{"report_id":"662e7855-7b2d-49b4-9454-12b44dc3cb26","version":6,"status":"done","tags":[],"date":"2025-08-17T01:50:28Z","url":{"schema":"https","addr":"curve-fi.us/","fqdn":"curve-fi.us","domain":"curve-fi.us","tld":"us"},"ip":{"addr":"87.120.126.210","port":0,"asn":401115,"as":"EKABI","country":"Bulgaria","country_code":"BG"},"final":{"url":{"schema":"https","addr":"curve-fi.us/","fqdn":"curve-fi.us","domain":"curve-fi.us","tld":"us"},"title":"Curve Finance"},"submit":{"url":{"schema":"https","addr":"curve-fi.us/","fqdn":"curve-fi.us","domain":"curve-fi.us","tld":"us"},"ip":{"addr":"87.120.126.210","port":0,"asn":401115,"as":"EKABI","country":"Bulgaria","country_code":"BG"},"tags":null,"meta":null,"user":{"user_id":"akbkyowd9geqr98"}},"settings":{"access":"public","device_type":"desktop","expires_at":"2026-09-21T01:50:28Z","useragent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0","referer":"","cookies":null,"exit_node":"z0yflva4pidy47h"},"stats":{"alert_count":{"ids":0,"urlquery":0,"analyzer":1}},"detection":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2025-08-17","alert":"Sinkholed","trigger":"curve-fi.us","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null},"summary":[{"fqdn":"curve-fi.us","ip":{"addr":"87.120.126.210","port":443,"asn":401115,"as":"EKABI","country":"Bulgaria","country_code":"BG"},"domain_registered":"unknown","domain_rank":0,"first_seen":"No data","last_seen":"No data","alert_count":3,"request_count":3,"received_data":615319,"sent_data":1338,"comment":"","tags":null,"fingerprints":[{"name":"Nginx:1.28.0","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}]}],"files":null,"artifacts":{"windows_shortcuts":null,"files":null,"telegram":null,"pdfs":null,"clipboard":null},"sensors":{"ids":[{"sensor_name":"suricata","description":"Suricata /w Emerging Threats Pro","alerts":null}],"analyzer":null,"urlquery":null},"javascript":{"script":[{"url":{"schema":"https","addr":"curve-fi.us/","fqdn":"curve-fi.us","domain":"curve-fi.us","tld":"us"},"ip":{"addr":"87.120.126.210","port":443,"asn":401115,"as":"EKABI","country":"Bulgaria","country_code":"BG"},"introduction_type":"scriptElement","is_inline":true,"md5":"77188552f958dfef8d8fffc2b09baa3c","sha1":"08c6a7f75272ffecb20a9431ad3172c514881872","sha256":"8bdef5e7e937d87772c5318e8daf600b82439425cecf0b7ed2b7d432ef33c614","sha512":"6436c2b9ca4faeb2b491e8c4da6499de2592750254a94e0e5e7e1a8d087d5397f4f463031f81c513879abfcf06fc29efa37830965e4c19df24b9e2d4a33531f9","ssdeep":"","tlshash":"a4b0122232e641310ca74e720074cbcd3ad5649318c84525363c980883a3ad034a63e9","size":104,"data":"","first_seen":"2025-06-21T11:51:51.201484Z","last_seen":"2025-10-25T01:11:25.038241Z","times_seen":15,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"curve-fi.us/","fqdn":"curve-fi.us","domain":"curve-fi.us","tld":"us"},"ip":{"addr":"87.120.126.210","port":443,"asn":401115,"as":"EKABI","country":"Bulgaria","country_code":"BG"},"introduction_type":"scriptElement","is_inline":true,"md5":"41bf0823a8a17e3428b37fcafd205bde","sha1":"4e364f2902f003cc9976b45f60fb6578f998d91f","sha256":"f2021ff894de5a94d0cac1ebfd913949bb2583890191f0b7abc85f5babdbb0e7","sha512":"c754a487df643c20e71f8b9840f9afe0920f2d8efe20f7ca498a01f123c1a479c6ba5986681dfb0fa7c276edd95fbdee90e2496bb7ecd9355d0c7e97d64baba5","ssdeep":"","tlshash":"29017b6b757604b009abb26b37bf97453532000b3d42ed0abebc85481f10e1636f2be4","size":750,"data":"","first_seen":"2025-06-21T11:51:51.202586Z","last_seen":"2025-08-19T04:04:20.519158Z","times_seen":5,"alerts":{"ids":null,"analyzer":null,"urlquery":null}}],"eval":null,"write":null,"console":null},"http":[{"url":{"schema":"https","addr":"curve-fi.us/favicon.png","fqdn":"curve-fi.us","domain":"curve-fi.us","tld":"us"},"ip":{"addr":"87.120.126.210","port":443,"asn":401115,"as":"EKABI","country":"Bulgaria","country_code":"BG"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://curve-fi.us/","date":"2025-08-17T01:50:07.537Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"curve-fi.us","organization":""},"issuer":{"commonName":"R11","organization":"Let's Encrypt"},"validity":{"start":"Fri, 25 Jul 2025 10:07:08 GMT","end":"Thu, 23 Oct 2025 10:07:07 GMT"},"fingerprint":{"sha1":"CF:95:C8:4B:BF:DD:88:69:D2:07:2B:01:8F:E1:82:3B:48:6A:3A:26","sha256":"0E:69:A0:D7:FC:1F:F5:90:35:B0:18:41:E8:0E:78:CA:17:17:01:61:E8:F5:42:3E:1E:45:7D:3D:D5:F8:DF:9E"}}},"request":{"raw":"GET /favicon.png HTTP/1.1\r\nHost: curve-fi.us\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://curve-fi.us/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nServer: nginx/1.28.0\r\nDate: Sun, 17 Aug 2025 01:50:07 GMT\r\nContent-Type: image/png\r\nContent-Length: 299756\r\nLast-Modified: Fri, 25 Jul 2025 10:55:26 GMT\r\nConnection: keep-alive\r\nETag: \"6883629e-492ec\"\r\nAccept-Ranges: bytes\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx:1.28.0","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":299756,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 1054 x 1060, 8-bit/color RGBA, non-interlaced","md5":"8acf41ff052eb4333b248c6238f4acff","sha1":"1b85094f51ffb63da3e19a432f37db82600da049","sha256":"9ccde45dca3deb307951d1f5641807f1098de0996b156d2c6531811c7020d0c7","sha512":"23d7b3e86f6a3d5e50028a634f394c0348a6e3ccd50d088b2a1cb50d4ad492eb3fbfc3e89f4d37dadc69a4cca61159162478b16efa1338a1f3a2baec84351b24","ssdeep":"6144:XPFwrgXlpfvcNUkFQHn0QAOH/Q73WAlPWofIYgdzLYDb8dLK5:X9lVxeNyH0QLH/Q7GUPWoAvzEDiLK5","tlshash":"cf5422c54876f8a8ce3a027f85e90ab340b3d6e5abacb193757c6b7c1f18f501830856","first_seen":"2025-08-17T01:50:32.125281Z","last_seen":"2025-08-17T01:50:32.125281Z","times_seen":1,"resource_available":false,"data":null}},"time_used":52,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":28,"receive":24,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2025-08-17","alert":"Sinkholed","trigger":"curve-fi.us","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"curve-fi.us/","fqdn":"curve-fi.us","domain":"curve-fi.us","tld":"us"},"ip":{"addr":"87.120.126.210","port":443,"asn":401115,"as":"EKABI","country":"Bulgaria","country_code":"BG"},"is_navigation_request":true,"resource_type":"document","requested_by":"","date":"2025-08-17T01:50:07.077Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"curve-fi.us","organization":""},"issuer":{"commonName":"R11","organization":"Let's Encrypt"},"validity":{"start":"Fri, 25 Jul 2025 10:07:08 GMT","end":"Thu, 23 Oct 2025 10:07:07 GMT"},"fingerprint":{"sha1":"CF:95:C8:4B:BF:DD:88:69:D2:07:2B:01:8F:E1:82:3B:48:6A:3A:26","sha256":"0E:69:A0:D7:FC:1F:F5:90:35:B0:18:41:E8:0E:78:CA:17:17:01:61:E8:F5:42:3E:1E:45:7D:3D:D5:F8:DF:9E"}}},"request":{"raw":"GET / HTTP/1.1\r\nHost: curve-fi.us\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nUpgrade-Insecure-Requests: 1\r\nSec-Fetch-Dest: document\r\nSec-Fetch-Mode: navigate\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nServer: nginx/1.28.0\r\nDate: Sun, 17 Aug 2025 01:50:07 GMT\r\nContent-Type: text/html; charset=UTF-8\r\nContent-Length: 4951\r\nConnection: keep-alive\r\nLast-Modified: Fri, 25 Jul 2025 10:55:26 GMT\r\nETag: \"3aa1-63abec7876380-gzip\"\r\nAccept-Ranges: bytes\r\nVary: Accept-Encoding\r\nContent-Encoding: gzip\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx:1.28.0","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":15009,"size_decoded":0,"mime_type":"text/html; charset=UTF-8","magic":"HTML document, ASCII text, with very long lines (2337), with CRLF, LF line terminators","md5":"106707e2d8de11a2efdaeba615461324","sha1":"67897b1909db12f9314e5b1c7665885f774059e5","sha256":"1358432594dffeee32bca082641f84dc71de84fbf1167e4ee342abb62678d7fe","sha512":"01be50464acc55bb78638bfdbf0b25fb20e7a3c26d8df88e3e2bef21b46cb0cf0f0ea77ba01a53e2b136292043fd8f97fcecc9d6d0586688efb65f41e7502b37","ssdeep":"192:XlFs2zQYOOcPrG9+We0Jk7c6uH+xqEypsx6W2qKiItp:cgJkEIyO6W21vL","tlshash":"5762c6369a8004151577c2657bb26b8efb958013c7028264bafd679f4ff2e44cdb3768","first_seen":"2025-08-17T01:50:32.128299Z","last_seen":"2025-08-17T01:50:32.128299Z","times_seen":1,"resource_available":false,"data":null}},"time_used":255,"timings":{"blocked":108,"dns":49,"connect":28,"send":0,"wait":32,"receive":0,"ssl":35},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2025-08-17","alert":"Sinkholed","trigger":"curve-fi.us","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"curve-fi.us/favicon.png","fqdn":"curve-fi.us","domain":"curve-fi.us","tld":"us"},"ip":{"addr":"87.120.126.210","port":443,"asn":401115,"as":"EKABI","country":"Bulgaria","country_code":"BG"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://curve-fi.us/","date":"2025-08-17T01:50:07.384Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"curve-fi.us","organization":""},"issuer":{"commonName":"R11","organization":"Let's Encrypt"},"validity":{"start":"Fri, 25 Jul 2025 10:07:08 GMT","end":"Thu, 23 Oct 2025 10:07:07 GMT"},"fingerprint":{"sha1":"CF:95:C8:4B:BF:DD:88:69:D2:07:2B:01:8F:E1:82:3B:48:6A:3A:26","sha256":"0E:69:A0:D7:FC:1F:F5:90:35:B0:18:41:E8:0E:78:CA:17:17:01:61:E8:F5:42:3E:1E:45:7D:3D:D5:F8:DF:9E"}}},"request":{"raw":"GET /favicon.png HTTP/1.1\r\nHost: curve-fi.us\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://curve-fi.us/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nServer: nginx/1.28.0\r\nDate: Sun, 17 Aug 2025 01:50:07 GMT\r\nContent-Type: image/png\r\nContent-Length: 299756\r\nLast-Modified: Fri, 25 Jul 2025 10:55:26 GMT\r\nConnection: keep-alive\r\nETag: \"6883629e-492ec\"\r\nAccept-Ranges: bytes\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx:1.28.0","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":299756,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 1054 x 1060, 8-bit/color RGBA, non-interlaced","md5":"8acf41ff052eb4333b248c6238f4acff","sha1":"1b85094f51ffb63da3e19a432f37db82600da049","sha256":"9ccde45dca3deb307951d1f5641807f1098de0996b156d2c6531811c7020d0c7","sha512":"23d7b3e86f6a3d5e50028a634f394c0348a6e3ccd50d088b2a1cb50d4ad492eb3fbfc3e89f4d37dadc69a4cca61159162478b16efa1338a1f3a2baec84351b24","ssdeep":"6144:XPFwrgXlpfvcNUkFQHn0QAOH/Q73WAlPWofIYgdzLYDb8dLK5:X9lVxeNyH0QLH/Q7GUPWoAvzEDiLK5","tlshash":"cf5422c54876f8a8ce3a027f85e90ab340b3d6e5abacb193757c6b7c1f18f501830856","first_seen":"2025-08-17T01:50:32.125281Z","last_seen":"2025-08-17T01:50:32.125281Z","times_seen":1,"resource_available":false,"data":null}},"time_used":142,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":38,"receive":104,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2025-08-17","alert":"Sinkholed","trigger":"curve-fi.us","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}}]}