{"report_id":"6cee6f46-a0ad-47ea-9c3b-ba0be81dd1d3","version":0,"status":"done","tags":[],"date":"2026-07-15T01:37:58Z","url":{"schema":"https","addr":"simpleswapp.at/","fqdn":"simpleswapp.at","domain":"simpleswapp.at","tld":"at"},"ip":{"addr":"130.12.180.128","port":0,"asn":0,"as":"","country":"","country_code":"zz"},"final":{"url":{"schema":"https","addr":"simpleswapp.at/","fqdn":"simpleswapp.at","domain":"simpleswapp.at","tld":"at"},"title":"SimpleSwap: New Loyalty Perks, Crypto Swap, Mobile App Launch","dom":{"size":24649,"mime_type":"text/html; charset=utf-8","magic":"HTML document, Unicode text, UTF-8 text","md5":"f9d10588be72a82d1686bd01f65beaa7","sha1":"6035651c20a4834b0508a3223984d105b806787e","sha256":"95065845bb941702b65ec9f62b2f571cc59020d21e3ef8c5a50944e5ded4c63a","sha512":"5180a21f3971797f93fc4c70138413bb3198f682b115fe2c0abf77d661839ffc008153083c916ca1953ecd115a2c2cfb8d4bf97434f7c12b203bd6de0f8d3042","ssdeep":"192:BvlCEs1Ta6VrN5HaEsQw1wbwzvUtwIw0HYwaw1wlwacsB6fH2X22INjlaRXt6sdT:BvcEsxUtpXaN6KRjITG/WQub6AjzLNb","tlshash":"37b21a17a6f311732a8a42d43bbb1be76f989017c247c664736c436c8f84c888677b9d","dom_hash":"domhashd8197ebc1abfadb156a85241b0588685","first_seen":"","last_seen":"","times_seen":0,"resource_available":false,"data":null}},"submit":{"url":{"schema":"https","addr":"simpleswapp.at/","fqdn":"simpleswapp.at","domain":"simpleswapp.at","tld":"at"},"ip":{"addr":"130.12.180.128","port":0,"asn":0,"as":"","country":"","country_code":"zz"},"tags":null,"meta":null},"settings":{"access":"public","device_type":"desktop","expires_at":"2027-08-19T01:37:58Z","useragent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0","referer":"","cookies":null,"exit_node":"qguvgzjxzsgb3vs"},"stats":{"alert_count":{"ids":0,"urlquery":0,"analyzer":2}},"detection":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-07-15","alert":"Sinkholed","trigger":"simpleswapp.at","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-07-15","alert":"Sinkholed","trigger":"simpleswapp.at","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null},"summary":[{"fqdn":"simpleswapp.at","ip":{"addr":"130.12.180.128","port":443,"asn":0,"as":"","country":"","country_code":"zz"},"domain_registered":"unknown","domain_rank":0,"first_seen":"2025-12-21T08:52:35.533846Z","last_seen":"2026-07-15T01:17:25.5462Z","alert_count":6,"request_count":3,"received_data":39223,"sent_data":1800,"comment":"","tags":null,"fingerprints":[{"name":"OpenResty","description":"OpenResty is a web platform based on nginx which can run Lua scripts using its LuaJIT engine.","website":"https://openresty.org","common_platform_enumeration":"","icon":"OpenResty.svg","categories":["Web servers"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"PHP:8.1.33","description":"PHP is a general-purpose scripting language used for web development.","website":"https://php.net","common_platform_enumeration":"cpe:2.3:a:php:php:*:*:*:*:*:*:*:*","icon":"PHP.svg","categories":["Programming languages"]}]}],"files":null,"artifacts":{"windows_shortcuts":null,"files":null,"telegram":null,"pdfs":null,"clipboard":null},"sensors":{"ids":null,"analyzer":null,"urlquery":null},"javascript":{"script":null,"eval":null,"write":null,"console":null},"http":[{"url":{"schema":"https","addr":"simpleswapp.at/","fqdn":"simpleswapp.at","domain":"simpleswapp.at","tld":"at"},"ip":{"addr":"130.12.180.128","port":443,"asn":0,"as":"","country":"","country_code":"zz"},"is_navigation_request":true,"resource_type":"document","requested_by":"","date":"2026-07-15T01:37:31.617Z","timestamp":1784079451617,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P384-SHA384","protocol":"TLSv1.3","cert":{"subject":{"commonName":"simpleswapp.at","organization":""},"issuer":{"commonName":"YE2","organization":"Let's Encrypt"},"validity":{"start":"Fri, 26 Jun 2026 06:18:46 GMT","end":"Thu, 24 Sep 2026 06:18:45 GMT"},"fingerprint":{"sha1":"79:85:DE:BA:6A:71:B7:28:4B:03:63:AC:1E:F4:41:E3:41:73:06:CC","sha256":"B1:5F:E9:C3:A7:CC:F8:51:08:76:74:89:54:EC:BE:09:DC:D3:C8:53:18:94:C3:DF:E7:AF:96:8F:97:1F:D9:21"}}},"request":{"raw":"GET / HTTP/1.1\r\nHost: simpleswapp.at\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nUpgrade-Insecure-Requests: 1\r\nSec-Fetch-Dest: document\r\nSec-Fetch-Mode: navigate\r\nSec-Fetch-Site: none\r\nPriority: u=0, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nserver: openresty\r\ndate: Wed, 15 Jul 2026 01:37:31 GMT\r\ncontent-type: text/html; charset=UTF-8\r\nvary: Accept-Encoding\r\nx-powered-by: PHP/8.1.33\r\nexpires: Thu, 19 Nov 1981 08:52:00 GMT\r\ncache-control: no-store, no-cache, must-revalidate\r\npragma: no-cache\r\nset-cookie: PHPSESSID=8fa310eab2dabf42602b07af7cf7e7fe; path=/\n_token=uarjd338spvs0.1784165851.2.177bfd90de32d9ce950473c83987122a; expires=Tue, 17-Nov-2026 01:37:31 GMT; Max-Age=10800000; path=/; domain=.simpleswapp.at\n_subid=18uumd0.36.f9h4i; expires=Tue, 17-Nov-2026 01:37:31 GMT; Max-Age=10800000; path=/; domain=.simpleswapp.at\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"OpenResty","description":"OpenResty is a web platform based on nginx which can run Lua scripts using its LuaJIT engine.","website":"https://openresty.org","common_platform_enumeration":"","icon":"OpenResty.svg","categories":["Web servers"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"PHP:8.1.33","description":"PHP is a general-purpose scripting language used for web development.","website":"https://php.net","common_platform_enumeration":"cpe:2.3:a:php:php:*:*:*:*:*:*:*:*","icon":"PHP.svg","categories":["Programming languages"]}],"data":{"size":24680,"size_decoded":8727,"mime_type":"text/html; charset=UTF-8","magic":"HTML document, Unicode text, UTF-8 text","md5":"b13f24a1fdf368891929d927ee5386bc","sha1":"23bdae880249c86d431fb6ceb2def643d68c0a2a","sha256":"8a5984edc40b40212655b47893b01a40aee32ef6d207ef03b6df252da9ccbb71","sha512":"8f6777edf91d1d1f4c8f873d853c6bc9eac3b356b0979d3a19522113712a4a5d0ff2efe69c5848e28dde62a3d8eaba4b0fefedec2558ebf012e869eb944e0ec7","ssdeep":"192:vOs1Ta/soN5HaLsQw1wbwzvUtwIw0HYwaw1wlwacsB6fH2X22INjlaRXt6sd7FMs:msYxtpXaN6KRjITG/WQub6AjzLNf","tlshash":"2bb22a07a6f311732a8a42e43bbb1bd76f989057c247c664736c436c8f84c888677b9d","first_seen":"2026-07-15T01:17:26.439226Z","last_seen":"2026-07-15T01:37:59.170615Z","times_seen":2,"resource_available":true,"data":null}},"time_used":349,"timings":{"blocked":-1,"dns":225,"connect":19,"send":0,"wait":72,"receive":0,"ssl":32},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-07-15","alert":"Sinkholed","trigger":"simpleswapp.at","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-07-15","alert":"Sinkholed","trigger":"simpleswapp.at","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"simpleswapp.at/apple_images_180x180.png","fqdn":"simpleswapp.at","domain":"simpleswapp.at","tld":"at"},"ip":{"addr":"130.12.180.128","port":443,"asn":0,"as":"","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://simpleswapp.at/","date":"2026-07-15T01:37:32.250Z","timestamp":1784079452250,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P384-SHA384","protocol":"TLSv1.3","cert":{"subject":{"commonName":"simpleswapp.at","organization":""},"issuer":{"commonName":"YE2","organization":"Let's Encrypt"},"validity":{"start":"Fri, 26 Jun 2026 06:18:46 GMT","end":"Thu, 24 Sep 2026 06:18:45 GMT"},"fingerprint":{"sha1":"79:85:DE:BA:6A:71:B7:28:4B:03:63:AC:1E:F4:41:E3:41:73:06:CC","sha256":"B1:5F:E9:C3:A7:CC:F8:51:08:76:74:89:54:EC:BE:09:DC:D3:C8:53:18:94:C3:DF:E7:AF:96:8F:97:1F:D9:21"}}},"request":{"raw":"GET /apple_images_180x180.png HTTP/1.1\r\nHost: simpleswapp.at\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://simpleswapp.at/\r\nCookie: PHPSESSID=8fa310eab2dabf42602b07af7cf7e7fe; _token=uarjd338spvs0.1784165851.2.177bfd90de32d9ce950473c83987122a; _subid=18uumd0.36.f9h4i\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=6\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nserver: openresty\r\ndate: Wed, 15 Jul 2026 01:37:32 GMT\r\ncontent-type: image/png\r\ncontent-length: 12178\r\nlast-modified: Fri, 19 Jun 2026 11:53:59 GMT\r\netag: \"6a352dd7-2f92\"\r\nx-cache-status: HIT\r\naccept-ranges: bytes\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"OpenResty","description":"OpenResty is a web platform based on nginx which can run Lua scripts using its LuaJIT engine.","website":"https://openresty.org","common_platform_enumeration":"","icon":"OpenResty.svg","categories":["Web servers"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":12178,"size_decoded":12429,"mime_type":"image/png","magic":"PNG image data, 180 x 180, 8-bit/color RGB, non-interlaced","md5":"11a6cefec7c87864a14a81b40a2990cf","sha1":"67fd95ea172adb88bb3970380bd30c9f634448d7","sha256":"f4268aff775cbb3e460711d797717a29f0fe24f371de9ac41270da1b872b7f69","sha512":"1c0213b9dd8cc885fe7ae3d14d4ecabd7a374f80bb44b420ef85a3bfb1f3c1b1b95245f4e940f82afd1b31f873318ec17b8357390bc45667936b1aa984e2b8a4","ssdeep":"192:nbWAdT1qAdSyFcK9DkIguTS3pur+7Ntpz+kw4yED1mfVzuh9EAfxWxsWQ93dh/PD:bW4bdSyFF/gDIK7DpCkByED1mVi9E6Ww","tlshash":"8c42d0e6237e521dfc7e3712cdc424ccaaa1e1df6614e254e0d1d90f80699f09faa643","first_seen":"2025-08-03T07:14:02.765744Z","last_seen":"2026-07-15T01:37:59.171685Z","times_seen":64,"resource_available":false,"data":null}},"time_used":19,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":19,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-07-15","alert":"Sinkholed","trigger":"simpleswapp.at","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-07-15","alert":"Sinkholed","trigger":"simpleswapp.at","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"simpleswapp.at/favicon-16x16.png","fqdn":"simpleswapp.at","domain":"simpleswapp.at","tld":"at"},"ip":{"addr":"130.12.180.128","port":443,"asn":0,"as":"","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://simpleswapp.at/","date":"2026-07-15T01:37:32.252Z","timestamp":1784079452252,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P384-SHA384","protocol":"TLSv1.3","cert":{"subject":{"commonName":"simpleswapp.at","organization":""},"issuer":{"commonName":"YE2","organization":"Let's Encrypt"},"validity":{"start":"Fri, 26 Jun 2026 06:18:46 GMT","end":"Thu, 24 Sep 2026 06:18:45 GMT"},"fingerprint":{"sha1":"79:85:DE:BA:6A:71:B7:28:4B:03:63:AC:1E:F4:41:E3:41:73:06:CC","sha256":"B1:5F:E9:C3:A7:CC:F8:51:08:76:74:89:54:EC:BE:09:DC:D3:C8:53:18:94:C3:DF:E7:AF:96:8F:97:1F:D9:21"}}},"request":{"raw":"GET /favicon-16x16.png HTTP/1.1\r\nHost: simpleswapp.at\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://simpleswapp.at/\r\nCookie: PHPSESSID=8fa310eab2dabf42602b07af7cf7e7fe; _token=uarjd338spvs0.1784165851.2.177bfd90de32d9ce950473c83987122a; _subid=18uumd0.36.f9h4i\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=6\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nserver: openresty\r\ndate: Wed, 15 Jul 2026 01:37:32 GMT\r\ncontent-type: image/png\r\ncontent-length: 928\r\netag: W/\"3a0-19f4c7e1840\"\r\nreferrer-policy: strict-origin-when-cross-origin\r\nx-download-options: noopen\r\nx-content-type-options: nosniff\r\nlast-modified: Fri, 10 Jul 2026 14:46:00 GMT\r\ncache-control: public, max-age=0\r\naccess-control-allow-headers: *\r\naccess-control-allow-methods: GET, POST, PUT, DELETE, PATCH, HEAD, OPTIONS\r\naccess-control-allow-origin: *\r\nx-cache-status: HIT\r\naccept-ranges: bytes\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"OpenResty","description":"OpenResty is a web platform based on nginx which can run Lua scripts using its LuaJIT engine.","website":"https://openresty.org","common_platform_enumeration":"","icon":"OpenResty.svg","categories":["Web servers"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":928,"size_decoded":1467,"mime_type":"image/png","magic":"PNG image data, 16 x 16, 8-bit colormap, non-interlaced","md5":"e278b4d9c14eba7ead546553719554dd","sha1":"ff939f15237e562bd87269c06bf79ac9b00ea2a4","sha256":"5957e82074edf8bdbe1c92b1a2c09e0379918cc467daaaf0635cdda175329328","sha512":"cf2739258993285c17bd151d4de808b30bc5e76a1f189329ceebb99b47d1fb90de037f4334d0c07ca8663d3c09c3dfc5f97bc5f2fcbf072209af3bafee0c8dc9","ssdeep":"","tlshash":"b5116fd2613b9e61c00b1420ce4300b8f6325025f29510ca8d8ef1ad290424db1ecfcf","first_seen":"2025-04-19T14:20:07.005691Z","last_seen":"2026-07-15T01:37:59.173164Z","times_seen":89,"resource_available":false,"data":null}},"time_used":43,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":43,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-07-15","alert":"Sinkholed","trigger":"simpleswapp.at","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-07-15","alert":"Sinkholed","trigger":"simpleswapp.at","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}}]}