{"report_id":"2f3bd03d-b18c-4adc-9f9b-ac44c1eb1d7d","version":6,"status":"done","tags":[],"date":"2025-12-18T16:03:52Z","url":{"schema":"https","addr":"ofx-logln.top/","fqdn":"ofx-logln.top","domain":"ofx-logln.top","tld":"top"},"ip":{"addr":"185.138.88.209","port":0,"asn":42478,"as":"Yug-Link Ltd.","country":"Russia","country_code":"RU"},"final":{"url":{"schema":"https","addr":"ofx-logln.top/","fqdn":"ofx-logln.top","domain":"ofx-logln.top","tld":"top"},"title":"Login","dom":{"size":9828,"mime_type":"text/html; charset=utf-8","magic":"HTML document, ASCII text, with very long lines (1724)","md5":"80bc05515ac3e560d7f9955da6c4f069","sha1":"c4dae2afe3fdba7e55c88322593e71158e6f0655","sha256":"6105a0ae822741827cd75b04c9c0a176550521aac2c5442d0a6c18d2ee1dade1","sha512":"8f7a4977b58284d371cb24ee87c79e6b6318a1e40e2cde3cae99bfa8de69f10ba6a1766652e7da1e97e9236f4c8a414a5a4cf0455a3e123c7a83c9a3bd432726","ssdeep":"192:856y7+x+IqewlCNGlRyJ2DaWumd5IHhxt3Pum1OVY:oEDGLoY5IBxtmmkC","tlshash":"e612869742e70056e403e2b86ff646012736c023d64bc9687adc5b9dcf8a5c99d67bcc","dom_hash":"domhash5d79a774a1b083424042135463ae8d04","first_seen":"2025-12-14T16:23:41.588395Z","last_seen":"2025-12-18T16:03:55.497233Z","times_seen":2,"resource_available":false,"data":null}},"submit":{"url":{"schema":"https","addr":"ofx-logln.top/","fqdn":"ofx-logln.top","domain":"ofx-logln.top","tld":"top"},"ip":{"addr":"185.138.88.209","port":0,"asn":42478,"as":"Yug-Link Ltd.","country":"Russia","country_code":"RU"},"tags":null,"meta":null},"settings":{"access":"public","device_type":"desktop","expires_at":"2027-01-22T16:03:52Z","useragent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/139.0.3405.13 Safari/537.36 Edg/139.0.3405.13","referer":"www.bing.com","cookies":null,"exit_node":"z0yflva4pidy47h"},"stats":{"alert_count":{"ids":0,"urlquery":0,"analyzer":1}},"detection":{"ids":null,"analyzer":[{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-12-18","alert":"Sinkholed","trigger":"ofx-logln.top","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null},"summary":[{"fqdn":"ofx-logln.top","ip":{"addr":"185.138.88.209","port":443,"asn":42478,"as":"Yug-Link Ltd.","country":"Russia","country_code":"RU"},"domain_registered":"2025-12-16","domain_rank":0,"first_seen":"2025-12-18T16:03:52.475793Z","last_seen":"2025-12-18T16:03:52.475793Z","alert_count":3,"request_count":3,"received_data":7106168,"sent_data":1509,"comment":"","tags":null,"fingerprints":[{"name":"Nginx:1.28.0","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}]}],"files":null,"artifacts":{"windows_shortcuts":null,"files":null,"telegram":null,"pdfs":null,"clipboard":null},"sensors":{"ids":null,"analyzer":null,"urlquery":null},"javascript":{"script":[{"url":{"schema":"https","addr":"ofx-logln.top/","fqdn":"ofx-logln.top","domain":"ofx-logln.top","tld":"top"},"ip":{"addr":"185.138.88.209","port":443,"asn":42478,"as":"Yug-Link Ltd.","country":"Russia","country_code":"RU"},"introduction_type":"scriptElement","is_inline":true,"md5":"186624faf93a485b610035444d570290","sha1":"aa1ff9a0c59e0a444c3808f1cc22e98c984214a1","sha256":"71de5d2f1a1930631d4e3cf5bf354b86111e4d6094f97eff1af5c9e40be416cf","sha512":"149f047898d1d003f267aefbbe3f538c2239d14b7ab56c22b4a99813d16cc0e7a254687b545add1c8d5348891bb0a57664b90d711064d00f0469cc1cccec90f4","ssdeep":"","tlshash":"b9e05c3945904a78e3f7205931db438026774423f688accf48e949094fe36900ba0bd2","size":434,"data":"","first_seen":"2025-12-14T16:21:33.691429Z","last_seen":"2025-12-18T16:03:55.505669Z","times_seen":3,"alerts":{"ids":null,"analyzer":null,"urlquery":null}}],"eval":null,"write":null,"console":null},"http":[{"url":{"schema":"https","addr":"ofx-logln.top/","fqdn":"ofx-logln.top","domain":"ofx-logln.top","tld":"top"},"ip":{"addr":"185.138.88.209","port":443,"asn":42478,"as":"Yug-Link Ltd.","country":"Russia","country_code":"RU"},"is_navigation_request":true,"resource_type":"document","requested_by":"","date":"2025-12-18T16:03:28.977Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"ofx-logln.top","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Thu, 18 Dec 2025 00:08:01 GMT","end":"Wed, 18 Mar 2026 00:08:00 GMT"},"fingerprint":{"sha1":"16:8A:EC:CD:2C:21:31:0F:3F:65:38:0B:1C:03:D5:A1:03:B7:6B:A5","sha256":"54:3E:D1:88:41:E8:CF:02:5C:BD:E8:11:92:1C:FD:EE:E5:4B:86:90:54:FF:E9:7B:A8:1E:08:C2:4B:D5:4B:F1"}}},"request":{"raw":"GET / HTTP/1.1\r\nHost: ofx-logln.top\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/139.0.3405.13 Safari/537.36 Edg/139.0.3405.13\r\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nUpgrade-Insecure-Requests: 1\r\nSec-Fetch-Dest: document\r\nSec-Fetch-Mode: navigate\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nServer: nginx/1.28.0\r\nDate: Thu, 18 Dec 2025 16:03:29 GMT\r\nContent-Type: text/html; charset=UTF-8\r\nContent-Length: 3021\r\nConnection: keep-alive\r\nVary: Accept-Encoding\r\nContent-Encoding: gzip\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx:1.28.0","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":9836,"size_decoded":0,"mime_type":"text/html; charset=UTF-8","magic":"HTML document, ASCII text, with very long lines (1724)","md5":"a1c9806d5e5a5663a5e2bebdcfc9e99d","sha1":"708d2e5d50f97e6ec6fafd38b0a8690db836340e","sha256":"a4bbf537218acecdcc702e4ad460375c260adea7f8db0f2eb3aabd7d73ce97ce","sha512":"7f47db5426593fa1d3027e24258d3ea2696e45321827679320f659ed06418799bd2a544b70f04e4561126ebc9b20835b910b39c03c16143ef1ffeec1b7e9f940","ssdeep":"192:656y7+x+IqewlCNGlRyJ2DaWumd5IHhxtzoumaOVD:CEDGLoY5IBxt9mDB","tlshash":"5b12869742e70056f403e2b86ff646012736c023da4bc9687adc5b9dcf8a5c99d67bc8","first_seen":"2025-12-14T16:21:33.68022Z","last_seen":"2025-12-18T16:03:55.501578Z","times_seen":3,"resource_available":false,"data":null}},"time_used":292,"timings":{"blocked":128,"dns":69,"connect":27,"send":0,"wait":32,"receive":0,"ssl":33},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-12-18","alert":"Sinkholed","trigger":"ofx-logln.top","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"ofx-logln.top/assets/bg.jpg","fqdn":"ofx-logln.top","domain":"ofx-logln.top","tld":"top"},"ip":{"addr":"185.138.88.209","port":443,"asn":42478,"as":"Yug-Link Ltd.","country":"Russia","country_code":"RU"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://ofx-logln.top/","date":"2025-12-18T16:03:29.300Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"ofx-logln.top","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Thu, 18 Dec 2025 00:08:01 GMT","end":"Wed, 18 Mar 2026 00:08:00 GMT"},"fingerprint":{"sha1":"16:8A:EC:CD:2C:21:31:0F:3F:65:38:0B:1C:03:D5:A1:03:B7:6B:A5","sha256":"54:3E:D1:88:41:E8:CF:02:5C:BD:E8:11:92:1C:FD:EE:E5:4B:86:90:54:FF:E9:7B:A8:1E:08:C2:4B:D5:4B:F1"}}},"request":{"raw":"GET /assets/bg.jpg HTTP/1.1\r\nHost: ofx-logln.top\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/139.0.3405.13 Safari/537.36 Edg/139.0.3405.13\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://ofx-logln.top/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nServer: nginx/1.28.0\r\nDate: Thu, 18 Dec 2025 16:03:29 GMT\r\nContent-Type: image/jpeg\r\nLast-Modified: Thu, 04 Dec 2025 17:49:13 GMT\r\nTransfer-Encoding: chunked\r\nConnection: keep-alive\r\nETag: W/\"6931c999-6c40cc\"\r\nContent-Encoding: gzip\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx:1.28.0","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":7094476,"size_decoded":0,"mime_type":"image/jpeg","magic":"JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, baseline, precision 8, 4096x2658, components 3","md5":"29fab8fc206bb8b6d97dd26f87a3365b","sha1":"c48428bfbf9195b67cdab38ff1994af6a200c509","sha256":"ae6ab47c909e638e53621c6c876bce17c9623f35a6e0d52ab65b018e80213a10","sha512":"b7e1a8f273c205e057fb3c811f1a0412b560c517392358deb82e258f7ab745077177b66218dbb372a20899b6cbdd82b4089aab96e038c9dbd97214b1b9731654","ssdeep":"24576:Dx0EhXP8TwNBHUulHm+iaE9pQ5Pn457d1SU:DxdxP80NBHU7aEe457R","tlshash":"ef252384171daf539ccf19a8ea5fdc6e8413cc0547e9128c6a2af8d678e0db75d88e43","first_seen":"2025-12-14T16:21:33.682373Z","last_seen":"2025-12-18T16:03:55.503276Z","times_seen":3,"resource_available":false,"data":null}},"time_used":970,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":56,"receive":914,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-12-18","alert":"Sinkholed","trigger":"ofx-logln.top","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"ofx-logln.top/favicon.ico","fqdn":"ofx-logln.top","domain":"ofx-logln.top","tld":"top"},"ip":{"addr":"185.138.88.209","port":443,"asn":42478,"as":"Yug-Link Ltd.","country":"Russia","country_code":"RU"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://ofx-logln.top/","date":"2025-12-18T16:03:29.451Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"ofx-logln.top","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Thu, 18 Dec 2025 00:08:01 GMT","end":"Wed, 18 Mar 2026 00:08:00 GMT"},"fingerprint":{"sha1":"16:8A:EC:CD:2C:21:31:0F:3F:65:38:0B:1C:03:D5:A1:03:B7:6B:A5","sha256":"54:3E:D1:88:41:E8:CF:02:5C:BD:E8:11:92:1C:FD:EE:E5:4B:86:90:54:FF:E9:7B:A8:1E:08:C2:4B:D5:4B:F1"}}},"request":{"raw":"GET /favicon.ico HTTP/1.1\r\nHost: ofx-logln.top\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/139.0.3405.13 Safari/537.36 Edg/139.0.3405.13\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://ofx-logln.top/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nServer: nginx/1.28.0\r\nDate: Thu, 18 Dec 2025 16:03:30 GMT\r\nContent-Type: image/x-icon\r\nContent-Length: 1150\r\nLast-Modified: Thu, 04 Dec 2025 18:51:26 GMT\r\nConnection: keep-alive\r\nETag: \"6931d82e-47e\"\r\nAccept-Ranges: bytes\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx:1.28.0","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":1150,"size_decoded":0,"mime_type":"image/x-icon","magic":"MS Windows icon resource - 1 icon, 16x16, 32 bits/pixel","md5":"b1b20a11e2ad457054c1d69ea4edfc56","sha1":"1b8e39b39d150d3d151b09670baca09e46ccd5ae","sha256":"23863b0f46a0cfc950ac22fab01bc36cf71efc7ed6691d4504ef02d411a085bb","sha512":"785f8f917493dccdf483b9c2179021e03e89608728bb22714cf2569ac6d39f5bae685bc9b16caae3825a8a2d01cb45f6cefc57f43ed61fb52e2112f31d15f33b","ssdeep":"","tlshash":"79217ed6f9910808c36bc13d4ca3cb10a1c69db2b99a8d36d8f8190a8cf0db969207c8","first_seen":"2024-06-17T20:51:01Z","last_seen":"2025-12-18T16:03:55.504527Z","times_seen":18,"resource_available":false,"data":null}},"time_used":853,"timings":{"blocked":0,"dns":1,"connect":29,"send":0,"wait":29,"receive":1,"ssl":793},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-12-18","alert":"Sinkholed","trigger":"ofx-logln.top","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}}]}