{"report_id":"284805dc-189f-4e3e-9046-44d881d25486","version":6,"status":"done","tags":[],"date":"2026-02-25T18:10:01Z","url":{"schema":"http","addr":"prod2.konmune.de","fqdn":"prod2.konmune.de","domain":"konmune.de","tld":"de"},"ip":{"addr":"212.132.66.182","port":0,"asn":8560,"as":"IONOS SE","country":"Germany","country_code":"DE"},"final":{"url":{"schema":"https","addr":"prod2.konmune.de/","fqdn":"prod2.konmune.de","domain":"konmune.de","tld":"de"},"title":"ThriveDX — Page not found","dom":{"size":362542,"mime_type":"text/html; charset=utf-8","magic":"HTML document, Unicode text, UTF-8 text, with very long lines (65327)","md5":"cc8e6311d27c9b746c1ec93cee47ca61","sha1":"913fdfec7f7ca2b10bcf3bf9a9a0c506a6cab0ae","sha256":"5fb38afd9c1704901290167915baed14e637d13468aa2461c7e9e8785d03b8bd","sha512":"11299805cbb94a72f748606ec93bc1b0e9faa3fa81b27bbe60f0662e72460668bd9f985b8b7dc8ac60a9d9932bbd4427ddf48fb008f3b1d46e20c6f3f616d984","ssdeep":"6144:0PeRzqNqA9lTmE+S3Frtz0is2q/J59QJsu0bQmm0IEkPPvuTfZylBZYzoyuZ42:0KzqNqA9GQJsuWpZgBZLyu62","tlshash":"70745da4b1403044b613d5abb1a39fd79b269142e702cdf5f1973da8db8e09a0633f5b","dom_hash":"domhashe5d75a81f29d3f16be0d68b5f1ccb47a","first_seen":"2026-02-25T18:10:02.506265Z","last_seen":"2026-02-25T18:10:02.506265Z","times_seen":1,"resource_available":false,"data":null}},"submit":{"url":{"schema":"http","addr":"prod2.konmune.de","fqdn":"prod2.konmune.de","domain":"konmune.de","tld":"de"},"ip":{"addr":"212.132.66.182","port":0,"asn":8560,"as":"IONOS SE","country":"Germany","country_code":"DE"},"tags":null,"meta":null},"settings":{"access":"public","device_type":"desktop","expires_at":"2027-04-01T18:10:01Z","useragent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0","referer":"","cookies":null,"exit_node":"z0yflva4pidy47h"},"stats":{"alert_count":{"ids":0,"urlquery":0,"analyzer":4}},"detection":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-02-25","alert":"Sinkholed","trigger":"prod2.konmune.de","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-02-25","alert":"Phishing Block","trigger":"prod2.konmune.de","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-02-25","alert":"Sinkholed","trigger":"prod2.konmune.de","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-02-25","alert":"Sinkholed","trigger":"prod2.konmune.de","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null},"summary":[{"fqdn":"prod2.konmune.de","ip":{"addr":"212.132.66.182","port":443,"asn":8560,"as":"IONOS SE","country":"Germany","country_code":"DE"},"domain_registered":"unknown","domain_rank":0,"first_seen":"2026-02-25T01:02:08.207879Z","last_seen":"2026-02-25T01:02:08.207879Z","alert_count":4,"request_count":1,"received_data":361338,"sent_data":485,"comment":"","tags":null,"fingerprints":[{"name":"PHP","description":"PHP is a general-purpose scripting language used for web development.","website":"https://php.net","common_platform_enumeration":"cpe:2.3:a:php:php:*:*:*:*:*:*:*:*","icon":"PHP.svg","categories":["Programming languages"]}]}],"files":null,"artifacts":{"windows_shortcuts":null,"files":null,"telegram":null,"pdfs":null,"clipboard":null},"sensors":{"ids":null,"analyzer":null,"urlquery":null},"javascript":{"script":[{"url":{"schema":"https","addr":"prod2.konmune.de/","fqdn":"prod2.konmune.de","domain":"konmune.de","tld":"de"},"ip":{"addr":"212.132.66.182","port":443,"asn":8560,"as":"IONOS SE","country":"Germany","country_code":"DE"},"introduction_type":"scriptElement","is_inline":true,"md5":"4938cdfad2d821c65ec000a783af5160","sha1":"67d8ce6748c8a8f6ee7290c7f967daba91b7fc18","sha256":"a0c0a13c68144d6b9d348fda68f6a7d5e039fe66eb2fef5d500755511defe34c","sha512":"6530a589ff66e9a7b3047acf74fd6cc4956d7910d501ab67ed57c68b958a79dd727b96c9b64157300725806010534900372c6908828e051496c259044e501898","ssdeep":"384:JThpC2MpUXtMrXG5Od4zh7uM0jPb19MvD5zNIVuC+FqmzzoPC8tSMJ:VhpCZUirEOdK9uM0jPQ5ZHkdNtSW","tlshash":"63d274987192f0d68bc36025493f920bf23a6d11344ed840e17af5e57c78aeb61a7e2d","size":28813,"data":"","first_seen":"2023-06-16T07:34:21Z","last_seen":"2026-03-26T19:11:58.390303Z","times_seen":23,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"prod2.konmune.de/","fqdn":"prod2.konmune.de","domain":"konmune.de","tld":"de"},"ip":{"addr":"212.132.66.182","port":443,"asn":8560,"as":"IONOS SE","country":"Germany","country_code":"DE"},"introduction_type":"scriptElement","is_inline":true,"md5":"cd6cc8dd21c2830734d6852d2b0abc6a","sha1":"215f76023961ef73e55611fbfecc9e4b937f00b1","sha256":"9bc59d99eb6ee30603851cca2e61d987bd73ac05c7c13de1c7893d46bc728e6f","sha512":"b309cd441b8b0297a586b056df512cde526668b5c4117c32274a730d651bf27708db991de002e32cacf6cc32a0747dcace14d343ed8cae637bc0da6e723a9ff5","ssdeep":"","tlshash":"9ba0124413f95c6440002241066a37a13e00c156a1c0c509e5899e3901c59c1c197053","size":84,"data":"","first_seen":"2024-01-17T23:59:02Z","last_seen":"2026-08-10T04:13:31.585164Z","times_seen":80,"alerts":{"ids":null,"analyzer":null,"urlquery":null}}],"eval":null,"write":null,"console":null},"http":[{"url":{"schema":"https","addr":"prod2.konmune.de/","fqdn":"prod2.konmune.de","domain":"konmune.de","tld":"de"},"ip":{"addr":"212.132.66.182","port":443,"asn":8560,"as":"IONOS SE","country":"Germany","country_code":"DE"},"is_navigation_request":true,"resource_type":"document","requested_by":"","date":"2026-02-25T18:09:39.774Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"konmune.de","organization":""},"issuer":{"commonName":"E7","organization":"Let's Encrypt"},"validity":{"start":"Sun, 04 Jan 2026 07:06:11 GMT","end":"Sat, 04 Apr 2026 07:06:10 GMT"},"fingerprint":{"sha1":"17:2F:08:F1:34:04:AA:89:21:99:31:54:1B:0F:7F:4F:74:15:38:F7","sha256":"E0:AD:2E:74:CC:8E:FE:C2:50:DD:35:8F:9B:D8:A3:28:DC:1B:D8:69:FD:22:48:6E:02:E7:83:1B:BD:0F:F6:24"}}},"request":{"raw":"GET / HTTP/1.1\r\nHost: prod2.konmune.de\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nUpgrade-Insecure-Requests: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: document\r\nSec-Fetch-Mode: navigate\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ndate: Wed, 25 Feb 2026 18:09:39 GMT\r\nserver: Lucy\r\nexpires: Thu, 19 Nov 1981 08:52:00 GMT\r\ncache-control: no-store, no-cache, must-revalidate\r\npragma: no-cache\r\nset-cookie: PHPSESSID=1ug4hog2tg877ijhagkh11pa95; path=/; secure; HttpOnly\r\nvary: Accept-Encoding\r\ncontent-encoding: gzip\r\naccess-control-allow-origin: *\r\naccess-control-allow-methods: *\r\naccess-control-allow-headers: *\r\ncontent-type: text/html; charset=UTF-8\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"PHP","description":"PHP is a general-purpose scripting language used for web development.","website":"https://php.net","common_platform_enumeration":"cpe:2.3:a:php:php:*:*:*:*:*:*:*:*","icon":"PHP.svg","categories":["Programming languages"]}],"data":{"size":360879,"size_decoded":0,"mime_type":"text/html; charset=UTF-8","magic":"HTML document, ASCII text, with very long lines (65301), with CRLF line terminators","md5":"929b9559b02c96cfb6e5b408b1771b19","sha1":"bfa007dfe0aa360a222df0923289499e0dbbad17","sha256":"bfdd297e7b860da5f6024f2a352740e4db00e7436ab700e67126bc6152d22f34","sha512":"8fb801c1b8473c65edf55243af6fcba72c764cbeb9ccadd26b6d3a1cce776f1b74f7f175893cbdac7dc6da8c0a7f560107fdd2e1d8e61d31a86f05fc25737e0f","ssdeep":"6144:aPeRzqNqA9lTmE+S3Frtz0is2q/Z59QJsu0bgPm0IEkPPxuTfZyjBZYzo34SZHX:aKzqNqA92QJsu37ZKBZL3dlX","tlshash":"21745da4b2403044b213d5abb5a39f979b269142e702cdf9f1973d68db8e0d90633f5b","first_seen":"2026-02-25T01:02:11.907215Z","last_seen":"2026-03-22T12:48:00.126371Z","times_seen":3,"resource_available":false,"data":null}},"time_used":415,"timings":{"blocked":154,"dns":83,"connect":26,"send":0,"wait":107,"receive":0,"ssl":41},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-02-25","alert":"Sinkholed","trigger":"prod2.konmune.de","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-02-25","alert":"Phishing Block","trigger":"prod2.konmune.de","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-02-25","alert":"Sinkholed","trigger":"prod2.konmune.de","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-02-25","alert":"Sinkholed","trigger":"prod2.konmune.de","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}}]}