{"report_id":"5b7a4382-226b-4e25-bc6d-f47261b05e51","version":0,"status":"done","tags":[],"date":"2026-09-17T18:43:51Z","url":{"schema":"http","addr":"searchpathofchicago.com/","fqdn":"searchpathofchicago.com","domain":"searchpathofchicago.com","tld":"com"},"ip":{"addr":"145.63.129.137","port":0,"asn":211381,"as":"Podaon SIA","country":"Germany","country_code":"DE"},"final":{"url":{"schema":"https","addr":"searchpathofchicago.com/","fqdn":"searchpathofchicago.com","domain":"searchpathofchicago.com","tld":"com"},"title":"Searchpath Chicago — A different way to look","dom":{"size":22832,"mime_type":"text/html; charset=utf-8","magic":"JavaScript source, Unicode text, UTF-8 text, with very long lines (563)","md5":"679023599da7cba3d180b59ff5cf6734","sha1":"15f44ab5bff45f9ec7db038dc185c93c598e5830","sha256":"57f78de6b138be000ab31e7bde6f7abc2ee1dca99cd8b9ff146e8d1fd86e1245","sha512":"85784e8c2ae2e26db959c9d762957b360c0586032a45c62880dc89c7d8480af6ab95a8db7f82d9f4348aef3e2c6f8fd9248f9d73fe831383044c87081341b920","ssdeep":"384:xgmSL046kCWiecvZU4AbggB8Wt+QGh1bzmEiL:xgmSL046YtIPwW++Rh1Vy","tlshash":"caa2fba262f41a36e23751d9b39363967369a046c108e868bffc011c5fc5df6a47738e","dom_hash":"domhashbe3195f4f8f3ccef7b092cad2aa24d89","first_seen":"2026-09-17T18:39:18.01326Z","last_seen":"2026-09-17T19:34:23.342961Z","times_seen":3,"resource_available":false,"data":null}},"submit":{"url":{"schema":"http","addr":"searchpathofchicago.com/","fqdn":"searchpathofchicago.com","domain":"searchpathofchicago.com","tld":"com"},"ip":{"addr":"145.63.129.137","port":0,"asn":211381,"as":"Podaon SIA","country":"Germany","country_code":"DE"},"tags":null,"meta":null},"settings":{"access":"public","device_type":"desktop","expires_at":"2027-10-22T18:43:51Z","useragent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0","referer":"","cookies":null,"exit_node":"qguvgzjxzsgb3vs"},"stats":{"alert_count":{"ids":0,"urlquery":0,"analyzer":5}},"detection":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-09-17","alert":"Sinkholed","trigger":"searchpathofchicago.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-09-17","alert":"Sinkholed","trigger":"searchpathofchicago.com","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-17","alert":"Sinkholed","trigger":"searchpathofchicago.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-09-17","alert":"Phishing Block","trigger":"searchpathofchicago.com","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-09-17","alert":"Sinkholed","trigger":"searchpathofchicago.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null}],"urlquery":null},"summary":[{"fqdn":"searchpathofchicago.com","ip":{"addr":"145.63.129.137","port":443,"asn":0,"as":"","country":"The Netherlands","country_code":"NL"},"domain_registered":"2010-01-11","domain_rank":0,"first_seen":"2026-09-17T18:39:14.282907Z","last_seen":"2026-09-17T18:39:14.282907Z","alert_count":10,"request_count":2,"received_data":23757,"sent_data":1014,"comment":"","tags":null,"fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}]}],"files":null,"artifacts":{"windows_shortcuts":null,"files":null,"telegram":null,"pdfs":null,"clipboard":null},"sensors":{"ids":null,"analyzer":null,"urlquery":null},"javascript":{"script":[{"url":{"schema":"https","addr":"searchpathofchicago.com/","fqdn":"searchpathofchicago.com","domain":"searchpathofchicago.com","tld":"com"},"ip":{"addr":"145.63.129.137","port":443,"asn":0,"as":"","country":"The Netherlands","country_code":"NL"},"introduction_type":"scriptElement","is_inline":true,"md5":"fb5b5bd34c498aa9d2756b1f2631cfac","sha1":"e16062d1919a2cdcf50c96309285efb05e512816","sha256":"ba359022752e0c8af779709cba008953920978e59ca502665ebc3b6fc41f9f2f","sha512":"097d8c71093c6f6160a6e68c02845ced158eb4424d3a4ae2ad1a68c880750e22eb78c66222ea0fcb0e2e5a5ddcee2663088d0b746e6f133b8e749243662aea35","ssdeep":"","tlshash":"c551f374127c5870423b52dfe2d693d6a675314eb002e886a91c490c3dc6fa762ee5f7","size":2830,"data":"","first_seen":"2026-09-17T18:39:18.017244Z","last_seen":"2026-09-17T19:34:23.347197Z","times_seen":3,"alerts":{"ids":null,"analyzer":null,"urlquery":null}}],"eval":null,"write":null,"console":null},"http":[{"url":{"schema":"https","addr":"searchpathofchicago.com/","fqdn":"searchpathofchicago.com","domain":"searchpathofchicago.com","tld":"com"},"ip":{"addr":"145.63.129.137","port":443,"asn":0,"as":"","country":"The Netherlands","country_code":"NL"},"is_navigation_request":true,"resource_type":"document","requested_by":"","date":"2026-09-17T18:43:23.318Z","timestamp":1789670603318,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"searchpathofchicago.com","organization":""},"issuer":{"commonName":"YE2","organization":"Let's Encrypt"},"validity":{"start":"Mon, 14 Sep 2026 16:37:22 GMT","end":"Sun, 13 Dec 2026 16:37:21 GMT"},"fingerprint":{"sha1":"FF:CF:75:8A:56:B5:EA:A1:78:25:A1:33:64:00:18:74:B3:D5:F2:F1","sha256":"23:6F:4D:37:54:E6:11:05:8F:8F:E2:22:4E:4B:0A:CF:06:49:14:AB:02:72:17:E8:23:90:86:17:CD:11:5A:D3"}}},"request":{"raw":"GET / HTTP/1.1\r\nHost: searchpathofchicago.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nUpgrade-Insecure-Requests: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: document\r\nSec-Fetch-Mode: navigate\r\nSec-Fetch-Site: none\r\nPriority: u=0, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nServer: nginx\r\nDate: Thu, 17 Sep 2026 18:43:23 GMT\r\nContent-Type: text/html\r\nLast-Modified: Mon, 14 Sep 2026 17:35:44 GMT\r\nTransfer-Encoding: chunked\r\nConnection: keep-alive\r\nETag: W/\"6aa83070-58cb\"\r\nX-Content-Type-Options: nosniff\r\nReferrer-Policy: strict-origin-when-cross-origin\r\nX-Frame-Options: DENY\r\nContent-Security-Policy: default-src 'self'; script-src 'self' 'unsafe-inline'; style-src 'self' 'unsafe-inline'; img-src 'self' data:; font-src 'self'; connect-src 'none'; form-action 'none'; frame-ancestors 'none'; base-uri 'none'\r\nContent-Encoding: gzip\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":22731,"size_decoded":8525,"mime_type":"text/html","magic":"HTML document, Unicode text, UTF-8 text, with very long lines (563)","md5":"0f425086c76f5e5e2d336996c67f7bf0","sha1":"2bebbbf52d3fa78f8788d8579fec6e2b04a5fdd0","sha256":"3656d9969189084a1ed71ccd53cc74837daa835bb224c4bb4a2a3e144deddb68","sha512":"0080439f1348e20532f60527ed20e6f751a4137c38ff8e0456517d54fffe739889c1bc1daa6404ea8b474e3510609904c86a5b1bee26a11399da9474ef822e3f","ssdeep":"384:rgASL046kCWiecvZU4WbL9pUNt+QGwYbzmEiP:rgASL046YtIPSeP+RwYVa","tlshash":"65a20ba252f41936d23781d9b39263967369a047d108e868bffc011c5fc9ef6a47738e","first_seen":"2026-09-17T18:39:18.014604Z","last_seen":"2026-09-17T19:34:23.345246Z","times_seen":3,"resource_available":true,"data":null}},"time_used":131,"timings":{"blocked":0,"dns":39,"connect":26,"send":0,"wait":28,"receive":0,"ssl":37},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-09-17","alert":"Sinkholed","trigger":"searchpathofchicago.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-09-17","alert":"Sinkholed","trigger":"searchpathofchicago.com","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-17","alert":"Sinkholed","trigger":"searchpathofchicago.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-09-17","alert":"Phishing Block","trigger":"searchpathofchicago.com","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-09-17","alert":"Sinkholed","trigger":"searchpathofchicago.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"searchpathofchicago.com/favicon.ico","fqdn":"searchpathofchicago.com","domain":"searchpathofchicago.com","tld":"com"},"ip":{"addr":"145.63.129.137","port":443,"asn":0,"as":"","country":"The Netherlands","country_code":"NL"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://searchpathofchicago.com/","date":"2026-09-17T18:43:23.666Z","timestamp":1789670603666,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"searchpathofchicago.com","organization":""},"issuer":{"commonName":"YE2","organization":"Let's Encrypt"},"validity":{"start":"Mon, 14 Sep 2026 16:37:22 GMT","end":"Sun, 13 Dec 2026 16:37:21 GMT"},"fingerprint":{"sha1":"FF:CF:75:8A:56:B5:EA:A1:78:25:A1:33:64:00:18:74:B3:D5:F2:F1","sha256":"23:6F:4D:37:54:E6:11:05:8F:8F:E2:22:4E:4B:0A:CF:06:49:14:AB:02:72:17:E8:23:90:86:17:CD:11:5A:D3"}}},"request":{"raw":"GET /favicon.ico HTTP/1.1\r\nHost: searchpathofchicago.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://searchpathofchicago.com/\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=6\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 204 No Content\r\nServer: nginx\r\nDate: Thu, 17 Sep 2026 18:43:23 GMT\r\nConnection: keep-alive\r\nX-Content-Type-Options: nosniff\r\nReferrer-Policy: strict-origin-when-cross-origin\r\nX-Frame-Options: DENY\r\nContent-Security-Policy: default-src 'self'; script-src 'self' 'unsafe-inline'; style-src 'self' 'unsafe-inline'; img-src 'self' data:; font-src 'self'; connect-src 'none'; form-action 'none'; frame-ancestors 'none'; base-uri 'none'\r\n\r\n","headers":null,"cookies":null,"status_code":"204","status_text":"No Content","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":0,"size_decoded":443,"mime_type":"text/plain","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-09-17T23:41:52.708065Z","times_seen":18524522,"resource_available":true,"data":null}},"time_used":27,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":27,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-09-17","alert":"Sinkholed","trigger":"searchpathofchicago.com","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-09-17","alert":"Phishing Block","trigger":"searchpathofchicago.com","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-17","alert":"Sinkholed","trigger":"searchpathofchicago.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-09-17","alert":"Sinkholed","trigger":"searchpathofchicago.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-09-17","alert":"Sinkholed","trigger":"searchpathofchicago.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null}],"urlquery":null}}]}