{"report_id":"1c045028-3837-451b-90fd-2e5cba8773f4","version":6,"status":"done","tags":[],"date":"2026-03-06T09:48:38Z","url":{"schema":"https","addr":"crab4.at","fqdn":"crab4.at","domain":"crab4.at","tld":"at"},"ip":{"addr":"172.67.182.237","port":0,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"final":{"url":{"schema":"https","addr":"crab4.at/","fqdn":"crab4.at","domain":"crab4.at","tld":"at"},"title":"slon3.at| slon3.cc | krab5.at | krab4.at","dom":{"size":24211,"mime_type":"text/html; charset=utf-8","magic":"HTML document, Unicode text, UTF-8 text, with very long lines (15582)","md5":"bf897d8796f63804945c7f74ae8a0d21","sha1":"ac309d6baf87f393941139f3bd81fef6a10bbd16","sha256":"3c843bb4a20585ddaf636360a5ca2e45878f797e2e3e9abb47cf2a284941e643","sha512":"b5e0c4ff9d098955d70526175f6b02f1911d5b1c79d09f3fbbf0e7798ee2514adddc48609e84522139943a75830b6199af7415f8aacaaf0262526ff71437581c","ssdeep":"384:sg8gUnqeHWNHK2rV5zltsIJvQFvT3v8BXotp+Bvi2eY5pJb44PQCvWJ2USf115zF:le2Qk58nRrvrp+Bz3p44C235z5Fx","tlshash":"54b29e12969f04829146f429ef027b0d7da6497b7a5692153a6c29ff2fe3178837238c","dom_hash":"domhashb80c8a8a80ab5e8f12fca37de4fa0967","first_seen":"2026-03-06T09:48:41.845504Z","last_seen":"2026-03-06T09:48:41.845504Z","times_seen":1,"resource_available":false,"data":null}},"submit":{"url":{"schema":"https","addr":"crab4.at","fqdn":"crab4.at","domain":"crab4.at","tld":"at"},"ip":{"addr":"172.67.182.237","port":0,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"tags":null,"meta":null,"user":{"user_id":"akbkyowd9geqr98"}},"settings":{"access":"public","device_type":"desktop","expires_at":"2027-04-10T09:48:38Z","useragent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0","referer":"","cookies":null,"exit_node":"z0yflva4pidy47h"},"stats":{"alert_count":{"ids":0,"urlquery":0,"analyzer":1}},"detection":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-03-06","alert":"Sinkholed","trigger":"crab4.at","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null},"summary":[{"fqdn":"crab4.at","ip":{"addr":"188.114.97.1","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"domain_registered":"unknown","domain_rank":0,"first_seen":"2026-03-06T09:48:38.120081Z","last_seen":"2026-03-06T09:48:38.120081Z","alert_count":3,"request_count":3,"received_data":27039,"sent_data":1389,"comment":"","tags":null,"fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}]}],"files":null,"artifacts":{"windows_shortcuts":null,"files":null,"telegram":null,"pdfs":null,"clipboard":null},"sensors":{"ids":null,"analyzer":null,"urlquery":null},"javascript":{"script":[{"url":{"schema":"https","addr":"crab4.at/","fqdn":"crab4.at","domain":"crab4.at","tld":"at"},"ip":{"addr":"188.114.97.1","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"scriptElement","is_inline":true,"md5":"273a567817a222ea36919fed78ed00ab","sha1":"f06cf879535c926fcbfac6a0db31e6706f6ca8c9","sha256":"11704e45a48552b3c0b2401e267c18d07102c0519b68178b4a4560ef631fde1c","sha512":"95502cfd7842634e46346f85c7355dfddaeec1781591dfd4d3db8fd11dc63682f297e550ae952353dd5aa181d547b24165cbf023ddb4038a79d86c1be62c9681","ssdeep":"","tlshash":"2ee02076e352410399e1e0258d70658c603000db6c49f6bad0597451710defb747bdba","size":341,"data":"","first_seen":"2025-03-05T21:23:04.354995Z","last_seen":"2026-06-06T04:44:48.462876Z","times_seen":178,"alerts":{"ids":null,"analyzer":null,"urlquery":null}}],"eval":null,"write":null,"console":null},"http":[{"url":{"schema":"https","addr":"crab4.at/","fqdn":"crab4.at","domain":"crab4.at","tld":"at"},"ip":{"addr":"188.114.97.1","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":true,"resource_type":"document","requested_by":"","date":"2026-03-06T09:48:15.794Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"crab4.at","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Mon, 19 Jan 2026 15:21:02 GMT","end":"Sun, 19 Apr 2026 16:19:53 GMT"},"fingerprint":{"sha1":"88:93:5C:40:42:50:71:D7:23:F7:4F:ED:D5:4A:D2:49:E5:82:1E:6B","sha256":"61:50:7B:01:7C:C8:B6:C7:FD:2C:D8:A6:D8:15:5C:8A:D6:F3:B6:86:F8:9F:EE:11:3C:D5:06:58:76:E1:51:3C"}}},"request":{"raw":"GET / HTTP/1.1\r\nHost: crab4.at\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nUpgrade-Insecure-Requests: 1\r\nSec-Fetch-Dest: document\r\nSec-Fetch-Mode: navigate\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ndate: Fri, 06 Mar 2026 09:48:15 GMT\r\ncontent-type: text/html;charset=UTF-8\r\nserver: cloudflare\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nset-cookie: scheck=1;Path=/;HttpOnly;Secure\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=bHjZm38Ppjd8xCtpo0hQeA4Yr%2BlcmI0ZAYhKTSAESkJklSg7qYV2MzlovDM%2BT1PT0AjDlI%2BsfOBuTvVJeQ%2FYcxx2V80ZP9sU\"}]}\r\ncf-cache-status: DYNAMIC\r\nvary: accept-encoding\r\ncontent-encoding: br\r\ncf-ray: 9d8071971b345cf6-ARN\r\nalt-svc: h3=\":443\"; ma=86400\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":9003,"size_decoded":0,"mime_type":"text/html; charset=UTF-8","magic":"HTML document, Unicode text, UTF-8 text, with very long lines (516)","md5":"bb7e34c5797f15233b340d2b69d31204","sha1":"8896f60f6b9516127513c8266a4ebc95a3d51744","sha256":"03b0d98678468acd566fa28ac2c1f1bdee4f959d093b17d24356d4460cdeb731","sha512":"f6c48dab422f0d488a09b0307b505ff5a0d828af64c7e9ad7b0eb8e5b1a5eb2ac6ea8a5a0626810469d5c0f47d1ccde969ee0fa8fd927aa6f8c5e72f5fed03b8","ssdeep":"192:eg7aE9Cgnia2USfqZ6VbZ75zwoJLpQuuFpjy:eg8gnj2USf115z0Fc","tlshash":"98026452569f08492101e036ef417b0d39a640bf7a17c2253eac39bf2fd31a8867675d","first_seen":"2026-03-06T09:48:41.84955Z","last_seen":"2026-03-06T09:48:41.84955Z","times_seen":1,"resource_available":false,"data":null}},"time_used":181,"timings":{"blocked":56,"dns":27,"connect":8,"send":0,"wait":66,"receive":0,"ssl":20},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-03-06","alert":"Sinkholed","trigger":"crab4.at","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"crab4.at/captcha","fqdn":"crab4.at","domain":"crab4.at","tld":"at"},"ip":{"addr":"188.114.97.1","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"fetch","requested_by":"https://crab4.at/","date":"2026-03-06T09:48:16.168Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"crab4.at","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Mon, 19 Jan 2026 15:21:02 GMT","end":"Sun, 19 Apr 2026 16:19:53 GMT"},"fingerprint":{"sha1":"88:93:5C:40:42:50:71:D7:23:F7:4F:ED:D5:4A:D2:49:E5:82:1E:6B","sha256":"61:50:7B:01:7C:C8:B6:C7:FD:2C:D8:A6:D8:15:5C:8A:D6:F3:B6:86:F8:9F:EE:11:3C:D5:06:58:76:E1:51:3C"}}},"request":{"raw":"GET /captcha HTTP/1.1\r\nHost: crab4.at\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://crab4.at/\r\nDNT: 1\r\nConnection: keep-alive\r\nCookie: scheck=1\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\ndate: Fri, 06 Mar 2026 09:48:16 GMT\r\ncontent-type: text/plain\r\nserver: cloudflare\r\npriority: u=4,i=?0\r\ncache-control: no-cache\r\nset-cookie: cookref=https%3A%2F%2Fcrab4.at%2F;Path=/;HttpOnly;Secure\nses=6aAq4m37ImCrEb0HGe;Path=/;HttpOnly;Secure\r\ncf-cache-status: DYNAMIC\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=kd1OV%2FRctJG2TxLrp3n27Qg%2FqqokoK0gY4CsD6ATl3xT1cw9A7S%2FTkWpF1PxZkyVU7%2F%2FgUn6StLu6%2FhvRbJbRy%2F9p0JFlZWg\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncontent-encoding: br\r\ncf-ray: 9d807199183a49cd-ARN\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":15504,"size_decoded":0,"mime_type":"text/plain","magic":"ASCII text, with very long lines (15504), with no line terminators","md5":"47cbbdce48b6ac74b28faede9ac9714d","sha1":"701df9d397c3eed07fbc8e30ab99d85e894dfe9e","sha256":"0f69e50dd50727e2bfe34a5b683b7b9bcdfa4b1abd827b519ac3c3150a68236a","sha512":"e2ee4ae14cddd80ccfda0b78e51a2d5956d9372ce250bffa44546f8ddf649c5c6e39f25aa720c2e745c5d65b74e72d4edbfb2878560c8bac9636b76b1760d4ca","ssdeep":"384:unqeHWNHK2rV5zltsIJvQFvT3v8BXotp+Bvi2eY5pJb44PQCvWT:7e2Qk58nRrvrp+Bz3p44W","tlshash":"8262d012ef9331d3c5fe2e6da98760dddf296e53a4e83a46d6200ad918f061703b51c9","first_seen":"2026-03-06T09:48:41.859525Z","last_seen":"2026-03-06T09:48:41.859525Z","times_seen":1,"resource_available":false,"data":null}},"time_used":71,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":52,"receive":19,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-03-06","alert":"Sinkholed","trigger":"crab4.at","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"crab4.at/favicon.ico","fqdn":"crab4.at","domain":"crab4.at","tld":"at"},"ip":{"addr":"188.114.97.1","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://crab4.at/","date":"2026-03-06T09:48:16.244Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"crab4.at","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Mon, 19 Jan 2026 15:21:02 GMT","end":"Sun, 19 Apr 2026 16:19:53 GMT"},"fingerprint":{"sha1":"88:93:5C:40:42:50:71:D7:23:F7:4F:ED:D5:4A:D2:49:E5:82:1E:6B","sha256":"61:50:7B:01:7C:C8:B6:C7:FD:2C:D8:A6:D8:15:5C:8A:D6:F3:B6:86:F8:9F:EE:11:3C:D5:06:58:76:E1:51:3C"}}},"request":{"raw":"GET /favicon.ico HTTP/1.1\r\nHost: crab4.at\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://crab4.at/\r\nCookie: scheck=1; cookref=https%3A%2F%2Fcrab4.at%2F; ses=6aAq4m37ImCrEb0HGe\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\ndate: Fri, 06 Mar 2026 09:48:16 GMT\r\ncontent-type: image/x-icon\r\nserver: cloudflare\r\nlast-modified: Fri, 24 Oct 2025 14:51:09 GMT\r\npriority: u=6,i=?0\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nage: 3145\r\ncache-control: max-age=14400\r\ncf-cache-status: HIT\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=hEE6Lun%2FPbbAjTnzVvubn%2Bbm%2FECyN5E5BIcxiCQn3chONrHwbF12AnmO86dNGcW%2FCnDPxftiyuGrM8xgc5RoNhuPkk6O%2By5R\"}]}\r\netag: W/\"68fb925d-256\"\r\ncontent-encoding: br\r\ncf-ray: 9d807199994949cd-ARN\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":598,"size_decoded":0,"mime_type":"image/x-icon","magic":"PNG image data, 16 x 16, 8-bit gray+alpha, non-interlaced","md5":"88dce50c34a848e75b6c7d916711e6b9","sha1":"0355f55c57c14900477cc886f3345b1e898fe28e","sha256":"4f0b7e5217318eedc1b42ca1ce5e128c649c97082912f1d800eec1325207ad96","sha512":"f6e0828ce51c9e2cb462b4884f01a5fb7083e4f26eeea1b596c5d04144b9226efb62347199546ce81e0473d97231cb1f6468ccc94e620cf83ffd9035fb63eed5","ssdeep":"","tlshash":"faf00ce3e838f489c98e2ca222911201da7585a723800819b6fac008ac20b885933f92","first_seen":"2023-05-10T12:46:36Z","last_seen":"2026-08-07T15:24:38.182968Z","times_seen":3781,"resource_available":false,"data":null}},"time_used":17,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":17,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-03-06","alert":"Sinkholed","trigger":"crab4.at","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}}]}