{"report_id":"315369d9-584c-4115-b06f-44bcd64f3b6e","version":0,"status":"done","tags":[],"date":"2026-08-17T14:18:50Z","url":{"schema":"https","addr":"cardvault-app.xyz/","fqdn":"cardvault-app.xyz","domain":"cardvault-app.xyz","tld":"xyz"},"ip":{"addr":"172.86.73.78","port":0,"asn":14956,"as":"ROUTERHOSTING","country":"United States","country_code":"US"},"final":{"url":{"schema":"https","addr":"cardvault-app.xyz/","fqdn":"cardvault-app.xyz","domain":"cardvault-app.xyz","tld":"xyz"},"title":"cardvault-app.xyz/","dom":{"size":57,"mime_type":"text/html; charset=utf-8","magic":"HTML document, ASCII text, with no line terminators","md5":"238e78f6609ff71ec8a8e0c80e33893e","sha1":"48c97b0d9ec1c0cdac46a987ac5d5d9f6489563c","sha256":"263331ea5f9509c3c053c16b9b180e72373a203106d82d386845269c02dbe98b","sha512":"872ffbc542f7b16b0442507ce327fbc28577c36228bc06ca5c00a8f8dce2fdd19751d94f9bda2603908dfefe21e3541aca3fe8e0f4429dab21c57b7507ef9c33","ssdeep":"","tlshash":"939002fa936560056c3075dd1cd117532819525464858b1015946465c645255e856298","dom_hash":"domhash1f07f384c75181c66badb60ab1ec770b","first_seen":"2026-08-17T14:18:51.85711Z","last_seen":"2026-08-17T14:20:22.344724Z","times_seen":2,"resource_available":false,"data":null}},"submit":{"url":{"schema":"https","addr":"cardvault-app.xyz/","fqdn":"cardvault-app.xyz","domain":"cardvault-app.xyz","tld":"xyz"},"ip":{"addr":"172.86.73.78","port":0,"asn":14956,"as":"ROUTERHOSTING","country":"United States","country_code":"US"},"tags":null,"meta":null},"settings":{"access":"public","device_type":"desktop","expires_at":"2027-09-21T14:18:50Z","useragent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0","referer":"","cookies":null,"exit_node":"qguvgzjxzsgb3vs"},"stats":{"alert_count":{"ids":0,"urlquery":0,"analyzer":1}},"detection":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-08-17","alert":"Sinkholed","trigger":"cardvault-app.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null},"summary":[{"fqdn":"cardvault-app.xyz","ip":{"addr":"172.86.73.78","port":443,"asn":14956,"as":"ROUTERHOSTING","country":"United States","country_code":"US"},"domain_registered":"2026-08-07","domain_rank":0,"first_seen":"2026-08-17T14:15:48.376668Z","last_seen":"2026-08-17T14:15:48.376668Z","alert_count":2,"request_count":2,"received_data":816,"sent_data":996,"comment":"","tags":null,"fingerprints":[{"name":"Express","description":"Express is a web application framework for Node.js, released as free and open-source software under the MIT License. It is designed for building web applications and APIs.","website":"https://expressjs.com","common_platform_enumeration":"cpe:2.3:a:expressjs:express:*:*:*:*:*:*:*:*","icon":"Express.svg","categories":["Web frameworks","Web servers"]},{"name":"Node.js","description":"Node.js is an open-source, cross-platform, JavaScript runtime environment that executes JavaScript code outside a web browser.","website":"https://nodejs.org","common_platform_enumeration":"cpe:2.3:a:nodejs:node.js:*:*:*:*:*:*:*:*","icon":"Node.js.svg","categories":["Programming languages"]},{"name":"Nginx:1.30.4","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}]}],"files":null,"artifacts":{"windows_shortcuts":null,"files":null,"telegram":null,"pdfs":null,"clipboard":null},"sensors":{"ids":null,"analyzer":null,"urlquery":null},"javascript":{"script":null,"eval":null,"write":null,"console":null},"http":[{"url":{"schema":"https","addr":"cardvault-app.xyz/","fqdn":"cardvault-app.xyz","domain":"cardvault-app.xyz","tld":"xyz"},"ip":{"addr":"172.86.73.78","port":443,"asn":14956,"as":"ROUTERHOSTING","country":"United States","country_code":"US"},"is_navigation_request":true,"resource_type":"document","requested_by":"","date":"2026-08-17T14:18:22.126Z","timestamp":1786976302126,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"cardvault-app.xyz","organization":""},"issuer":{"commonName":"YE2","organization":"Let's Encrypt"},"validity":{"start":"Fri, 07 Aug 2026 14:28:03 GMT","end":"Thu, 05 Nov 2026 14:28:02 GMT"},"fingerprint":{"sha1":"46:C6:98:4B:48:E2:51:65:47:68:8F:89:D9:54:9F:7D:55:DD:BF:A1","sha256":"01:5D:60:EB:69:5C:CC:74:EB:4B:0D:21:CD:E6:6D:EC:D7:EE:69:E0:B3:40:B8:B7:EE:06:C9:CF:B6:10:17:FA"}}},"request":{"raw":"GET / HTTP/1.1\r\nHost: cardvault-app.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nUpgrade-Insecure-Requests: 1\r\nSec-Fetch-Dest: document\r\nSec-Fetch-Mode: navigate\r\nSec-Fetch-Site: none\r\nPriority: u=0, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nServer: nginx/1.30.4\r\nDate: Mon, 17 Aug 2026 14:18:22 GMT\r\nContent-Type: text/html; charset=UTF-8\r\nContent-Length: 18\r\nConnection: keep-alive\r\nX-Powered-By: Express\r\nAccess-Control-Allow-Origin: *\r\nAccept-Ranges: bytes\r\nCache-Control: public, max-age=0\r\nLast-Modified: Fri, 07 Aug 2026 01:29:30 GMT\r\nETag: W/\"12-19fd9d6f123\"\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Express","description":"Express is a web application framework for Node.js, released as free and open-source software under the MIT License. It is designed for building web applications and APIs.","website":"https://expressjs.com","common_platform_enumeration":"cpe:2.3:a:expressjs:express:*:*:*:*:*:*:*:*","icon":"Express.svg","categories":["Web frameworks","Web servers"]},{"name":"Node.js","description":"Node.js is an open-source, cross-platform, JavaScript runtime environment that executes JavaScript code outside a web browser.","website":"https://nodejs.org","common_platform_enumeration":"cpe:2.3:a:nodejs:node.js:*:*:*:*:*:*:*:*","icon":"Node.js.svg","categories":["Programming languages"]},{"name":"Nginx:1.30.4","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":18,"size_decoded":363,"mime_type":"text/html; charset=UTF-8","magic":"ASCII text, with no line terminators","md5":"94f36bc3d8b4e331d0c2c1a05d70e521","sha1":"ddd98660c2917a2de177150be1bc389b85ae392a","sha256":"4869a5c1fcbd27a57d430fa2530a5422a28d7ae079430912670a9f281842b555","sha512":"6852bc6a87728f84b3cfb22fcf72cf1cbf2ec8787f51aab237e1c1d5887b44769e1380d80e9879a536947bc7953c6ee22a308431b4ad9d7dd1cd5b871f51c7c8","ssdeep":"","tlshash":"a7700002030800002820800e20200a03000a20008880822000088002828228080a0228","first_seen":"2026-08-17T14:18:51.859107Z","last_seen":"2026-08-17T14:20:22.346098Z","times_seen":2,"resource_available":false,"data":null}},"time_used":387,"timings":{"blocked":-1,"dns":8,"connect":122,"send":0,"wait":125,"receive":0,"ssl":132},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-08-17","alert":"Sinkholed","trigger":"cardvault-app.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"cardvault-app.xyz/favicon.ico","fqdn":"cardvault-app.xyz","domain":"cardvault-app.xyz","tld":"xyz"},"ip":{"addr":"172.86.73.78","port":443,"asn":14956,"as":"ROUTERHOSTING","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://cardvault-app.xyz/","date":"2026-08-17T14:18:22.726Z","timestamp":1786976302726,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"cardvault-app.xyz","organization":""},"issuer":{"commonName":"YE2","organization":"Let's Encrypt"},"validity":{"start":"Fri, 07 Aug 2026 14:28:03 GMT","end":"Thu, 05 Nov 2026 14:28:02 GMT"},"fingerprint":{"sha1":"46:C6:98:4B:48:E2:51:65:47:68:8F:89:D9:54:9F:7D:55:DD:BF:A1","sha256":"01:5D:60:EB:69:5C:CC:74:EB:4B:0D:21:CD:E6:6D:EC:D7:EE:69:E0:B3:40:B8:B7:EE:06:C9:CF:B6:10:17:FA"}}},"request":{"raw":"GET /favicon.ico HTTP/1.1\r\nHost: cardvault-app.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://cardvault-app.xyz/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=6\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 404 Not Found\r\nServer: nginx/1.30.4\r\nDate: Mon, 17 Aug 2026 14:18:22 GMT\r\nContent-Type: text/html; charset=utf-8\r\nContent-Length: 150\r\nConnection: keep-alive\r\nX-Powered-By: Express\r\nAccess-Control-Allow-Origin: *\r\nContent-Security-Policy: default-src 'none'\r\nX-Content-Type-Options: nosniff\r\n\r\n","headers":null,"cookies":null,"status_code":"404","status_text":"Not Found","fingerprints":[{"name":"Nginx:1.30.4","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"Express","description":"Express is a web application framework for Node.js, released as free and open-source software under the MIT License. It is designed for building web applications and APIs.","website":"https://expressjs.com","common_platform_enumeration":"cpe:2.3:a:expressjs:express:*:*:*:*:*:*:*:*","icon":"Express.svg","categories":["Web frameworks","Web servers"]},{"name":"Node.js","description":"Node.js is an open-source, cross-platform, JavaScript runtime environment that executes JavaScript code outside a web browser.","website":"https://nodejs.org","common_platform_enumeration":"cpe:2.3:a:nodejs:node.js:*:*:*:*:*:*:*:*","icon":"Node.js.svg","categories":["Programming languages"]}],"data":{"size":150,"size_decoded":453,"mime_type":"text/html; charset=utf-8","magic":"HTML document, ASCII text","md5":"84241342d84ac29592a5d9516f8edf7f","sha1":"03c53980e18e17625f439c20e7d438f066202428","sha256":"6e21162bc64073fe9e3d3d6375ca24d04fed1912a5b7716aac0cb0f2d16fae7c","sha512":"7509483335c7a30365f7f403098491ac0b44fffcc68a5cdacb86ec191f02dbda5b16a20a09e924b6a29ac938578d43bacb9a50115db5c5668ea27fe1811bd530","ssdeep":"","tlshash":"34c08c9e140012010b2087042ac1326464973b992de685006a87e027ece8a1ad987288","first_seen":"2023-04-05T13:59:49Z","last_seen":"2026-08-17T17:29:34.150124Z","times_seen":8999,"resource_available":false,"data":null}},"time_used":128,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":128,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-08-17","alert":"Sinkholed","trigger":"cardvault-app.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}}]}