{"report_id":"78c9d6fe-059a-4bb5-9e96-9206bada8606","version":6,"status":"done","tags":[],"date":"2026-05-27T00:41:56Z","url":{"schema":"https","addr":"lo4d1ng.ceo/","fqdn":"lo4d1ng.ceo","domain":"lo4d1ng.ceo","tld":"ceo"},"ip":{"addr":"81.177.165.139","port":0,"asn":8342,"as":"JSC RTComm.RU","country":"Russia","country_code":"RU"},"final":{"url":{"schema":"https","addr":"lo4d1ng.ceo/","fqdn":"lo4d1ng.ceo","domain":"lo4d1ng.ceo","tld":"ceo"},"title":"Приват24","dom":{"size":65205,"mime_type":"text/html; charset=utf-8","magic":"HTML document, Unicode text, UTF-8 text, with very long lines (54287)","md5":"53513a4b4ca60f8749b1f4f68f173434","sha1":"a219a1ffe811e7450ef6bf58e02f750125601bae","sha256":"b909cdb728ea42e7aa70229deef4715e12a005e25c0a3fd19dbb3bde86bca130","sha512":"aec4d11e7f04cd3226a9cab933a8e0dc95929209ff8d8385e57083797fd22ff43a59cd785a5a12cfab41621e3d863fe2fa0a1ee617c79e545bf73053722f1082","ssdeep":"1536:1vhu80edYCuuRX+8MpFaYjzSQd+hKM4xmYneUlg0txJ:LM6VRIjxnSS+1KmYePa","tlshash":"e953e0e156e18220f6860012769b3a6a3d798493d54fdd7af7ee2404cfc959ec83b39c","dom_hash":"domhash3db195a1af1c60c5519189386195f100","first_seen":"2026-03-18T15:54:02.96705Z","last_seen":"2026-05-27T00:41:57.311186Z","times_seen":6,"resource_available":false,"data":null}},"submit":{"url":{"schema":"https","addr":"lo4d1ng.ceo/","fqdn":"lo4d1ng.ceo","domain":"lo4d1ng.ceo","tld":"ceo"},"ip":{"addr":"81.177.165.139","port":0,"asn":8342,"as":"JSC RTComm.RU","country":"Russia","country_code":"RU"},"tags":null,"meta":null},"settings":{"access":"public","device_type":"desktop","expires_at":"2027-07-01T00:41:56Z","useragent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0","referer":"","cookies":null,"exit_node":"z0yflva4pidy47h"},"stats":{"alert_count":{"ids":0,"urlquery":0,"analyzer":2}},"detection":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-05-26","alert":"Sinkholed","trigger":"lo4d1ng.ceo","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-05-26","alert":"Sinkholed","trigger":"lo4d1ng.ceo","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null},"summary":[{"fqdn":"lo4d1ng.ceo","ip":{"addr":"81.177.165.139","port":443,"asn":8342,"as":"JSC RTComm.RU","country":"Russia","country_code":"RU"},"domain_registered":"2025-09-22","domain_rank":0,"first_seen":"2026-03-18T15:53:56.582684Z","last_seen":"2026-05-26T17:46:54.477502Z","alert_count":4,"request_count":2,"received_data":66306,"sent_data":909,"comment":"","tags":null,"fingerprints":[{"name":"PHP:7.4.33","description":"PHP is a general-purpose scripting language used for web development.","website":"https://php.net","common_platform_enumeration":"cpe:2.3:a:php:php:*:*:*:*:*:*:*:*","icon":"PHP.svg","categories":["Programming languages"]},{"name":"Apache HTTP Server","description":"Apache is a free and open-source cross-platform web server software.","website":"https://httpd.apache.org/","common_platform_enumeration":"cpe:2.3:a:apache:http_server:*:*:*:*:*:*:*:*","icon":"Apache.svg","categories":["Web servers"]}]}],"files":null,"artifacts":{"windows_shortcuts":null,"files":null,"telegram":null,"pdfs":null,"clipboard":null},"sensors":{"ids":null,"analyzer":null,"urlquery":null},"javascript":{"script":[{"url":{"schema":"https","addr":"lo4d1ng.ceo/","fqdn":"lo4d1ng.ceo","domain":"lo4d1ng.ceo","tld":"ceo"},"ip":{"addr":"81.177.165.139","port":443,"asn":8342,"as":"JSC RTComm.RU","country":"Russia","country_code":"RU"},"introduction_type":"scriptElement","is_inline":true,"md5":"8ee4a5b29af3c39268206c67af5aa4c0","sha1":"586d32a21371049b9849968461ebac34772d44ec","sha256":"46c5de5e61d7e2bce6ef99d86d61c395f34ba6e30b6bd8fda446f5f5657f2bcc","sha512":"d138e67fd3e6770f5f1d80cb1c9aafd5ffe444a12a84077eb452fabb1f1faa2d32b5405dfae93836ff23492c42f8e249e19f299108fa3b168c6c4c6d8c3ce640","ssdeep":"","tlshash":"22f05cb73ab3dc7519fb2af729f643c83a348e8a2c06f145195868591831d8011f9ede","size":446,"data":"","first_seen":"2026-03-18T15:54:02.975557Z","last_seen":"2026-05-27T00:41:57.314228Z","times_seen":6,"alerts":{"ids":null,"analyzer":null,"urlquery":null}}],"eval":null,"write":null,"console":null},"http":[{"url":{"schema":"https","addr":"lo4d1ng.ceo/","fqdn":"lo4d1ng.ceo","domain":"lo4d1ng.ceo","tld":"ceo"},"ip":{"addr":"81.177.165.139","port":443,"asn":8342,"as":"JSC RTComm.RU","country":"Russia","country_code":"RU"},"is_navigation_request":true,"resource_type":"document","requested_by":"","date":"2026-05-27T00:41:35.221Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.2","cert":{"subject":{"commonName":"lo4d1ng.ceo","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Thu, 21 May 2026 10:44:21 GMT","end":"Wed, 19 Aug 2026 10:44:20 GMT"},"fingerprint":{"sha1":"71:9B:27:6A:42:C4:12:07:B9:4E:88:24:B1:55:44:41:B2:7E:60:F8","sha256":"46:4E:AD:EC:CB:9C:FA:5D:1A:B2:EB:CD:77:FA:01:67:0A:C3:CC:F7:7F:52:EE:EF:76:59:3C:F9:FF:70:B2:46"}}},"request":{"raw":"GET / HTTP/1.1\r\nHost: lo4d1ng.ceo\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nUpgrade-Insecure-Requests: 1\r\nSec-Fetch-Dest: document\r\nSec-Fetch-Mode: navigate\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ndate: Wed, 27 May 2026 00:41:35 GMT\r\ncontent-type: text/html; charset=UTF-8\r\nserver: Apache\r\nx-powered-by: PHP/7.4.33\r\nvary: Accept-Encoding\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"PHP:7.4.33","description":"PHP is a general-purpose scripting language used for web development.","website":"https://php.net","common_platform_enumeration":"cpe:2.3:a:php:php:*:*:*:*:*:*:*:*","icon":"PHP.svg","categories":["Programming languages"]},{"name":"Apache HTTP Server","description":"Apache is a free and open-source cross-platform web server software.","website":"https://httpd.apache.org/","common_platform_enumeration":"cpe:2.3:a:apache:http_server:*:*:*:*:*:*:*:*","icon":"Apache.svg","categories":["Web servers"]}],"data":{"size":65326,"size_decoded":0,"mime_type":"text/html; charset=UTF-8","magic":"HTML document, Unicode text, UTF-8 text, with very long lines (54287)","md5":"c0bb658e585c863b2c9f1c537d990672","sha1":"240af67845622a486bdf6f2a772ea54a387ebb69","sha256":"8a0353e37d16e5df0e48f213302f1811f9c60717bddcf8a1f6aec27313e66ef5","sha512":"091a217d17ade62fa28882c1a407b104846e7085a4b8779bbd061cbb7ebfc2ccef784605b55325fd42f52cccb85c17d3981dd8593b90ec93fdae0393f0e17f66","ssdeep":"1536:Kvhu80edYCuuRX+8MpFaYjzSQd+hKM4xmYneUlg0txX:eM6VRIjxnSS+1KmYePi","tlshash":"3b53e0e156e18220f6860012769b3a6a3d798493d54fd97af7ee2404cfc959ec83b39c","first_seen":"2026-03-18T15:54:02.971528Z","last_seen":"2026-05-27T00:41:57.312425Z","times_seen":6,"resource_available":false,"data":null}},"time_used":865,"timings":{"blocked":132,"dns":1,"connect":42,"send":0,"wait":598,"receive":0,"ssl":89},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-05-26","alert":"Sinkholed","trigger":"lo4d1ng.ceo","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-05-26","alert":"Sinkholed","trigger":"lo4d1ng.ceo","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"lo4d1ng.ceo/favicon.ico","fqdn":"lo4d1ng.ceo","domain":"lo4d1ng.ceo","tld":"ceo"},"ip":{"addr":"81.177.165.139","port":443,"asn":8342,"as":"JSC RTComm.RU","country":"Russia","country_code":"RU"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://lo4d1ng.ceo/","date":"2026-05-27T00:41:36.106Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.2","cert":{"subject":{"commonName":"lo4d1ng.ceo","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Thu, 21 May 2026 10:44:21 GMT","end":"Wed, 19 Aug 2026 10:44:20 GMT"},"fingerprint":{"sha1":"71:9B:27:6A:42:C4:12:07:B9:4E:88:24:B1:55:44:41:B2:7E:60:F8","sha256":"46:4E:AD:EC:CB:9C:FA:5D:1A:B2:EB:CD:77:FA:01:67:0A:C3:CC:F7:7F:52:EE:EF:76:59:3C:F9:FF:70:B2:46"}}},"request":{"raw":"GET /favicon.ico HTTP/1.1\r\nHost: lo4d1ng.ceo\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://lo4d1ng.ceo/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 404 Not Found\r\ndate: Wed, 27 May 2026 00:41:36 GMT\r\ncontent-type: text/html\r\ncontent-length: 634\r\nserver: Apache\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"404","status_text":"Not Found","fingerprints":[{"name":"Apache HTTP Server","description":"Apache is a free and open-source cross-platform web server software.","website":"https://httpd.apache.org/","common_platform_enumeration":"cpe:2.3:a:apache:http_server:*:*:*:*:*:*:*:*","icon":"Apache.svg","categories":["Web servers"]}],"data":{"size":634,"size_decoded":0,"mime_type":"text/html","magic":"HTML document, Unicode text, UTF-8 text, with very long lines (526), with no line terminators","md5":"47b971b9d908b4cdf9edf50cf42cd9d4","sha1":"276c9e8798ad4e3e959c280a08e66efbeaed4bf5","sha256":"aa74bb63be736aa40ac4e1592bfec7c97a92b15686353e87a5c7c4bc223f1360","sha512":"82c84288c64d45035bbba34731bda98b4c52329b893d8b7edd0a4a3ca644edd34c2c6f8c96637affdf1bf0e778c954838f025f3b9ffbe4c17b32a20a9ff7e9e2","ssdeep":"","tlshash":"a8f0dd730c6c801d9220d7d479a5b12c2dc5b9db75ea6d28d56028ad3ef23f4c953310","first_seen":"2023-04-23T07:49:39Z","last_seen":"2026-07-26T14:21:37.770787Z","times_seen":421,"resource_available":true,"data":null}},"time_used":43,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":43,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-05-26","alert":"Sinkholed","trigger":"lo4d1ng.ceo","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-05-26","alert":"Sinkholed","trigger":"lo4d1ng.ceo","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}}]}