{"report_id":"23963570-abdb-4745-94aa-816d296b7ae4","version":6,"status":"done","tags":[],"date":"2025-12-01T11:56:17Z","url":{"schema":"http","addr":"projectmerlin.icu/","fqdn":"projectmerlin.icu","domain":"projectmerlin.icu","tld":"icu"},"ip":{"addr":"64.29.17.1","port":0,"asn":16509,"as":"AMAZON-02","country":"United States","country_code":"US"},"final":{"url":{"schema":"https","addr":"projectmerlin.icu/","fqdn":"projectmerlin.icu","domain":"projectmerlin.icu","tld":"icu"},"title":"Deployment Unavailable","dom":{"size":1636,"mime_type":"text/html; charset=utf-8","magic":"HTML document, ASCII text, with very long lines (1636), with no line terminators","md5":"a93cff0d7666f8fcd981767e453361b8","sha1":"3fdafbe81af6fc5c3ec6d2b39d7878045d3c253d","sha256":"3d0e170a11d1d7c4d03466ff34982594fa1162308b7c146e96fe841764f2eaa2","sha512":"d290866f72f39131bac3bafe7f48793163dbd83f98736b268d3b9e84441d5de0e2edc8bc99d92e2127a89c5a8e144d6a02e3061b92800f8069d5c279703915c3","ssdeep":"","tlshash":"1e3152b745b1702ef33b8cfe34e673646244811bc0920f99b618abf8e2d7ca75123685","dom_hash":"domhashec6cdb565b8b0f77c754672472fa9910","first_seen":"2025-12-01T11:56:20.463795Z","last_seen":"2025-12-01T11:56:20.463795Z","times_seen":1,"resource_available":false,"data":null}},"submit":{"url":{"schema":"http","addr":"projectmerlin.icu/","fqdn":"projectmerlin.icu","domain":"projectmerlin.icu","tld":"icu"},"ip":{"addr":"64.29.17.1","port":0,"asn":16509,"as":"AMAZON-02","country":"United States","country_code":"US"},"tags":null,"meta":null},"settings":{"access":"public","device_type":"desktop","expires_at":"2027-01-05T11:56:17Z","useragent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0","referer":"","cookies":null,"exit_node":"z0yflva4pidy47h"},"stats":{"alert_count":{"ids":1,"urlquery":0,"analyzer":1}},"detection":{"ids":[{"sensor_name":"suricata","title":"Suricata IDS","description":"Suricata /w Emerging Threats Pro","date":"2025-12-01T11:55:55Z","timestamp":1764590155,"ip_dst":{"addr":"64.29.17.1","port":443,"asn":16509,"as":"AMAZON-02","country":"United States","country_code":"US"},"ip_src":{"addr":"172.18.0.45","port":32854,"asn":0,"as":"","country":"","country_code":"zz"},"severity":"medium","alert":"ET INFO Suspicious Domain (*.icu) in TLS SNI","source":"{\"timestamp\":\"2025-12-01T11:55:55.242755+0000\",\"flow_id\":1006136929767142,\"in_iface\":\"br-31613a7ed13b\",\"event_type\":\"alert\",\"src_ip\":\"172.18.0.45\",\"src_port\":32854,\"dest_ip\":\"64.29.17.1\",\"dest_port\":443,\"proto\":\"TCP\",\"tx_id\":0,\"alert\":{\"action\":\"allowed\",\"gid\":1,\"signature_id\":2026889,\"rev\":4,\"signature\":\"ET INFO Suspicious Domain (*.icu) in TLS SNI\",\"category\":\"Potentially Bad Traffic\",\"severity\":2,\"metadata\":{\"attack_target\":[\"Client_Endpoint\"],\"confidence\":[\"High\"],\"created_at\":[\"2019_02_06\"],\"deployment\":[\"Perimeter\"],\"signature_severity\":[\"Informational\"],\"updated_at\":[\"2022_11_21\"]}},\"tls\":{\"sni\":\"projectmerlin.icu\",\"version\":\"TLS 1.3\",\"ja3\":{\"hash\":\"0faf2a91198d40dbd58b9308f3fca2fd\",\"string\":\"771,4865-4867-4866-49195-49199-52393-52392-49196-49200-49171-49172-156-157-47-53,0-23-65281-10-11-16-5-34-51-43-13-28-65037,29-23-24-25-256-257,0\"},\"ja3s\":{\"hash\":\"f4febc55ea12b31ae17cfb7e614afda8\",\"string\":\"771,4865,43-51\"}},\"app_proto\":\"tls\",\"flow\":{\"pkts_toserver\":4,\"pkts_toclient\":5,\"bytes_toserver\":919,\"bytes_toclient\":3486,\"start\":\"2025-12-01T11:55:55.151270+0000\"}}"}],"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2025-12-01","alert":"Sinkholed","trigger":"projectmerlin.icu","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null},"summary":[{"fqdn":"projectmerlin.icu","ip":{"addr":"64.29.17.1","port":443,"asn":16509,"as":"AMAZON-02","country":"United States","country_code":"US"},"domain_registered":"2025-07-31","domain_rank":0,"first_seen":"2025-12-01T11:56:17.329107Z","last_seen":"2025-12-01T11:56:17.329107Z","alert_count":3,"request_count":3,"received_data":4384,"sent_data":1413,"comment":"","tags":null,"fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Vercel","description":"Vercel is a cloud platform for static frontends and serverless functions.","website":"https://vercel.com","common_platform_enumeration":"","icon":"vercel.svg","categories":["PaaS"]}]}],"files":null,"artifacts":{"windows_shortcuts":null,"files":null,"telegram":null,"pdfs":null,"clipboard":null},"sensors":{"ids":null,"analyzer":null,"urlquery":null},"javascript":{"script":null,"eval":null,"write":null,"console":null},"http":[{"url":{"schema":"https","addr":"projectmerlin.icu/","fqdn":"projectmerlin.icu","domain":"projectmerlin.icu","tld":"icu"},"ip":{"addr":"64.29.17.1","port":443,"asn":16509,"as":"AMAZON-02","country":"United States","country_code":"US"},"is_navigation_request":true,"resource_type":"document","requested_by":"","date":"2025-12-01T11:55:55.076Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.projectmerlin.icu","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Mon, 01 Dec 2025 02:23:00 GMT","end":"Sun, 01 Mar 2026 02:22:59 GMT"},"fingerprint":{"sha1":"20:D2:08:12:30:90:FC:9F:E6:2B:74:EC:FE:2A:4C:E2:76:87:4D:E6","sha256":"70:3A:75:88:69:6E:D4:67:54:FC:5F:8A:25:FD:CE:9D:5A:3D:28:89:13:F3:50:FF:C2:42:65:BD:AD:27:04:59"}}},"request":{"raw":"GET / HTTP/1.1\r\nHost: projectmerlin.icu\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nUpgrade-Insecure-Requests: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: document\r\nSec-Fetch-Mode: navigate\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 451 Unavailable For Legal Reasons\r\ncache-control: public, max-age=0, must-revalidate\r\ncontent-type: text/html; charset=utf-8\r\ndate: Mon, 01 Dec 2025 11:55:55 GMT\r\nserver: Vercel\r\nstrict-transport-security: max-age=63072000\r\nx-vercel-error: DEPLOYMENT_DISABLED\r\nx-vercel-id: arn1::mw6pg-1764590155253-c011130691a2\r\ncontent-length: 1590\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"451","status_text":"Unavailable For Legal Reasons","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Vercel","description":"Vercel is a cloud platform for static frontends and serverless functions.","website":"https://vercel.com","common_platform_enumeration":"","icon":"vercel.svg","categories":["PaaS"]}],"data":{"size":1590,"size_decoded":0,"mime_type":"text/html; charset=utf-8","magic":"HTML document, ASCII text, with very long lines (1590), with no line terminators","md5":"298769d95c18c3c36c53ccf68c949d8d","sha1":"ef78a4082cb2f78404e5c7c03e44a0bd1698ee50","sha256":"1fc7460e2f727e192c86ec58f253b839ed51df05d6f24b5fdedd3604a53cad61","sha512":"0263080fa1999bb9d034bff2a1c06291520f58d48bff07618f60daa9312ec0d918ce06e76522e288927db9ad89062763ab8f43fc91cf498861e1e6f9609b4d5a","ssdeep":"","tlshash":"d53124a70571702ef23b88fd38d63b6462049526c0920f95f518fff8e6c78a66533749","first_seen":"2025-12-01T11:56:20.468122Z","last_seen":"2025-12-01T11:56:20.468122Z","times_seen":1,"resource_available":false,"data":null}},"time_used":529,"timings":{"blocked":171,"dns":75,"connect":1,"send":0,"wait":10,"receive":177,"ssl":91},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2025-12-01","alert":"Sinkholed","trigger":"projectmerlin.icu","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"projectmerlin.icu/","fqdn":"projectmerlin.icu","domain":"projectmerlin.icu","tld":"icu"},"ip":{"addr":"64.29.17.1","port":443,"asn":16509,"as":"AMAZON-02","country":"United States","country_code":"US"},"is_navigation_request":true,"resource_type":"document","requested_by":"","date":"2025-12-01T11:55:55.556Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.projectmerlin.icu","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Mon, 01 Dec 2025 02:23:00 GMT","end":"Sun, 01 Mar 2026 02:22:59 GMT"},"fingerprint":{"sha1":"20:D2:08:12:30:90:FC:9F:E6:2B:74:EC:FE:2A:4C:E2:76:87:4D:E6","sha256":"70:3A:75:88:69:6E:D4:67:54:FC:5F:8A:25:FD:CE:9D:5A:3D:28:89:13:F3:50:FF:C2:42:65:BD:AD:27:04:59"}}},"request":{"raw":"GET / HTTP/1.1\r\nHost: projectmerlin.icu\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nUpgrade-Insecure-Requests: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: document\r\nSec-Fetch-Mode: navigate\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 451 Unavailable For Legal Reasons\r\ncache-control: public, max-age=0, must-revalidate\r\ncontent-type: text/html; charset=utf-8\r\ndate: Mon, 01 Dec 2025 11:55:55 GMT\r\nserver: Vercel\r\nstrict-transport-security: max-age=63072000\r\nx-vercel-error: DEPLOYMENT_DISABLED\r\nx-vercel-id: arn1::jfvll-1764590155560-9f64f33e3b27\r\ncontent-length: 1590\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"451","status_text":"Unavailable For Legal Reasons","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Vercel","description":"Vercel is a cloud platform for static frontends and serverless functions.","website":"https://vercel.com","common_platform_enumeration":"","icon":"vercel.svg","categories":["PaaS"]}],"data":{"size":1590,"size_decoded":0,"mime_type":"text/html; charset=utf-8","magic":"HTML document, ASCII text, with very long lines (1590), with no line terminators","md5":"38477d5f7a0b54fb9f3954c97005343b","sha1":"ae24af91781a7fce3c2160ba824e8c17cb4ad22f","sha256":"5ea9b2356a0c8ceda3bf9f61dc37c518adea11cb565623984b7ccfc69c2c4885","sha512":"346b63778632dff3af9297d3dc74bce73b95ea42e35622e940202e574d6bd2b7b4aa6e77f1c1e2a65492c4b83770fbff17e60dd37a1d1556516c6c05e9ede84a","ssdeep":"","tlshash":"9c3122a715b1702ef33b88fd38d637546204d526c0920f99f518efb8e2c78a66533649","first_seen":"2025-12-01T11:56:20.471402Z","last_seen":"2025-12-01T11:56:20.471402Z","times_seen":1,"resource_available":false,"data":null}},"time_used":180,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":10,"receive":170,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2025-12-01","alert":"Sinkholed","trigger":"projectmerlin.icu","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"projectmerlin.icu/favicon.ico","fqdn":"projectmerlin.icu","domain":"projectmerlin.icu","tld":"icu"},"ip":{"addr":"64.29.17.1","port":443,"asn":16509,"as":"AMAZON-02","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://projectmerlin.icu/","date":"2025-12-01T11:55:55.875Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.projectmerlin.icu","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Mon, 01 Dec 2025 02:23:00 GMT","end":"Sun, 01 Mar 2026 02:22:59 GMT"},"fingerprint":{"sha1":"20:D2:08:12:30:90:FC:9F:E6:2B:74:EC:FE:2A:4C:E2:76:87:4D:E6","sha256":"70:3A:75:88:69:6E:D4:67:54:FC:5F:8A:25:FD:CE:9D:5A:3D:28:89:13:F3:50:FF:C2:42:65:BD:AD:27:04:59"}}},"request":{"raw":"GET /favicon.ico HTTP/1.1\r\nHost: projectmerlin.icu\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://projectmerlin.icu/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 451 Unavailable For Legal Reasons\r\ncache-control: public, max-age=0, must-revalidate\r\ncontent-type: text/plain; charset=utf-8\r\ndate: Mon, 01 Dec 2025 11:55:55 GMT\r\nserver: Vercel\r\nstrict-transport-security: max-age=63072000\r\nx-vercel-error: DEPLOYMENT_DISABLED\r\nx-vercel-id: arn1::mw6pg-1764590155874-45f76fa1e395\r\ncontent-length: 109\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"451","status_text":"Unavailable For Legal Reasons","fingerprints":[{"name":"Vercel","description":"Vercel is a cloud platform for static frontends and serverless functions.","website":"https://vercel.com","common_platform_enumeration":"","icon":"vercel.svg","categories":["PaaS"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":109,"size_decoded":0,"mime_type":"text/plain; charset=utf-8","magic":"ASCII text","md5":"1eff76cec6ea1f5c2ca0d2dd46fce99b","sha1":"085533d69406a8f2b271268640bdcb06c34e9a57","sha256":"a3e98af9181b34181612402dc2fae00ae11312cb25d69da9eeedd99e0982f4a5","sha512":"f679778257fe4604a3e4afa5ab2cab1e4d50e61cdce0f79f06fb0a50c7a0d9fc293bd492bef59b25931713262fa8dcad0fdc313a1bb9d0fe858150b3521c2ac0","ssdeep":"","tlshash":"f0b092b524664882e27946454c2028656c4082a9aa1db54446f1aeae628aaa8cbaa0a5","first_seen":"2025-12-01T11:56:20.47428Z","last_seen":"2025-12-01T11:56:20.47428Z","times_seen":1,"resource_available":false,"data":null}},"time_used":12,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":11,"receive":1,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2025-12-01","alert":"Sinkholed","trigger":"projectmerlin.icu","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}}]}