{"report_id":"4958e89f-3bab-49ce-8aac-f69acb47aad8","version":0,"status":"done","tags":[],"date":"2026-07-18T15:59:51Z","url":{"schema":"http","addr":"kangawoo.com","fqdn":"kangawoo.com","domain":"kangawoo.com","tld":"com"},"ip":{"addr":"185.97.52.87","port":0,"asn":51790,"as":"SIEL, d.o.o.","country":"Slovenia","country_code":"SI"},"final":{"url":{"schema":"http","addr":"kangawoo.com/","fqdn":"kangawoo.com","domain":"kangawoo.com","tld":"com"},"title":"Briefly unavailable for scheduled maintenance","dom":{"size":1801,"mime_type":"text/html; charset=utf-8","magic":"HTML document, ASCII text","md5":"bda14b9fd24981271d99c0607b5248ad","sha1":"ac0374733a08962eaa47f52724e927d51b5eb61b","sha256":"9babc9dc9b7aab947bcf382b59e98da1be7782eb5a343a0622ce3c44e92c94c9","sha512":"983491c5aef4583f140f4d31b472ab434a01e68910e270a45bb54cea366335576e98ffe7983b9f3f3df51a6972951d54b1fae43d48835cfe8ad5038ad4d74cde","ssdeep":"","tlshash":"9f3172279685080b7467d8386bd7165835c85827921b84e4bfcf778ccfc6a8bc6a1f1c","dom_hash":"domhash9d65271f054c58d6bc7a6e8b4154c7dd","first_seen":"","last_seen":"","times_seen":0,"resource_available":false,"data":null}},"submit":{"url":{"schema":"http","addr":"kangawoo.com","fqdn":"kangawoo.com","domain":"kangawoo.com","tld":"com"},"ip":{"addr":"185.97.52.87","port":0,"asn":51790,"as":"SIEL, d.o.o.","country":"Slovenia","country_code":"SI"},"tags":null,"meta":null},"settings":{"access":"public","device_type":"desktop","expires_at":"2027-08-22T15:59:51Z","useragent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0","referer":"","cookies":null,"exit_node":"qguvgzjxzsgb3vs"},"stats":{"alert_count":{"ids":0,"urlquery":0,"analyzer":3}},"detection":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-07-18","alert":"Sinkholed","trigger":"kangawoo.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-07-18","alert":"Sinkholed","trigger":"kangawoo.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-07-18","alert":"Sinkholed","trigger":"kangawoo.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null},"summary":[{"fqdn":"kangawoo.com","ip":{"addr":"185.97.52.87","port":80,"asn":51790,"as":"SIEL, d.o.o.","country":"Slovenia","country_code":"SI"},"domain_registered":"2014-11-27","domain_rank":0,"first_seen":"2026-05-14T14:48:25.854881Z","last_seen":"2026-07-18T15:59:02.75471Z","alert_count":9,"request_count":3,"received_data":6321,"sent_data":1290,"comment":"","tags":null,"fingerprints":[{"name":"Apache HTTP Server","description":"Apache is a free and open-source cross-platform web server software.","website":"https://httpd.apache.org/","common_platform_enumeration":"cpe:2.3:a:apache:http_server:*:*:*:*:*:*:*:*","icon":"Apache.svg","categories":["Web servers"]}]}],"files":null,"artifacts":{"windows_shortcuts":null,"files":null,"telegram":null,"pdfs":null,"clipboard":null},"sensors":{"ids":null,"analyzer":null,"urlquery":null},"javascript":{"script":[{"url":{"schema":"http","addr":"kangawoo.com/","fqdn":"kangawoo.com","domain":"kangawoo.com","tld":"com"},"ip":{"addr":"185.97.52.87","port":80,"asn":51790,"as":"SIEL, d.o.o.","country":"Slovenia","country_code":"SI"},"introduction_type":"scriptElement","is_inline":true,"md5":"94e92b00c36291c6191fcd52c29e73f2","sha1":"b7093d124d98b86f3d7535bc7d2fd24485bc5132","sha256":"844a7ecc570a1d69df287999c52fec45c62f404978d8d3a50296f8bf3fa7ab42","sha512":"f68c6f3062aa3f8ff43830ccd0091b4fb44c855654bd43e9145cfd021e2aea4dbe397f9fba30bd56fa4e2f95bce28b30b09bd68eedce03a04a6cb8b6217fb5da","ssdeep":"","tlshash":"b0d0a71a965a440726312d5a2dc5511818a3503f6c7544a193090ed837ef956466e9a8","size":225,"data":"","first_seen":"2026-07-18T15:59:02.77333Z","last_seen":"2026-07-18T15:59:52.718788Z","times_seen":2,"alerts":{"ids":null,"analyzer":null,"urlquery":null}}],"eval":null,"write":null,"console":null},"http":[{"url":{"schema":"http","addr":"kangawoo.com/","fqdn":"kangawoo.com","domain":"kangawoo.com","tld":"com"},"ip":{"addr":"185.97.52.87","port":80,"asn":51790,"as":"SIEL, d.o.o.","country":"Slovenia","country_code":"SI"},"is_navigation_request":true,"resource_type":"document","requested_by":"","date":"2026-07-18T15:59:25.894Z","timestamp":1784390365894,"http_version":"HTTP/1.1","security_state":"insecure","security_info":null,"request":{"raw":"GET / HTTP/1.1\r\nHost: kangawoo.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nUpgrade-Insecure-Requests: 1\r\nPriority: u=0, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 503 Service Unavailable\r\nDate: Sat, 18 Jul 2026 15:59:25 GMT\r\nServer: Apache\r\nRetry-After: 3600\r\nCache-Control: no-store, no-cache, must-revalidate, max-age=0\r\nPragma: no-cache\r\nExpires: 0\r\nConnection: close\r\nTransfer-Encoding: chunked\r\nContent-Type: text/html; charset=UTF-8\r\n\r\n","headers":null,"cookies":null,"status_code":"503","status_text":"Service Unavailable","fingerprints":[{"name":"Apache HTTP Server","description":"Apache is a free and open-source cross-platform web server software.","website":"https://httpd.apache.org/","common_platform_enumeration":"cpe:2.3:a:apache:http_server:*:*:*:*:*:*:*:*","icon":"Apache.svg","categories":["Web servers"]}],"data":{"size":1819,"size_decoded":2107,"mime_type":"text/html; charset=UTF-8","magic":"HTML document, ASCII text","md5":"86bbbec7fbe36fcbc6ca16f026e1a92d","sha1":"7d469b1bbc17ee9e9e43c0e947c9c94f8e45c18d","sha256":"e8d88db6a7731d315155c30be8a8ac43590a328b52d2db5c5af8dccfe0f34d6c","sha512":"3ed5fd8ca113916d05c1207f786b27a6c19b735ec2dd04c6aea354ab95db9dcc5fefbb38594e6906c7d808f1e58a4434fe1a3e472e7a47a8685652486e3ea0f1","ssdeep":"","tlshash":"18317227968508077467d8386bd6164835c85827911b84e4bfce778ccfc6a8ac6a1f1c","first_seen":"2026-07-18T15:59:02.765963Z","last_seen":"2026-07-18T15:59:52.717083Z","times_seen":2,"resource_available":true,"data":null}},"time_used":154,"timings":{"blocked":-1,"dns":37,"connect":41,"send":0,"wait":74,"receive":1,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-07-18","alert":"Sinkholed","trigger":"kangawoo.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-07-18","alert":"Sinkholed","trigger":"kangawoo.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-07-18","alert":"Sinkholed","trigger":"kangawoo.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"http","addr":"kangawoo.com/favicon.ico","fqdn":"kangawoo.com","domain":"kangawoo.com","tld":"com"},"ip":{"addr":"185.97.52.87","port":80,"asn":51790,"as":"SIEL, d.o.o.","country":"Slovenia","country_code":"SI"},"is_navigation_request":false,"resource_type":"img","requested_by":"http://kangawoo.com/","date":"2026-07-18T15:59:26.183Z","timestamp":1784390366183,"http_version":"HTTP/1.1","security_state":"insecure","security_info":null,"request":{"raw":"GET /favicon.ico HTTP/1.1\r\nHost: kangawoo.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: http://kangawoo.com/\r\nPriority: u=6\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 503 Service Unavailable\r\nDate: Sat, 18 Jul 2026 15:59:26 GMT\r\nServer: Apache\r\nRetry-After: 3600\r\nCache-Control: no-store, no-cache, must-revalidate, max-age=0\r\nPragma: no-cache\r\nExpires: 0\r\nConnection: close\r\nTransfer-Encoding: chunked\r\nContent-Type: text/html; charset=UTF-8\r\n\r\n","headers":null,"cookies":null,"status_code":"503","status_text":"Service Unavailable","fingerprints":[{"name":"Apache HTTP Server","description":"Apache is a free and open-source cross-platform web server software.","website":"https://httpd.apache.org/","common_platform_enumeration":"cpe:2.3:a:apache:http_server:*:*:*:*:*:*:*:*","icon":"Apache.svg","categories":["Web servers"]}],"data":{"size":1819,"size_decoded":2107,"mime_type":"text/html; charset=UTF-8","magic":"HTML document, ASCII text","md5":"86bbbec7fbe36fcbc6ca16f026e1a92d","sha1":"7d469b1bbc17ee9e9e43c0e947c9c94f8e45c18d","sha256":"e8d88db6a7731d315155c30be8a8ac43590a328b52d2db5c5af8dccfe0f34d6c","sha512":"3ed5fd8ca113916d05c1207f786b27a6c19b735ec2dd04c6aea354ab95db9dcc5fefbb38594e6906c7d808f1e58a4434fe1a3e472e7a47a8685652486e3ea0f1","ssdeep":"","tlshash":"18317227968508077467d8386bd6164835c85827911b84e4bfce778ccfc6a8ac6a1f1c","first_seen":"2026-07-18T15:59:02.765963Z","last_seen":"2026-07-18T15:59:52.717083Z","times_seen":2,"resource_available":true,"data":null}},"time_used":119,"timings":{"blocked":-1,"dns":0,"connect":41,"send":0,"wait":76,"receive":1,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-07-18","alert":"Sinkholed","trigger":"kangawoo.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-07-18","alert":"Sinkholed","trigger":"kangawoo.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-07-18","alert":"Sinkholed","trigger":"kangawoo.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"kangawoo.com/","fqdn":"kangawoo.com","domain":"kangawoo.com","tld":"com"},"ip":{"addr":"185.97.52.87","port":443,"asn":51790,"as":"SIEL, d.o.o.","country":"Slovenia","country_code":"SI"},"is_navigation_request":true,"resource_type":"document","requested_by":"","date":"2026-07-18T15:59:25.585Z","timestamp":1784390365585,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"kangawoo.com","organization":""},"issuer":{"commonName":"YR1","organization":"Let's Encrypt"},"validity":{"start":"Sat, 06 Jun 2026 09:51:37 GMT","end":"Fri, 04 Sep 2026 09:51:36 GMT"},"fingerprint":{"sha1":"F7:11:72:AA:4B:30:73:BE:0D:8B:B6:E3:09:4D:2D:13:82:C1:82:20","sha256":"24:01:E3:43:11:8A:9C:86:39:59:B2:F4:26:E1:2B:F4:B5:69:64:9A:A4:1B:F3:74:90:20:98:20:A0:FA:89:91"}}},"request":{"raw":"GET / HTTP/1.1\r\nHost: kangawoo.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nUpgrade-Insecure-Requests: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: document\r\nSec-Fetch-Mode: navigate\r\nSec-Fetch-Site: none\r\nPriority: u=0, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 503 Service Unavailable\r\nDate: Sat, 18 Jul 2026 15:59:25 GMT\r\nServer: Apache\r\nRetry-After: 3600\r\nCache-Control: no-store, no-cache, must-revalidate, max-age=0\r\nPragma: no-cache\r\nExpires: 0\r\nConnection: close\r\nTransfer-Encoding: chunked\r\nContent-Type: text/html; charset=UTF-8\r\n\r\n","headers":null,"cookies":null,"status_code":"503","status_text":"Service Unavailable","fingerprints":[{"name":"Apache HTTP Server","description":"Apache is a free and open-source cross-platform web server software.","website":"https://httpd.apache.org/","common_platform_enumeration":"cpe:2.3:a:apache:http_server:*:*:*:*:*:*:*:*","icon":"Apache.svg","categories":["Web servers"]}],"data":{"size":1819,"size_decoded":2107,"mime_type":"text/html; charset=UTF-8","magic":"HTML document, ASCII text","md5":"86bbbec7fbe36fcbc6ca16f026e1a92d","sha1":"7d469b1bbc17ee9e9e43c0e947c9c94f8e45c18d","sha256":"e8d88db6a7731d315155c30be8a8ac43590a328b52d2db5c5af8dccfe0f34d6c","sha512":"3ed5fd8ca113916d05c1207f786b27a6c19b735ec2dd04c6aea354ab95db9dcc5fefbb38594e6906c7d808f1e58a4434fe1a3e472e7a47a8685652486e3ea0f1","ssdeep":"","tlshash":"18317227968508077467d8386bd6164835c85827911b84e4bfce778ccfc6a8ac6a1f1c","first_seen":"2026-07-18T15:59:02.765963Z","last_seen":"2026-07-18T15:59:52.717083Z","times_seen":2,"resource_available":true,"data":null}},"time_used":162,"timings":{"blocked":-1,"dns":3,"connect":38,"send":0,"wait":73,"receive":5,"ssl":43},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-07-18","alert":"Sinkholed","trigger":"kangawoo.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-07-18","alert":"Sinkholed","trigger":"kangawoo.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-07-18","alert":"Sinkholed","trigger":"kangawoo.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}}]}