{"report_id":"7bcbf074-be64-4ec2-a4a5-9d71f674c42c","version":6,"status":"done","tags":[],"date":"2026-04-17T13:56:38Z","url":{"schema":"http","addr":"privacnote.com/notes","fqdn":"privacnote.com","domain":"privacnote.com","tld":"com"},"ip":{"addr":"62.60.226.244","port":0,"asn":215939,"as":"Valery Smoliar","country":"Iran","country_code":"IR"},"final":{"url":{"schema":"https","addr":"privacnote.com/notes/","fqdn":"privacnote.com","domain":"privacnote.com","tld":"com"},"title":"Privnote - Send notes that will self-destruct after being read","dom":{"size":38003,"mime_type":"text/html; charset=utf-8","magic":"HTML document, Unicode text, UTF-8 text, with very long lines (10705)","md5":"effd382c4994e683bed60602fb47fe9f","sha1":"44cdecf3b75bf05d6565a7766d049f7707fb4dd5","sha256":"a39e85612900cf1cc6e4ad94e3a9d2e877fa4a3f0ea3a9680f874a2efac6ffee","sha512":"7f8b8c7925aa0773b58990719c417bbce519da698b0ec8790d8cae68468082128934904cce4b88577a36938e67f73e983b82991727bb58437b09d9b27878e065","ssdeep":"384:Tyte2P607RoLnjYlGwwilXYC7neY5qKlNlxV9Bqyt0rJ:dz07S7E9weH9Bqyt0rJ","tlshash":"8403d91860f20465412be0ba7b8b461a71b0c51b850b8f10fd3e8be59fe3cab9777795","dom_hash":"domhashd997856dac96d704928a58cb14989c18","first_seen":"2026-04-12T11:45:32.969306Z","last_seen":"2026-05-19T05:58:42.329674Z","times_seen":7,"resource_available":false,"data":null}},"submit":{"url":{"schema":"http","addr":"privacnote.com/notes","fqdn":"privacnote.com","domain":"privacnote.com","tld":"com"},"ip":{"addr":"62.60.226.244","port":0,"asn":215939,"as":"Valery Smoliar","country":"Iran","country_code":"IR"},"tags":null,"meta":null,"user":{"user_id":"akbkyowd9geqr98"}},"settings":{"access":"public","device_type":"desktop","expires_at":"2027-05-22T13:56:38Z","useragent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0","referer":"","cookies":null,"exit_node":"z0yflva4pidy47h"},"stats":{"alert_count":{"ids":1,"urlquery":0,"analyzer":2}},"detection":{"ids":[{"sensor_name":"suricata","title":"Suricata IDS","description":"Suricata /w Emerging Threats Pro","date":"2026-04-17T13:56:16Z","timestamp":1776434176,"ip_dst":{"addr":"Client IP","port":40854,"asn":0,"as":"","country":"","country_code":"zz"},"ip_src":{"addr":"62.60.226.244","port":443,"asn":215939,"as":"Valery Smoliar","country":"Iran","country_code":"IR"},"severity":"medium","alert":"ET DROP Spamhaus DROP Listed Traffic Inbound group 8","source":"{\"timestamp\":\"2026-04-17T13:56:16.808158+0000\",\"flow_id\":143087842161601,\"in_iface\":\"br-31613a7ed13b\",\"event_type\":\"alert\",\"src_ip\":\"62.60.226.244\",\"src_port\":443,\"dest_ip\":\"172.18.0.12\",\"dest_port\":40854,\"proto\":\"TCP\",\"metadata\":{\"flowbits\":[\"ET.Evil\",\"ET.DROPIP\"]},\"alert\":{\"action\":\"allowed\",\"gid\":1,\"signature_id\":2400007,\"rev\":4421,\"signature\":\"ET DROP Spamhaus DROP Listed Traffic Inbound group 8\",\"category\":\"Misc Attack\",\"severity\":2,\"metadata\":{\"affected_product\":[\"Any\"],\"attack_target\":[\"Any\"],\"created_at\":[\"2010_12_30\"],\"deployment\":[\"Perimeter\"],\"signature_severity\":[\"Minor\"],\"tag\":[\"Dshield\"],\"updated_at\":[\"2025_08_01\"]}},\"flow\":{\"pkts_toserver\":1,\"pkts_toclient\":1,\"bytes_toserver\":74,\"bytes_toclient\":74,\"start\":\"2026-04-17T13:56:16.783297+0000\"}}"}],"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-04-17","alert":"Sinkholed","trigger":"privacnote.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-04-17","alert":"Sinkholed","trigger":"privacnote.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null},"summary":[{"fqdn":"privacnote.com","ip":{"addr":"62.60.226.244","port":443,"asn":215939,"as":"Valery Smoliar","country":"Iran","country_code":"IR"},"domain_registered":"2026-04-08","domain_rank":0,"first_seen":"2026-04-12T11:45:29.075434Z","last_seen":"2026-04-12T11:45:29.075434Z","alert_count":12,"request_count":6,"received_data":99573,"sent_data":2774,"comment":"","tags":null,"fingerprints":[{"name":"Nginx:1.28.3","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}]}],"files":null,"artifacts":{"windows_shortcuts":null,"files":null,"telegram":null,"pdfs":null,"clipboard":null},"sensors":{"ids":null,"analyzer":null,"urlquery":null},"javascript":{"script":[{"url":{"schema":"https","addr":"privacnote.com/notes/","fqdn":"privacnote.com","domain":"privacnote.com","tld":"com"},"ip":{"addr":"62.60.226.244","port":443,"asn":215939,"as":"Valery Smoliar","country":"Iran","country_code":"IR"},"introduction_type":"scriptElement","is_inline":true,"md5":"a68faa5d423b77c3232d91ffddafd51a","sha1":"ba7b6ebac7a9111fec8cf9bdb625807aad8427df","sha256":"a37db3864cb48078c7451ceab31c8c1c246bbb30a716b7437b763a42b90c4287","sha512":"24543ec947413ccb11db8a2ed12eb8f0c650b8a3d769407c5b3aad1190233c841893c92e57bff860fcc9c581c976f1bc299560761ae368e9323f9be0bf585ccc","ssdeep":"192:q9WtJg+rDCMDMkXVL7TM+9BqytU6fS2Ud08qajdTc0q+UN:ZV9Bqyt0rE","tlshash":"3c628a5c64f308910627b07a4b9f5418b2b1d55b040ace007e2cd39daf66c6a87f9bea","size":14608,"data":"","first_seen":"2026-04-12T11:45:32.979422Z","last_seen":"2026-05-31T12:46:54.046755Z","times_seen":13,"alerts":{"ids":null,"analyzer":null,"urlquery":null}}],"eval":null,"write":null,"console":null},"http":[{"url":{"schema":"https","addr":"privacnote.com/notes/app.css","fqdn":"privacnote.com","domain":"privacnote.com","tld":"com"},"ip":{"addr":"62.60.226.244","port":443,"asn":215939,"as":"Valery Smoliar","country":"Iran","country_code":"IR"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://privacnote.com/notes/","date":"2026-04-17T13:56:17.087Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"privacnote.com","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Wed, 08 Apr 2026 15:00:56 GMT","end":"Tue, 07 Jul 2026 15:00:55 GMT"},"fingerprint":{"sha1":"B6:81:09:1E:AC:4D:28:44:AB:31:36:87:E3:28:06:21:AF:B1:2F:D5","sha256":"D2:80:92:7A:B0:E0:C3:9F:C1:AC:1B:03:A4:98:C1:31:35:AF:81:79:51:53:C8:0D:9C:37:FC:EA:39:51:6F:20"}}},"request":{"raw":"GET /notes/app.css HTTP/1.1\r\nHost: privacnote.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://privacnote.com/notes/\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nServer: nginx/1.28.3\r\nDate: Fri, 17 Apr 2026 13:56:17 GMT\r\nContent-Type: text/css\r\nLast-Modified: Fri, 10 Apr 2026 10:43:08 GMT\r\nTransfer-Encoding: chunked\r\nConnection: keep-alive\r\nETag: W/\"69d8d43c-301b\"\r\nContent-Encoding: gzip\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx:1.28.3","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":12315,"size_decoded":0,"mime_type":"text/css","magic":"ASCII text","md5":"15594e997d5591f286d0b0f39d4b72d7","sha1":"092b08a8c60a03fc934d54d24f14ae7f275ab90f","sha256":"10730a8aef489a646d7c34b7a7fc0d94040a4c957e0ccb6ce0c466eb293d5f68","sha512":"36e06764f6843b60c80eac7f190932321bf7bf2a200000a888d9174cc197634d4008a83a0dc50472a7a087068bc32fef978205fb6918e4bbba645e3f5702ee4a","ssdeep":"192:cqjQmjDun5+gYgH5bDhhbDKxFGFyFmFyKDrJD+yBqSEZD2ccR7D6cP7EmvURU2Ew:v5QBDXDKxFGFyFmFPDFDpADeGP","tlshash":"07423215aed30805b44bc8647babd781e32840139d0fde3dbe9eb694cf4d1a465b9b8c","first_seen":"2026-04-12T11:45:32.971469Z","last_seen":"2026-06-18T17:25:13.141898Z","times_seen":14,"resource_available":false,"data":null}},"time_used":25,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":25,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-04-17","alert":"Sinkholed","trigger":"privacnote.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-04-17","alert":"Sinkholed","trigger":"privacnote.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"privacnote.com/notes/privnote-logo.svg","fqdn":"privacnote.com","domain":"privacnote.com","tld":"com"},"ip":{"addr":"62.60.226.244","port":443,"asn":215939,"as":"Valery Smoliar","country":"Iran","country_code":"IR"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://privacnote.com/notes/","date":"2026-04-17T13:56:17.089Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"privacnote.com","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Wed, 08 Apr 2026 15:00:56 GMT","end":"Tue, 07 Jul 2026 15:00:55 GMT"},"fingerprint":{"sha1":"B6:81:09:1E:AC:4D:28:44:AB:31:36:87:E3:28:06:21:AF:B1:2F:D5","sha256":"D2:80:92:7A:B0:E0:C3:9F:C1:AC:1B:03:A4:98:C1:31:35:AF:81:79:51:53:C8:0D:9C:37:FC:EA:39:51:6F:20"}}},"request":{"raw":"GET /notes/privnote-logo.svg HTTP/1.1\r\nHost: privacnote.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://privacnote.com/notes/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nServer: nginx/1.28.3\r\nDate: Fri, 17 Apr 2026 13:56:17 GMT\r\nContent-Type: image/svg+xml\r\nContent-Length: 4176\r\nLast-Modified: Wed, 08 Apr 2026 15:46:28 GMT\r\nConnection: keep-alive\r\nETag: \"69d67854-1050\"\r\nAccept-Ranges: bytes\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx:1.28.3","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":4176,"size_decoded":0,"mime_type":"image/svg+xml","magic":"SVG Scalable Vector Graphics image","md5":"3ac4b26791b94e920eac8f1dd39f21b0","sha1":"9544c7029666841beb4ae6275428fad3d04d3208","sha256":"fa47222dd980603c69bd8a5ad7f80ec7ddde705c9daf415c0ae50a3ec9116c18","sha512":"49a038b96c993bd875900ce17272577e0baed83a602930f3eedb8381f2a2ccc919f8199f94fa6975408f0ae7c14f77a90651346dd942de41a233a83a14d37830","ssdeep":"96:COMq0AkrXKXGfOT60wRM0OSn7pmCfW+lLnBLoUNAIlDchb:C5q0AcXK/T60d0BndrfW+Rn9oUXlDCb","tlshash":"d08185ec69dc8c79888b4bc881deb4d7001da08fe16619bcb39b14e9663241f9d8cd59","first_seen":"2026-04-12T11:45:32.972484Z","last_seen":"2026-05-19T05:58:42.3447Z","times_seen":7,"resource_available":false,"data":null}},"time_used":48,"timings":{"blocked":22,"dns":0,"connect":0,"send":0,"wait":25,"receive":1,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-04-17","alert":"Sinkholed","trigger":"privacnote.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-04-17","alert":"Sinkholed","trigger":"privacnote.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"privacnote.com/notes/privnote-page-flip-30.png","fqdn":"privacnote.com","domain":"privacnote.com","tld":"com"},"ip":{"addr":"62.60.226.244","port":443,"asn":215939,"as":"Valery Smoliar","country":"Iran","country_code":"IR"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://privacnote.com/notes/","date":"2026-04-17T13:56:17.122Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"privacnote.com","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Wed, 08 Apr 2026 15:00:56 GMT","end":"Tue, 07 Jul 2026 15:00:55 GMT"},"fingerprint":{"sha1":"B6:81:09:1E:AC:4D:28:44:AB:31:36:87:E3:28:06:21:AF:B1:2F:D5","sha256":"D2:80:92:7A:B0:E0:C3:9F:C1:AC:1B:03:A4:98:C1:31:35:AF:81:79:51:53:C8:0D:9C:37:FC:EA:39:51:6F:20"}}},"request":{"raw":"GET /notes/privnote-page-flip-30.png HTTP/1.1\r\nHost: privacnote.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://privacnote.com/notes/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nServer: nginx/1.28.3\r\nDate: Fri, 17 Apr 2026 13:56:17 GMT\r\nContent-Type: image/png\r\nContent-Length: 174\r\nLast-Modified: Sun, 30 Nov 2025 09:42:22 GMT\r\nConnection: keep-alive\r\nETag: \"692c117e-ae\"\r\nAccept-Ranges: bytes\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx:1.28.3","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":174,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 30 x 30, 8-bit colormap, non-interlaced","md5":"eccb8dfcf75f2ddd8f2ce81533ebfb6a","sha1":"ec66a18b92a1635fd2fb2690e0823bbf375b4912","sha256":"0fda09b6fbd18ef079182f76f3a43a0aeedfcefac474efed7fb654e4dd9ae70a","sha512":"1ff3b76dc691123c3bd915ad67216e3a0a537038535017a47b6a2dfbaad41ba9b0b87380757651520464dc4fd1274dd7a6f3ce0fce25b43394040712745e1b34","ssdeep":"","tlshash":"b7c08cc7bd688e78cf230232eb25f20198cac74323219272188a882353e254480f6583","first_seen":"2025-04-25T09:36:31.317447Z","last_seen":"2026-06-18T17:25:13.115638Z","times_seen":84,"resource_available":false,"data":null}},"time_used":40,"timings":{"blocked":15,"dns":0,"connect":0,"send":0,"wait":25,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-04-17","alert":"Sinkholed","trigger":"privacnote.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-04-17","alert":"Sinkholed","trigger":"privacnote.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"privacnote.com/notes/favicon.ico","fqdn":"privacnote.com","domain":"privacnote.com","tld":"com"},"ip":{"addr":"62.60.226.244","port":443,"asn":215939,"as":"Valery Smoliar","country":"Iran","country_code":"IR"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://privacnote.com/notes/","date":"2026-04-17T13:56:17.178Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"privacnote.com","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Wed, 08 Apr 2026 15:00:56 GMT","end":"Tue, 07 Jul 2026 15:00:55 GMT"},"fingerprint":{"sha1":"B6:81:09:1E:AC:4D:28:44:AB:31:36:87:E3:28:06:21:AF:B1:2F:D5","sha256":"D2:80:92:7A:B0:E0:C3:9F:C1:AC:1B:03:A4:98:C1:31:35:AF:81:79:51:53:C8:0D:9C:37:FC:EA:39:51:6F:20"}}},"request":{"raw":"GET /notes/favicon.ico HTTP/1.1\r\nHost: privacnote.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://privacnote.com/notes/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nServer: nginx/1.28.3\r\nDate: Fri, 17 Apr 2026 13:56:17 GMT\r\nContent-Type: image/x-icon\r\nContent-Length: 5430\r\nLast-Modified: Sun, 30 Nov 2025 09:40:42 GMT\r\nConnection: keep-alive\r\nETag: \"692c111a-1536\"\r\nAccept-Ranges: bytes\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx:1.28.3","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":5430,"size_decoded":0,"mime_type":"image/x-icon","magic":"MS Windows icon resource - 2 icons, 16x16, 32 bits/pixel, 32x32, 32 bits/pixel","md5":"d4d9a16d1bbb97e341d99bbed2a3935a","sha1":"148873c298ca2de094c245c031499fd7390aa78f","sha256":"9b41efba844b0c019854e1f022e3fddb777d4a62365e00f113d721e0b3e6656d","sha512":"776858769c99d426365a8e25250a9d9f29689dfe94679eeb8ae6eb3d4ef8edf9d52704ebfb780c29091bba2656370d5a395714b21a04e9bfc2b1afe3989f0c49","ssdeep":"48:heeeeeeeeeeeeeeeeZeeWBeedeezeezeeXeeAeeceeegReeeeDSSreeeehweeeej:OC9SSSSSSSSSSSSSSSSSSLGbNrV","tlshash":"08b1b6f62888d861d6830fb32161522610509d8c6ef5952be35c3f6f75b12d15f34d27","first_seen":"2025-02-19T00:42:59.725686Z","last_seen":"2026-07-16T02:58:44.299552Z","times_seen":89,"resource_available":false,"data":null}},"time_used":25,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":25,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-04-17","alert":"Sinkholed","trigger":"privacnote.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-04-17","alert":"Sinkholed","trigger":"privacnote.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"privacnote.com/notes","fqdn":"privacnote.com","domain":"privacnote.com","tld":"com"},"ip":{"addr":"62.60.226.244","port":443,"asn":215939,"as":"Valery Smoliar","country":"Iran","country_code":"IR"},"is_navigation_request":true,"resource_type":"document","requested_by":"","date":"2026-04-17T13:56:16.783Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"privacnote.com","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Wed, 08 Apr 2026 15:00:56 GMT","end":"Tue, 07 Jul 2026 15:00:55 GMT"},"fingerprint":{"sha1":"B6:81:09:1E:AC:4D:28:44:AB:31:36:87:E3:28:06:21:AF:B1:2F:D5","sha256":"D2:80:92:7A:B0:E0:C3:9F:C1:AC:1B:03:A4:98:C1:31:35:AF:81:79:51:53:C8:0D:9C:37:FC:EA:39:51:6F:20"}}},"request":{"raw":"GET /notes HTTP/1.1\r\nHost: privacnote.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nUpgrade-Insecure-Requests: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: document\r\nSec-Fetch-Mode: navigate\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 301 Moved Permanently\r\nServer: nginx/1.28.3\r\nDate: Fri, 17 Apr 2026 13:56:16 GMT\r\nContent-Type: text/html\r\nContent-Length: 169\r\nLocation: https://privacnote.com/notes/\r\nConnection: keep-alive\r\n\r\n","headers":null,"cookies":null,"status_code":"301","status_text":"Moved Permanently","fingerprints":[{"name":"Nginx:1.28.3","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":38018,"size_decoded":0,"mime_type":"text/html; charset=utf-8","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-08-03T05:46:54.344469Z","times_seen":17684990,"resource_available":true,"data":null}},"time_used":138,"timings":{"blocked":56,"dns":1,"connect":25,"send":0,"wait":25,"receive":0,"ssl":28},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-04-17","alert":"Sinkholed","trigger":"privacnote.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-04-17","alert":"Sinkholed","trigger":"privacnote.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"privacnote.com/notes/","fqdn":"privacnote.com","domain":"privacnote.com","tld":"com"},"ip":{"addr":"62.60.226.244","port":443,"asn":215939,"as":"Valery Smoliar","country":"Iran","country_code":"IR"},"is_navigation_request":true,"resource_type":"document","requested_by":"","date":"2026-04-17T13:56:16.870Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"privacnote.com","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Wed, 08 Apr 2026 15:00:56 GMT","end":"Tue, 07 Jul 2026 15:00:55 GMT"},"fingerprint":{"sha1":"B6:81:09:1E:AC:4D:28:44:AB:31:36:87:E3:28:06:21:AF:B1:2F:D5","sha256":"D2:80:92:7A:B0:E0:C3:9F:C1:AC:1B:03:A4:98:C1:31:35:AF:81:79:51:53:C8:0D:9C:37:FC:EA:39:51:6F:20"}}},"request":{"raw":"GET /notes/ HTTP/1.1\r\nHost: privacnote.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nUpgrade-Insecure-Requests: 1\r\nSec-Fetch-Dest: document\r\nSec-Fetch-Mode: navigate\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nServer: nginx/1.28.3\r\nDate: Fri, 17 Apr 2026 13:56:16 GMT\r\nContent-Type: text/html; charset=utf-8\r\nLast-Modified: Fri, 10 Apr 2026 14:11:04 GMT\r\nTransfer-Encoding: chunked\r\nConnection: keep-alive\r\nETag: W/\"69d904f8-9482\"\r\nContent-Encoding: gzip\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx:1.28.3","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":38018,"size_decoded":0,"mime_type":"text/html; charset=utf-8","magic":"HTML document, Unicode text, UTF-8 text, with very long lines (10705)","md5":"cb8d6612975f9d69256ecac6ed78747d","sha1":"8c8b56308bd86c09b2914d1305bdc357bc4799cd","sha256":"9db0bbf459b111be5723e4ae123bca0e79563dff45f82b23aa1e8019c2b1c3cc","sha512":"7b336832fbdeaab0af620d9d6dec92302705831d15a9de76c00e41e615676c72b004995c34bea38cf0df2de493099ddd200bbcc3bf375ebf21bc14ff86c7f867","ssdeep":"384:Pyte2P607RoLnjYlGwwilXYC7neY5qKAN1xV9Bqyt0rN:pz07S7E9wey9Bqyt0rN","tlshash":"7103d91860f20465412be0ba7b8b461a71b0c51b850b8f10fd3ecbe59fe38ab9777795","first_seen":"2026-04-13T06:32:04.643626Z","last_seen":"2026-04-17T13:56:38.7046Z","times_seen":3,"resource_available":false,"data":null}},"time_used":27,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":26,"receive":1,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-04-17","alert":"Sinkholed","trigger":"privacnote.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-04-17","alert":"Sinkholed","trigger":"privacnote.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}}]}