{"report_id":"601c818c-f5b5-46ca-bdac-453ecd4596d5","version":6,"status":"done","tags":[],"date":"2026-05-03T13:49:34Z","url":{"schema":"https","addr":"welcome-trezo.vercel.app/","fqdn":"welcome-trezo.vercel.app","domain":"welcome-trezo.vercel.app","tld":"vercel.app"},"ip":{"addr":"64.29.17.131","port":0,"asn":16509,"as":"AMAZON-02","country":"United States","country_code":"US"},"final":{"url":{"schema":"https","addr":"welcome-trezo.vercel.app/","fqdn":"welcome-trezo.vercel.app","domain":"welcome-trezo.vercel.app","tld":"vercel.app"},"title":"Trezor.io/Start® - Start Up Your Device® | Trezor®","dom":{"size":5769,"mime_type":"text/html; charset=utf-8","magic":"HTML document, Unicode text, UTF-8 text, with very long lines (440)","md5":"77c16bb13a2a6cdca7b55082ac1c22e7","sha1":"18e3f890f48be38befc84a02e8bcaa8b40c77932","sha256":"c7f02ef02f2df9de6a62b2442f9193bd58b1304883966186ffcd774ef738d4c3","sha512":"518512b712ec9a7092f1e52db56c6bdb24512af976c931a6fda3290cb139ab2fda2e36d1ad3ddd7b1aca7a365a216d5a6a70313ed641a3fc4e8faf8c7ba84c14","ssdeep":"96:nhF6GtL69FPEJXyMwkySwl6v/p9wwt3o+mdNA6pud+XBHB3LqlGAqkaJauAV0dxc:hw+L6zcJXyyy7aBt3nw3XFuGA1VVSq8c","tlshash":"0cc1941ff61e372652920376b4ea76b4ff2fc0a8925517996a2c811c63e07d181733c6","dom_hash":"domhash027d72df08692d488674a0878fdba96d","first_seen":"2026-02-17T14:36:05.452046Z","last_seen":"2026-05-03T13:49:36.010026Z","times_seen":9,"resource_available":false,"data":null}},"submit":{"url":{"schema":"https","addr":"welcome-trezo.vercel.app/","fqdn":"welcome-trezo.vercel.app","domain":"welcome-trezo.vercel.app","tld":"vercel.app"},"ip":{"addr":"64.29.17.131","port":0,"asn":16509,"as":"AMAZON-02","country":"United States","country_code":"US"},"tags":["openphish"],"meta":null},"settings":{"access":"public","device_type":"desktop","expires_at":"2027-06-07T13:49:34Z","useragent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0","referer":"","cookies":null,"exit_node":"z0yflva4pidy47h"},"stats":{"alert_count":{"ids":0,"urlquery":0,"analyzer":2}},"detection":{"ids":null,"analyzer":[{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-05-03","alert":"Sinkholed","trigger":"welcome-trezo.vercel.app","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-05-03","alert":"Sinkholed","trigger":"welcome-trezo.vercel.app","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null},"summary":[{"fqdn":"welcome-trezo.vercel.app","ip":{"addr":"216.198.79.67","port":443,"asn":16509,"as":"AMAZON-02","country":"United States","country_code":"US"},"domain_registered":"2020-01-28","domain_rank":0,"first_seen":"2026-03-09T22:17:16.276228Z","last_seen":"2026-04-17T00:56:31.311113Z","alert_count":4,"request_count":2,"received_data":6766,"sent_data":948,"comment":"","tags":null,"fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Vercel","description":"Vercel is a cloud platform for static frontends and serverless functions.","website":"https://vercel.com","common_platform_enumeration":"","icon":"vercel.svg","categories":["PaaS"]}]},{"fqdn":"i.ibb.co","ip":{"addr":"45.43.142.5","port":443,"asn":215751,"as":"Mikhail Fedorov","country":"Israel","country_code":"IL"},"domain_registered":"2010-07-20","domain_rank":21643,"first_seen":"2018-11-25T10:13:48Z","last_seen":"2026-04-30T06:40:48.502219Z","alert_count":0,"request_count":1,"received_data":1278724,"sent_data":445,"comment":"","tags":null,"fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"OpenResty","description":"OpenResty is a web platform based on nginx which can run Lua scripts using its LuaJIT engine.","website":"https://openresty.org","common_platform_enumeration":"","icon":"OpenResty.svg","categories":["Web servers"]}]}],"files":null,"artifacts":{"windows_shortcuts":null,"files":null,"telegram":null,"pdfs":null,"clipboard":null},"sensors":{"ids":null,"analyzer":null,"urlquery":null},"javascript":{"script":null,"eval":null,"write":null,"console":null},"http":[{"url":{"schema":"https","addr":"welcome-trezo.vercel.app/","fqdn":"welcome-trezo.vercel.app","domain":"welcome-trezo.vercel.app","tld":"vercel.app"},"ip":{"addr":"216.198.79.67","port":443,"asn":16509,"as":"AMAZON-02","country":"United States","country_code":"US"},"is_navigation_request":true,"resource_type":"document","requested_by":"","date":"2026-05-03T13:49:09.901Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.vercel.app","organization":""},"issuer":{"commonName":"WR1","organization":"Google Trust Services"},"validity":{"start":"Tue, 28 Apr 2026 02:04:43 GMT","end":"Mon, 27 Jul 2026 02:04:42 GMT"},"fingerprint":{"sha1":"26:33:D5:7C:A2:5E:E5:03:8C:D8:EA:45:43:9F:3B:5B:E3:1E:B6:A2","sha256":"F8:32:DF:B2:65:37:61:E8:B0:00:1D:BA:F8:4E:AB:20:66:7C:9B:FB:05:20:70:05:47:D3:B3:BF:54:81:43:AA"}}},"request":{"raw":"GET / HTTP/1.1\r\nHost: welcome-trezo.vercel.app\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nUpgrade-Insecure-Requests: 1\r\nSec-Fetch-Dest: document\r\nSec-Fetch-Mode: navigate\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\naccess-control-allow-origin: *\r\nage: 683930\r\ncache-control: public, max-age=0, must-revalidate\r\ncontent-disposition: inline\r\ncontent-encoding: br\r\ncontent-type: text/html; charset=utf-8\r\ndate: Sun, 03 May 2026 13:49:09 GMT\r\netag: W/\"8e5b9d7ae8506db23b673f4e95b1c8da\"\r\nlast-modified: Sat, 25 Apr 2026 15:50:19 GMT\r\nserver: Vercel\r\nstrict-transport-security: max-age=63072000; includeSubDomains; preload\r\nx-vercel-cache: HIT\r\nx-vercel-id: arn1::9j2z5-1777816149941-08ff6af1b45e\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Vercel","description":"Vercel is a cloud platform for static frontends and serverless functions.","website":"https://vercel.com","common_platform_enumeration":"","icon":"vercel.svg","categories":["PaaS"]}],"data":{"size":5811,"size_decoded":0,"mime_type":"text/html; charset=utf-8","magic":"HTML document, Unicode text, UTF-8 text, with very long lines (440)","md5":"8e5b9d7ae8506db23b673f4e95b1c8da","sha1":"2a9f9fcaf8cc961d315622e198ada6d98ceee674","sha256":"89d1f0fc865393bb389eb6f80102005fa09f290d132e99793619516d45f22e9b","sha512":"d6d0bb6c3f586557bf196b3050697e89694326ee9898c301187f15f356aedce3efdfd1f269ac9f5faf5a92a3efae00dca14ef9db1e235a43bd5b64c022f3bb7e","ssdeep":"96:3H61tBYEJMyMwkySwl6v/p9wwt3o+mdNA6pud+XBHB3LqlGAqkaJauAV0dxJ+UGB:3a7xJMyyy7aBt3nw3XFuGA1VVSq8yxOO","tlshash":"22c1941ff64e372642920376b5ea76b4ff2fc0a99255179c6a2c811c63e07d181733c6","first_seen":"2026-02-17T14:36:05.458689Z","last_seen":"2026-05-03T13:49:36.011612Z","times_seen":9,"resource_available":true,"data":null}},"time_used":81,"timings":{"blocked":35,"dns":6,"connect":1,"send":0,"wait":10,"receive":0,"ssl":25},"alerts":{"ids":null,"analyzer":[{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-05-03","alert":"Sinkholed","trigger":"welcome-trezo.vercel.app","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-05-03","alert":"Sinkholed","trigger":"welcome-trezo.vercel.app","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"i.ibb.co/w775vxJ/banner.jpg","fqdn":"i.ibb.co","domain":"ibb.co","tld":"co"},"ip":{"addr":"45.43.142.5","port":443,"asn":215751,"as":"Mikhail Fedorov","country":"Israel","country_code":"IL"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://welcome-trezo.vercel.app/","date":"2026-05-03T13:49:10.134Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"ibb.co","organization":""},"issuer":{"commonName":"E8","organization":"Let's Encrypt"},"validity":{"start":"Wed, 15 Apr 2026 08:46:45 GMT","end":"Tue, 14 Jul 2026 08:46:44 GMT"},"fingerprint":{"sha1":"AB:FE:0C:54:E2:24:E0:D9:B7:F9:DC:18:02:C9:05:26:34:63:E8:65","sha256":"F0:A7:95:74:CF:C2:BC:7A:69:1D:6A:03:47:B4:D3:2A:76:24:DE:28:F8:31:95:41:B2:F8:86:C9:B3:F8:E3:01"}}},"request":{"raw":"GET /w775vxJ/banner.jpg HTTP/1.1\r\nHost: i.ibb.co\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://welcome-trezo.vercel.app/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: openresty\r\ndate: Sun, 03 May 2026 13:49:10 GMT\r\ncontent-type: image/jpeg\r\ncontent-length: 1278354\r\nlast-modified: Mon, 12 Aug 2024 05:14:29 GMT\r\nexpires: Thu, 31 Dec 2037 23:55:55 GMT\r\ncache-control: max-age=315360000, public\r\naccess-control-allow-origin: *\r\naccess-control-allow-methods: GET, OPTIONS\r\naccept-ranges: bytes\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"OpenResty","description":"OpenResty is a web platform based on nginx which can run Lua scripts using its LuaJIT engine.","website":"https://openresty.org","common_platform_enumeration":"","icon":"OpenResty.svg","categories":["Web servers"]}],"data":{"size":1278354,"size_decoded":0,"mime_type":"image/jpeg","magic":"JPEG image data, Exif standard: [TIFF image data, little-endian, direntries=0], baseline, precision 8, 1920x4223, components 3","md5":"ea2338ffa05881db939dbafc82ca5bd0","sha1":"401b2a1186749931c93970d4fb04dcb4e6b1d751","sha256":"fed14df1f014f23095a6f546ab0855bb2694ebb2597057242d6a54715c90760d","sha512":"f5299ef58933c64fd371b98dd67d9b2ba213f8ae5478ddb20094882e86d188591c57e58b813be43d80015f5617880ca5815c872fe4ed824fd60c4f0bc8145136","ssdeep":"24576:VWJ4Jrqqqqqqq/MhSqqqqqqqul7PlYsq+q7Rl/d6y2yIMFgV1W:wQqqqqqqqVqqqqqqqO7PKsq5H/tQMQW","tlshash":"83252295c7476c41d38f6eb9d2271a7afef1a6e392010a03598e8b3f1a3df528541f81","first_seen":"2026-02-14T11:13:29.745703Z","last_seen":"2026-05-30T11:01:54.066391Z","times_seen":21,"resource_available":false,"data":null}},"time_used":558,"timings":{"blocked":62,"dns":1,"connect":26,"send":0,"wait":26,"receive":407,"ssl":34},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"welcome-trezo.vercel.app/favicon.ico","fqdn":"welcome-trezo.vercel.app","domain":"welcome-trezo.vercel.app","tld":"vercel.app"},"ip":{"addr":"216.198.79.67","port":443,"asn":16509,"as":"AMAZON-02","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://welcome-trezo.vercel.app/","date":"2026-05-03T13:49:10.258Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.vercel.app","organization":""},"issuer":{"commonName":"WR1","organization":"Google Trust Services"},"validity":{"start":"Tue, 28 Apr 2026 02:04:43 GMT","end":"Mon, 27 Jul 2026 02:04:42 GMT"},"fingerprint":{"sha1":"26:33:D5:7C:A2:5E:E5:03:8C:D8:EA:45:43:9F:3B:5B:E3:1E:B6:A2","sha256":"F8:32:DF:B2:65:37:61:E8:B0:00:1D:BA:F8:4E:AB:20:66:7C:9B:FB:05:20:70:05:47:D3:B3:BF:54:81:43:AA"}}},"request":{"raw":"GET /favicon.ico HTTP/1.1\r\nHost: welcome-trezo.vercel.app\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://welcome-trezo.vercel.app/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 404 Not Found\r\ncache-control: public, max-age=0, must-revalidate\r\ncontent-type: text/plain; charset=utf-8\r\ndate: Sun, 03 May 2026 13:49:10 GMT\r\nserver: Vercel\r\nstrict-transport-security: max-age=63072000; includeSubDomains; preload\r\nx-vercel-error: NOT_FOUND\r\nx-vercel-id: arn1::zpgr4-1777816150262-8f3b4ecc910e\r\ncontent-length: 79\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"404","status_text":"Not Found","fingerprints":[{"name":"Vercel","description":"Vercel is a cloud platform for static frontends and serverless functions.","website":"https://vercel.com","common_platform_enumeration":"","icon":"vercel.svg","categories":["PaaS"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":79,"size_decoded":0,"mime_type":"text/plain; charset=utf-8","magic":"ASCII text","md5":"1b3b1c39e858bc41a6d22778fae7c8ba","sha1":"e3d5f5cc14b639a57f6ea57c171025408ae4ea10","sha256":"9ea27f0532e64c033e63cd00b23e66aae9432b7cfa26ff7e071cb0ab15eb3308","sha512":"dcf18ae3d5b9a05a901c77cf5d85fb7ae5613cecd9ceb4e4f074f9b220acfdff0746766a595c7a9496fa228f3efdd4550ca62f62af62f1eaab2c48c4e500d834","ssdeep":"","tlshash":"38a0120e04440a4832c0589030521138001441275f54b140908c7240108c5ee7341050","first_seen":"2026-05-03T13:49:36.013768Z","last_seen":"2026-05-03T13:49:36.013768Z","times_seen":1,"resource_available":false,"data":null}},"time_used":15,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":15,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-05-03","alert":"Sinkholed","trigger":"welcome-trezo.vercel.app","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-05-03","alert":"Sinkholed","trigger":"welcome-trezo.vercel.app","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}}]}