{"report_id":"950814f8-ebf9-4c61-9c11-da6cf68a7371","version":6,"status":"done","tags":[],"date":"2026-03-13T03:33:15Z","url":{"schema":"https","addr":"kr2trfa.com/","fqdn":"kr2trfa.com","domain":"kr2trfa.com","tld":"com"},"ip":{"addr":"104.21.78.98","port":0,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"final":{"url":{"schema":"https","addr":"kr2trfa.com/","fqdn":"kr2trfa.com","domain":"kr2trfa.com","tld":"com"},"title":"KRAKEN","dom":{"size":21059,"mime_type":"text/html; charset=utf-8","magic":"HTML document, Unicode text, UTF-8 text, with very long lines (15982)","md5":"0b8a66a811e3acc77fb90b84e4f2bbd6","sha1":"7652d367a3e389de7aa01be3951c9f728c37d42c","sha256":"f6131289e8d2dbfdf87853d745994c0955e549c40c739790f4e76e99d0676826","sha512":"3039ca59a78d1280c5407d6bbd251c19a1d72f7bc87006cb7db70eeda5f9141bbc3bab2452b4adfd2887d4b8064d1023ee9ab6c62afa12210107905a7650136a","ssdeep":"384:nQnV5knTus83Eyd+SH4P6DNgorxn3bqxr9tw85liRnneqkYq2USZFx:nQnV5GHwb4P6Ko1IgteqkYq25Fx","tlshash":"5a92af36ea8b0042a8105838efa671d90f4cc47b584ae9b83b5c26ae3fcd1f44537b4d","dom_hash":"domhashe192326cf64dd9fe5c9525758063724f","first_seen":"2026-03-13T03:33:19.44892Z","last_seen":"2026-03-13T03:33:19.44892Z","times_seen":1,"resource_available":false,"data":null}},"submit":{"url":{"schema":"https","addr":"kr2trfa.com/","fqdn":"kr2trfa.com","domain":"kr2trfa.com","tld":"com"},"ip":{"addr":"104.21.78.98","port":0,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"tags":null,"meta":null},"settings":{"access":"public","device_type":"desktop","expires_at":"2027-04-17T03:33:15Z","useragent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0","referer":"","cookies":null,"exit_node":"z0yflva4pidy47h"},"stats":{"alert_count":{"ids":0,"urlquery":0,"analyzer":1}},"detection":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-03-13","alert":"Sinkholed","trigger":"kr2trfa.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null},"summary":[{"fqdn":"kr2trfa.com","ip":{"addr":"172.67.220.51","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"domain_registered":"unknown","domain_rank":0,"first_seen":"No data","last_seen":"No data","alert_count":3,"request_count":3,"received_data":23919,"sent_data":1345,"comment":"","tags":null,"fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}]}],"files":null,"artifacts":{"windows_shortcuts":null,"files":null,"telegram":null,"pdfs":null,"clipboard":null},"sensors":{"ids":null,"analyzer":null,"urlquery":null},"javascript":{"script":[{"url":{"schema":"https","addr":"kr2trfa.com/","fqdn":"kr2trfa.com","domain":"kr2trfa.com","tld":"com"},"ip":{"addr":"172.67.220.51","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"scriptElement","is_inline":true,"md5":"273a567817a222ea36919fed78ed00ab","sha1":"f06cf879535c926fcbfac6a0db31e6706f6ca8c9","sha256":"11704e45a48552b3c0b2401e267c18d07102c0519b68178b4a4560ef631fde1c","sha512":"95502cfd7842634e46346f85c7355dfddaeec1781591dfd4d3db8fd11dc63682f297e550ae952353dd5aa181d547b24165cbf023ddb4038a79d86c1be62c9681","ssdeep":"","tlshash":"2ee02076e352410399e1e0258d70658c603000db6c49f6bad0597451710defb747bdba","size":341,"data":"","first_seen":"2025-03-05T21:23:04.354995Z","last_seen":"2026-06-06T04:44:48.462876Z","times_seen":178,"alerts":{"ids":null,"analyzer":null,"urlquery":null}}],"eval":null,"write":null,"console":null},"http":[{"url":{"schema":"https","addr":"kr2trfa.com/","fqdn":"kr2trfa.com","domain":"kr2trfa.com","tld":"com"},"ip":{"addr":"172.67.220.51","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":true,"resource_type":"document","requested_by":"","date":"2026-03-13T03:32:53.363Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"kr2trfa.com","organization":""},"issuer":{"commonName":"E8","organization":"Let's Encrypt"},"validity":{"start":"Thu, 05 Mar 2026 03:11:08 GMT","end":"Wed, 03 Jun 2026 03:11:07 GMT"},"fingerprint":{"sha1":"60:4C:B2:9A:B2:DD:E7:30:B0:B1:B8:35:88:BF:67:1E:E9:EA:CD:FB","sha256":"0B:1B:0E:C6:4E:46:40:46:C6:64:AC:D9:9D:5D:64:9C:B3:59:ED:31:74:64:61:CD:68:A9:37:95:AD:BB:13:FB"}}},"request":{"raw":"GET / HTTP/1.1\r\nHost: kr2trfa.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nUpgrade-Insecure-Requests: 1\r\nSec-Fetch-Dest: document\r\nSec-Fetch-Mode: navigate\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ndate: Fri, 13 Mar 2026 03:32:53 GMT\r\ncontent-type: text/html;charset=UTF-8\r\nserver: cloudflare\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nset-cookie: scheck=1;Path=/;HttpOnly;Secure\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=5Scwx%2F5iNHxHobLdwe0I0ffE1NflkdLeX6YdqNhpG5zC%2BrnVSG5spHNWuzUWM5pHL6fU0VFmE%2BSbqkEk0sCO4aIiW3HE4CiBBvPh\"}]}\r\ncf-cache-status: DYNAMIC\r\nvary: accept-encoding\r\ncontent-encoding: br\r\ncf-ray: 9db7f959da0b2678-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":5494,"size_decoded":0,"mime_type":"text/html; charset=UTF-8","magic":"HTML document, Unicode text, UTF-8 text, with very long lines (514)","md5":"a84c2c49c7a8faff3454cc2428cb6055","sha1":"d8bb3674511fa4138b416f606e11d097f9fc3d23","sha256":"5f15ce653446abca74cf7917a04ab78a7a4f20ee37ffc41d553035d6491c4940","sha512":"44cf7dc7a9decd6fa95cc864f3e1def754bbe0d59875575f846c0947d98ec22e62ce84687aa76b43daaf16d54eb6e6206903289f054591c135df4e91e071f6c5","ssdeep":"96:BQnq6pPMMIW5aTiUf6n7iQfZTdyu7qFsejy:BQnV5Ja2USdpQuuFpjy","tlshash":"c9b16553d65704563402e434af9a77062ed8803be507e4643fdc66ad6fc66f489b3b8c","first_seen":"2026-03-13T03:33:19.450642Z","last_seen":"2026-03-13T04:30:50.699684Z","times_seen":2,"resource_available":false,"data":null}},"time_used":280,"timings":{"blocked":52,"dns":40,"connect":1,"send":0,"wait":169,"receive":0,"ssl":15},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-03-13","alert":"Sinkholed","trigger":"kr2trfa.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"kr2trfa.com/captcha","fqdn":"kr2trfa.com","domain":"kr2trfa.com","tld":"com"},"ip":{"addr":"172.67.220.51","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"fetch","requested_by":"https://kr2trfa.com/","date":"2026-03-13T03:32:53.746Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"kr2trfa.com","organization":""},"issuer":{"commonName":"E8","organization":"Let's Encrypt"},"validity":{"start":"Thu, 05 Mar 2026 03:11:08 GMT","end":"Wed, 03 Jun 2026 03:11:07 GMT"},"fingerprint":{"sha1":"60:4C:B2:9A:B2:DD:E7:30:B0:B1:B8:35:88:BF:67:1E:E9:EA:CD:FB","sha256":"0B:1B:0E:C6:4E:46:40:46:C6:64:AC:D9:9D:5D:64:9C:B3:59:ED:31:74:64:61:CD:68:A9:37:95:AD:BB:13:FB"}}},"request":{"raw":"GET /captcha HTTP/1.1\r\nHost: kr2trfa.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://kr2trfa.com/\r\nDNT: 1\r\nConnection: keep-alive\r\nCookie: scheck=1\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\nserver: cloudflare\r\ndate: Fri, 13 Mar 2026 03:32:53 GMT\r\ncontent-type: text/plain\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=q%2FqVyqG4GwsH1rYs5mBbweoCoVZoAECOF1HXQPCSK88u%2BUcw4iLCt8%2B0adxa3MvaS4lSaDOb2soLaSrACggN7ypbBNKJGMOTPBBf\"}]}\r\npriority: u=4,i=?0\r\ncache-control: no-cache\r\nset-cookie: cookref=https%3A%2F%2Fkr2trfa.com%2F;Path=/;HttpOnly;Secure\nses=exO9iO1ixEm2YLK5BQ;Path=/;HttpOnly;Secure\r\ncf-cache-status: DYNAMIC\r\ncontent-encoding: br\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncf-ray: 9db7f95bee218be6-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":15904,"size_decoded":0,"mime_type":"text/plain","magic":"ASCII text, with very long lines (15904), with no line terminators","md5":"109a5fac187608aa26f477132bcd92ee","sha1":"3016364fb60b67ff8f25da08b53f6f5e6ebc890d","sha256":"8db5584e89a066bb9cf69bf83bcc687520b98806c039f0723555fa0c9f496599","sha512":"092e44ed2d645f4aded6f824d4d70b3fe7c5e0fe7b0530c651a55a5320292f7d12d3ed32cfff90aaa929f7fc17e745b722543634ea841f04ee9248676521b2a9","ssdeep":"384:VnTus83Eyd+SH4P6DNgorxn3bqxr9tw85liRnneqkYO:pHwb4P6Ko1IgteqkYO","tlshash":"8b62be79eacb8587dda00d6de4a2b0e80b0ccdfa5cd99af9011c6aa233cc194553f749","first_seen":"2026-03-13T03:33:19.451684Z","last_seen":"2026-03-13T03:33:19.451684Z","times_seen":1,"resource_available":false,"data":null}},"time_used":126,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":123,"receive":3,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-03-13","alert":"Sinkholed","trigger":"kr2trfa.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"kr2trfa.com/favicon.ico","fqdn":"kr2trfa.com","domain":"kr2trfa.com","tld":"com"},"ip":{"addr":"172.67.220.51","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://kr2trfa.com/","date":"2026-03-13T03:32:53.853Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"kr2trfa.com","organization":""},"issuer":{"commonName":"E8","organization":"Let's Encrypt"},"validity":{"start":"Thu, 05 Mar 2026 03:11:08 GMT","end":"Wed, 03 Jun 2026 03:11:07 GMT"},"fingerprint":{"sha1":"60:4C:B2:9A:B2:DD:E7:30:B0:B1:B8:35:88:BF:67:1E:E9:EA:CD:FB","sha256":"0B:1B:0E:C6:4E:46:40:46:C6:64:AC:D9:9D:5D:64:9C:B3:59:ED:31:74:64:61:CD:68:A9:37:95:AD:BB:13:FB"}}},"request":{"raw":"GET /favicon.ico HTTP/1.1\r\nHost: kr2trfa.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://kr2trfa.com/\r\nCookie: scheck=1\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\nserver: cloudflare\r\ndate: Fri, 13 Mar 2026 03:32:54 GMT\r\ncontent-type: image/x-icon\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=LlRrxVXwsoQBaBKlEXQXW5GMibYQ4GM7y0OmhnL%2BbTlVt%2FqQRhHHw6s7GvOVWY4dceK6TBLsPzJl72Dsv7h3xsiTukfBhFPcBIBs\"}]}\r\nlast-modified: Fri, 24 Oct 2025 14:51:09 GMT\r\npriority: u=6,i=?0\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncontent-encoding: br\r\ncache-control: max-age=14400\r\ncf-cache-status: MISS\r\netag: W/\"68fb925d-256\"\r\ncf-ray: 9db7f95c9e2a8be6-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":598,"size_decoded":0,"mime_type":"image/x-icon","magic":"PNG image data, 16 x 16, 8-bit gray+alpha, non-interlaced","md5":"88dce50c34a848e75b6c7d916711e6b9","sha1":"0355f55c57c14900477cc886f3345b1e898fe28e","sha256":"4f0b7e5217318eedc1b42ca1ce5e128c649c97082912f1d800eec1325207ad96","sha512":"f6e0828ce51c9e2cb462b4884f01a5fb7083e4f26eeea1b596c5d04144b9226efb62347199546ce81e0473d97231cb1f6468ccc94e620cf83ffd9035fb63eed5","ssdeep":"","tlshash":"faf00ce3e838f489c98e2ca222911201da7585a723800819b6fac008ac20b885933f92","first_seen":"2023-05-10T12:46:36Z","last_seen":"2026-08-02T04:47:18.660775Z","times_seen":3764,"resource_available":false,"data":null}},"time_used":150,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":150,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-03-13","alert":"Sinkholed","trigger":"kr2trfa.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}}]}