{"report_id":"01a8afa3-bd7e-4b51-a64d-79605846220e","version":6,"status":"done","tags":[],"date":"2026-03-04T19:23:25Z","url":{"schema":"https","addr":"skinriot.icu","fqdn":"skinriot.icu","domain":"skinriot.icu","tld":"icu"},"ip":{"addr":"95.182.116.28","port":0,"asn":48780,"as":"Oltelecom Jsc","country":"Russia","country_code":"RU"},"final":{"url":{"schema":"https","addr":"skinriot.icu/.merc/captcha?return_url=%2F\u0026score=13\u0026reason=suspicious_rdns\u0026type=click_shape\u0026ct=68608aeda81461c5\u0026dots=3","fqdn":"skinriot.icu","domain":"skinriot.icu","tld":"icu"},"title":"Security Check","dom":{"size":104520,"mime_type":"text/html; charset=utf-8","magic":"HTML document, ASCII text, with very long lines (58141)","md5":"dcfd2251d178ea3b6b2560d6ad8c1a0e","sha1":"03217395ecfb8ed6d9ce26786fb58da0e44bd4d4","sha256":"c99e7c0833d8a79d3481bde6112fc7ee1f4707e92163b2c5c490e198b912bd1d","sha512":"b971a5df9ee3b06ab4872907411eee8c9cee9446ad8d86d5144e3e27a119198ceaca1e7daeec4ddf9fa0a367d510e9c326fdb4f6a5cb439c853ba8cc11974971","ssdeep":"3072:j83a6Oq8CW3R0a/4AV9RpZ2NXaF3iXjJ6YbW:j8t7KB54AV9bZ2NXaFSXIYbW","tlshash":"9ba3f1247992252fad13d10db1e2da4f3539d863c803881d868f65e5ce59887a72ffac","dom_hash":"domhash69efb32501f0eae3f4d0119aed69f153","first_seen":"","last_seen":"","times_seen":0,"resource_available":false,"data":null}},"submit":{"url":{"schema":"https","addr":"skinriot.icu","fqdn":"skinriot.icu","domain":"skinriot.icu","tld":"icu"},"ip":{"addr":"95.182.116.28","port":0,"asn":48780,"as":"Oltelecom Jsc","country":"Russia","country_code":"RU"},"tags":null,"meta":null,"user":{"user_id":"akbkyowd9geqr98"}},"settings":{"access":"public","device_type":"desktop","expires_at":"2027-04-08T19:23:25Z","useragent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0","referer":"","cookies":null,"exit_node":"z0yflva4pidy47h"},"stats":{"alert_count":{"ids":1,"urlquery":0,"analyzer":1}},"detection":{"ids":[{"sensor_name":"suricata","title":"Suricata IDS","description":"Suricata /w Emerging Threats Pro","date":"2026-03-04T19:23:05Z","timestamp":1772652185,"ip_dst":{"addr":"95.182.116.28","port":443,"asn":48780,"as":"Oltelecom Jsc","country":"Russia","country_code":"RU"},"ip_src":{"addr":"Client IP","port":49170,"asn":0,"as":"","country":"","country_code":"zz"},"severity":"medium","alert":"ET INFO Suspicious Domain (*.icu) in TLS SNI","source":"{\"timestamp\":\"2026-03-04T19:23:05.044814+0000\",\"flow_id\":2226835426966239,\"in_iface\":\"br-31613a7ed13b\",\"event_type\":\"alert\",\"src_ip\":\"172.18.0.20\",\"src_port\":49170,\"dest_ip\":\"95.182.116.28\",\"dest_port\":443,\"proto\":\"TCP\",\"tx_id\":0,\"alert\":{\"action\":\"allowed\",\"gid\":1,\"signature_id\":2026889,\"rev\":4,\"signature\":\"ET INFO Suspicious Domain (*.icu) in TLS SNI\",\"category\":\"Potentially Bad Traffic\",\"severity\":2,\"metadata\":{\"attack_target\":[\"Client_Endpoint\"],\"confidence\":[\"High\"],\"created_at\":[\"2019_02_06\"],\"deployment\":[\"Perimeter\"],\"signature_severity\":[\"Informational\"],\"updated_at\":[\"2022_11_21\"]}},\"tls\":{\"sni\":\"skinriot.icu\",\"version\":\"TLS 1.3\",\"ja3\":{\"hash\":\"0faf2a91198d40dbd58b9308f3fca2fd\",\"string\":\"771,4865-4867-4866-49195-49199-52393-52392-49196-49200-49171-49172-156-157-47-53,0-23-65281-10-11-16-5-34-51-43-13-28-65037,29-23-24-25-256-257,0\"},\"ja3s\":{\"hash\":\"15af977ce25de452b96affa2addb1036\",\"string\":\"771,4866,43-51\"}},\"app_proto\":\"tls\",\"flow\":{\"pkts_toserver\":4,\"pkts_toclient\":3,\"bytes_toserver\":914,\"bytes_toclient\":1554,\"start\":\"2026-03-04T19:23:04.522975+0000\"}}"}],"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-03-04","alert":"Sinkholed","trigger":"skinriot.icu","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null},"summary":[{"fqdn":"skinriot.icu","ip":{"addr":"95.182.116.28","port":443,"asn":48780,"as":"Oltelecom Jsc","country":"Russia","country_code":"RU"},"domain_registered":"2026-02-26","domain_rank":0,"first_seen":"2026-03-04T19:23:25.842408Z","last_seen":"2026-03-04T19:23:25.842408Z","alert_count":4,"request_count":4,"received_data":119649,"sent_data":2166,"comment":"","tags":null,"fingerprints":[{"name":"OpenResty:1.27.1.2","description":"OpenResty is a web platform based on nginx which can run Lua scripts using its LuaJIT engine.","website":"https://openresty.org","common_platform_enumeration":"","icon":"OpenResty.svg","categories":["Web servers"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}]}],"files":null,"artifacts":{"windows_shortcuts":null,"files":null,"telegram":null,"pdfs":null,"clipboard":null},"sensors":{"ids":null,"analyzer":null,"urlquery":null},"javascript":{"script":[{"url":{"schema":"https","addr":"skinriot.icu/.merc/captcha?return_url=%2F\u0026score=13\u0026reason=suspicious_rdns\u0026type=click_shape\u0026ct=68608aeda81461c5\u0026dots=3","fqdn":"skinriot.icu","domain":"skinriot.icu","tld":"icu"},"ip":{"addr":"95.182.116.28","port":443,"asn":48780,"as":"Oltelecom Jsc","country":"Russia","country_code":"RU"},"introduction_type":"scriptElement","is_inline":true,"md5":"bb5f8fe42948e18ed82db981ee2e1829","sha1":"c60290ca7d231e203167fbecae1cc3d0ab230fee","sha256":"5d1af970f12e89d76b9eeb84d879a850f41d33534decf4bd10fbff30f0c0c205","sha512":"e7879ef4b396dddccb2f42bf9de10fd938f8cf424d04db788255c49325fd12d6d0a6d346a82d7bae561708a076b85411d998abe81fa95568a5e5a1aaf07db635","ssdeep":"96:FGGM6N1inrR60foL1Wf+w1qx1JLnCBYknH+HhNQekq0wRA7e+Uqz84rKPNH:CFVp12pnCKknE6pkqBrKVH","tlshash":"b6b1b5f63496243f0cba527f157fa34d3d7218265c0b8504ccaca85c6e74d8625b9fad","size":5247,"data":"","first_seen":"2026-03-04T19:23:29.426182Z","last_seen":"2026-03-04T19:25:24.940894Z","times_seen":2,"alerts":{"ids":null,"analyzer":null,"urlquery":null}}],"eval":null,"write":null,"console":null},"http":[{"url":{"schema":"https","addr":"skinriot.icu/","fqdn":"skinriot.icu","domain":"skinriot.icu","tld":"icu"},"ip":{"addr":"95.182.116.28","port":443,"asn":48780,"as":"Oltelecom Jsc","country":"Russia","country_code":"RU"},"is_navigation_request":true,"resource_type":"document","requested_by":"","date":"2026-03-04T19:23:04.254Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"skinriot.icu","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Thu, 26 Feb 2026 13:58:37 GMT","end":"Wed, 27 May 2026 13:58:36 GMT"},"fingerprint":{"sha1":"19:54:E5:15:08:80:3A:C7:15:C3:AA:2E:BF:99:C9:FB:7A:96:6E:72","sha256":"5F:FD:F4:8D:C4:1D:C1:46:73:6F:AB:94:10:BC:DE:7E:3B:58:1F:2D:20:BF:6C:E7:99:DA:04:BE:81:F7:7B:90"}}},"request":{"raw":"GET / HTTP/1.1\r\nHost: skinriot.icu\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nUpgrade-Insecure-Requests: 1\r\nSec-Fetch-Dest: document\r\nSec-Fetch-Mode: navigate\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 302 Found\r\nServer: openresty/1.27.1.2\r\nDate: Wed, 04 Mar 2026 19:23:05 GMT\r\nContent-Type: text/html; charset=utf-8\r\nContent-Length: 148\r\nConnection: keep-alive\r\nCache-Control: no-store, no-cache, must-revalidate, private\r\nExpires: 0\r\nLocation: /.merc/captcha?return_url=%2F\u0026score=13\u0026reason=suspicious_rdns\u0026type=click_shape\u0026ct=68608aeda81461c5\u0026dots=3\r\nPermissions-Policy: geolocation=(), microphone=(), camera=()\r\nPragma: no-cache\r\nReferrer-Policy: strict-origin-when-cross-origin\r\nX-Content-Type-Options: nosniff\r\nX-Frame-Options: SAMEORIGIN\r\nX-Xss-Protection: 0\r\n\r\n","headers":null,"cookies":null,"status_code":"302","status_text":"Found","fingerprints":[{"name":"OpenResty:1.27.1.2","description":"OpenResty is a web platform based on nginx which can run Lua scripts using its LuaJIT engine.","website":"https://openresty.org","common_platform_enumeration":"","icon":"OpenResty.svg","categories":["Web servers"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":13311,"size_decoded":0,"mime_type":"text/html; charset=utf-8","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-07-26T12:24:06.790852Z","times_seen":17544719,"resource_available":true,"data":null}},"time_used":1902,"timings":{"blocked":833,"dns":272,"connect":34,"send":0,"wait":233,"receive":0,"ssl":526},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-03-04","alert":"Sinkholed","trigger":"skinriot.icu","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"skinriot.icu/.merc/captcha?return_url=%2F\u0026score=13\u0026reason=suspicious_rdns\u0026type=click_shape\u0026ct=68608aeda81461c5\u0026dots=3","fqdn":"skinriot.icu","domain":"skinriot.icu","tld":"icu"},"ip":{"addr":"95.182.116.28","port":443,"asn":48780,"as":"Oltelecom Jsc","country":"Russia","country_code":"RU"},"is_navigation_request":true,"resource_type":"document","requested_by":"","date":"2026-03-04T19:23:05.329Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"skinriot.icu","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Thu, 26 Feb 2026 13:58:37 GMT","end":"Wed, 27 May 2026 13:58:36 GMT"},"fingerprint":{"sha1":"19:54:E5:15:08:80:3A:C7:15:C3:AA:2E:BF:99:C9:FB:7A:96:6E:72","sha256":"5F:FD:F4:8D:C4:1D:C1:46:73:6F:AB:94:10:BC:DE:7E:3B:58:1F:2D:20:BF:6C:E7:99:DA:04:BE:81:F7:7B:90"}}},"request":{"raw":"GET /.merc/captcha?return_url=%2F\u0026score=13\u0026reason=suspicious_rdns\u0026type=click_shape\u0026ct=68608aeda81461c5\u0026dots=3 HTTP/1.1\r\nHost: skinriot.icu\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nUpgrade-Insecure-Requests: 1\r\nSec-Fetch-Dest: document\r\nSec-Fetch-Mode: navigate\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nServer: openresty/1.27.1.2\r\nDate: Wed, 04 Mar 2026 19:23:05 GMT\r\nContent-Type: text/html; charset=utf-8\r\nTransfer-Encoding: chunked\r\nConnection: keep-alive\r\nVary: Accept-Encoding\r\nCache-Control: no-store, no-cache, must-revalidate, private\r\nExpires: 0\r\nPragma: no-cache\r\nContent-Encoding: gzip\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"OpenResty:1.27.1.2","description":"OpenResty is a web platform based on nginx which can run Lua scripts using its LuaJIT engine.","website":"https://openresty.org","common_platform_enumeration":"","icon":"OpenResty.svg","categories":["Web servers"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":13311,"size_decoded":0,"mime_type":"text/html; charset=utf-8","magic":"HTML document, ASCII text, with very long lines (354)","md5":"6a63301d2dd0a675d9286386bceba7ef","sha1":"d97c86ea9447f30c93b8b26876057b4629bbf72a","sha256":"f2d857804611b905d3305533fb83fdceaec4334a68d3038d865dbc01553951e7","sha512":"4026f68024b8e0c958d098cb5f2aa7fb38b1432f1f880ce12d4e494f36496cda1906659879760c3c6d143627c6ff016e225373841b05e8cf7e7c7580c1e12e86","ssdeep":"192:8sLQRxLD9Z1aCOFEbFdb62IyaflGlwYk45h9s/AbFOyFVp12pnCKknE6pkqBrKVW:zgyQbFdun1flOwhSlEyNYWVpnrmW","tlshash":"d5521ab22541203fa433c1ab6af5e74e34758803e913490deaed729dcf559cf25b9b88","first_seen":"2026-03-04T19:23:29.423373Z","last_seen":"2026-03-04T19:25:24.93608Z","times_seen":2,"resource_available":false,"data":null}},"time_used":133,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":132,"receive":1,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-03-04","alert":"Sinkholed","trigger":"skinriot.icu","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"skinriot.icu/.merc/captcha/generate?type=click_shape\u0026dots=3\u0026ct=68608aeda81461c5","fqdn":"skinriot.icu","domain":"skinriot.icu","tld":"icu"},"ip":{"addr":"95.182.116.28","port":443,"asn":48780,"as":"Oltelecom Jsc","country":"Russia","country_code":"RU"},"is_navigation_request":false,"resource_type":"fetch","requested_by":"https://skinriot.icu/.merc/captcha?return_url=%2F\u0026score=13\u0026reason=suspicious_rdns\u0026type=click_shape\u0026ct=68608aeda81461c5\u0026dots=3","date":"2026-03-04T19:23:05.699Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"skinriot.icu","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Thu, 26 Feb 2026 13:58:37 GMT","end":"Wed, 27 May 2026 13:58:36 GMT"},"fingerprint":{"sha1":"19:54:E5:15:08:80:3A:C7:15:C3:AA:2E:BF:99:C9:FB:7A:96:6E:72","sha256":"5F:FD:F4:8D:C4:1D:C1:46:73:6F:AB:94:10:BC:DE:7E:3B:58:1F:2D:20:BF:6C:E7:99:DA:04:BE:81:F7:7B:90"}}},"request":{"raw":"GET /.merc/captcha/generate?type=click_shape\u0026dots=3\u0026ct=68608aeda81461c5 HTTP/1.1\r\nHost: skinriot.icu\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://skinriot.icu/.merc/captcha?return_url=%2F\u0026score=13\u0026reason=suspicious_rdns\u0026type=click_shape\u0026ct=68608aeda81461c5\u0026dots=3\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nServer: openresty/1.27.1.2\r\nDate: Wed, 04 Mar 2026 19:23:06 GMT\r\nContent-Type: application/json\r\nTransfer-Encoding: chunked\r\nConnection: keep-alive\r\nVary: Accept-Encoding\r\nCache-Control: no-store\r\nContent-Encoding: gzip\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"OpenResty:1.27.1.2","description":"OpenResty is a web platform based on nginx which can run Lua scripts using its LuaJIT engine.","website":"https://openresty.org","common_platform_enumeration":"","icon":"OpenResty.svg","categories":["Web servers"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":91377,"size_decoded":0,"mime_type":"application/json","magic":"JSON text data","md5":"3fa1983a283e116241eeefc5a3237b46","sha1":"fd0fa3c59ecd11833d6d8938f80b63cff6bc0c28","sha256":"5091379f6a3595adb541772e2f310be934359b45dcf28bc42210407aee93f3eb","sha512":"14356d65b24afae9ab4e1715fd57445e95dcbe958860be2983d85b2b5a6e23d5ec11d11442d54709cc08e8c9468b7c173c2bf4a793da374366ae273be9e761c0","ssdeep":"1536:H98g6armBcqHhiO9P2T3R01IJ2zpNSvwP/wVegRpjV2a8noUJXaeudRi8R+j/Jy4:d83a6Oq8CW3R0a/4AV9RpZ2NXaF3iXjB","tlshash":"4f93021cb8a6aa069f57a10cf0d3dc966a29e4f38805c83e054f69e1c49d943e70fe7c","first_seen":"2026-03-04T19:23:29.424573Z","last_seen":"2026-03-04T19:23:29.424573Z","times_seen":1,"resource_available":false,"data":null}},"time_used":676,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":499,"receive":177,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-03-04","alert":"Sinkholed","trigger":"skinriot.icu","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"skinriot.icu/favicon.ico","fqdn":"skinriot.icu","domain":"skinriot.icu","tld":"icu"},"ip":{"addr":"95.182.116.28","port":443,"asn":48780,"as":"Oltelecom Jsc","country":"Russia","country_code":"RU"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://skinriot.icu/.merc/captcha?return_url=%2F\u0026score=13\u0026reason=suspicious_rdns\u0026type=click_shape\u0026ct=68608aeda81461c5\u0026dots=3","date":"2026-03-04T19:23:05.818Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"skinriot.icu","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Thu, 26 Feb 2026 13:58:37 GMT","end":"Wed, 27 May 2026 13:58:36 GMT"},"fingerprint":{"sha1":"19:54:E5:15:08:80:3A:C7:15:C3:AA:2E:BF:99:C9:FB:7A:96:6E:72","sha256":"5F:FD:F4:8D:C4:1D:C1:46:73:6F:AB:94:10:BC:DE:7E:3B:58:1F:2D:20:BF:6C:E7:99:DA:04:BE:81:F7:7B:90"}}},"request":{"raw":"GET /favicon.ico HTTP/1.1\r\nHost: skinriot.icu\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://skinriot.icu/.merc/captcha?return_url=%2F\u0026score=13\u0026reason=suspicious_rdns\u0026type=click_shape\u0026ct=68608aeda81461c5\u0026dots=3\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 404 Not Found\r\nServer: openresty/1.27.1.2\r\nDate: Wed, 04 Mar 2026 19:23:06 GMT\r\nContent-Type: application/json; charset=utf-8\r\nTransfer-Encoding: chunked\r\nConnection: keep-alive\r\nEtag: W/\"15-bm7tJgu8FHlq5QU+Y6gDxOGPfRc\"\r\nPermissions-Policy: geolocation=(), microphone=(), camera=()\r\nReferrer-Policy: strict-origin-when-cross-origin\r\nVary: Accept-Encoding, Accept-Encoding\r\nX-Content-Type-Options: nosniff, nosniff\r\nX-Frame-Options: SAMEORIGIN\r\nX-Xss-Protection: 0\r\nContent-Encoding: gzip\r\n\r\n","headers":null,"cookies":null,"status_code":"404","status_text":"Not Found","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"OpenResty:1.27.1.2","description":"OpenResty is a web platform based on nginx which can run Lua scripts using its LuaJIT engine.","website":"https://openresty.org","common_platform_enumeration":"","icon":"OpenResty.svg","categories":["Web servers"]}],"data":{"size":21,"size_decoded":0,"mime_type":"application/json; charset=utf-8","magic":"JSON text data","md5":"2efae0e06cfdc3eacc743546ff595d74","sha1":"6e6eed260bbc14796ae5053e63a803c4e18f7d17","sha256":"c8d3eae160a892e32837db3dcae515e843e5383fef52b8141940c8bcf8b6d59f","sha512":"0041d86cee0352b6e8af8e9755fbe8ad6db1912b7bc2efd53d19ff60ce8f79a69bbac9bc2bbac25d9fa6d9e9e48d8bcc241fe04776c23c13ba5a2b2896643572","ssdeep":"","tlshash":"c57000082082020e0002e0e0088c283000880a8008308c2000008008800008f8800088","first_seen":"2023-05-16T10:31:07Z","last_seen":"2026-07-26T10:40:25.593086Z","times_seen":694,"resource_available":true,"data":null}},"time_used":487,"timings":{"blocked":-1,"dns":4,"connect":34,"send":0,"wait":267,"receive":0,"ssl":182},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-03-04","alert":"Sinkholed","trigger":"skinriot.icu","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}}]}