{"report_id":"a6b2b7d0-90ae-4a1f-be36-3c4e510ff7c6","version":0,"status":"done","tags":[],"date":"2026-08-24T06:09:20Z","url":{"schema":"https","addr":"chm1.top/","fqdn":"chm1.top","domain":"chm1.top","tld":"top"},"ip":{"addr":"212.118.55.209","port":0,"asn":216071,"as":"Servers Tech Fzco","country":"The Netherlands","country_code":"NL"},"final":{"url":{"schema":"https","addr":"chm1.top/","fqdn":"chm1.top","domain":"chm1.top","tld":"top"},"title":"chm1","dom":{"size":2576,"mime_type":"text/html; charset=utf-8","magic":"HTML document, Unicode text, UTF-8 text, with very long lines (1056)","md5":"c275f5d4e5538c7e04eb394522284ab8","sha1":"a79bb4b47812b5e1637300375be53f8f295e7d10","sha256":"1109310c3c88bdaf5e291ae32663388b91ccc5947451c9af0f1c18fa5c635a58","sha512":"54c076ab04ca674bf6ba15edf0cf30437f7fe1b5029239ec9cb77c22cf621bf37d640e75db68188bbd707326793ad55135e0394aa180cfa1db2f683b7ccc70c4","ssdeep":"","tlshash":"e65193b72c4685348a2a9270f4b3e9c8a466893af84bbc40b89c14755fe5bd48d77e0c","dom_hash":"domhashf2f6b7ce7d924300aa6db11859a51bff","first_seen":"2026-08-24T05:25:42.612326Z","last_seen":"2026-08-24T06:09:20.791694Z","times_seen":2,"resource_available":false,"data":null}},"submit":{"url":{"schema":"https","addr":"chm1.top/","fqdn":"chm1.top","domain":"chm1.top","tld":"top"},"ip":{"addr":"212.118.55.209","port":0,"asn":216071,"as":"Servers Tech Fzco","country":"The Netherlands","country_code":"NL"},"tags":null,"meta":null},"settings":{"access":"public","device_type":"desktop","expires_at":"2027-09-28T06:09:20Z","useragent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0","referer":"","cookies":null,"exit_node":"qguvgzjxzsgb3vs"},"stats":{"alert_count":{"ids":0,"urlquery":0,"analyzer":1}},"detection":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-08-24","alert":"Sinkholed","trigger":"chm1.top","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null},"summary":[{"fqdn":"chm1.top","ip":{"addr":"212.118.55.209","port":443,"asn":216071,"as":"Servers Tech Fzco","country":"The Netherlands","country_code":"NL"},"domain_registered":"2025-09-29","domain_rank":0,"first_seen":"2026-08-24T05:25:39.317595Z","last_seen":"2026-08-24T05:25:39.317595Z","alert_count":3,"request_count":3,"received_data":12949,"sent_data":1568,"comment":"","tags":null,"fingerprints":[{"name":"OpenResty","description":"OpenResty is a web platform based on nginx which can run Lua scripts using its LuaJIT engine.","website":"https://openresty.org","common_platform_enumeration":"","icon":"OpenResty.svg","categories":["Web servers"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}]}],"files":null,"artifacts":{"windows_shortcuts":null,"files":null,"telegram":null,"pdfs":null,"clipboard":null},"sensors":{"ids":null,"analyzer":null,"urlquery":null},"javascript":{"script":[{"url":{"schema":"https","addr":"chm1.top/","fqdn":"chm1.top","domain":"chm1.top","tld":"top"},"ip":{"addr":"212.118.55.209","port":443,"asn":216071,"as":"Servers Tech Fzco","country":"The Netherlands","country_code":"NL"},"introduction_type":"scriptElement","is_inline":true,"md5":"f745c22b8eb9b285d676b54de141f869","sha1":"3b380fe50a0e1157bfaa3b76ef04ca80c8ad2a4c","sha256":"0e3c46ef176a8c48db02ab9e446429608b74b8e4a5cd7db7ccb554850ab9e437","sha512":"b57f0a8e0efac9745add975681373d06475dc9b1a1bb46dceb314303c436b4c05bf7fb119da949692174072249652a07c0716f30212658bda677d04649c220e6","ssdeep":"","tlshash":"62c02b3b71092c74039bf936503fe3681b35300130011101d414084c4d96b8ce076c89","size":139,"data":"","first_seen":"2025-03-13T21:00:39.55932Z","last_seen":"2026-08-24T09:47:02.332711Z","times_seen":222,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"chm1.top/","fqdn":"chm1.top","domain":"chm1.top","tld":"top"},"ip":{"addr":"212.118.55.209","port":443,"asn":216071,"as":"Servers Tech Fzco","country":"The Netherlands","country_code":"NL"},"introduction_type":"scriptElement","is_inline":true,"md5":"3ef2f22b911d107b4c92384c31a6e9f2","sha1":"2c825aafd3f9ab6c3c5d595161212d0a4d579166","sha256":"9d594b22792cfe80f04c21b8815f73d4d045e8424cd99595659a1a53b4c42e34","sha512":"500c16c7c48ed1b57df01e838d616655ae49ad1125a5aa38d9fa1beb60a891a06286b9828c4e398607e41ae8de159ae0901d0e37c8db3fa1f832404982fd6507","ssdeep":"","tlshash":"edf041f73c890538c3a302613b739248303a243f340eac12b40c18623fa0f6518b750c","size":615,"data":"","first_seen":"2026-08-24T05:25:42.618847Z","last_seen":"2026-08-24T06:09:20.803749Z","times_seen":2,"alerts":{"ids":null,"analyzer":null,"urlquery":null}}],"eval":null,"write":null,"console":null},"http":[{"url":{"schema":"https","addr":"chm1.top/","fqdn":"chm1.top","domain":"chm1.top","tld":"top"},"ip":{"addr":"212.118.55.209","port":443,"asn":216071,"as":"Servers Tech Fzco","country":"The Netherlands","country_code":"NL"},"is_navigation_request":true,"resource_type":"document","requested_by":"","date":"2026-08-24T06:08:52.848Z","timestamp":1787551732848,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"chm1.top","organization":""},"issuer":{"commonName":"YE1","organization":"Let's Encrypt"},"validity":{"start":"Fri, 17 Jul 2026 21:56:56 GMT","end":"Thu, 15 Oct 2026 21:56:55 GMT"},"fingerprint":{"sha1":"7B:FC:79:ED:9E:30:D8:AD:66:5A:9B:43:B1:84:DC:16:F0:08:A6:3B","sha256":"C5:01:E2:42:67:69:B8:8A:7E:9A:AA:4E:E7:2B:A1:5B:2A:8F:7B:D5:46:9E:2B:C6:83:8F:96:FC:82:00:C7:2D"}}},"request":{"raw":"GET / HTTP/1.1\r\nHost: chm1.top\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nUpgrade-Insecure-Requests: 1\r\nSec-Fetch-Dest: document\r\nSec-Fetch-Mode: navigate\r\nSec-Fetch-Site: none\r\nPriority: u=0, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nalt-svc: h3=\":443\"; ma=2592000\r\ncache-control: no-cache\r\ncontent-encoding: gzip\r\ncontent-type: text/html\r\ndate: Mon, 24 Aug 2026 06:08:53 GMT\r\nexpires: Thu, 01 Jan 1970 00:00:01 GMT\r\nserver: openresty\r\nset-cookie: lox_session=7a66ff09467ae07ebd7fac63adf40f8d; Path=/; Max-Age=86400; HttpOnly; SameSite=Lax\r\nvia: 1.1 Caddy\r\ncontent-length: 1325\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":[{"name":"lox_session","value":"7a66ff09467ae07ebd7fac63adf40f8d","quoted":false,"path":"/","max_age":86400,"secure":false,"http_only":true,"same_site":"Lax","partitioned":false,"raw":"lox_session=7a66ff09467ae07ebd7fac63adf40f8d; Path=/; Max-Age=86400; HttpOnly; SameSite=Lax"}],"status_code":"200","status_text":"OK","fingerprints":[{"name":"OpenResty","description":"OpenResty is a web platform based on nginx which can run Lua scripts using its LuaJIT engine.","website":"https://openresty.org","common_platform_enumeration":"","icon":"OpenResty.svg","categories":["Web servers"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":2495,"size_decoded":1705,"mime_type":"text/html","magic":"HTML document, Unicode text, UTF-8 text, with very long lines (1057)","md5":"3851eb6f0bc7a43079662d972d36d28b","sha1":"11f1e30e549770574d38c4af3bfec6ac27aa99d6","sha256":"2f0e574c65e7d45a850b64b910b0270a37ddd8fbde9bdcd0623caf48b1845698","sha512":"5b64a0f80944017064e9c2afd47673ac814ffbe03982ea0f2daa5349f411839c0a451bb4aaaf6ffc3d0a25e2f8bdaa49e26049724acabd5ab7e76f7207f8f21e","ssdeep":"","tlshash":"ad5186772c464434852ac670f4b3e5c8a466893af90bbc40b88c14755fe9fd48d76e0c","first_seen":"2026-08-24T05:25:42.616449Z","last_seen":"2026-08-24T06:09:20.795029Z","times_seen":2,"resource_available":false,"data":null}},"time_used":481,"timings":{"blocked":-1,"dns":56,"connect":28,"send":0,"wait":328,"receive":0,"ssl":69},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-08-24","alert":"Sinkholed","trigger":"chm1.top","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"chm1.top/captcha","fqdn":"chm1.top","domain":"chm1.top","tld":"top"},"ip":{"addr":"212.118.55.209","port":443,"asn":216071,"as":"Servers Tech Fzco","country":"The Netherlands","country_code":"NL"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://chm1.top/","date":"2026-08-24T06:08:53.726Z","timestamp":1787551733726,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"chm1.top","organization":""},"issuer":{"commonName":"YE1","organization":"Let's Encrypt"},"validity":{"start":"Fri, 17 Jul 2026 21:56:56 GMT","end":"Thu, 15 Oct 2026 21:56:55 GMT"},"fingerprint":{"sha1":"7B:FC:79:ED:9E:30:D8:AD:66:5A:9B:43:B1:84:DC:16:F0:08:A6:3B","sha256":"C5:01:E2:42:67:69:B8:8A:7E:9A:AA:4E:E7:2B:A1:5B:2A:8F:7B:D5:46:9E:2B:C6:83:8F:96:FC:82:00:C7:2D"}}},"request":{"raw":"GET /captcha HTTP/1.1\r\nHost: chm1.top\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://chm1.top/\r\nCookie: lox_session=7a66ff09467ae07ebd7fac63adf40f8d\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=4, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\ncache-control: no-cache, no-store, max-age=0, must-revalidate\r\ncontent-encoding: gzip\r\ndate: Mon, 24 Aug 2026 06:08:53 GMT\r\nexpires: 0\r\nlast-modified: Thu, 02 Jun 2022 00:28:45 GMT\r\npragma: no-cache\r\nvia: 1.1 Caddy\r\ncache-directive: no-cache\r\netag: \"6298043d-1b41\"\r\ncontent-type: image/png\r\npragma-directive: no-cache\r\nserver: openresty\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"OpenResty","description":"OpenResty is a web platform based on nginx which can run Lua scripts using its LuaJIT engine.","website":"https://openresty.org","common_platform_enumeration":"","icon":"OpenResty.svg","categories":["Web servers"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":6977,"size_decoded":7356,"mime_type":"image/png","magic":"PNG image data, 285 x 77, 8-bit/color RGB, non-interlaced","md5":"22162cc36bf6cc2815aca4cb415a3b4d","sha1":"f7395c786ca8832dc446e7304b82ba8960df22e8","sha256":"34071da0056c40796bfb41adc937a2e4b91f4022707bbb634b72b4a3262d0831","sha512":"8a740855559f96f0f643123328e23886a3be030c6f4dcdacae34b31c8d93c7a61fdc7960ef4b6fd579ec254c5c06546041c48557487f87f1d91bfd491e5c5e11","ssdeep":"192:bqkmO0pz1jMxkLU/SQxM46xnpd7euuxGzNWwAWamBI:O5O0njMvHCL/7NGkNWwAWar","tlshash":"26e1af0a6e3a55edc99c5704c8adf99469a2002e231379cdbdfd86019a70fcc3789642","first_seen":"2026-08-24T06:09:20.796079Z","last_seen":"2026-08-24T06:09:20.796079Z","times_seen":1,"resource_available":false,"data":null}},"time_used":326,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":325,"receive":1,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-08-24","alert":"Sinkholed","trigger":"chm1.top","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"chm1.top/favicon.ico","fqdn":"chm1.top","domain":"chm1.top","tld":"top"},"ip":{"addr":"212.118.55.209","port":443,"asn":216071,"as":"Servers Tech Fzco","country":"The Netherlands","country_code":"NL"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://chm1.top/","date":"2026-08-24T06:08:53.830Z","timestamp":1787551733830,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"chm1.top","organization":""},"issuer":{"commonName":"YE1","organization":"Let's Encrypt"},"validity":{"start":"Fri, 17 Jul 2026 21:56:56 GMT","end":"Thu, 15 Oct 2026 21:56:55 GMT"},"fingerprint":{"sha1":"7B:FC:79:ED:9E:30:D8:AD:66:5A:9B:43:B1:84:DC:16:F0:08:A6:3B","sha256":"C5:01:E2:42:67:69:B8:8A:7E:9A:AA:4E:E7:2B:A1:5B:2A:8F:7B:D5:46:9E:2B:C6:83:8F:96:FC:82:00:C7:2D"}}},"request":{"raw":"GET /favicon.ico HTTP/1.1\r\nHost: chm1.top\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://chm1.top/\r\nCookie: lox_session=7a66ff09467ae07ebd7fac63adf40f8d\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=6\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\ndate: Mon, 24 Aug 2026 06:08:54 GMT\r\nexpires: Thu, 01 Jan 1970 00:00:01 GMT\r\nserver: openresty\r\ncontent-length: 1347\r\ncache-control: no-cache\r\nvia: 1.1 Caddy\r\ncontent-encoding: gzip\r\ncontent-type: text/html\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"OpenResty","description":"OpenResty is a web platform based on nginx which can run Lua scripts using its LuaJIT engine.","website":"https://openresty.org","common_platform_enumeration":"","icon":"OpenResty.svg","categories":["Web servers"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":2521,"size_decoded":1570,"mime_type":"text/html","magic":"HTML document, Unicode text, UTF-8 text, with very long lines (1072)","md5":"b0e9d1b015cf3cb8c5d3fcaa8fb101d5","sha1":"764986304c212fc7768b311d606c5846b793cb27","sha256":"f90011e9e51517b4c608626e7e98766bb4075f08e863e41bca93b04907f73c7c","sha512":"38456a556a924335a45d8cfe9b9aea4a47a93415c69f348a3c258fba7ccab75ec2d81f7bc57beb80c5976d711e3f3915b6f40f1d81e707c08a83fb6456b63221","ssdeep":"","tlshash":"295186772c468434852ad670f4b3e5c8a466893af90bbc40b89c24755fe9fd4cd76e0c","first_seen":"2026-08-24T05:25:42.615338Z","last_seen":"2026-08-24T06:09:20.802102Z","times_seen":2,"resource_available":false,"data":null}},"time_used":402,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":402,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-08-24","alert":"Sinkholed","trigger":"chm1.top","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}}]}