{"report_id":"5ed5bccc-a9c4-4ec8-967f-89d7801ce342","version":6,"status":"done","tags":[],"date":"2025-10-15T01:33:28Z","url":{"schema":"http","addr":"0997e86c03.c6073077cc.com","fqdn":"0997e86c03.c6073077cc.com","domain":"c6073077cc.com","tld":"com"},"ip":{"addr":"45.133.44.52","port":0,"asn":39572,"as":"DataWeb Global Group B.V.","country":"United States","country_code":"US"},"final":{"url":{"schema":"http","addr":"0997e86c03.c6073077cc.com/","fqdn":"0997e86c03.c6073077cc.com","domain":"c6073077cc.com","tld":"com"},"title":"0997e86c03.c6073077cc.com/"},"submit":{"url":{"schema":"http","addr":"0997e86c03.c6073077cc.com","fqdn":"0997e86c03.c6073077cc.com","domain":"c6073077cc.com","tld":"com"},"ip":{"addr":"45.133.44.52","port":0,"asn":39572,"as":"DataWeb Global Group B.V.","country":"United States","country_code":"US"},"tags":null,"meta":null,"user":{"user_id":"akbkyowd9geqr98"}},"settings":{"access":"public","device_type":"desktop","expires_at":"2026-11-19T01:33:28Z","useragent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0","referer":"","cookies":null,"exit_node":"z0yflva4pidy47h"},"stats":{"alert_count":{"ids":0,"urlquery":0,"analyzer":1}},"detection":{"ids":null,"analyzer":[{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-10-15","alert":"Sinkholed","trigger":"0997e86c03.c6073077cc.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null},"summary":[{"fqdn":"0997e86c03.c6073077cc.com","ip":{"addr":"45.133.44.53","port":443,"asn":39572,"as":"DataWeb Global Group B.V.","country":"United States","country_code":"US"},"domain_registered":"2025-09-15","domain_rank":0,"first_seen":"2025-10-15T00:09:52.005713Z","last_seen":"2025-10-15T00:09:52.005713Z","alert_count":3,"request_count":3,"received_data":627,"sent_data":1279,"comment":"","tags":null,"fingerprints":[{"name":"Nginx:1.18.0","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}]}],"files":null,"artifacts":{"windows_shortcuts":null,"files":null,"telegram":null,"pdfs":null,"clipboard":null},"sensors":{"ids":[{"sensor_name":"suricata","description":"Suricata /w Emerging Threats Pro","alerts":null}],"analyzer":null,"urlquery":null},"javascript":{"script":null,"eval":null,"write":null},"http":[{"url":{"schema":"https","addr":"0997e86c03.c6073077cc.com/","fqdn":"0997e86c03.c6073077cc.com","domain":"c6073077cc.com","tld":"com"},"ip":{"addr":"45.133.44.53","port":443,"asn":39572,"as":"DataWeb Global Group B.V.","country":"United States","country_code":"US"},"is_navigation_request":true,"resource_type":"document","requested_by":"","date":"2025-10-15T01:33:07.709Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"0997e86c03.c6073077cc.com","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Sun, 12 Oct 2025 02:47:58 GMT","end":"Sat, 10 Jan 2026 02:47:57 GMT"},"fingerprint":{"sha1":"62:FA:97:9D:CC:65:15:65:FD:AF:71:B3:D0:87:DB:13:D9:B3:17:70","sha256":"28:60:5D:8D:3D:22:B9:F9:B1:9E:A4:31:69:8A:A2:B3:4C:D6:34:9E:5B:9C:8F:58:56:22:72:66:34:DE:54:D3"}}},"request":{"raw":"GET / HTTP/1.1\r\nHost: 0997e86c03.c6073077cc.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nUpgrade-Insecure-Requests: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: document\r\nSec-Fetch-Mode: navigate\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 404 Not Found\r\ndate: Wed, 15 Oct 2025 01:33:08 GMT\r\ncontent-type: text/plain; charset=utf-8\r\ncontent-length: 18\r\nserver: nginx/1.18.0\r\nx-cdn-host-id: DS8138\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"404","status_text":"Not Found","fingerprints":[{"name":"Nginx:1.18.0","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":18,"size_decoded":0,"mime_type":"text/plain; charset=utf-8","magic":"ASCII text, with no line terminators","md5":"7f5c24be74faf261f5aa35b567b838bf","sha1":"8e139e6621297a6608f68fede9b735424135247a","sha256":"8d13e9e92cc81a38caae9b13d3786422782132e1a746ac73cae921e5df6da3be","sha512":"9bc877d4c75d47f33ec8f95d47b7643f0beeeef0986bb2ee13da9ab5494e73e88f7b011cae11cfd8d99e129420d022539a18b194256079414088a9748a35d3e5","ssdeep":"","tlshash":"3e70008c8802020880200028228080280828020008c00220200aa00882800000820888","first_seen":"2023-05-15T10:38:28Z","last_seen":"2026-04-05T08:29:19.746472Z","times_seen":60596,"resource_available":true,"data":null}},"time_used":860,"timings":{"blocked":235,"dns":20,"connect":103,"send":0,"wait":390,"receive":0,"ssl":109},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-10-15","alert":"Sinkholed","trigger":"0997e86c03.c6073077cc.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"http","addr":"0997e86c03.c6073077cc.com/","fqdn":"0997e86c03.c6073077cc.com","domain":"c6073077cc.com","tld":"com"},"ip":{"addr":"45.133.44.53","port":80,"asn":39572,"as":"DataWeb Global Group B.V.","country":"United States","country_code":"US"},"is_navigation_request":true,"resource_type":"document","requested_by":"","date":"2025-10-15T01:33:08.455Z","timestamp":0,"http_version":"","security_state":"insecure","security_info":null,"request":{"raw":"GET / HTTP/1.1\r\nHost: 0997e86c03.c6073077cc.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate\r\nDNT: 1\r\nConnection: keep-alive\r\nUpgrade-Insecure-Requests: 1\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 404 Not Found\r\nDate: Wed, 15 Oct 2025 01:33:08 GMT\r\nContent-Type: text/plain; charset=utf-8\r\nContent-Length: 18\r\nConnection: keep-alive\r\nServer: nginx/1.18.0\r\nX-CDN-Host-ID: AH1747\r\n\r\n","headers":null,"cookies":null,"status_code":"404","status_text":"Not Found","fingerprints":[{"name":"Nginx:1.18.0","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":18,"size_decoded":0,"mime_type":"text/plain; charset=utf-8","magic":"ASCII text, with no line terminators","md5":"7f5c24be74faf261f5aa35b567b838bf","sha1":"8e139e6621297a6608f68fede9b735424135247a","sha256":"8d13e9e92cc81a38caae9b13d3786422782132e1a746ac73cae921e5df6da3be","sha512":"9bc877d4c75d47f33ec8f95d47b7643f0beeeef0986bb2ee13da9ab5494e73e88f7b011cae11cfd8d99e129420d022539a18b194256079414088a9748a35d3e5","ssdeep":"","tlshash":"3e70008c8802020880200028228080280828020008c00220200aa00882800000820888","first_seen":"2023-05-15T10:38:28Z","last_seen":"2026-04-05T08:29:19.746472Z","times_seen":60596,"resource_available":true,"data":null}},"time_used":91,"timings":{"blocked":19,"dns":1,"connect":21,"send":0,"wait":50,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-10-15","alert":"Sinkholed","trigger":"0997e86c03.c6073077cc.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"http","addr":"0997e86c03.c6073077cc.com/favicon.ico","fqdn":"0997e86c03.c6073077cc.com","domain":"c6073077cc.com","tld":"com"},"ip":{"addr":"45.133.44.53","port":80,"asn":39572,"as":"DataWeb Global Group B.V.","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"http://0997e86c03.c6073077cc.com/","date":"2025-10-15T01:33:08.624Z","timestamp":0,"http_version":"","security_state":"insecure","security_info":null,"request":{"raw":"GET /favicon.ico HTTP/1.1\r\nHost: 0997e86c03.c6073077cc.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: http://0997e86c03.c6073077cc.com/\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 404 Not Found\r\nDate: Wed, 15 Oct 2025 01:33:08 GMT\r\nContent-Type: text/plain; charset=utf-8\r\nContent-Length: 18\r\nConnection: keep-alive\r\nServer: nginx/1.18.0\r\nX-CDN-Host-ID: AH1747\r\n\r\n","headers":null,"cookies":null,"status_code":"404","status_text":"Not Found","fingerprints":[{"name":"Nginx:1.18.0","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":18,"size_decoded":0,"mime_type":"text/plain; charset=utf-8","magic":"ASCII text, with no line terminators","md5":"7f5c24be74faf261f5aa35b567b838bf","sha1":"8e139e6621297a6608f68fede9b735424135247a","sha256":"8d13e9e92cc81a38caae9b13d3786422782132e1a746ac73cae921e5df6da3be","sha512":"9bc877d4c75d47f33ec8f95d47b7643f0beeeef0986bb2ee13da9ab5494e73e88f7b011cae11cfd8d99e129420d022539a18b194256079414088a9748a35d3e5","ssdeep":"","tlshash":"3e70008c8802020880200028228080280828020008c00220200aa00882800000820888","first_seen":"2023-05-15T10:38:28Z","last_seen":"2026-04-05T08:29:19.746472Z","times_seen":60596,"resource_available":true,"data":null}},"time_used":49,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":49,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-10-15","alert":"Sinkholed","trigger":"0997e86c03.c6073077cc.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}}]}