=\":443\";h3-Q048=\":443\"; h3-Q046=\":443\"; h3-Q043=\":443\"\r\naccept-ranges: bytes\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":894,"size_decoded":0,"mime_type":"image/x-icon","magic":"MS Windows icon resource - 1 icon, 16x16, 24 bits/pixel","md5":"4b295984e253cd32f1dd384d90d9c50d","sha1":"e92a7709332dc639c9b7abb6e51a9610b5b8426f","sha256":"7fd68da70956cd007e17f904814bc2a50d96b7c013bd5a942382e3b85fa6af4c","sha512":"aed5e2b92f57f42ce302bdfdb0d773524914cf1416fe9868947bba4b0a6bf31bc41c7b8445104a8a7187b23d7882e6788966c33f3423f7769da18fcfef5f289f","ssdeep":"","tlshash":"2711abc76210a8b4d3640f324a2aaba189831fba1baacd19c5e0b2c10bb42f2a550416","first_seen":"2026-03-11T10:18:29.051027Z","last_seen":"2026-03-24T07:02:06.105934Z","times_seen":4,"resource_available":false,"data":null}},"time_used":174,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":147,"receive":27,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-03-24","alert":"Sinkholed","trigger":"www.amweqe.help","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-03-24","alert":"Sinkholed","trigger":"www.amweqe.help","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-03-24","alert":"Sinkholed","trigger":"www.amweqe.help","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-03-24","alert":"Sinkholed","trigger":"www.amweqe.help","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"ecos.eopyyu.help/api/index/channel","fqdn":"ecos.eopyyu.help","domain":"eopyyu.help","tld":"help"},"ip":{"addr":"104.168.22.92","port":443,"asn":36352,"as":"AS-COLOCROSSING","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"https://www.amweqe.help/pages/team/register?invite_code=180962","date":"2026-03-24T07:00:17.845Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"ecos.eopyyu.help","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Mon, 16 Mar 2026 07:16:56 GMT","end":"Sun, 14 Jun 2026 07:16:55 GMT"},"fingerprint":{"sha1":"BC:9A:D7:FB:8D:B4:DC:51:83:CB:77:9D:28:3B:1E:1D:09:AD:B6:E3","sha256":"A0:88:3B:E7:75:73:F3:C6:A1:96:A5:61:A7:05:63:D1:E9:D2:BE:D5:F4:2E:0A:85:12:67:70:60:A0:A1:02:6F"}}},"request":{"raw":"POST /api/index/channel HTTP/1.1\r\nHost: ecos.eopyyu.help\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en\r\nAccept-Encoding: gzip, deflate, br\r\nApi-Name: wap\r\nApi-Token: -\r\nContent-Type: application/x-www-form-urlencoded\r\ntoken: -\r\nContent-Length: 22\r\nOrigin: https://www.amweqe.help\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://www.amweqe.help/\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"POST","post_data":{"size":22,"data":"domain=www.amweqe.help"}},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Tue, 24 Mar 2026 07:00:17 GMT\r\ncontent-type: application/json; charset=utf-8\r\nvary: Accept-Encoding\r\naccess-control-allow-origin: https://www.amweqe.help\r\naccess-control-allow-credentials: true\r\naccess-control-max-age: 86400\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: quic=\":443\"; h3=\":443\"; h3-29=\":443\"; h3-27=\":443\";h3-25=\":443\"; h3-T050=\":443\"; h3-Q050=\":443\";h3-Q049=\":443\";h3-Q048=\":443\"; h3-Q046=\":443\"; h3-Q043=\":443\"\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":58,"size_decoded":0,"mime_type":"application/json; charset=utf-8","magic":"JSON text data","md5":"24958937de9abbe3a483f130f61973b7","sha1":"df7db5cd6fd5c48aa964db3f25490ed88cac8176","sha256":"7b4e20892d57fbf27c8948a745876ffa603ab23150e4816facd6dbad603debb8","sha512":"87441e7e30698d5f638ef8d0a6d45f42d5f25cdb6d5258936e2b15860e585bfa69452b02b257c522a1f0bdaf213ec3497d4bbb415aaaf24a6f81133ed9c5929b","ssdeep":"","tlshash":"f8a0026654490c461515755841488786529d504389815710995faf28858c068b052432","first_seen":"2026-03-24T07:00:43.254967Z","last_seen":"2026-03-24T07:00:43.254967Z","times_seen":1,"resource_available":false,"data":null}},"time_used":213,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":213,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-03-24","alert":"Sinkholed","trigger":"ecos.eopyyu.help","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-03-24","alert":"Phishing Block","trigger":"ecos.eopyyu.help","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"www.amweqe.help/static/js/chunk-vendors.fd1d24e5.js","fqdn":"www.amweqe.help","domain":"amweqe.help","tld":"help"},"ip":{"addr":"104.168.22.92","port":443,"asn":36352,"as":"AS-COLOCROSSING","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://www.amweqe.help/pages/team/register?invite_code=180962","date":"2026-03-24T07:00:15.250Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"android.ahdmnb.help","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Mon, 16 Mar 2026 12:14:31 GMT","end":"Sun, 14 Jun 2026 12:14:30 GMT"},"fingerprint":{"sha1":"F6:7D:BA:4E:6C:C6:A4:C1:34:A0:65:54:AA:E0:4B:9D:47:7C:D3:9F","sha256":"C5:BB:CC:52:64:D3:42:4E:8A:E7:97:A5:E6:1A:88:EA:97:2E:81:86:47:CA:F9:7C:27:81:A9:51:59:48:4D:F7"}}},"request":{"raw":"GET /static/js/chunk-vendors.fd1d24e5.js HTTP/1.1\r\nHost: www.amweqe.help\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://www.amweqe.help/pages/team/register?invite_code=180962\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Tue, 24 Mar 2026 07:00:15 GMT\r\ncontent-type: application/javascript\r\nlast-modified: Sun, 01 Mar 2026 15:00:49 GMT\r\nvary: Accept-Encoding\r\netag: W/\"69a454a1-3c6329\"\r\nexpires: Tue, 24 Mar 2026 19:00:15 GMT\r\ncache-control: max-age=43200\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: quic=\":443\"; h3=\":443\"; h3-29=\":443\"; h3-27=\":443\";h3-25=\":443\"; h3-T050=\":443\"; h3-Q050=\":443\";h3-Q049=\":443\";h3-Q048=\":443\"; h3-Q046=\":443\"; h3-Q043=\":443\"\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":3957545,"size_decoded":0,"mime_type":"application/javascript","magic":"JavaScript source, Unicode text, UTF-8 text, with very long lines (36999)","md5":"144d03d2d01b43031c95431c1d6abd4b","sha1":"c57df0fd8208947751b3ad54ab7c9aaefd214bec","sha256":"45c54537ea05abfecb504a9548777d6873714aa8f331dab3a1d50eeebe057692","sha512":"3725bd761af0ad1284ea20c3387aca312127d9cda14d4619c43fa7e0bbae3639befcf0180c8d25470b0eb63cf298885fcedc8b786ee2fefae595dec87548b978","ssdeep":"12288:pFXLB71kIpJWcpUxs5JFotZrEObN+TOX7FS:XXLB71kZcUxs5reJSOk","tlshash":"ae354a9872c4f1b94ad351f4843f2005b27f59aca009b558f3bac8d0ab2958d927bf7d","first_seen":"2026-03-11T10:18:29.028676Z","last_seen":"2026-03-24T07:00:43.256085Z","times_seen":2,"resource_available":false,"data":null}},"time_used":431,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":431,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-03-24","alert":"Sinkholed","trigger":"www.amweqe.help","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-03-24","alert":"Sinkholed","trigger":"www.amweqe.help","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-03-24","alert":"Sinkholed","trigger":"www.amweqe.help","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-03-24","alert":"Sinkholed","trigger":"www.amweqe.help","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"www.amweqe.help/static/team/rg7.png","fqdn":"www.amweqe.help","domain":"amweqe.help","tld":"help"},"ip":{"addr":"104.168.22.92","port":443,"asn":36352,"as":"AS-COLOCROSSING","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://www.amweqe.help/pages/team/register?invite_code=180962","date":"2026-03-24T07:00:17.212Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"android.ahdmnb.help","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Mon, 16 Mar 2026 12:14:31 GMT","end":"Sun, 14 Jun 2026 12:14:30 GMT"},"fingerprint":{"sha1":"F6:7D:BA:4E:6C:C6:A4:C1:34:A0:65:54:AA:E0:4B:9D:47:7C:D3:9F","sha256":"C5:BB:CC:52:64:D3:42:4E:8A:E7:97:A5:E6:1A:88:EA:97:2E:81:86:47:CA:F9:7C:27:81:A9:51:59:48:4D:F7"}}},"request":{"raw":"GET /static/team/rg7.png HTTP/1.1\r\nHost: www.amweqe.help\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://www.amweqe.help/pages/team/register?invite_code=180962\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Tue, 24 Mar 2026 07:00:17 GMT\r\ncontent-type: image/png\r\nlast-modified: Sun, 01 Mar 2026 15:00:49 GMT\r\nvary: Accept-Encoding\r\netag: W/\"69a454a1-7996\"\r\nexpires: Thu, 23 Apr 2026 07:00:17 GMT\r\ncache-control: max-age=2592000\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: quic=\":443\"; h3=\":443\"; h3-29=\":443\"; h3-27=\":443\";h3-25=\":443\"; h3-T050=\":443\"; h3-Q050=\":443\";h3-Q049=\":443\";h3-Q048=\":443\"; h3-Q046=\":443\"; h3-Q043=\":443\"\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":31126,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 200 x 200, 8-bit/color RGBA, non-interlaced","md5":"a9be08f2ee8b8abb9cfdbb1b24b3c24c","sha1":"5ed11ebe84dd8b5c6d05f6d08680781c3baf10d8","sha256":"3dc7dd49aed0243af48da296df56b06ae301de972a8ead3aab27aecdc1aaa3e1","sha512":"3fa70e9afc50d7dedebe25a242c4be680e3831b0c74b15890be50028ff9e9f4bbf982ab836fcc39b4102382b87af5f535e6ea1688d6fc5dcda36dfa60112cda1","ssdeep":"768:N3WU/tOg3g+lYrPxLimJ7GGTrXS/o6KsH11gK/I+yEG:tpIgQoqxLiIHrCYYgK/nyV","tlshash":"59e2e12565e2c328a986305da1e94b6db267d9d60513f4dc8e2bc4f33a823e9e2047e1","first_seen":"2026-03-11T10:18:29.02449Z","last_seen":"2026-05-01T14:21:25.167998Z","times_seen":6,"resource_available":false,"data":null}},"time_used":148,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":148,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-03-24","alert":"Sinkholed","trigger":"www.amweqe.help","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-03-24","alert":"Sinkholed","trigger":"www.amweqe.help","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-03-24","alert":"Sinkholed","trigger":"www.amweqe.help","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-03-24","alert":"Sinkholed","trigger":"www.amweqe.help","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"ecos.eopyyu.help/api/index/config","fqdn":"ecos.eopyyu.help","domain":"eopyyu.help","tld":"help"},"ip":{"addr":"104.168.22.92","port":443,"asn":36352,"as":"AS-COLOCROSSING","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"https://www.amweqe.help/pages/team/register?invite_code=180962","date":"2026-03-24T07:00:17.253Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"ecos.eopyyu.help","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Mon, 16 Mar 2026 07:16:56 GMT","end":"Sun, 14 Jun 2026 07:16:55 GMT"},"fingerprint":{"sha1":"BC:9A:D7:FB:8D:B4:DC:51:83:CB:77:9D:28:3B:1E:1D:09:AD:B6:E3","sha256":"A0:88:3B:E7:75:73:F3:C6:A1:96:A5:61:A7:05:63:D1:E9:D2:BE:D5:F4:2E:0A:85:12:67:70:60:A0:A1:02:6F"}}},"request":{"raw":"OPTIONS /api/index/config HTTP/1.1\r\nHost: ecos.eopyyu.help\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nAccess-Control-Request-Method: POST\r\nAccess-Control-Request-Headers: api-name,api-token,token\r\nReferer: https://www.amweqe.help/\r\nOrigin: https://www.amweqe.help\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"OPTIONS"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Tue, 24 Mar 2026 07:00:17 GMT\r\ncontent-type: text/html; charset=utf-8\r\nvary: Accept-Encoding\r\naccess-control-allow-origin: https://www.amweqe.help\r\naccess-control-allow-credentials: true\r\naccess-control-max-age: 86400\r\naccess-control-allow-methods: GET, POST, PUT, DELETE, OPTIONS\r\naccess-control-allow-headers: api-name,api-token,token\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: quic=\":443\"; h3=\":443\"; h3-29=\":443\"; h3-27=\":443\";h3-25=\":443\"; h3-T050=\":443\"; h3-Q050=\":443\";h3-Q049=\":443\";h3-Q048=\":443\"; h3-Q046=\":443\"; h3-Q043=\":443\"\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":0,"size_decoded":0,"mime_type":"text/html; charset=utf-8","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-08-10T04:49:07.925952Z","times_seen":17811481,"resource_available":true,"data":null}},"time_used":906,"timings":{"blocked":376,"dns":79,"connect":144,"send":0,"wait":152,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-03-24","alert":"Sinkholed","trigger":"ecos.eopyyu.help","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-03-24","alert":"Phishing Block","trigger":"ecos.eopyyu.help","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"ecos.eopyyu.help/api/index/channel","fqdn":"ecos.eopyyu.help","domain":"eopyyu.help","tld":"help"},"ip":{"addr":"104.168.22.92","port":443,"asn":36352,"as":"AS-COLOCROSSING","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"https://www.amweqe.help/pages/team/register?invite_code=180962","date":"2026-03-24T07:00:17.254Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"ecos.eopyyu.help","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Mon, 16 Mar 2026 07:16:56 GMT","end":"Sun, 14 Jun 2026 07:16:55 GMT"},"fingerprint":{"sha1":"BC:9A:D7:FB:8D:B4:DC:51:83:CB:77:9D:28:3B:1E:1D:09:AD:B6:E3","sha256":"A0:88:3B:E7:75:73:F3:C6:A1:96:A5:61:A7:05:63:D1:E9:D2:BE:D5:F4:2E:0A:85:12:67:70:60:A0:A1:02:6F"}}},"request":{"raw":"OPTIONS /api/index/channel HTTP/1.1\r\nHost: ecos.eopyyu.help\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nAccess-Control-Request-Method: POST\r\nAccess-Control-Request-Headers: api-name,api-token,token\r\nReferer: https://www.amweqe.help/\r\nOrigin: https://www.amweqe.help\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"OPTIONS"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Tue, 24 Mar 2026 07:00:17 GMT\r\ncontent-type: text/html; charset=utf-8\r\nvary: Accept-Encoding\r\naccess-control-allow-origin: https://www.amweqe.help\r\naccess-control-allow-credentials: true\r\naccess-control-max-age: 86400\r\naccess-control-allow-methods: GET, POST, PUT, DELETE, OPTIONS\r\naccess-control-allow-headers: api-name,api-token,token\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: quic=\":443\"; h3=\":443\"; h3-29=\":443\"; h3-27=\":443\";h3-25=\":443\"; h3-T050=\":443\"; h3-Q050=\":443\";h3-Q049=\":443\";h3-Q048=\":443\"; h3-Q046=\":443\"; h3-Q043=\":443\"\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":0,"size_decoded":0,"mime_type":"text/html; charset=utf-8","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-08-10T04:49:07.925952Z","times_seen":17811481,"resource_available":true,"data":null}},"time_used":909,"timings":{"blocked":379,"dns":76,"connect":148,"send":0,"wait":150,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-03-24","alert":"Sinkholed","trigger":"ecos.eopyyu.help","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-03-24","alert":"Phishing Block","trigger":"ecos.eopyyu.help","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null}],"urlquery":null}}]}