{"report_id":"a36d0040-bf83-45a6-b3f5-a4e658bc2d31","version":0,"status":"done","tags":[],"date":"2026-08-24T05:54:46Z","url":{"schema":"https","addr":"lineshop.icu/","fqdn":"lineshop.icu","domain":"lineshop.icu","tld":"icu"},"ip":{"addr":"212.118.55.209","port":0,"asn":216071,"as":"Servers Tech Fzco","country":"The Netherlands","country_code":"NL"},"final":{"url":{"schema":"https","addr":"lineshop.icu/","fqdn":"lineshop.icu","domain":"lineshop.icu","tld":"icu"},"title":"lineshop biz","dom":{"size":2670,"mime_type":"text/html; charset=utf-8","magic":"HTML document, Unicode text, UTF-8 text, with very long lines (1092)","md5":"11bde363b93784bf74a29ce7fb860649","sha1":"b9b8e3baa244e2c886ec0c2eb51d1def181bb945","sha256":"31bb490d05ac8b4b5d549aadedaf2d446aa205a31efc754b837ab1a53003618e","sha512":"e1261c5c822fca48c807859fcb6dff6ae7bcbac3ab0e2cfa427cc5a4e406f11a5aff13e80680e4e183949e7102ae9c70c756082d4aafe026a69d1a8a7e469900","ssdeep":"","tlshash":"a05184bb3c45842485269370f9a3eac86066983bfa0abc00f89c11784fe4fd48c72e5d","dom_hash":"domhashf2f6b7ce7d924300aa6db11859a51bff","first_seen":"2026-06-10T19:05:36.639758Z","last_seen":"2026-08-24T05:54:46.536084Z","times_seen":3,"resource_available":false,"data":null}},"submit":{"url":{"schema":"https","addr":"lineshop.icu/","fqdn":"lineshop.icu","domain":"lineshop.icu","tld":"icu"},"ip":{"addr":"212.118.55.209","port":0,"asn":216071,"as":"Servers Tech Fzco","country":"The Netherlands","country_code":"NL"},"tags":null,"meta":null},"settings":{"access":"public","device_type":"desktop","expires_at":"2027-09-28T05:54:46Z","useragent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0","referer":"","cookies":null,"exit_node":"qguvgzjxzsgb3vs"},"stats":{"alert_count":{"ids":0,"urlquery":0,"analyzer":2}},"detection":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-08-24","alert":"Sinkholed","trigger":"lineshop.icu","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-08-24","alert":"Sinkholed","trigger":"lineshop.icu","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null},"summary":[{"fqdn":"lineshop.icu","ip":{"addr":"212.118.55.209","port":443,"asn":216071,"as":"Servers Tech Fzco","country":"The Netherlands","country_code":"NL"},"domain_registered":"2026-03-08","domain_rank":0,"first_seen":"2026-06-10T19:05:33.340875Z","last_seen":"2026-08-24T05:32:31.266772Z","alert_count":6,"request_count":3,"received_data":15237,"sent_data":1588,"comment":"","tags":null,"fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"OpenResty","description":"OpenResty is a web platform based on nginx which can run Lua scripts using its LuaJIT engine.","website":"https://openresty.org","common_platform_enumeration":"","icon":"OpenResty.svg","categories":["Web servers"]}]}],"files":null,"artifacts":{"windows_shortcuts":null,"files":null,"telegram":null,"pdfs":null,"clipboard":null},"sensors":{"ids":null,"analyzer":null,"urlquery":null},"javascript":{"script":[{"url":{"schema":"https","addr":"lineshop.icu/","fqdn":"lineshop.icu","domain":"lineshop.icu","tld":"icu"},"ip":{"addr":"212.118.55.209","port":443,"asn":216071,"as":"Servers Tech Fzco","country":"The Netherlands","country_code":"NL"},"introduction_type":"scriptElement","is_inline":true,"md5":"f745c22b8eb9b285d676b54de141f869","sha1":"3b380fe50a0e1157bfaa3b76ef04ca80c8ad2a4c","sha256":"0e3c46ef176a8c48db02ab9e446429608b74b8e4a5cd7db7ccb554850ab9e437","sha512":"b57f0a8e0efac9745add975681373d06475dc9b1a1bb46dceb314303c436b4c05bf7fb119da949692174072249652a07c0716f30212658bda677d04649c220e6","ssdeep":"","tlshash":"62c02b3b71092c74039bf936503fe3681b35300130011101d414084c4d96b8ce076c89","size":139,"data":"","first_seen":"2025-03-13T21:00:39.55932Z","last_seen":"2026-08-24T09:47:02.332711Z","times_seen":222,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"lineshop.icu/","fqdn":"lineshop.icu","domain":"lineshop.icu","tld":"icu"},"ip":{"addr":"212.118.55.209","port":443,"asn":216071,"as":"Servers Tech Fzco","country":"The Netherlands","country_code":"NL"},"introduction_type":"scriptElement","is_inline":true,"md5":"cc265b081a9be978af85d19e32ab9728","sha1":"2048c9173610c9d1a56fe48019315790e77abd0a","sha256":"e48570ea52db832fe15743af8b8b896b74b9541bef554a87a3a6ac68be916ae9","sha512":"f574a617422d872491ce5f860dc5f37476c21246a025647b49c4eb861edc2baab1921fc7d937893fd96f75cf31dae3e8de4fffdd10276ef429ba1e416219c722","ssdeep":"","tlshash":"5ef041eb3c8a4038c3a302753b73d2483039243fb40eac52b51c28622f80e6514a764c","size":615,"data":"","first_seen":"2026-06-10T19:05:36.648463Z","last_seen":"2026-08-24T05:54:46.547261Z","times_seen":3,"alerts":{"ids":null,"analyzer":null,"urlquery":null}}],"eval":null,"write":null,"console":null},"http":[{"url":{"schema":"https","addr":"lineshop.icu/","fqdn":"lineshop.icu","domain":"lineshop.icu","tld":"icu"},"ip":{"addr":"212.118.55.209","port":443,"asn":216071,"as":"Servers Tech Fzco","country":"The Netherlands","country_code":"NL"},"is_navigation_request":true,"resource_type":"document","requested_by":"","date":"2026-08-24T05:54:17.370Z","timestamp":1787550857370,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"lineshop.icu","organization":""},"issuer":{"commonName":"YE1","organization":"Let's Encrypt"},"validity":{"start":"Fri, 17 Jul 2026 21:56:26 GMT","end":"Thu, 15 Oct 2026 21:56:25 GMT"},"fingerprint":{"sha1":"7B:4A:E6:B8:75:64:3B:60:24:EF:84:C5:8E:14:C4:3E:09:2C:0F:0F","sha256":"3A:63:EA:CA:3B:34:A8:78:7B:01:18:AA:A7:FA:20:35:FE:F4:74:DA:B9:A9:F8:40:FC:7C:D2:3B:09:37:63:9C"}}},"request":{"raw":"GET / HTTP/1.1\r\nHost: lineshop.icu\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nUpgrade-Insecure-Requests: 1\r\nSec-Fetch-Dest: document\r\nSec-Fetch-Mode: navigate\r\nSec-Fetch-Site: none\r\nPriority: u=0, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nalt-svc: h3=\":443\"; ma=2592000\r\ncache-control: no-cache\r\ncontent-encoding: gzip\r\ncontent-type: text/html\r\ndate: Mon, 24 Aug 2026 05:54:18 GMT\r\nexpires: Thu, 01 Jan 1970 00:00:01 GMT\r\nserver: openresty\r\nset-cookie: lox_session=067434a1dab5e3fc2d6e945d2d2ccc0e; Path=/; Max-Age=86400; HttpOnly; SameSite=Lax\r\nvia: 1.1 Caddy\r\ncontent-length: 1366\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":[{"name":"lox_session","value":"067434a1dab5e3fc2d6e945d2d2ccc0e","quoted":false,"path":"/","max_age":86400,"secure":false,"http_only":true,"same_site":"Lax","partitioned":false,"raw":"lox_session=067434a1dab5e3fc2d6e945d2d2ccc0e; Path=/; Max-Age=86400; HttpOnly; SameSite=Lax"}],"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"OpenResty","description":"OpenResty is a web platform based on nginx which can run Lua scripts using its LuaJIT engine.","website":"https://openresty.org","common_platform_enumeration":"","icon":"OpenResty.svg","categories":["Web servers"]}],"data":{"size":2589,"size_decoded":1746,"mime_type":"text/html","magic":"HTML document, Unicode text, UTF-8 text, with very long lines (1093)","md5":"7c69f39377f78908da237c8c724cc0e1","sha1":"98fe46728de3769f7c80ef0f35cfcc6b48b54d1f","sha256":"0ae867a65076ffeaf614482131bc0ea5ee77c4b17047295254c3c43002e0e858","sha512":"28c483a0bdc63989e1cc2d3d180265ca1d3b571d891492e43b0aa0c459278d54f22247f708f2accb792de16b3cc6bdf1efe5e6b6b06247580d28f66ced76f2d0","ssdeep":"","tlshash":"f451957b2c4584248526d330f9a3eac8a066583bfa0abc44b89c11794fe4fd48d72e5c","first_seen":"2026-06-10T19:05:36.642672Z","last_seen":"2026-08-24T05:54:46.538116Z","times_seen":3,"resource_available":false,"data":null}},"time_used":1356,"timings":{"blocked":-1,"dns":100,"connect":29,"send":0,"wait":1160,"receive":0,"ssl":66},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-08-24","alert":"Sinkholed","trigger":"lineshop.icu","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-08-24","alert":"Sinkholed","trigger":"lineshop.icu","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"lineshop.icu/captcha","fqdn":"lineshop.icu","domain":"lineshop.icu","tld":"icu"},"ip":{"addr":"212.118.55.209","port":443,"asn":216071,"as":"Servers Tech Fzco","country":"The Netherlands","country_code":"NL"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://lineshop.icu/","date":"2026-08-24T05:54:19.102Z","timestamp":1787550859102,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"lineshop.icu","organization":""},"issuer":{"commonName":"YE1","organization":"Let's Encrypt"},"validity":{"start":"Fri, 17 Jul 2026 21:56:26 GMT","end":"Thu, 15 Oct 2026 21:56:25 GMT"},"fingerprint":{"sha1":"7B:4A:E6:B8:75:64:3B:60:24:EF:84:C5:8E:14:C4:3E:09:2C:0F:0F","sha256":"3A:63:EA:CA:3B:34:A8:78:7B:01:18:AA:A7:FA:20:35:FE:F4:74:DA:B9:A9:F8:40:FC:7C:D2:3B:09:37:63:9C"}}},"request":{"raw":"GET /captcha HTTP/1.1\r\nHost: lineshop.icu\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://lineshop.icu/\r\nCookie: lox_session=067434a1dab5e3fc2d6e945d2d2ccc0e\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nserver: openresty\r\ncache-control: no-cache, no-store, max-age=0, must-revalidate\r\ncontent-encoding: gzip\r\ncontent-type: image/png\r\ndate: Mon, 24 Aug 2026 05:54:19 GMT\r\nlast-modified: Thu, 02 Jun 2022 00:28:44 GMT\r\npragma: no-cache\r\netag: \"6298043c-2375\"\r\nvia: 1.1 Caddy\r\npragma-directive: no-cache\r\ncache-directive: no-cache\r\nexpires: 0\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"OpenResty","description":"OpenResty is a web platform based on nginx which can run Lua scripts using its LuaJIT engine.","website":"https://openresty.org","common_platform_enumeration":"","icon":"OpenResty.svg","categories":["Web servers"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":9077,"size_decoded":9440,"mime_type":"image/png","magic":"PNG image data, 384 x 82, 8-bit/color RGB, non-interlaced","md5":"e2c790c758c0b008c6fefec9db3f4d08","sha1":"c91033e4a3fc8c298372acaebbaf8cdc77f22163","sha256":"ff423da11d4fcf56beb4cd3e2849f91b8680a299f994b81e4b2fd36cdcc64e5d","sha512":"17ee022ab4faaf941a64aec06acfe36d7318dbe5561e0f8c71e5d6a01d5e4b698d2bf16fb9a7b6e20c93d8a679c1ea4d05dd34a7a0ee0285c3ac274bba1c7e7d","ssdeep":"192:/Bdt+gxcEa03Et0Qd3mChK4sJbYPwvdorclz4t/XOOdK813idJDQdp0S8FKGY46o:Jz+ScEF3EtNmqLsGwvdaclkdt1SLDQ/c","tlshash":"e612bfbbc1bdc2c2dd101b74d1ccc8fdb4818cf56550a3dd9f2872241baa8356b58a27","first_seen":"2026-08-24T05:54:46.539549Z","last_seen":"2026-08-24T05:54:46.539549Z","times_seen":1,"resource_available":false,"data":null}},"time_used":336,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":336,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-08-24","alert":"Sinkholed","trigger":"lineshop.icu","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-08-24","alert":"Sinkholed","trigger":"lineshop.icu","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"lineshop.icu/favicon.ico","fqdn":"lineshop.icu","domain":"lineshop.icu","tld":"icu"},"ip":{"addr":"212.118.55.209","port":443,"asn":216071,"as":"Servers Tech Fzco","country":"The Netherlands","country_code":"NL"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://lineshop.icu/","date":"2026-08-24T05:54:19.207Z","timestamp":1787550859207,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"lineshop.icu","organization":""},"issuer":{"commonName":"YE1","organization":"Let's Encrypt"},"validity":{"start":"Fri, 17 Jul 2026 21:56:26 GMT","end":"Thu, 15 Oct 2026 21:56:25 GMT"},"fingerprint":{"sha1":"7B:4A:E6:B8:75:64:3B:60:24:EF:84:C5:8E:14:C4:3E:09:2C:0F:0F","sha256":"3A:63:EA:CA:3B:34:A8:78:7B:01:18:AA:A7:FA:20:35:FE:F4:74:DA:B9:A9:F8:40:FC:7C:D2:3B:09:37:63:9C"}}},"request":{"raw":"GET /favicon.ico HTTP/1.1\r\nHost: lineshop.icu\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://lineshop.icu/\r\nCookie: lox_session=067434a1dab5e3fc2d6e945d2d2ccc0e\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=6\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\ncontent-length: 1383\r\ncache-control: no-cache\r\ncontent-encoding: gzip\r\ncontent-type: text/html\r\ndate: Mon, 24 Aug 2026 05:54:19 GMT\r\nexpires: Thu, 01 Jan 1970 00:00:01 GMT\r\nserver: openresty\r\nvia: 1.1 Caddy\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"OpenResty","description":"OpenResty is a web platform based on nginx which can run Lua scripts using its LuaJIT engine.","website":"https://openresty.org","common_platform_enumeration":"","icon":"OpenResty.svg","categories":["Web servers"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":2615,"size_decoded":1606,"mime_type":"text/html","magic":"HTML document, Unicode text, UTF-8 text, with very long lines (1108)","md5":"b224ce12eb8d886fe64ca0ffdfbf271e","sha1":"964a315dc421b9ad94c00c8dd9ba38b383f1c09c","sha256":"26b433812786d15161988b680618d24a76f556151267d760b17efbc3ca90d0b5","sha512":"582931990792ed375d43961872b567fa131cfc4b3fdcb6223de844afb60b67a389b37c1c1a9f0c3af40fe924e47fbb239d00b3e4fa7a75ab818b4fc4c3733b50","ssdeep":"","tlshash":"f751967b2c5584248526d371f963eac86456583bfa0abc44b89c10794fe4fd4cd72e5c","first_seen":"2026-06-10T19:05:36.646293Z","last_seen":"2026-08-24T05:54:46.543503Z","times_seen":3,"resource_available":false,"data":null}},"time_used":486,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":486,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-08-24","alert":"Sinkholed","trigger":"lineshop.icu","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-08-24","alert":"Sinkholed","trigger":"lineshop.icu","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}}]}