{"report_id":"6f43d55d-ff23-480f-a8c7-3bb78491aeeb","version":6,"status":"done","tags":["opendir"],"date":"2026-01-23T14:22:42Z","url":{"schema":"http","addr":"recoveryaccount-coinbaseupdatekey.rotaryqueensnecklace.org","fqdn":"recoveryaccount-coinbaseupdatekey.rotaryqueensnecklace.org","domain":"rotaryqueensnecklace.org","tld":"org"},"ip":{"addr":"103.152.79.202","port":0,"asn":140641,"as":"YOTTA NETWORK SERVICES PRIVATE LIMITED","country":"India","country_code":"IN"},"final":{"url":{"schema":"https","addr":"recoveryaccount-coinbaseupdatekey.rotaryqueensnecklace.org/","fqdn":"recoveryaccount-coinbaseupdatekey.rotaryqueensnecklace.org","domain":"rotaryqueensnecklace.org","tld":"org"},"title":"Index of /","dom":{"size":580,"mime_type":"text/html; charset=utf-8","magic":"HTML document, ASCII text","md5":"b15304d7de0600ec53f6900237f7acbf","sha1":"6b61bbcc1e2bb6b1e1e4a16feff1aab9dfd449b9","sha256":"3580bfdd2027490bd69c7965617743c4d8494f2ffaa16d97f02ea4dc42cf03ca","sha512":"0151d3f56428c6ace119b33603db797a6238a0f28218f1c1fadb63108381b6a42f3ddcd0164df3fa9d00b08f26c3e37140055657c24c6fd35a016f5fb6054b2e","ssdeep":"","tlshash":"f2f0f64a68e422bb7c91361f85007dca8ae5c4b882b15d703d4fb497cb85eb8d4071e5","dom_hash":"domhash6bc22f81b9c0fe616439e7fc6f9216cc","first_seen":"2026-01-23T12:51:04.207015Z","last_seen":"2026-01-23T14:22:42.444462Z","times_seen":2,"resource_available":false,"data":null}},"submit":{"url":{"schema":"http","addr":"recoveryaccount-coinbaseupdatekey.rotaryqueensnecklace.org","fqdn":"recoveryaccount-coinbaseupdatekey.rotaryqueensnecklace.org","domain":"rotaryqueensnecklace.org","tld":"org"},"ip":{"addr":"103.152.79.202","port":0,"asn":140641,"as":"YOTTA NETWORK SERVICES PRIVATE LIMITED","country":"India","country_code":"IN"},"tags":null,"meta":null},"settings":{"access":"public","device_type":"desktop","expires_at":"2027-02-27T14:22:42Z","useragent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0","referer":"","cookies":null,"exit_node":"z0yflva4pidy47h"},"stats":{"alert_count":{"ids":0,"urlquery":2,"analyzer":3}},"detection":{"ids":null,"analyzer":[{"sensor_name":"cira_dns","sensor_type":"DNS","title":"CIRA Canadian Shield DNS","description":"CIRA Canadian Shield DNS","scan_date":"2026-01-23","alert":"Sinkholed","trigger":"recoveryaccount-coinbaseupdatekey.rotaryqueensnecklace.org","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cira.ca/en/canadian-shield/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-01-23","alert":"Sinkholed","trigger":"recoveryaccount-coinbaseupdatekey.rotaryqueensnecklace.org","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-01-23","alert":"Sinkholed","trigger":"recoveryaccount-coinbaseupdatekey.rotaryqueensnecklace.org","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null}],"urlquery":[{"sensor_name":"urlquery","alert":"Audit - Open directory","verdict":"none","severity":"audit","comment":"","tags":["opendir"],"meta":null},{"sensor_name":"urlquery","alert":"Audit - Open directory","verdict":"none","severity":"audit","comment":"","tags":["opendir"],"meta":null}]},"summary":[{"fqdn":"recoveryaccount-coinbaseupdatekey.rotaryqueensnecklace.org","ip":{"addr":"103.152.79.202","port":443,"asn":140641,"as":"YOTTA NETWORK SERVICES PRIVATE LIMITED","country":"India","country_code":"IN"},"domain_registered":"2006-05-31","domain_rank":0,"first_seen":"2025-04-23T17:20:52.706816Z","last_seen":"2026-01-23T12:51:03.959715Z","alert_count":7,"request_count":2,"received_data":1704,"sent_data":1050,"comment":"","tags":null,"fingerprints":[{"name":"Apache HTTP Server","description":"Apache is a free and open-source cross-platform web server software.","website":"https://httpd.apache.org/","common_platform_enumeration":"cpe:2.3:a:apache:http_server:*:*:*:*:*:*:*:*","icon":"Apache.svg","categories":["Web servers"]}]}],"files":null,"artifacts":{"windows_shortcuts":null,"files":null,"telegram":null,"pdfs":null,"clipboard":null},"sensors":{"ids":null,"analyzer":null,"urlquery":[{"sensor_name":"urlquery","alert":"Audit - Open directory","verdict":"none","severity":"audit","comment":"","tags":["opendir"],"meta":null}]},"javascript":{"script":null,"eval":null,"write":null,"console":null},"http":[{"url":{"schema":"https","addr":"recoveryaccount-coinbaseupdatekey.rotaryqueensnecklace.org/","fqdn":"recoveryaccount-coinbaseupdatekey.rotaryqueensnecklace.org","domain":"rotaryqueensnecklace.org","tld":"org"},"ip":{"addr":"103.152.79.202","port":443,"asn":140641,"as":"YOTTA NETWORK SERVICES PRIVATE LIMITED","country":"India","country_code":"IN"},"is_navigation_request":true,"resource_type":"document","requested_by":"","date":"2026-01-23T14:22:20.289Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"recoveryaccount-coinbaseupdatekey.rotaryqueensnecklace.org","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Tue, 23 Dec 2025 16:49:19 GMT","end":"Mon, 23 Mar 2026 16:49:18 GMT"},"fingerprint":{"sha1":"09:C8:C1:BD:30:52:4D:C4:BE:7D:CE:E4:00:A1:DE:FD:2D:A1:DB:92","sha256":"9B:06:BD:D3:A0:B5:7D:8B:1B:0E:2E:AF:17:0B:62:E8:4B:EB:89:46:C5:5F:49:CB:76:6C:4E:B2:29:4C:E1:CC"}}},"request":{"raw":"GET / HTTP/1.1\r\nHost: recoveryaccount-coinbaseupdatekey.rotaryqueensnecklace.org\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nUpgrade-Insecure-Requests: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: document\r\nSec-Fetch-Mode: navigate\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Fri, 23 Jan 2026 14:22:20 GMT\r\nServer: Apache\r\nContent-Length: 623\r\nKeep-Alive: timeout=5, max=100\r\nConnection: Keep-Alive\r\nContent-Type: text/html;charset=ISO-8859-1\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Apache HTTP Server","description":"Apache is a free and open-source cross-platform web server software.","website":"https://httpd.apache.org/","common_platform_enumeration":"cpe:2.3:a:apache:http_server:*:*:*:*:*:*:*:*","icon":"Apache.svg","categories":["Web servers"]}],"data":{"size":623,"size_decoded":0,"mime_type":"text/html; charset=ISO-8859-1","magic":"HTML document, ASCII text","md5":"4797c9bb74b12002c2e81631ff70559a","sha1":"8812aec788a5202448ad46c08782f1c6df513e55","sha256":"e2cc489d9b0e938cbf67bc46f9512d86920da0ac2813393e65dcbdc374440d80","sha512":"7c6db88c7d8ba5ba6be18dc3f783573c96a85642d269d050f68aba02828febb313cf1ec7d52eba781cc66eb1a9ace87813d6a9def0f8944bb614bd5111178a57","ssdeep":"","tlshash":"0af02d45a8d432b76c91351f95407dca86e1c5b842b14d743c4fb493cb86eb8d1071e9","first_seen":"2025-05-07T12:10:23.823057Z","last_seen":"2026-01-23T14:22:42.445514Z","times_seen":4,"resource_available":false,"data":null}},"time_used":761,"timings":{"blocked":296,"dns":1,"connect":146,"send":0,"wait":150,"receive":0,"ssl":165},"alerts":{"ids":null,"analyzer":[{"sensor_name":"cira_dns","sensor_type":"DNS","title":"CIRA Canadian Shield DNS","description":"CIRA Canadian Shield DNS","scan_date":"2026-01-23","alert":"Sinkholed","trigger":"recoveryaccount-coinbaseupdatekey.rotaryqueensnecklace.org","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cira.ca/en/canadian-shield/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-01-23","alert":"Sinkholed","trigger":"recoveryaccount-coinbaseupdatekey.rotaryqueensnecklace.org","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-01-23","alert":"Sinkholed","trigger":"recoveryaccount-coinbaseupdatekey.rotaryqueensnecklace.org","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null}],"urlquery":[{"sensor_name":"urlquery","alert":"Audit - Open directory","verdict":"none","severity":"audit","comment":"","tags":["opendir"],"meta":null}]}},{"url":{"schema":"https","addr":"recoveryaccount-coinbaseupdatekey.rotaryqueensnecklace.org/favicon.ico","fqdn":"recoveryaccount-coinbaseupdatekey.rotaryqueensnecklace.org","domain":"rotaryqueensnecklace.org","tld":"org"},"ip":{"addr":"103.152.79.202","port":443,"asn":140641,"as":"YOTTA NETWORK SERVICES PRIVATE LIMITED","country":"India","country_code":"IN"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://recoveryaccount-coinbaseupdatekey.rotaryqueensnecklace.org/","date":"2026-01-23T14:22:21.042Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"recoveryaccount-coinbaseupdatekey.rotaryqueensnecklace.org","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Tue, 23 Dec 2025 16:49:19 GMT","end":"Mon, 23 Mar 2026 16:49:18 GMT"},"fingerprint":{"sha1":"09:C8:C1:BD:30:52:4D:C4:BE:7D:CE:E4:00:A1:DE:FD:2D:A1:DB:92","sha256":"9B:06:BD:D3:A0:B5:7D:8B:1B:0E:2E:AF:17:0B:62:E8:4B:EB:89:46:C5:5F:49:CB:76:6C:4E:B2:29:4C:E1:CC"}}},"request":{"raw":"GET /favicon.ico HTTP/1.1\r\nHost: recoveryaccount-coinbaseupdatekey.rotaryqueensnecklace.org\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://recoveryaccount-coinbaseupdatekey.rotaryqueensnecklace.org/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 500 Internal Server Error\r\nDate: Fri, 23 Jan 2026 14:22:21 GMT\r\nServer: Apache\r\nContent-Length: 712\r\nConnection: close\r\nContent-Type: text/html; charset=iso-8859-1\r\n\r\n","headers":null,"cookies":null,"status_code":"500","status_text":"Internal Server Error","fingerprints":[{"name":"Apache HTTP Server","description":"Apache is a free and open-source cross-platform web server software.","website":"https://httpd.apache.org/","common_platform_enumeration":"cpe:2.3:a:apache:http_server:*:*:*:*:*:*:*:*","icon":"Apache.svg","categories":["Web servers"]}],"data":{"size":712,"size_decoded":0,"mime_type":"text/html; charset=iso-8859-1","magic":"HTML document, ASCII text","md5":"c12b9022df6d58e5d19aff65f9ed03c4","sha1":"d4b5d452148c3c94d4df8b9d9e2394f961a2aa50","sha256":"5cc5e374eda7ed47c1f2d5cf7072815fb07c938000c8e6065bc7336902c0ac70","sha512":"d6a2d1c09417b6462c901a058797a98fb6700b3f9b9d00db81432669e371954735406a2c5e9394a356a2379b58dc4a1a6337960398ec292204954b7f668bbbce","ssdeep":"","tlshash":"11017bab534a332350717648688261c87f20203566f1a89c26589abb72c69d69f3f7ec","first_seen":"2025-05-07T12:10:23.824731Z","last_seen":"2026-01-23T14:22:42.446446Z","times_seen":4,"resource_available":false,"data":null}},"time_used":150,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":148,"receive":2,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-01-23","alert":"Sinkholed","trigger":"recoveryaccount-coinbaseupdatekey.rotaryqueensnecklace.org","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"cira_dns","sensor_type":"DNS","title":"CIRA Canadian Shield DNS","description":"CIRA Canadian Shield DNS","scan_date":"2026-01-23","alert":"Sinkholed","trigger":"recoveryaccount-coinbaseupdatekey.rotaryqueensnecklace.org","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cira.ca/en/canadian-shield/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-01-23","alert":"Sinkholed","trigger":"recoveryaccount-coinbaseupdatekey.rotaryqueensnecklace.org","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}}]}