{"report_id":"7e547fff-74e9-4a25-a49c-fa9f97e0d637","version":6,"status":"done","tags":[],"date":"2025-11-25T00:19:30Z","url":{"schema":"http","addr":"guardan.io/","fqdn":"guardan.io","domain":"guardan.io","tld":"io"},"ip":{"addr":"172.67.131.96","port":0,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"final":{"url":{"schema":"http","addr":"guardan.io/","fqdn":"guardan.io","domain":"guardan.io","tld":"io"},"title":"guardan.io/","dom":{"size":126,"mime_type":"text/html; charset=utf-8","magic":"HTML document, ASCII text, with no line terminators","md5":"d070ab4ac62f0308bb63dd910078ace5","sha1":"df37dd50408bd08f18536cbe189116ff57127896","sha256":"4fe6bb763b783ab8a84473642275087451510b3d40651777303f1c152e876720","sha512":"55f1aea170314af1656c8cd044067e01c33f0024e89d66d29dfa98279a8081f92411677d53bbc17de869650a4d2c6837a38e9dd673978eca1a96906ad220380c","ssdeep":"","tlshash":"d9b092baf1702480a9b22a8598aa2e435d3c877870066a091958607d4539b8ff8af3dc","dom_hash":"domhash1f07f384c75181c66badb60ab1ec770b","first_seen":"2025-11-16T01:32:24.341879Z","last_seen":"2025-12-17T14:32:53.419427Z","times_seen":4,"resource_available":false,"data":null}},"submit":{"url":{"schema":"http","addr":"guardan.io/","fqdn":"guardan.io","domain":"guardan.io","tld":"io"},"ip":{"addr":"172.67.131.96","port":0,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"tags":null,"meta":null},"settings":{"access":"public","device_type":"desktop","expires_at":"2026-12-30T00:19:30Z","useragent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0","referer":"","cookies":null,"exit_node":"z0yflva4pidy47h"},"stats":{"alert_count":{"ids":0,"urlquery":0,"analyzer":4}},"detection":{"ids":null,"analyzer":[{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2025-11-25","alert":"Sinkholed","trigger":"guardan.io","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2025-11-25","alert":"Sinkholed","trigger":"guardan.io","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-11-25","alert":"Sinkholed","trigger":"guardan.io","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2025-11-25","alert":"Sinkholed","trigger":"guardan.io","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null},"summary":[{"fqdn":"guardan.io","ip":{"addr":"104.21.3.247","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"domain_registered":"2025-03-08","domain_rank":0,"first_seen":"2025-06-28T19:17:47.52978Z","last_seen":"2025-11-16T01:32:23.642527Z","alert_count":12,"request_count":3,"received_data":2275,"sent_data":1219,"comment":"","tags":null,"fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"Express","description":"Express is a web application framework for Node.js, released as free and open-source software under the MIT License. It is designed for building web applications and APIs.","website":"https://expressjs.com","common_platform_enumeration":"cpe:2.3:a:expressjs:express:*:*:*:*:*:*:*:*","icon":"Express.svg","categories":["Web frameworks","Web servers"]},{"name":"Node.js","description":"Node.js is an open-source, cross-platform, JavaScript runtime environment that executes JavaScript code outside a web browser.","website":"https://nodejs.org","common_platform_enumeration":"cpe:2.3:a:nodejs:node.js:*:*:*:*:*:*:*:*","icon":"Node.js.svg","categories":["Programming languages"]}]}],"files":null,"artifacts":{"windows_shortcuts":null,"files":null,"telegram":null,"pdfs":null,"clipboard":null},"sensors":{"ids":null,"analyzer":null,"urlquery":null},"javascript":{"script":null,"eval":null,"write":null,"console":null},"http":[{"url":{"schema":"https","addr":"guardan.io/","fqdn":"guardan.io","domain":"guardan.io","tld":"io"},"ip":{"addr":"104.21.3.247","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":true,"resource_type":"document","requested_by":"","date":"2025-11-25T00:19:08.692Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"guardan.io","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Thu, 30 Oct 2025 15:05:31 GMT","end":"Wed, 28 Jan 2026 16:03:59 GMT"},"fingerprint":{"sha1":"0F:1B:82:4A:EE:76:DE:87:57:37:11:81:AB:34:AB:82:59:C7:B9:41","sha256":"FA:A0:8E:1B:32:66:66:CD:1C:92:FD:1D:B2:7E:07:1F:82:E0:97:C0:B8:25:A6:07:DB:24:6C:D2:21:11:4A:6A"}}},"request":{"raw":"GET / HTTP/1.1\r\nHost: guardan.io\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nUpgrade-Insecure-Requests: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: document\r\nSec-Fetch-Mode: navigate\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 404 Not Found\r\ndate: Tue, 25 Nov 2025 00:19:08 GMT\r\ncontent-type: text/html; charset=utf-8\r\nx-powered-by: Express\r\naccess-control-allow-origin: *\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\netag: W/\"57-CkZuP7W3L3T1xfF2f4lYEjvZSRU\"\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=Z08vfq1dnwwBP46eIwfif4aDIgVljiIyorJhTW4YYF5YhsoL4ev2fWptp3FugqQ%2Bad7%2B3WhhreEA63KHddLa7LyS47zh25lg\"}]}\r\ncf-cache-status: DYNAMIC\r\ncontent-encoding: br\r\nserver: cloudflare\r\ncf-ray: 9a3cf90b8c535697-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"404","status_text":"Not Found","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"Express","description":"Express is a web application framework for Node.js, released as free and open-source software under the MIT License. It is designed for building web applications and APIs.","website":"https://expressjs.com","common_platform_enumeration":"cpe:2.3:a:expressjs:express:*:*:*:*:*:*:*:*","icon":"Express.svg","categories":["Web frameworks","Web servers"]},{"name":"Node.js","description":"Node.js is an open-source, cross-platform, JavaScript runtime environment that executes JavaScript code outside a web browser.","website":"https://nodejs.org","common_platform_enumeration":"cpe:2.3:a:nodejs:node.js:*:*:*:*:*:*:*:*","icon":"Node.js.svg","categories":["Programming languages"]}],"data":{"size":87,"size_decoded":0,"mime_type":"text/html; charset=utf-8","magic":"ASCII text, with no line terminators","md5":"2ca64a4b8e9d72325c362522b3237143","sha1":"0a466e3fb5b72f74f5c5f1767f8958123bd94915","sha256":"e980165fbd43b80cb71b17bd49882bfe9d92517bb64b7e2ce29fb8b1efd86760","sha512":"04b6db63d360a54e2fa0ac0b811576a6956fdb548817bf8ff73dc03f2046fca8970be755588a68e6aacebae6926edcfe12f867aa3c51b93c76505a28faabc9ce","ssdeep":"","tlshash":"c9b01236f130244050a20504802e2c034c3c863460052109081c102d013474fb4ae358","first_seen":"2025-10-24T16:37:23.321829Z","last_seen":"2025-12-21T04:35:35.175056Z","times_seen":21,"resource_available":false,"data":null}},"time_used":209,"timings":{"blocked":40,"dns":21,"connect":1,"send":0,"wait":129,"receive":0,"ssl":15},"alerts":{"ids":null,"analyzer":[{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2025-11-25","alert":"Sinkholed","trigger":"guardan.io","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2025-11-25","alert":"Sinkholed","trigger":"guardan.io","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-11-25","alert":"Sinkholed","trigger":"guardan.io","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2025-11-25","alert":"Sinkholed","trigger":"guardan.io","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"http","addr":"guardan.io/","fqdn":"guardan.io","domain":"guardan.io","tld":"io"},"ip":{"addr":"104.21.3.247","port":80,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":true,"resource_type":"document","requested_by":"","date":"2025-11-25T00:19:08.969Z","timestamp":0,"http_version":"","security_state":"insecure","security_info":null,"request":{"raw":"GET / HTTP/1.1\r\nHost: guardan.io\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate\r\nDNT: 1\r\nConnection: keep-alive\r\nUpgrade-Insecure-Requests: 1\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 404 Not Found\r\nDate: Tue, 25 Nov 2025 00:19:09 GMT\r\nContent-Type: text/html; charset=utf-8\r\nTransfer-Encoding: chunked\r\nConnection: keep-alive\r\nX-Powered-By: Express\r\nAccess-Control-Allow-Origin: *\r\nNel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nETag: W/\"57-CkZuP7W3L3T1xfF2f4lYEjvZSRU\"\r\nReport-To: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=WcbIPr6PqvKIm4JgVd%2BxTvQCDH2uV%2FFxfv14nYunYs%2Bt50NvOfFXpr%2BIjif%2BpAFEQfUxIIC41qVTOwu21z%2BX5iCGUtOw2Zfl\"}]}\r\ncf-cache-status: DYNAMIC\r\nContent-Encoding: gzip\r\nServer: cloudflare\r\nCF-RAY: 9a3cf90d0d840b61-OSL\r\nalt-svc: h2=\":443\"; ma=60\r\n\r\n","headers":null,"cookies":null,"status_code":"404","status_text":"Not Found","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"Express","description":"Express is a web application framework for Node.js, released as free and open-source software under the MIT License. It is designed for building web applications and APIs.","website":"https://expressjs.com","common_platform_enumeration":"cpe:2.3:a:expressjs:express:*:*:*:*:*:*:*:*","icon":"Express.svg","categories":["Web frameworks","Web servers"]},{"name":"Node.js","description":"Node.js is an open-source, cross-platform, JavaScript runtime environment that executes JavaScript code outside a web browser.","website":"https://nodejs.org","common_platform_enumeration":"cpe:2.3:a:nodejs:node.js:*:*:*:*:*:*:*:*","icon":"Node.js.svg","categories":["Programming languages"]}],"data":{"size":87,"size_decoded":0,"mime_type":"text/html; charset=utf-8","magic":"ASCII text, with no line terminators","md5":"2ca64a4b8e9d72325c362522b3237143","sha1":"0a466e3fb5b72f74f5c5f1767f8958123bd94915","sha256":"e980165fbd43b80cb71b17bd49882bfe9d92517bb64b7e2ce29fb8b1efd86760","sha512":"04b6db63d360a54e2fa0ac0b811576a6956fdb548817bf8ff73dc03f2046fca8970be755588a68e6aacebae6926edcfe12f867aa3c51b93c76505a28faabc9ce","ssdeep":"","tlshash":"c9b01236f130244050a20504802e2c034c3c863460052109081c102d013474fb4ae358","first_seen":"2025-10-24T16:37:23.321829Z","last_seen":"2025-12-21T04:35:35.175056Z","times_seen":21,"resource_available":false,"data":null}},"time_used":131,"timings":{"blocked":-1,"dns":1,"connect":1,"send":0,"wait":129,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2025-11-25","alert":"Sinkholed","trigger":"guardan.io","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2025-11-25","alert":"Sinkholed","trigger":"guardan.io","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2025-11-25","alert":"Sinkholed","trigger":"guardan.io","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-11-25","alert":"Sinkholed","trigger":"guardan.io","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"http","addr":"guardan.io/favicon.ico","fqdn":"guardan.io","domain":"guardan.io","tld":"io"},"ip":{"addr":"104.21.3.247","port":80,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"http://guardan.io/","date":"2025-11-25T00:19:09.178Z","timestamp":0,"http_version":"","security_state":"insecure","security_info":null,"request":{"raw":"GET /favicon.ico HTTP/1.1\r\nHost: guardan.io\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: http://guardan.io/\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 404 Not Found\r\nDate: Tue, 25 Nov 2025 00:19:09 GMT\r\nContent-Type: text/html; charset=utf-8\r\nTransfer-Encoding: chunked\r\nConnection: keep-alive\r\nX-Powered-By: Express\r\nAccess-Control-Allow-Origin: *\r\nNel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nETag: W/\"57-CkZuP7W3L3T1xfF2f4lYEjvZSRU\"\r\nReport-To: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=mFgw1r6mIjdNtwYK87oH7fqw56lVnR%2FB1nHUVDIUKSJTA1G82%2BfpM4aB3qYeON%2BaWcCEbEUBotQ%2FjrxwxI94AmwCCDqVzg06\"}]}\r\nCache-Control: max-age=14400\r\ncf-cache-status: HIT\r\nVary: accept-encoding\r\nContent-Encoding: gzip\r\nServer: cloudflare\r\nCF-RAY: 9a3cf90e5dc00b61-OSL\r\nalt-svc: h2=\":443\"; ma=60\r\n\r\n","headers":null,"cookies":null,"status_code":"404","status_text":"Not Found","fingerprints":[{"name":"Express","description":"Express is a web application framework for Node.js, released as free and open-source software under the MIT License. It is designed for building web applications and APIs.","website":"https://expressjs.com","common_platform_enumeration":"cpe:2.3:a:expressjs:express:*:*:*:*:*:*:*:*","icon":"Express.svg","categories":["Web frameworks","Web servers"]},{"name":"Node.js","description":"Node.js is an open-source, cross-platform, JavaScript runtime environment that executes JavaScript code outside a web browser.","website":"https://nodejs.org","common_platform_enumeration":"cpe:2.3:a:nodejs:node.js:*:*:*:*:*:*:*:*","icon":"Node.js.svg","categories":["Programming languages"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":87,"size_decoded":0,"mime_type":"text/html; charset=utf-8","magic":"ASCII text, with no line terminators","md5":"2ca64a4b8e9d72325c362522b3237143","sha1":"0a466e3fb5b72f74f5c5f1767f8958123bd94915","sha256":"e980165fbd43b80cb71b17bd49882bfe9d92517bb64b7e2ce29fb8b1efd86760","sha512":"04b6db63d360a54e2fa0ac0b811576a6956fdb548817bf8ff73dc03f2046fca8970be755588a68e6aacebae6926edcfe12f867aa3c51b93c76505a28faabc9ce","ssdeep":"","tlshash":"c9b01236f130244050a20504802e2c034c3c863460052109081c102d013474fb4ae358","first_seen":"2025-10-24T16:37:23.321829Z","last_seen":"2025-12-21T04:35:35.175056Z","times_seen":21,"resource_available":false,"data":null}},"time_used":133,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":133,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2025-11-25","alert":"Sinkholed","trigger":"guardan.io","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2025-11-25","alert":"Sinkholed","trigger":"guardan.io","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2025-11-25","alert":"Sinkholed","trigger":"guardan.io","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-11-25","alert":"Sinkholed","trigger":"guardan.io","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}}]}