{"report_id":"4950c2b5-953c-4b11-a6d0-584a737d0cab","version":0,"status":"done","tags":[],"date":"2026-09-11T10:18:22Z","url":{"schema":"http","addr":"xrpl-verify.com/","fqdn":"xrpl-verify.com","domain":"xrpl-verify.com","tld":"com"},"ip":{"addr":"65.109.115.239","port":0,"asn":24940,"as":"Hetzner Online GmbH","country":"Finland","country_code":"FI"},"final":{"url":{"schema":"https","addr":"xrpl-verify.com/","fqdn":"xrpl-verify.com","domain":"xrpl-verify.com","tld":"com"},"title":"NFToffer flow — ISOLATED SECURITY LAB (XRPL LIVENET)","dom":{"size":3204,"mime_type":"text/html; charset=utf-8","magic":"HTML document, Unicode text, UTF-8 text","md5":"742127ef90b294c6801bd821d6026d48","sha1":"83e4b63b8d045e1451155b39daac469a848f3928","sha256":"fd1f44dac7556f09360024f94fd5c1a240654256b7f3062eb298283ba983841f","sha512":"78343a651fbc347b07c6d10f029d5c2753b87f9133502f4d4c2e2aeee70cc0e1adc61b8c9565d18bf3507a78db703a74c3badae63a3da43b5a333e5ae61f5a1e","ssdeep":"","tlshash":"ef616113a2d512067263c9b4be669bdb377d524bc102ca793eec62a8cf4c49144f7798","dom_hash":"domhashdd46da432d19951e63b00542e96175d4","first_seen":"2026-09-11T10:10:38.712274Z","last_seen":"2026-09-11T10:18:23.040675Z","times_seen":2,"resource_available":false,"data":null}},"submit":{"url":{"schema":"http","addr":"xrpl-verify.com/","fqdn":"xrpl-verify.com","domain":"xrpl-verify.com","tld":"com"},"ip":{"addr":"65.109.115.239","port":0,"asn":24940,"as":"Hetzner Online GmbH","country":"Finland","country_code":"FI"},"tags":null,"meta":null},"settings":{"access":"public","device_type":"desktop","expires_at":"2027-10-16T10:18:22Z","useragent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0","referer":"","cookies":null,"exit_node":"qguvgzjxzsgb3vs"},"stats":{"alert_count":{"ids":0,"urlquery":0,"analyzer":1}},"detection":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-11","alert":"Sinkholed","trigger":"xrpl-verify.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null},"summary":[{"fqdn":"xrpl-verify.com","ip":{"addr":"65.109.115.239","port":443,"asn":24940,"as":"Hetzner Online GmbH","country":"Finland","country_code":"FI"},"domain_registered":"2026-09-09","domain_rank":0,"first_seen":"2026-09-11T10:10:35.051424Z","last_seen":"2026-09-11T10:10:35.051424Z","alert_count":3,"request_count":3,"received_data":16033,"sent_data":1341,"comment":"","tags":null,"fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}]}],"files":null,"artifacts":{"windows_shortcuts":null,"files":null,"telegram":null,"pdfs":null,"clipboard":null},"sensors":{"ids":null,"analyzer":null,"urlquery":null},"javascript":{"script":[{"url":{"schema":"https","addr":"xrpl-verify.com/app.js","fqdn":"xrpl-verify.com","domain":"xrpl-verify.com","tld":"com"},"ip":{"addr":"65.109.115.239","port":443,"asn":24940,"as":"Hetzner Online GmbH","country":"Finland","country_code":"FI"},"introduction_type":"scriptElement","is_inline":false,"md5":"e42c2c169d4ed4a318bebd5d38d97c7c","sha1":"0a0954afdaeea6c8365474313ce030f6911a89ea","sha256":"65d32d8644c4bbce0fed7263b9b4a8e9a29c3b72be45b35d362f952c51980284","sha512":"fa138dee3c0c2e34ab579773ed1d8955b78a2ea78aa81c1d9178ba2b710c744fb70a1f63825812c518f27e17015ff099e81f5dc8e8558d24808676bf715f9ef9","ssdeep":"192:7m9a/jB09qkawHEaOcZ9OA+URyaf7xoqDcqMBer/6u/aOD+w+3aYsfAZNau:Qal0AwkpI8CP6C+tLsE7","tlshash":"5332e78e60bb1935023b14ada62f2175b632801b3495cdc4bb9f580cbfc9d2857f67d8","size":11902,"data":"","first_seen":"2026-09-11T10:10:38.719685Z","last_seen":"2026-09-11T10:18:23.043266Z","times_seen":2,"alerts":{"ids":null,"analyzer":null,"urlquery":null}}],"eval":null,"write":null,"console":null},"http":[{"url":{"schema":"https","addr":"xrpl-verify.com/","fqdn":"xrpl-verify.com","domain":"xrpl-verify.com","tld":"com"},"ip":{"addr":"65.109.115.239","port":443,"asn":24940,"as":"Hetzner Online GmbH","country":"Finland","country_code":"FI"},"is_navigation_request":true,"resource_type":"document","requested_by":"","date":"2026-09-11T10:17:53.503Z","timestamp":1789121873503,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"xrpl-verify.com","organization":""},"issuer":{"commonName":"YR1","organization":"Let's Encrypt"},"validity":{"start":"Wed, 09 Sep 2026 18:03:33 GMT","end":"Tue, 08 Dec 2026 18:03:32 GMT"},"fingerprint":{"sha1":"16:EB:AE:F4:B3:5E:A2:99:25:4B:3A:39:91:C4:C5:9E:21:4C:E1:AC","sha256":"87:59:D4:45:A7:D5:90:A9:40:46:58:39:F1:3B:30:BE:45:C8:05:15:14:E7:6A:A1:18:6D:E9:D8:74:D8:6A:D3"}}},"request":{"raw":"GET / HTTP/1.1\r\nHost: xrpl-verify.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nUpgrade-Insecure-Requests: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: document\r\nSec-Fetch-Mode: navigate\r\nSec-Fetch-Site: none\r\nPriority: u=0, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\ncontent-type: text/html\r\ndate: Fri, 11 Sep 2026 10:17:53 GMT\r\nreferrer-policy: no-referrer\r\nstrict-transport-security: max-age=31536000; includeSubDomains; preload\r\nx-content-type-options: nosniff\r\nx-download-options: noopen\r\nx-permitted-cross-domain-policies: none\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":3227,"size_decoded":3529,"mime_type":"text/html","magic":"HTML document, Unicode text, UTF-8 text","md5":"2c0c49a4dbaa994b8426c6497de83c1b","sha1":"55c111d96e5d27a9f4553e67243ee3d19c65da1c","sha256":"5b9c4473146a8273eef184687bc7ad181c0e2d941484f4152b878a7efe35d738","sha512":"c1a81d1be6f61851f178704f76e57343be7e33903e5fb5da02c2ba1b316285248626475362b5d95dc9e4e46b964cea45eb199b951eadb43ada4f4acab8c5d313","ssdeep":"","tlshash":"0d616413a2d50606726389b4be629bdb377d5247c102ca7d3eec61b8cf8c59144f7798","first_seen":"2026-09-11T10:10:38.716913Z","last_seen":"2026-09-11T10:18:23.041964Z","times_seen":2,"resource_available":false,"data":null}},"time_used":74,"timings":{"blocked":0,"dns":8,"connect":18,"send":0,"wait":17,"receive":0,"ssl":30},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-11","alert":"Sinkholed","trigger":"xrpl-verify.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"xrpl-verify.com/app.js","fqdn":"xrpl-verify.com","domain":"xrpl-verify.com","tld":"com"},"ip":{"addr":"65.109.115.239","port":443,"asn":24940,"as":"Hetzner Online GmbH","country":"Finland","country_code":"FI"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://xrpl-verify.com/","date":"2026-09-11T10:17:53.785Z","timestamp":1789121873785,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"xrpl-verify.com","organization":""},"issuer":{"commonName":"YR1","organization":"Let's Encrypt"},"validity":{"start":"Wed, 09 Sep 2026 18:03:33 GMT","end":"Tue, 08 Dec 2026 18:03:32 GMT"},"fingerprint":{"sha1":"16:EB:AE:F4:B3:5E:A2:99:25:4B:3A:39:91:C4:C5:9E:21:4C:E1:AC","sha256":"87:59:D4:45:A7:D5:90:A9:40:46:58:39:F1:3B:30:BE:45:C8:05:15:14:E7:6A:A1:18:6D:E9:D8:74:D8:6A:D3"}}},"request":{"raw":"GET /app.js HTTP/1.1\r\nHost: xrpl-verify.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\ncontent-type: text/javascript\r\ndate: Fri, 11 Sep 2026 10:17:53 GMT\r\nreferrer-policy: no-referrer\r\nstrict-transport-security: max-age=31536000; includeSubDomains; preload\r\nx-content-type-options: nosniff\r\nx-download-options: noopen\r\nx-permitted-cross-domain-policies: none\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":11910,"size_decoded":12218,"mime_type":"text/javascript","magic":"JavaScript source, Unicode text, UTF-8 text","md5":"e42c2c169d4ed4a318bebd5d38d97c7c","sha1":"0a0954afdaeea6c8365474313ce030f6911a89ea","sha256":"65d32d8644c4bbce0fed7263b9b4a8e9a29c3b72be45b35d362f952c51980284","sha512":"fa138dee3c0c2e34ab579773ed1d8955b78a2ea78aa81c1d9178ba2b710c744fb70a1f63825812c518f27e17015ff099e81f5dc8e8558d24808676bf715f9ef9","ssdeep":"192:7m9a/jB09qkawHEaOcZ9OA+URyaf7xoqDcqMBer/6u/aOD+w+3aYsfAZNau:Qal0AwkpI8CP6C+tLsE7","tlshash":"5332e78e60bb1935023b14ada62f2175b632801b3495cdc4bb9f580cbfc9d2857f67d8","first_seen":"2026-09-11T10:10:38.719685Z","last_seen":"2026-09-11T10:18:23.043266Z","times_seen":2,"resource_available":true,"data":null}},"time_used":18,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":18,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-11","alert":"Sinkholed","trigger":"xrpl-verify.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"xrpl-verify.com/favicon.ico","fqdn":"xrpl-verify.com","domain":"xrpl-verify.com","tld":"com"},"ip":{"addr":"65.109.115.239","port":443,"asn":24940,"as":"Hetzner Online GmbH","country":"Finland","country_code":"FI"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://xrpl-verify.com/","date":"2026-09-11T10:17:53.836Z","timestamp":1789121873836,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"xrpl-verify.com","organization":""},"issuer":{"commonName":"YR1","organization":"Let's Encrypt"},"validity":{"start":"Wed, 09 Sep 2026 18:03:33 GMT","end":"Tue, 08 Dec 2026 18:03:32 GMT"},"fingerprint":{"sha1":"16:EB:AE:F4:B3:5E:A2:99:25:4B:3A:39:91:C4:C5:9E:21:4C:E1:AC","sha256":"87:59:D4:45:A7:D5:90:A9:40:46:58:39:F1:3B:30:BE:45:C8:05:15:14:E7:6A:A1:18:6D:E9:D8:74:D8:6A:D3"}}},"request":{"raw":"GET /favicon.ico HTTP/1.1\r\nHost: xrpl-verify.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=6\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 404 \r\ndate: Fri, 11 Sep 2026 10:17:53 GMT\r\nreferrer-policy: no-referrer\r\nstrict-transport-security: max-age=31536000; includeSubDomains; preload\r\nx-content-type-options: nosniff\r\nx-download-options: noopen\r\nx-permitted-cross-domain-policies: none\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"404","status_text":"Not Found","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":9,"size_decoded":286,"mime_type":"text/plain","magic":"ASCII text, with no line terminators","md5":"d8f4a1993546cc4b850cde3599e27aec","sha1":"094b763b4cfcc0b05e5d040581cd513c3ca08067","sha256":"907ba78b4545338d3539683e63ecb51cf51c10adc9dabd86e92bd52339f298b9","sha512":"7c696247f98aa6fe4e1df001fd6029abbbccf45b122d65dfdede8f8a400cda775387c657f96bd1e4e52da7409187892b1f0786c54d835d2e44227b2e1335eaf6","ssdeep":"","tlshash":"4a50000c0003030c0000003000c00030000c03000c0000300000c00c00000000c000cc","first_seen":"2023-03-08T07:11:06Z","last_seen":"2026-09-11T11:44:27.794324Z","times_seen":23484,"resource_available":true,"data":null}},"time_used":17,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":17,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-11","alert":"Sinkholed","trigger":"xrpl-verify.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}}]}