{"report_id":"23ce5b76-30b4-4adf-a5fb-abe9b6894b2c","version":6,"status":"done","tags":[],"date":"2026-03-06T15:06:27Z","url":{"schema":"https","addr":"0efc87c2a1aaaf03e72d6f971113a2a1.info","fqdn":"0efc87c2a1aaaf03e72d6f971113a2a1.info","domain":"0efc87c2a1aaaf03e72d6f971113a2a1.info","tld":"info"},"ip":{"addr":"169.40.135.224","port":0,"asn":0,"as":"","country":"United States","country_code":"US"},"final":{"url":{"schema":"https","addr":"0efc87c2a1aaaf03e72d6f971113a2a1.info/","fqdn":"0efc87c2a1aaaf03e72d6f971113a2a1.info","domain":"0efc87c2a1aaaf03e72d6f971113a2a1.info","tld":"info"},"title":"403 Forbidden","dom":{"size":163,"mime_type":"text/html; charset=utf-8","magic":"HTML document, ASCII text","md5":"5035348d4b51cec54b90e75229885f44","sha1":"62100065370b3ffb8d721b78bf059be3d9a796de","sha256":"9cfd87f3565c8cdbe4e557c1e1cc0fdb5d07ed7a52a5e59f3a6959fa051b2d9f","sha512":"658f0ef8a82a6be760cfbc2bfdee1a3a2789b3aa8acba8fc7c86d32eeebb27ac0f1b69f9ccadeb3eab6ec771f65d27b122f9b1e5a0f6694d07071f7bcbd22275","ssdeep":"","tlshash":"0cc08c0b60bd042ea22362900b857b82bd46426d88674a40bb02a1175b0857ac5c74a4","dom_hash":"domhash708e23ff7118010b850548f2bb495d9b","first_seen":"2026-01-04T13:19:38.372894Z","last_seen":"2026-03-06T15:06:36.378234Z","times_seen":2,"resource_available":false,"data":null}},"submit":{"url":{"schema":"https","addr":"0efc87c2a1aaaf03e72d6f971113a2a1.info","fqdn":"0efc87c2a1aaaf03e72d6f971113a2a1.info","domain":"0efc87c2a1aaaf03e72d6f971113a2a1.info","tld":"info"},"ip":{"addr":"169.40.135.224","port":0,"asn":0,"as":"","country":"United States","country_code":"US"},"tags":null,"meta":null,"user":{"user_id":"akbkyowd9geqr98"}},"settings":{"access":"public","device_type":"desktop","expires_at":"2027-04-10T15:06:27Z","useragent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0","referer":"","cookies":null,"exit_node":"z0yflva4pidy47h"},"stats":{"alert_count":{"ids":0,"urlquery":0,"analyzer":2}},"detection":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-03-06","alert":"Sinkholed","trigger":"0efc87c2a1aaaf03e72d6f971113a2a1.info","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-03-06","alert":"Sinkholed","trigger":"0efc87c2a1aaaf03e72d6f971113a2a1.info","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null},"summary":[{"fqdn":"0efc87c2a1aaaf03e72d6f971113a2a1.info","ip":{"addr":"0.0.0.0","port":0,"asn":0,"as":"","country":"","country_code":"zz"},"domain_registered":"unknown","domain_rank":0,"first_seen":"2026-03-06T15:06:27.159292Z","last_seen":"2026-03-06T15:06:27.159292Z","alert_count":6,"request_count":3,"received_data":885,"sent_data":1493,"comment":"","tags":null,"fingerprints":[{"name":"Nginx:1.14.1","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}]}],"files":null,"artifacts":{"windows_shortcuts":null,"files":null,"telegram":null,"pdfs":null,"clipboard":null},"sensors":{"ids":null,"analyzer":null,"urlquery":null},"javascript":{"script":null,"eval":null,"write":null,"console":null},"http":[{"url":{"schema":"https","addr":"0efc87c2a1aaaf03e72d6f971113a2a1.info/","fqdn":"0efc87c2a1aaaf03e72d6f971113a2a1.info","domain":"0efc87c2a1aaaf03e72d6f971113a2a1.info","tld":"info"},"ip":{"addr":"0.0.0.0","port":0,"asn":0,"as":"","country":"","country_code":"zz"},"is_navigation_request":true,"resource_type":"document","requested_by":"","date":"2026-03-06T15:06:05.746Z","timestamp":0,"http_version":"","security_state":"broken","security_info":null,"request":{"raw":"GET / HTTP/1.1\r\nHost: 0efc87c2a1aaaf03e72d6f971113a2a1.info\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nUpgrade-Insecure-Requests: 1\r\nSec-Fetch-Dest: document\r\nSec-Fetch-Mode: navigate\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"","headers":null,"cookies":null,"status_code":"","status_text":"","fingerprints":null,"data":{"size":0,"size_decoded":0,"mime_type":"","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-08-18T23:45:00.487881Z","times_seen":17963874,"resource_available":true,"data":null}},"time_used":373,"timings":{"blocked":0,"dns":317,"connect":25,"send":0,"wait":0,"receive":0,"ssl":29},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-03-06","alert":"Sinkholed","trigger":"0efc87c2a1aaaf03e72d6f971113a2a1.info","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-03-06","alert":"Sinkholed","trigger":"0efc87c2a1aaaf03e72d6f971113a2a1.info","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"0efc87c2a1aaaf03e72d6f971113a2a1.info/","fqdn":"0efc87c2a1aaaf03e72d6f971113a2a1.info","domain":"0efc87c2a1aaaf03e72d6f971113a2a1.info","tld":"info"},"ip":{"addr":"169.40.135.224","port":443,"asn":0,"as":"","country":"United States","country_code":"US"},"is_navigation_request":true,"resource_type":"document","requested_by":"","date":"2026-03-06T15:06:07.202Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"","organization":"Default Company Ltd"},"issuer":{"commonName":"","organization":"Default Company Ltd"},"validity":{"start":"Wed, 18 Feb 2026 12:56:59 GMT","end":"Wed, 14 Nov 2029 12:56:59 GMT"},"fingerprint":{"sha1":"3C:15:AD:3F:CF:5B:58:2E:F1:C2:6F:20:84:39:E7:C7:8A:44:44:28","sha256":"79:2F:DE:24:8A:D7:46:88:47:35:54:C0:89:25:D8:37:0E:9E:75:00:58:24:8F:5B:7E:BA:15:FC:F7:2C:4F:C6"}}},"request":{"raw":"GET / HTTP/1.1\r\nHost: 0efc87c2a1aaaf03e72d6f971113a2a1.info\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nUpgrade-Insecure-Requests: 1\r\nSec-Fetch-Dest: document\r\nSec-Fetch-Mode: navigate\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 403 Forbidden\r\nServer: nginx/1.14.1\r\nDate: Fri, 06 Mar 2026 15:06:07 GMT\r\nContent-Type: text/html; charset=UTF-8\r\nTransfer-Encoding: chunked\r\nConnection: keep-alive\r\nUpgrade: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"403","status_text":"Forbidden","fingerprints":[{"name":"Nginx:1.14.1","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":180,"size_decoded":0,"mime_type":"text/html; charset=UTF-8","magic":"HTML document, ASCII text","md5":"08f5fc9a6406eb77b8e218fa00cdda5f","sha1":"356b6b26510e275bd7551099fa1f3a3e714086fd","sha256":"f9c08d0b4aad14e4428e5947b4311045730a46ab3672ab46cdd42421590b6a2b","sha512":"79c97324150b1b8b422171abc766d90235aca8e6ce7225836756f21aa1fad71006096d3c076c52c109d3ade6ed1939042d191d7029d91bb9192ed50f6ee775f7","ssdeep":"","tlshash":"01c0804f707d0519522352801fc57b52794303bd949706407f43e1135f5467dc5c7458","first_seen":"2024-10-06T09:18:10.348156Z","last_seen":"2026-03-06T15:06:36.384336Z","times_seen":6,"resource_available":false,"data":null}},"time_used":174,"timings":{"blocked":58,"dns":1,"connect":26,"send":0,"wait":58,"receive":0,"ssl":29},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-03-06","alert":"Sinkholed","trigger":"0efc87c2a1aaaf03e72d6f971113a2a1.info","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-03-06","alert":"Sinkholed","trigger":"0efc87c2a1aaaf03e72d6f971113a2a1.info","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"0efc87c2a1aaaf03e72d6f971113a2a1.info/favicon.ico","fqdn":"0efc87c2a1aaaf03e72d6f971113a2a1.info","domain":"0efc87c2a1aaaf03e72d6f971113a2a1.info","tld":"info"},"ip":{"addr":"169.40.135.224","port":443,"asn":0,"as":"","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://0efc87c2a1aaaf03e72d6f971113a2a1.info/","date":"2026-03-06T15:06:07.407Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"","organization":"Default Company Ltd"},"issuer":{"commonName":"","organization":"Default Company Ltd"},"validity":{"start":"Wed, 18 Feb 2026 12:56:59 GMT","end":"Wed, 14 Nov 2029 12:56:59 GMT"},"fingerprint":{"sha1":"3C:15:AD:3F:CF:5B:58:2E:F1:C2:6F:20:84:39:E7:C7:8A:44:44:28","sha256":"79:2F:DE:24:8A:D7:46:88:47:35:54:C0:89:25:D8:37:0E:9E:75:00:58:24:8F:5B:7E:BA:15:FC:F7:2C:4F:C6"}}},"request":{"raw":"GET /favicon.ico HTTP/1.1\r\nHost: 0efc87c2a1aaaf03e72d6f971113a2a1.info\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://0efc87c2a1aaaf03e72d6f971113a2a1.info/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 404 Not Found\r\nServer: nginx/1.14.1\r\nDate: Fri, 06 Mar 2026 15:06:07 GMT\r\nContent-Type: text/html; charset=iso-8859-1\r\nContent-Length: 340\r\nConnection: keep-alive\r\n\r\n","headers":null,"cookies":null,"status_code":"404","status_text":"Not Found","fingerprints":[{"name":"Nginx:1.14.1","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":340,"size_decoded":0,"mime_type":"text/html; charset=iso-8859-1","magic":"HTML document, ASCII text","md5":"d7aeb8cfdbbe939504041594d51950e6","sha1":"256c8557fd33007d08c96b3cca29106e0dbcda87","sha256":"bff1b5c85c430a477d8278f0100abf01e0325037ceef50f32bba4fcb9825d9e7","sha512":"23274a7d3442f5d56e0c1277189e7bfa4ad3d71bb18061386e3bddda064f6dafbaba12845140c780300b932aaa10362d12dc63008924b9454a1eab5b4177aaae","ssdeep":"","tlshash":"06e02dae0113b38b04407d403dd0a3c23a4a13eb7cb682e63ec1c0835208a7ecce19c9","first_seen":"2026-03-06T15:06:36.386583Z","last_seen":"2026-03-06T15:06:36.386583Z","times_seen":1,"resource_available":false,"data":null}},"time_used":49,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":49,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-03-06","alert":"Sinkholed","trigger":"0efc87c2a1aaaf03e72d6f971113a2a1.info","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-03-06","alert":"Sinkholed","trigger":"0efc87c2a1aaaf03e72d6f971113a2a1.info","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}}]}