{"report_id":"93c32846-0990-433a-953d-ea91c3176991","version":6,"status":"done","tags":["opendir"],"date":"2026-04-14T13:22:17Z","url":{"schema":"https","addr":"nomine.ro","fqdn":"nomine.ro","domain":"nomine.ro","tld":"ro"},"ip":{"addr":"195.20.203.130","port":0,"asn":41752,"as":"Teron Systems Srl","country":"Romania","country_code":"RO"},"final":{"url":{"schema":"https","addr":"nomine.ro/","fqdn":"nomine.ro","domain":"nomine.ro","tld":"ro"},"title":"Index of /","dom":{"size":769,"mime_type":"text/html; charset=utf-8","magic":"HTML document, ASCII text","md5":"7bc56b9465a14a3e9e406bc425089ef3","sha1":"1c3f6dcc2f4a9f469493b4e709a13802de39ea1f","sha256":"61565346f923a99a94026a447d83036fb9cc69e3585d845dc664f268c5cce42b","sha512":"d1164b58ed04666587fcdc29f4846cb34f5abe91cec0475afbc468ce0df2f5629d5a44883e1713aaa49d215d191c8d482a2967fa5ae5e5e43e93f7f11cde58ad","ssdeep":"","tlshash":"29014545b5d0227b2c91211bc0407dcac6f694b983b248743c8fb8d3db8deb885031e1","dom_hash":"domhash42e809a7585403f5ed9100552aa73714","first_seen":"2026-04-14T13:22:18.2812Z","last_seen":"2026-04-14T13:22:18.2812Z","times_seen":1,"resource_available":false,"data":null}},"submit":{"url":{"schema":"https","addr":"nomine.ro","fqdn":"nomine.ro","domain":"nomine.ro","tld":"ro"},"ip":{"addr":"195.20.203.130","port":0,"asn":41752,"as":"Teron Systems Srl","country":"Romania","country_code":"RO"},"tags":null,"meta":null,"user":{"user_id":"akbkyowd9geqr98"}},"settings":{"access":"public","device_type":"desktop","expires_at":"2027-05-19T13:22:17Z","useragent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0","referer":"","cookies":null,"exit_node":"z0yflva4pidy47h"},"stats":{"alert_count":{"ids":0,"urlquery":2,"analyzer":3}},"detection":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-04-14","alert":"Sinkholed","trigger":"nomine.ro","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-04-14","alert":"Phishing Block","trigger":"nomine.ro","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-04-14","alert":"Sinkholed","trigger":"nomine.ro","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":[{"sensor_name":"urlquery","alert":"Audit - Open directory","verdict":"none","severity":"audit","comment":"","tags":["opendir"],"meta":null},{"sensor_name":"urlquery","alert":"Audit - Open directory","verdict":"none","severity":"audit","comment":"","tags":["opendir"],"meta":null}]},"summary":[{"fqdn":"nomine.ro","ip":{"addr":"195.20.203.130","port":443,"asn":41752,"as":"Teron Systems Srl","country":"Romania","country_code":"RO"},"domain_registered":"2026-02-10","domain_rank":0,"first_seen":"2026-04-14T05:50:12.733096Z","last_seen":"2026-04-14T05:50:12.733096Z","alert_count":7,"request_count":2,"received_data":1530,"sent_data":903,"comment":"","tags":null,"fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}]}],"files":null,"artifacts":{"windows_shortcuts":null,"files":null,"telegram":null,"pdfs":null,"clipboard":null},"sensors":{"ids":null,"analyzer":null,"urlquery":[{"sensor_name":"urlquery","alert":"Audit - Open directory","verdict":"none","severity":"audit","comment":"","tags":["opendir"],"meta":null}]},"javascript":{"script":null,"eval":null,"write":null,"console":null},"http":[{"url":{"schema":"https","addr":"nomine.ro/","fqdn":"nomine.ro","domain":"nomine.ro","tld":"ro"},"ip":{"addr":"195.20.203.130","port":443,"asn":41752,"as":"Teron Systems Srl","country":"Romania","country_code":"RO"},"is_navigation_request":true,"resource_type":"document","requested_by":"","date":"2026-04-14T13:21:53.104Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.nomine.ro","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Sun, 12 Apr 2026 11:49:58 GMT","end":"Sat, 11 Jul 2026 11:49:57 GMT"},"fingerprint":{"sha1":"0C:DB:F3:6F:8E:69:86:63:CB:04:32:4E:E4:EC:BB:F1:A4:28:8D:68","sha256":"76:6E:78:40:0B:5D:15:C5:61:A6:76:26:83:5B:2D:29:F8:22:B9:C7:49:5A:26:0B:1A:F6:9A:78:23:D9:DA:45"}}},"request":{"raw":"GET / HTTP/1.1\r\nHost: nomine.ro\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nUpgrade-Insecure-Requests: 1\r\nSec-Fetch-Dest: document\r\nSec-Fetch-Mode: navigate\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nServer: nginx\r\nDate: Tue, 14 Apr 2026 13:21:53 GMT\r\nContent-Type: text/html;charset=ISO-8859-1\r\nContent-Length: 847\r\nConnection: keep-alive\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":847,"size_decoded":0,"mime_type":"text/html; charset=ISO-8859-1","magic":"HTML document, ASCII text","md5":"1d1fea2a45699463f71d72ad7dd7d794","sha1":"300006cdeaafdd7c8bf7abf6c230df72c8b69e1e","sha256":"afd6b9f67147817c4c4d295e4bfa0c4597380e42a50c8ab210a39da1e8113f59","sha512":"1080e942242ef7dbda8fbf86c4af213d3911662093ec0e2035fe5c6d8c8c0cf123e95deb50c8a4d20896e6629ff151851bb37db2099d305dd22af9adaf1513c1","ssdeep":"","tlshash":"9e014849a5e062b71891251bd1807dcac6f295ba83f249743c8fb8d3db8defc91071a6","first_seen":"2026-04-14T13:22:18.28318Z","last_seen":"2026-04-14T13:22:18.28318Z","times_seen":1,"resource_available":false,"data":null}},"time_used":324,"timings":{"blocked":128,"dns":1,"connect":62,"send":0,"wait":62,"receive":0,"ssl":68},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-04-14","alert":"Sinkholed","trigger":"nomine.ro","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-04-14","alert":"Phishing Block","trigger":"nomine.ro","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-04-14","alert":"Sinkholed","trigger":"nomine.ro","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":[{"sensor_name":"urlquery","alert":"Audit - Open directory","verdict":"none","severity":"audit","comment":"","tags":["opendir"],"meta":null}]}},{"url":{"schema":"https","addr":"nomine.ro/favicon.ico","fqdn":"nomine.ro","domain":"nomine.ro","tld":"ro"},"ip":{"addr":"195.20.203.130","port":443,"asn":41752,"as":"Teron Systems Srl","country":"Romania","country_code":"RO"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://nomine.ro/","date":"2026-04-14T13:21:53.458Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.nomine.ro","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Sun, 12 Apr 2026 11:49:58 GMT","end":"Sat, 11 Jul 2026 11:49:57 GMT"},"fingerprint":{"sha1":"0C:DB:F3:6F:8E:69:86:63:CB:04:32:4E:E4:EC:BB:F1:A4:28:8D:68","sha256":"76:6E:78:40:0B:5D:15:C5:61:A6:76:26:83:5B:2D:29:F8:22:B9:C7:49:5A:26:0B:1A:F6:9A:78:23:D9:DA:45"}}},"request":{"raw":"GET /favicon.ico HTTP/1.1\r\nHost: nomine.ro\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://nomine.ro/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 404 Not Found\r\nServer: nginx\r\nDate: Tue, 14 Apr 2026 13:21:53 GMT\r\nContent-Type: text/html; charset=iso-8859-1\r\nContent-Length: 355\r\nConnection: keep-alive\r\n\r\n","headers":null,"cookies":null,"status_code":"404","status_text":"Not Found","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":355,"size_decoded":0,"mime_type":"text/html; charset=iso-8859-1","magic":"HTML document, ASCII text","md5":"4525b2d648f7c457a689fd96421783a5","sha1":"11bfe30ce44585a15a38e86bc094224ddfe2c08e","sha256":"cc0b4e42510d49c6decd464123ecf3b14ae9b47f9b4ed2ee64893e2d6520a264","sha512":"94e3e8246cf38ff7740e51aa115c8c455b14f78e672c2686b782c0ce30b6fa2dbd91a78b29b3964d9c0414aabd4b9391fd5db326665e25b4b8e73dae60ffe979","ssdeep":"","tlshash":"71e0c04f4057b3474011a2907dc01291e505236b38a152f93ac09467500897dc4aa2dd","first_seen":"2025-12-09T03:51:58.5943Z","last_seen":"2026-08-08T05:28:14.062237Z","times_seen":54542,"resource_available":true,"data":null}},"time_used":81,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":81,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-04-14","alert":"Sinkholed","trigger":"nomine.ro","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-04-14","alert":"Phishing Block","trigger":"nomine.ro","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-04-14","alert":"Sinkholed","trigger":"nomine.ro","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}}]}