{"report_id":"7780e314-8c2e-458d-9b84-7bd6bdff7e14","version":0,"status":"done","tags":["malicious","clickfix"],"date":"2026-08-14T08:05:44Z","url":{"schema":"http","addr":"msn00273.beer/","fqdn":"msn00273.beer","domain":"msn00273.beer","tld":"beer"},"ip":{"addr":"178.16.52.101","port":0,"asn":40999,"as":"dus.net GmbH","country":"Germany","country_code":"DE"},"final":{"url":{"schema":"https","addr":"msn00273.beer/","fqdn":"msn00273.beer","domain":"msn00273.beer","tld":"beer"},"title":"Site is created successfully!","dom":{"size":32787,"mime_type":"text/html; charset=utf-8","magic":"JavaScript source, Unicode text, UTF-8 text, with very long lines (14017)","md5":"b1b548e9a904f34d66d80825ea2bb29a","sha1":"996aeee2d2bdbcba2dcb5e0cacd3cde65d187a3f","sha256":"e6a21ebc5383c7321076ecf3d39ed8d133d4b8fb28abd129a63c1c84d6d76c2a","sha512":"6cdcac7bfaf17eebdcf006142436b4b599ed69ff15a42ad2dfb87e91a077cda3c883e43723ec00deeed34ce09cc5a1887d1845843d5b7ed744f7f4b0091c1d5e","ssdeep":"384:kYvVcPhWRFxBvBRyWfj1iC7wtr8KraZ6l7V3oizHuKX41V3oizHuheI3oizHuWeb:4OVkLr53oKOQ4D3oKOh3oKOz/","tlshash":"c8e2a4230616723d61620ea79219330b32e8c0d78c9a197df35669f0fe8fb4365a772d","dom_hash":"domhash73e5d1be477a16c83d6ca0abcd5fc34a","first_seen":"2026-08-14T08:05:46.078503Z","last_seen":"2026-08-14T08:05:46.078503Z","times_seen":1,"resource_available":false,"data":null}},"submit":{"url":{"schema":"http","addr":"msn00273.beer/","fqdn":"msn00273.beer","domain":"msn00273.beer","tld":"beer"},"ip":{"addr":"178.16.52.101","port":0,"asn":40999,"as":"dus.net GmbH","country":"Germany","country_code":"DE"},"tags":null,"meta":null},"settings":{"access":"public","device_type":"desktop","expires_at":"2027-09-18T08:05:44Z","useragent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0","referer":"","cookies":null,"exit_node":"qguvgzjxzsgb3vs"},"stats":{"alert_count":{"ids":0,"urlquery":2,"analyzer":3}},"detection":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-08-13","alert":"Sinkholed","trigger":"analysis-id-fmd.info","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-08-13","alert":"Sinkholed","trigger":"analysis-id-fmd.info","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-08-14","alert":"Sinkholed","trigger":"analysis-id-fmd.info","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":[{"sensor_name":"urlquery","alert":"Malicious - Copy/Paste Social Engineering (ClickFix)","verdict":"malicious","severity":"medium","comment":"","tags":["malicious","clickfix"],"meta":null},{"sensor_name":"urlquery","alert":"Malicious - Copy/Paste Social Engineering (ClickFix)","verdict":"malicious","severity":"medium","comment":"","tags":["malicious","clickfix"],"meta":null}]},"summary":[{"fqdn":"rpc-mainnet.matic.quiknode.pro","ip":{"addr":"150.136.141.142","port":443,"asn":31898,"as":"ORACLE-BMC-31898","country":"United States","country_code":"US"},"domain_registered":"2018-01-05","domain_rank":2989773,"first_seen":"2021-05-19T17:40:41Z","last_seen":"2026-08-13T12:50:39.26101Z","alert_count":0,"request_count":1,"received_data":355,"sent_data":556,"comment":"","tags":null,"fingerprints":null},{"fqdn":"msn00273.beer","ip":{"addr":"178.16.52.101","port":443,"asn":40999,"as":"dus.net GmbH","country":"Germany","country_code":"DE"},"domain_registered":"2026-08-12","domain_rank":0,"first_seen":"2026-08-14T08:05:09.8519Z","last_seen":"2026-08-14T08:05:09.8519Z","alert_count":1,"request_count":2,"received_data":68932,"sent_data":984,"comment":"","tags":null,"fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}]},{"fqdn":"analysis-id-fmd.info","ip":{"addr":"178.16.52.101","port":443,"asn":40999,"as":"dus.net GmbH","country":"Germany","country_code":"DE"},"domain_registered":"unknown","domain_rank":0,"first_seen":"2026-08-12T08:28:57.883446Z","last_seen":"2026-08-12T08:28:57.883446Z","alert_count":9,"request_count":3,"received_data":148532,"sent_data":1714,"comment":"","tags":null,"fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}]}],"files":null,"artifacts":{"windows_shortcuts":null,"files":null,"telegram":null,"pdfs":null,"clipboard":null},"sensors":{"ids":null,"analyzer":null,"urlquery":[{"sensor_name":"urlquery","alert":"Malicious - Copy/Paste Social Engineering (ClickFix)","verdict":"malicious","severity":"medium","comment":"","tags":["malicious","clickfix"],"meta":null}]},"javascript":{"script":[{"url":{"schema":"https","addr":"analysis-id-fmd.info/api.php?s=1c55e7ed8b95e21f617684f41ff2b052280234cc6c134d60\u0026_v=29778245","fqdn":"analysis-id-fmd.info","domain":"analysis-id-fmd.info","tld":"info"},"ip":{"addr":"178.16.52.101","port":443,"asn":40999,"as":"dus.net GmbH","country":"Germany","country_code":"DE"},"introduction_type":"scriptElement","is_inline":false,"md5":"e8c68252e001800b8870447f9f204328","sha1":"d76d5c8503e3857f9c0da7828d54549e18d48d15","sha256":"740b83937f251e2bf42939c1042a6cb7a20bc31c1f8930f6b0d228d031fdeb9e","sha512":"fc3359163db1c508bd8653600e124393f8b17a3cb778611f435af4d72cebd366047039c1fdca4e24e3012dfe6256bc7e70f37d6c6071e5db95c3d800ff8abe29","ssdeep":"768:ZtXj7ZJYI0wXdlIoTDDH7jD8uNYtdKCdtYvGA5k:ZtXj7GtdKCdtYvGA5k","tlshash":"11e36c86278807bdf7b8ccc91498b21716f2d26d3c2e2b5aead187677c3de607925530","size":147203,"data":"","first_seen":"2026-08-14T08:05:46.087715Z","last_seen":"2026-08-14T08:05:46.087715Z","times_seen":1,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"msn00273.beer/","fqdn":"msn00273.beer","domain":"msn00273.beer","tld":"beer"},"ip":{"addr":"178.16.52.101","port":443,"asn":40999,"as":"dus.net GmbH","country":"Germany","country_code":"DE"},"introduction_type":"Function","is_inline":false,"md5":"f84b0eda4c09956ac9904ae01edf483a","sha1":"48db7d7ba0c842093343a8a4ea1b8cc51b66cb30","sha256":"727936b88ee9f195ec846f70e8c707db0d68960de2cd08dc80119179ef901436","sha512":"c6f232cbab4bb17c4816f2c131a28a3eba0fd0a88507d0fc709f4bffd8218b6a8cf57ffed4c0f649dd32c17d33ac41cc661a26ab34457fa9c0e3d2b2f52443be","ssdeep":"768:CRujSrgr2Cj+eN8ttRRauRpKpVfRneerw3:CsSEieN8LRRfwRn2","tlshash":"c7e23c7993b0202e94b389cbac3bb3ce30780047c55796b88336663599c7597d73bb99","size":31305,"data":"","first_seen":"2026-08-14T08:05:46.097843Z","last_seen":"2026-08-14T08:05:46.097843Z","times_seen":1,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"msn00273.beer/","fqdn":"msn00273.beer","domain":"msn00273.beer","tld":"beer"},"ip":{"addr":"178.16.52.101","port":443,"asn":40999,"as":"dus.net GmbH","country":"Germany","country_code":"DE"},"introduction_type":"scriptElement","is_inline":true,"md5":"0311237d0b84fbf7a075595c3007f300","sha1":"17350532cd01b92d6fd2f2047798337703e43f50","sha256":"4368af0e1101b01ee55cf6f6d5800efa01f1e7879bb76984dfbe6a77ddd78502","sha512":"0bfe20cfbabc5453f4b8da15dca6b10b1c1f6e18428d258aafd6ab6887cc39f424c4242d69224224e75e297dfcb445bd22a9b1beefec12967ec740c4c1520271","ssdeep":"192:KVSvVZ0xZxhUZx9sLuyzj4PwoBvxHRyWewjP/ZvLiCwCwtO:KYvVcPhWRFxBvBRyWfj1iC7wtO","tlshash":"970293631f272b7c62d11db282093607a9e1c97b1c6d207ff74255e5fc6d74388aaa32","size":8787,"data":"","first_seen":"2026-08-14T08:05:13.889516Z","last_seen":"2026-08-14T08:05:46.100748Z","times_seen":2,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"msn00273.beer/","fqdn":"msn00273.beer","domain":"msn00273.beer","tld":"beer"},"ip":{"addr":"178.16.52.101","port":443,"asn":40999,"as":"dus.net GmbH","country":"Germany","country_code":"DE"},"introduction_type":"Function","is_inline":false,"md5":"80cdfc8f51756351c252a5b5819d55ab","sha1":"35a022e84505bf612b015eafba2895a62c6159ce","sha256":"568a5c03e74ed0c678e4ce7b445c95aa97bf6f41e5d836abcdc102b3e2ea5573","sha512":"5d354123298b62b3101ca447fd53ce641cf42ea31c2b056692ce8c1d18beb8214b146993a34205ae8ff0016ac494d92c99204084f114e57fab7fa5e052998382","ssdeep":"","tlshash":"fe4152cb62a255995bd25cfa907f0e0df0966869ec94e470c001f8503d3ae69fa576d0","size":2078,"data":"","first_seen":"2026-08-14T08:05:13.891049Z","last_seen":"2026-08-14T08:05:46.102763Z","times_seen":2,"alerts":{"ids":null,"analyzer":null,"urlquery":null}}],"eval":null,"write":null,"console":null},"http":[{"url":{"schema":"https","addr":"msn00273.beer/","fqdn":"msn00273.beer","domain":"msn00273.beer","tld":"beer"},"ip":{"addr":"178.16.52.101","port":443,"asn":40999,"as":"dus.net GmbH","country":"Germany","country_code":"DE"},"is_navigation_request":true,"resource_type":"document","requested_by":"","date":"2026-08-14T08:05:17.619Z","timestamp":1786694717619,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"msn00273.beer","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Wed, 12 Aug 2026 00:50:42 GMT","end":"Tue, 10 Nov 2026 00:50:41 GMT"},"fingerprint":{"sha1":"A5:09:EA:07:E5:B6:C7:87:DB:13:28:05:35:F8:A9:4E:7B:94:61:14","sha256":"1D:C1:70:18:8A:65:3A:0C:81:56:F7:B9:D6:85:54:68:C1:A9:30:F6:3C:91:EF:26:29:F4:59:A2:0B:4A:E1:31"}}},"request":{"raw":"GET / HTTP/1.1\r\nHost: msn00273.beer\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nUpgrade-Insecure-Requests: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: document\r\nSec-Fetch-Mode: navigate\r\nSec-Fetch-Site: none\r\nPriority: u=0, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nserver: nginx\r\ndate: Fri, 14 Aug 2026 08:05:17 GMT\r\ncontent-type: text/html\r\nlast-modified: Wed, 12 Aug 2026 01:50:08 GMT\r\nvary: Accept-Encoding\r\netag: W/\"6a7bd150-27c1\"\r\nstrict-transport-security: max-age=31536000\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":10177,"size_decoded":3506,"mime_type":"text/html","magic":"HTML document, ASCII text, with very long lines (8160)","md5":"335b5b1aaf30a09178a07536846ed696","sha1":"c5f0e8c8adf6fc72be76d686892f92cd7aa46165","sha256":"2b70555bc39f42f0e78cca142467e5f2b6748514262a501db8167d4910d364a0","sha512":"c394259589198b2c6c60d634cdd3ad54452ca73c40fa268456c17fa4377ba14f2e4dda4e0845c25faf925ac8d982bf57865a599f5869b10d73386b606f0a5351","ssdeep":"192:gVSvVZ0xZxhUZx9sLuyzj4PwoBvxHRyWewjP/ZvLiCwCwtFAMdiM:gYvVcPhWRFxBvBRyWfj1iC7wtj","tlshash":"ed22f9630f27277c62910db282093607a9e1c96b1c6d207ff74655e4ff6d74388aab32","first_seen":"2026-08-14T08:05:13.882288Z","last_seen":"2026-08-14T08:05:46.082451Z","times_seen":2,"resource_available":false,"data":null}},"time_used":242,"timings":{"blocked":-1,"dns":23,"connect":72,"send":0,"wait":72,"receive":0,"ssl":75},"alerts":{"ids":null,"analyzer":null,"urlquery":[{"sensor_name":"urlquery","alert":"Malicious - Copy/Paste Social Engineering (ClickFix)","verdict":"malicious","severity":"medium","comment":"","tags":["malicious","clickfix"],"meta":null}]}},{"url":{"schema":"https","addr":"msn00273.beer/favicon.ico","fqdn":"msn00273.beer","domain":"msn00273.beer","tld":"beer"},"ip":{"addr":"178.16.52.101","port":443,"asn":40999,"as":"dus.net GmbH","country":"Germany","country_code":"DE"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://msn00273.beer/","date":"2026-08-14T08:05:18.307Z","timestamp":1786694718307,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"msn00273.beer","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Wed, 12 Aug 2026 00:50:42 GMT","end":"Tue, 10 Nov 2026 00:50:41 GMT"},"fingerprint":{"sha1":"A5:09:EA:07:E5:B6:C7:87:DB:13:28:05:35:F8:A9:4E:7B:94:61:14","sha256":"1D:C1:70:18:8A:65:3A:0C:81:56:F7:B9:D6:85:54:68:C1:A9:30:F6:3C:91:EF:26:29:F4:59:A2:0B:4A:E1:31"}}},"request":{"raw":"GET /favicon.ico HTTP/1.1\r\nHost: msn00273.beer\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://msn00273.beer/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=6\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 404 \r\nserver: nginx\r\ndate: Fri, 14 Aug 2026 08:05:18 GMT\r\ncontent-type: text/html\r\nvary: Accept-Encoding\r\netag: W/\"6a7bd10b-e3b8\"\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"404","status_text":"","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":58296,"size_decoded":44116,"mime_type":"text/html","magic":"HTML document, ASCII text, with very long lines (56756)","md5":"cbb42513032d6c09e496731ac16c20a9","sha1":"c92f38a701aad58408451d24dd4c47b05f158cf0","sha256":"d189695b2f3bb92369881f2428fa861dca9d9a94c638d9bdc4e2fa747d6f315b","sha512":"3d76f1018afceaba7cbb4083f4a5b5758966ec2aa5d5c6b07d72361782809f7ed4bd34ed9e0c4154d01a2db7192155de8251e5a834dd90b8d9823d916e1b7285","ssdeep":"768:cHJYDDQHVZHIs91TXESJBjgBSp00yCqJ3Z+IYM3WiesRQiULO0bpD9tcNQEfdom2:cmDD6oeFUycwpk06hWp1b99c7VM","tlshash":"8443021803de40a2cd8978d9426f2f3d842a1863da1c94bd1f5b6df4ca0d8a4767f1e9","first_seen":"2024-11-25T13:26:01.204756Z","last_seen":"2026-08-14T08:05:46.086198Z","times_seen":13924,"resource_available":true,"data":null}},"time_used":147,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":147,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"analysis-id-fmd.info/api.php?s=1c55e7ed8b95e21f617684f41ff2b052280234cc6c134d60\u0026_v=29778245","fqdn":"analysis-id-fmd.info","domain":"analysis-id-fmd.info","tld":"info"},"ip":{"addr":"178.16.52.101","port":443,"asn":40999,"as":"dus.net GmbH","country":"Germany","country_code":"DE"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://msn00273.beer/","date":"2026-08-14T08:05:18.623Z","timestamp":1786694718623,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"analysis-id-fmd.info","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Wed, 12 Aug 2026 00:04:23 GMT","end":"Tue, 10 Nov 2026 00:04:22 GMT"},"fingerprint":{"sha1":"22:D6:0D:05:B5:C6:D7:1F:50:7F:16:A4:5C:AF:37:2C:0D:D6:B6:63","sha256":"F7:4A:41:03:8E:72:7C:60:97:4F:3E:B6:68:C8:E3:96:95:27:0E:5D:06:C2:92:A8:CB:58:A9:20:16:DA:07:97"}}},"request":{"raw":"GET /api.php?s=1c55e7ed8b95e21f617684f41ff2b052280234cc6c134d60\u0026_v=29778245 HTTP/1.1\r\nHost: analysis-id-fmd.info\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-Fetch-Storage-Access: none\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://msn00273.beer/\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nserver: nginx\r\ndate: Fri, 14 Aug 2026 08:05:18 GMT\r\ncontent-type: application/javascript; charset=utf-8\r\nvary: Accept-Encoding\r\naccess-control-allow-origin: *\r\naccess-control-allow-methods: GET, POST, OPTIONS\r\naccess-control-allow-headers: Content-Type\r\ncache-control: no-store, no-cache, must-revalidate\r\npragma: no-cache\r\nx-content-type-options: nosniff\r\nstrict-transport-security: max-age=31536000\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":147203,"size_decoded":27639,"mime_type":"application/javascript; charset=utf-8","magic":"JavaScript source, ASCII text, with very long lines (65419)","md5":"e8c68252e001800b8870447f9f204328","sha1":"d76d5c8503e3857f9c0da7828d54549e18d48d15","sha256":"740b83937f251e2bf42939c1042a6cb7a20bc31c1f8930f6b0d228d031fdeb9e","sha512":"fc3359163db1c508bd8653600e124393f8b17a3cb778611f435af4d72cebd366047039c1fdca4e24e3012dfe6256bc7e70f37d6c6071e5db95c3d800ff8abe29","ssdeep":"768:ZtXj7ZJYI0wXdlIoTDDH7jD8uNYtdKCdtYvGA5k:ZtXj7GtdKCdtYvGA5k","tlshash":"11e36c86278807bdf7b8ccc91498b21716f2d26d3c2e2b5aead187677c3de607925530","first_seen":"2026-08-14T08:05:46.087715Z","last_seen":"2026-08-14T08:05:46.087715Z","times_seen":1,"resource_available":true,"data":null}},"time_used":334,"timings":{"blocked":0,"dns":3,"connect":71,"send":0,"wait":184,"receive":0,"ssl":75},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-08-13","alert":"Sinkholed","trigger":"analysis-id-fmd.info","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-08-13","alert":"Sinkholed","trigger":"analysis-id-fmd.info","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-08-14","alert":"Sinkholed","trigger":"analysis-id-fmd.info","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"analysis-id-fmd.info/api.php","fqdn":"analysis-id-fmd.info","domain":"analysis-id-fmd.info","tld":"info"},"ip":{"addr":"178.16.52.101","port":443,"asn":40999,"as":"dus.net GmbH","country":"Germany","country_code":"DE"},"is_navigation_request":false,"resource_type":"fetch","requested_by":"https://msn00273.beer/","date":"2026-08-14T08:05:19.003Z","timestamp":1786694719003,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"analysis-id-fmd.info","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Wed, 12 Aug 2026 00:04:23 GMT","end":"Tue, 10 Nov 2026 00:04:22 GMT"},"fingerprint":{"sha1":"22:D6:0D:05:B5:C6:D7:1F:50:7F:16:A4:5C:AF:37:2C:0D:D6:B6:63","sha256":"F7:4A:41:03:8E:72:7C:60:97:4F:3E:B6:68:C8:E3:96:95:27:0E:5D:06:C2:92:A8:CB:58:A9:20:16:DA:07:97"}}},"request":{"raw":"POST /api.php HTTP/1.1\r\nHost: analysis-id-fmd.info\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://msn00273.beer/\r\nContent-Type: application/x-www-form-urlencoded\r\nContent-Length: 250\r\nOrigin: https://msn00273.beer\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPriority: u=4\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"POST"},"response":{"raw":"HTTP/2 200 \r\nserver: nginx\r\ndate: Fri, 14 Aug 2026 08:05:19 GMT\r\ncontent-type: text/plain; charset=utf-8\r\nvary: Accept-Encoding\r\naccess-control-allow-origin: *\r\naccess-control-allow-methods: GET, POST, OPTIONS\r\naccess-control-allow-headers: Content-Type\r\ncache-control: no-store, no-cache\r\nstrict-transport-security: max-age=31536000\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":44,"size_decoded":439,"mime_type":"text/plain; charset=utf-8","magic":"ASCII text, with no line terminators","md5":"a323dc33a6fd0339d9ee14b5865b48eb","sha1":"68067538957025a6800000059ff88e6ec65f0cad","sha256":"a2d3e44e8a72bc4307c28dfb7e4ee589a2fd283451666b9a92131ee299bb7d05","sha512":"3946e1b71f973c4c483454758241d10645e6bdb38603b8e9eb5ff2ef1da840d6991cba264866d8c122df2271f597aedd5449ebb0d14570efa1b5c60e4c53c878","ssdeep":"","tlshash":"e89002200e16b470904f72e81084294cd6701244044b048606d0404a8428619986d044","first_seen":"2026-08-14T08:05:13.886593Z","last_seen":"2026-08-14T08:05:46.091805Z","times_seen":2,"resource_available":false,"data":null}},"time_used":258,"timings":{"blocked":0,"dns":0,"connect":72,"send":0,"wait":111,"receive":0,"ssl":75},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-08-14","alert":"Sinkholed","trigger":"analysis-id-fmd.info","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-08-13","alert":"Sinkholed","trigger":"analysis-id-fmd.info","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-08-13","alert":"Sinkholed","trigger":"analysis-id-fmd.info","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"analysis-id-fmd.info/api.php?k=1c55e7ed8b95e21f617684f41ff2b052280234cc6c134d60\u0026d=RpVQMJ33Yw8gaYMvSgk9Xy3c%2B96bdfY%2F7j%2FgK%2FmwcmQJJlan8ojPXT66Su9rWzeE5crurWTokbBOnw0MZYZM5O1iuxHNHphPvdMTmUKa%2B%2F9zWmIed6gKUtWKKNYDYJH3fKDDOTTG%2Fy95hioQrIo1xBWU","fqdn":"analysis-id-fmd.info","domain":"analysis-id-fmd.info","tld":"info"},"ip":{"addr":"178.16.52.101","port":443,"asn":40999,"as":"dus.net GmbH","country":"Germany","country_code":"DE"},"is_navigation_request":false,"resource_type":"fetch","requested_by":"https://msn00273.beer/","date":"2026-08-14T08:05:19.023Z","timestamp":1786694719023,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"analysis-id-fmd.info","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Wed, 12 Aug 2026 00:04:23 GMT","end":"Tue, 10 Nov 2026 00:04:22 GMT"},"fingerprint":{"sha1":"22:D6:0D:05:B5:C6:D7:1F:50:7F:16:A4:5C:AF:37:2C:0D:D6:B6:63","sha256":"F7:4A:41:03:8E:72:7C:60:97:4F:3E:B6:68:C8:E3:96:95:27:0E:5D:06:C2:92:A8:CB:58:A9:20:16:DA:07:97"}}},"request":{"raw":"GET /api.php?k=1c55e7ed8b95e21f617684f41ff2b052280234cc6c134d60\u0026d=RpVQMJ33Yw8gaYMvSgk9Xy3c%2B96bdfY%2F7j%2FgK%2FmwcmQJJlan8ojPXT66Su9rWzeE5crurWTokbBOnw0MZYZM5O1iuxHNHphPvdMTmUKa%2B%2F9zWmIed6gKUtWKKNYDYJH3fKDDOTTG%2Fy95hioQrIo1xBWU HTTP/1.1\r\nHost: analysis-id-fmd.info\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://msn00273.beer/\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPriority: u=4\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nserver: nginx\r\ndate: Fri, 14 Aug 2026 08:05:19 GMT\r\ncontent-type: image/gif\r\nvary: Accept-Encoding\r\naccess-control-allow-origin: *\r\naccess-control-allow-methods: GET, POST, OPTIONS\r\naccess-control-allow-headers: Content-Type\r\ncache-control: no-store, no-cache, must-revalidate\r\npragma: no-cache\r\nstrict-transport-security: max-age=31536000\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":43,"size_decoded":456,"mime_type":"image/gif","magic":"GIF image data, version 89a, 1 x 1","md5":"b4491705564909da7f9eaf749dbbfbb1","sha1":"279315d507855c6a4351e1e2c2f39dd9cd2fccd8","sha256":"4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49","sha512":"b8d82d64ec656c63570b82215564929adad167e61643fd72283b94f3e448ef8ab0ad42202f3537a0da89960bbdc69498608fc6ec89502c6c338b6226c8bf5e14","ssdeep":"","tlshash":"c5900403d140d041c351c0300d0cc740174471304514030f70fc175dfc353510c13000","first_seen":"2023-04-05T09:54:56Z","last_seen":"2026-08-14T09:47:48.62224Z","times_seen":103439,"resource_available":true,"data":null}},"time_used":230,"timings":{"blocked":-1,"dns":0,"connect":71,"send":0,"wait":83,"receive":0,"ssl":75},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-08-14","alert":"Sinkholed","trigger":"analysis-id-fmd.info","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-08-13","alert":"Sinkholed","trigger":"analysis-id-fmd.info","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-08-13","alert":"Sinkholed","trigger":"analysis-id-fmd.info","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"rpc-mainnet.matic.quiknode.pro/","fqdn":"rpc-mainnet.matic.quiknode.pro","domain":"quiknode.pro","tld":"pro"},"ip":{"addr":"150.136.141.142","port":443,"asn":31898,"as":"ORACLE-BMC-31898","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"https://msn00273.beer/","date":"2026-08-14T08:05:18.207Z","timestamp":1786694718207,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.matic.quiknode.pro","organization":""},"issuer":{"commonName":"YE2","organization":"Let's Encrypt"},"validity":{"start":"Sun, 09 Aug 2026 17:36:40 GMT","end":"Sat, 07 Nov 2026 17:36:39 GMT"},"fingerprint":{"sha1":"2C:89:30:28:52:72:4C:A6:6E:C7:DC:45:90:B0:9C:1B:EC:9F:B7:D9","sha256":"10:AC:72:DD:DD:5D:C5:53:C7:A8:98:93:99:9F:A7:53:1B:18:94:90:B7:BB:00:8A:C4:4F:F9:D1:FD:92:86:56"}}},"request":{"raw":"OPTIONS / HTTP/1.1\r\nHost: rpc-mainnet.matic.quiknode.pro\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nAccess-Control-Request-Method: POST\r\nAccess-Control-Request-Headers: content-type\r\nReferer: https://msn00273.beer/\r\nOrigin: https://msn00273.beer\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPriority: u=4\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"OPTIONS"},"response":{"raw":"HTTP/2 200 \r\naccess-control-allow-credentials: true\r\naccess-control-allow-headers: Content-Type,Authorization,User-Agent\r\naccess-control-allow-methods: GET, POST, OPTIONS\r\naccess-control-allow-origin: https://msn00273.beer\r\nvary: Accept-Encoding\r\nx-node-id: polygon_matic_iad\r\ncontent-length: 0\r\ndate: Fri, 14 Aug 2026 08:05:18 GMT\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":null,"data":{"size":0,"size_decoded":355,"mime_type":"text/plain","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-08-14T09:51:58.62312Z","times_seen":17884480,"resource_available":true,"data":null}},"time_used":308,"timings":{"blocked":-1,"dns":0,"connect":99,"send":0,"wait":98,"receive":0,"ssl":111},"alerts":{"ids":null,"analyzer":null,"urlquery":null}}]}