{"report_id":"a9069f2f-0187-4d15-9864-94855d77b0c1","version":6,"status":"done","tags":[],"date":"2026-05-12T01:59:22Z","url":{"schema":"https","addr":"mandalacraft.ro/lop/admin%20verify/","fqdn":"mandalacraft.ro","domain":"mandalacraft.ro","tld":"ro"},"ip":{"addr":"89.42.218.9","port":0,"asn":205275,"as":"ROMARG SRL","country":"Romania","country_code":"RO"},"final":{"url":{"schema":"https","addr":"mandalacraft.ro/lop/admin%20verify/","fqdn":"mandalacraft.ro","domain":"mandalacraft.ro","tld":"ro"},"title":"Email Settings | Verification","dom":{"size":17936,"mime_type":"text/html; charset=utf-8","magic":"HTML document, ASCII text, with very long lines (5198)","md5":"71af6e9b7987e4a4288c4fb641f635e0","sha1":"bad97ea96e3d8e7802e4bf131350ebad43253d4e","sha256":"741e6f76c24d0e271a58280b035a1a3b7c5751c56642effa449b440ac402bf18","sha512":"902f0437e54f797ed553076b9e22b962a0d9fe43f30d87a20022ea35e3d0d3230fbc0dac900b0b0c8b1179727e1a18c59422d75ca1d4bf8dd54943e56779de57","ssdeep":"192:PaWsN6tpy000Eipy000EYp6PN68IGpZrpMDgaVhSoqhaqpsEQaAp/zt2r000X1IB:HtQiQ5Ps8zfryD+J+E+1z0amECPWjc","tlshash":"7682463cb591c46d787b0a7beee66e49d8880f53c6ce674410dcc67d2bf8f1a2110696","dom_hash":"domhashdbea77f4d0b67eb2da87536aec438366","first_seen":"","last_seen":"","times_seen":0,"resource_available":false,"data":null}},"submit":{"url":{"schema":"https","addr":"mandalacraft.ro/lop/admin%20verify/","fqdn":"mandalacraft.ro","domain":"mandalacraft.ro","tld":"ro"},"ip":{"addr":"89.42.218.9","port":0,"asn":205275,"as":"ROMARG SRL","country":"Romania","country_code":"RO"},"tags":["openphish"],"meta":null},"settings":{"access":"public","device_type":"desktop","expires_at":"2027-06-16T01:59:22Z","useragent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0","referer":"","cookies":null,"exit_node":"z0yflva4pidy47h"},"stats":{"alert_count":{"ids":0,"urlquery":0,"analyzer":2}},"detection":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-05-12","alert":"Sinkholed","trigger":"mandalacraft.ro","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-05-12","alert":"Sinkholed","trigger":"mandalacraft.ro","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null},"summary":[{"fqdn":"mandalacraft.ro","ip":{"addr":"89.42.218.9","port":443,"asn":205275,"as":"ROMARG SRL","country":"Romania","country_code":"RO"},"domain_registered":"2025-10-02","domain_rank":0,"first_seen":"2026-03-22T15:44:58.388675Z","last_seen":"2026-04-15T12:24:40.209094Z","alert_count":8,"request_count":4,"received_data":58790,"sent_data":1933,"comment":"","tags":null,"fingerprints":[{"name":"LiteSpeed","description":"LiteSpeed is a high-scalability web server.","website":"https://litespeedtech.com","common_platform_enumeration":"cpe:2.3:a:litespeedtech:litespeed_web_server:*:*:*:*:*:*:*:*","icon":"LiteSpeed.svg","categories":["Web servers"]}]}],"files":null,"artifacts":{"windows_shortcuts":null,"files":null,"telegram":null,"pdfs":null,"clipboard":null},"sensors":{"ids":null,"analyzer":null,"urlquery":null},"javascript":{"script":[{"url":{"schema":"https","addr":"mandalacraft.ro/lop/admin%20verify/","fqdn":"mandalacraft.ro","domain":"mandalacraft.ro","tld":"ro"},"ip":{"addr":"89.42.218.9","port":443,"asn":205275,"as":"ROMARG SRL","country":"Romania","country_code":"RO"},"introduction_type":"scriptElement","is_inline":true,"md5":"35c48691ddb4b0807fa2f7874ee5a06a","sha1":"614feab698a1017cdf7b4fd8d985aae72b334702","sha256":"086c383d9587ccb93e64e46cb4a8104eed01b824ca562f9942e545e34fcad394","sha512":"536ccdba7c3da0b59d37b8acf4e2336eadc8c62d1f46dc3cf5609178cd9240797ccc89bd258f6f505f388d6eaea2e2ae3b78d8dd5bd3e69a5c7fb33e1c1ffeac","ssdeep":"96:naONsN6RKGpnUV000EipnUV000EYp6PM06erVyGpnPXBsspns:naWsN6tpy000Eipy000EYp6PN68IGpZW","tlshash":"38b1303c65a1d86d387b4abbfde79a15984c0f57d2ce671400ecc67d2af8f452100a57","size":5211,"data":"","first_seen":"2023-03-07T14:27:18Z","last_seen":"2026-05-12T01:59:23.404343Z","times_seen":86,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"mandalacraft.ro/lop/admin%20verify/","fqdn":"mandalacraft.ro","domain":"mandalacraft.ro","tld":"ro"},"ip":{"addr":"89.42.218.9","port":443,"asn":205275,"as":"ROMARG SRL","country":"Romania","country_code":"RO"},"introduction_type":"scriptElement","is_inline":true,"md5":"e8e75b64cf354a92238981bb4c8ff7dc","sha1":"92c7139ad3921981faaf76fab38b1acc0d611e0b","sha256":"fcaaf2dac7cd07b9c29b3d557e80341ce844a20ea15e6f0b005d1e88eb968ccb","sha512":"98bfd086551ba52dca05f9ab80c93227dfb2b83038c24f4b11da0745b47e93d49156c85e6934ed9cee9d7f1718002d73575c8853fb33f513f6592515d0b5db0c","ssdeep":"","tlshash":"cd413a3c6192d0beb8b74e7bede52e28d8980f93c9cd374400a886792ff8e197504657","size":2355,"data":"","first_seen":"2023-03-07T14:27:18Z","last_seen":"2026-05-12T01:59:23.40575Z","times_seen":86,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"mandalacraft.ro/lop/admin%20verify/","fqdn":"mandalacraft.ro","domain":"mandalacraft.ro","tld":"ro"},"ip":{"addr":"89.42.218.9","port":443,"asn":205275,"as":"ROMARG SRL","country":"Romania","country_code":"RO"},"introduction_type":"scriptElement","is_inline":true,"md5":"d4271c8b78e6b0cc93f5a9419cde6b01","sha1":"aa3bdb8bb9529f878053cb927277482c780c43ef","sha256":"43024d8f7cbc52fb31bd9bdbeab4ef7b1c756fc8547d2259ab23fe5484f12633","sha512":"4668a1f3a67737e847a185bc1b8dc153e6cf2235db750b54f9693163279e604860810ad76d99206c282ccb68f1cf445e10027c58b25609df49cda48ca90b3cde","ssdeep":"96:naApnScz/VgpgYk340004M7pqpEzn000mk3rOVnrV3Ve:naAp/zt2r000X1IU000P","tlshash":"e181813c75a1c0ade4bb0a6beda56959d8580f57cacd978800d8857c2ff8f5e3104b92","size":4161,"data":"","first_seen":"2023-03-07T14:27:18Z","last_seen":"2026-05-12T01:59:23.407616Z","times_seen":86,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"mandalacraft.ro/lop/admin%20verify/","fqdn":"mandalacraft.ro","domain":"mandalacraft.ro","tld":"ro"},"ip":{"addr":"89.42.218.9","port":443,"asn":205275,"as":"ROMARG SRL","country":"Romania","country_code":"RO"},"introduction_type":"scriptElement","is_inline":false,"md5":"eecd07c22cc00c609342129ad8fe641b","sha1":"c5f93a3b131012fcfbefa4e596d9ed4a0036d842","sha256":"05fe4a816f5950e877d650b20c87b0045708aa1d34bf710a9e29615849f704fd","sha512":"3a5b65c8c7440ea44d45b1ed52aeb2fac9d6690f986e2ae2d54979a25e53c7be9d5dfafdaa8e8c8895887a842e1d213a8071706feb580f84901b0dc6eef20a8e","ssdeep":"","tlshash":"cff0e229f64f49a0db6b3179676a52c836a8030bf902e0043c2ec8013f2845fe365b58","size":490,"data":"","first_seen":"2023-04-13T09:21:38Z","last_seen":"2026-05-12T01:59:23.409651Z","times_seen":86,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"mandalacraft.ro/lop/admin%20verify/","fqdn":"mandalacraft.ro","domain":"mandalacraft.ro","tld":"ro"},"ip":{"addr":"89.42.218.9","port":443,"asn":205275,"as":"ROMARG SRL","country":"Romania","country_code":"RO"},"introduction_type":"scriptElement","is_inline":true,"md5":"bf6ebd71aabe5f7ac14e31983440530f","sha1":"06b0efab0af8ca3fdd8d717627ffc81b98d1a6df","sha256":"7018572cd6d1916182277a3b42033d10c302be832ddda3c23b3b3a74f4ba259f","sha512":"2024da4830c63d6013e3ebe79d74a29d80545efe99fef1a42911e88896ce46c666749de7cbefeb5be25c0b5906ec09d8b115e6e239bcbb0c8dffeb047d551d78","ssdeep":"","tlshash":"ee31e539b4d194ad357b0aabed979a06cc0c4f52d3cf574401ec877d26fcf1a2210a6a","size":1764,"data":"","first_seen":"2023-03-07T14:27:18Z","last_seen":"2026-05-12T01:59:23.41041Z","times_seen":86,"alerts":{"ids":null,"analyzer":null,"urlquery":null}}],"eval":null,"write":[{"md5":"d5da4bc11ce0d78e51933026aec87ab3","sha1":"892a045851cf480bef6a4cb8bd5df204a7eb553e","sha256":"90393741756b9513295d6789b4831194fb6ee6a4cfce878e43f801a37c81b22f","sha512":"da985ab21d5694f49e279498f23455055dfc9bd9e666cbb24c3ca93431ed33669faba5473d3c1fe95580f02a2f1a59be098d636f7f5f0191fda9fb92225153ba","ssdeep":"","tlshash":"0cf0c2ae73cf98255fd20006d13abd8619d13070d67228203a4b7b6fe4451a876a3b8e","size":574,"data":"","first_seen":"2023-03-07T14:27:18Z","last_seen":"2026-05-12T01:59:23.411914Z","times_seen":86,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"md5":"02f98e109909541d3a4c18bad834ca94","sha1":"ff2076ee0f3f796ea042c5382d34e8249996e661","sha256":"a3d32e08b7bc8507197e181dcfeb233808d41154a60a898d1247e25dbbaba4ce","sha512":"2802cbb37568182daa1a11909890345a389cded26bf5f915749427e1997ae109545f1980b42d1d3c9727cc1e35c79903d31f57038dea8b5c732b51f6e363603f","ssdeep":"","tlshash":"d8318e6db78be93e8f670102d3797c942ae3b024d73204247a47b77f544115abe661ac","size":1723,"data":"","first_seen":"2023-03-07T14:27:18Z","last_seen":"2026-05-12T01:59:23.413701Z","times_seen":86,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"md5":"22552ac9c32f5dd3be104b878e2a615c","sha1":"4390aec1040eaafba8b75e8614701b0e95ef23c4","sha256":"6161402eb2580ae0378db35c173e710cf1cac7354be6ac99719ccc8b499be855","sha512":"983bd81a459a820dfe4f0f237471654646e2cb0a2b515febb8d54505f78669239082b5f053145edc13759ba5a278fc3b949d22d8b0082c0c8b59aa89100aa788","ssdeep":"","tlshash":"3b016d3a7b4f8a74cb272145a7396ac4b8ae5317750290043cad94033f7885f8ba56ac","size":771,"data":"","first_seen":"2023-03-07T14:27:18Z","last_seen":"2026-05-12T01:59:23.415179Z","times_seen":86,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"md5":"d16b423ae15d071a09abbef3b00c9078","sha1":"7a1851bc02a390baefe7f913b10572dff6ea92dc","sha256":"1d440b95fced58d7bb4b33f5a8f011d1bacb129cb81ca3d6ff68ce178b1ff749","sha512":"45508baa4dd86a00cec1fafcac626597b94f311a2e0d719f1ce486c0c73fd321e26b1fceb8fdf7e2fd7da64a5cf9b1f9b2a666b893b1028125f26aaa0c7c4bbe","ssdeep":"","tlshash":"d721d0b87b5f402536a28405b128fec324d76212515008507ddfbabff79d8b879712dc","size":1373,"data":"","first_seen":"2023-03-07T14:27:18Z","last_seen":"2026-05-12T01:59:23.41663Z","times_seen":86,"alerts":{"ids":null,"analyzer":null,"urlquery":null}}],"console":null},"http":[{"url":{"schema":"https","addr":"mandalacraft.ro/lop/admin%20verify/files/mail.png","fqdn":"mandalacraft.ro","domain":"mandalacraft.ro","tld":"ro"},"ip":{"addr":"89.42.218.9","port":443,"asn":205275,"as":"ROMARG SRL","country":"Romania","country_code":"RO"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://mandalacraft.ro/lop/admin%20verify/","date":"2026-05-12T01:59:00.458Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"indochina-art.ro","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Mon, 30 Mar 2026 17:44:08 GMT","end":"Sun, 28 Jun 2026 17:44:07 GMT"},"fingerprint":{"sha1":"A3:24:FB:2D:47:E5:AB:26:43:69:EE:F9:25:68:43:6C:37:33:E0:27","sha256":"5F:56:F3:F2:1D:41:8C:81:50:14:FD:E9:8F:8B:9D:DE:D9:20:E0:31:79:83:6A:83:40:69:B7:A5:EB:5E:B4:18"}}},"request":{"raw":"GET /lop/admin%20verify/files/mail.png HTTP/1.1\r\nHost: mandalacraft.ro\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://mandalacraft.ro/lop/admin%20verify/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\ncache-control: public, max-age=604800\r\nexpires: Tue, 19 May 2026 01:58:59 GMT\r\ncontent-type: image/png\r\nlast-modified: Mon, 13 Mar 2017 03:40:06 GMT\r\naccept-ranges: bytes\r\ncontent-length: 34328\r\ndate: Tue, 12 May 2026 01:58:59 GMT\r\nserver: LiteSpeed\r\nx-xss-protection: 1; mode=block\r\nx-content-type-options: nosniff\r\nalt-svc: h3=\":443\"; ma=2592000, h3-29=\":443\"; ma=2592000, h3-Q050=\":443\"; ma=2592000, h3-Q046=\":443\"; ma=2592000, h3-Q043=\":443\"; ma=2592000, quic=\":443\"; ma=2592000; v=\"43,46\"\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"LiteSpeed","description":"LiteSpeed is a high-scalability web server.","website":"https://litespeedtech.com","common_platform_enumeration":"cpe:2.3:a:litespeedtech:litespeed_web_server:*:*:*:*:*:*:*:*","icon":"LiteSpeed.svg","categories":["Web servers"]}],"data":{"size":34328,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 312 x 214, 8-bit/color RGBA, non-interlaced","md5":"23f7e3555145f8b35f9187347e80b490","sha1":"30be3577ba0615b4a350ffede5bab43332b7cedf","sha256":"e11a6773a10302f1d4a38c34b58395884c4ad628ff0f7842aa03fba5e8e50ab1","sha512":"96acb3864d3aba86abe64fbe1579b7b640ebc31e4d92015ca52e425c962a0f97215ac201a51cabacd6d820fa5fbb63c64aad963d53fcee69d28625a13cced748","ssdeep":"768:Y35cI0uCwufT2AYwGdSLdge33Q4dw9nxCqkcDMxdbYviEBs7LA:zI01wk2vdveNwuxxivimgLA","tlshash":"4df201189c61d4d33bf78062ef1fb64f3f97b05e6a86f128620094879281553bf83ca9","first_seen":"2023-05-01T12:03:36Z","last_seen":"2026-07-13T07:35:51.790516Z","times_seen":459,"resource_available":false,"data":null}},"time_used":84,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":69,"receive":15,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-05-12","alert":"Sinkholed","trigger":"mandalacraft.ro","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-05-12","alert":"Sinkholed","trigger":"mandalacraft.ro","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"mandalacraft.ro/lop/admin%20verify/files/id.png","fqdn":"mandalacraft.ro","domain":"mandalacraft.ro","tld":"ro"},"ip":{"addr":"89.42.218.9","port":443,"asn":205275,"as":"ROMARG SRL","country":"Romania","country_code":"RO"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://mandalacraft.ro/lop/admin%20verify/","date":"2026-05-12T01:59:00.461Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"indochina-art.ro","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Mon, 30 Mar 2026 17:44:08 GMT","end":"Sun, 28 Jun 2026 17:44:07 GMT"},"fingerprint":{"sha1":"A3:24:FB:2D:47:E5:AB:26:43:69:EE:F9:25:68:43:6C:37:33:E0:27","sha256":"5F:56:F3:F2:1D:41:8C:81:50:14:FD:E9:8F:8B:9D:DE:D9:20:E0:31:79:83:6A:83:40:69:B7:A5:EB:5E:B4:18"}}},"request":{"raw":"GET /lop/admin%20verify/files/id.png HTTP/1.1\r\nHost: mandalacraft.ro\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://mandalacraft.ro/lop/admin%20verify/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\ncache-control: public, max-age=604800\r\nexpires: Tue, 19 May 2026 01:58:59 GMT\r\ncontent-type: image/png\r\nlast-modified: Mon, 13 Mar 2017 03:40:06 GMT\r\naccept-ranges: bytes\r\ncontent-length: 4545\r\ndate: Tue, 12 May 2026 01:58:59 GMT\r\nserver: LiteSpeed\r\nx-xss-protection: 1; mode=block\r\nx-content-type-options: nosniff\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"LiteSpeed","description":"LiteSpeed is a high-scalability web server.","website":"https://litespeedtech.com","common_platform_enumeration":"cpe:2.3:a:litespeedtech:litespeed_web_server:*:*:*:*:*:*:*:*","icon":"LiteSpeed.svg","categories":["Web servers"]}],"data":{"size":4545,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 200 x 200, 8-bit/color RGBA, non-interlaced","md5":"20012b70e82c499b433b37b2a98b9079","sha1":"847a4aa7495440eeca16eb6211ec72c7dea2e22b","sha256":"272c9a8ee9faf4bb46b70403cda777ce98f24fd48b2083ee133478461261d5dd","sha512":"945eea20183a0f698e691395fdd6ccbddfd216906e1349b1db1d46a6a7154825df15e370f5f8729363848d3749b997b9e8f7704bbb045c9c971cb1f1b09090a6","ssdeep":"96:kId9viKmNuAlugFx86YPARZxlZfYbZI2YMWM+aZLu:kyiKWu1Ux8HIDdYG/MWr","tlshash":"0f918e75d375aea3f00da92669aad331cc6f181445221c9f227bc56f42b328e82f0770","first_seen":"2023-05-01T12:03:36Z","last_seen":"2026-07-13T07:35:51.79364Z","times_seen":461,"resource_available":false,"data":null}},"time_used":81,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":77,"receive":4,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-05-12","alert":"Sinkholed","trigger":"mandalacraft.ro","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-05-12","alert":"Sinkholed","trigger":"mandalacraft.ro","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"mandalacraft.ro/lop/admin%20verify/files/id.png","fqdn":"mandalacraft.ro","domain":"mandalacraft.ro","tld":"ro"},"ip":{"addr":"89.42.218.9","port":443,"asn":205275,"as":"ROMARG SRL","country":"Romania","country_code":"RO"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://mandalacraft.ro/lop/admin%20verify/","date":"2026-05-12T01:59:00.557Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"indochina-art.ro","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Mon, 30 Mar 2026 17:44:08 GMT","end":"Sun, 28 Jun 2026 17:44:07 GMT"},"fingerprint":{"sha1":"A3:24:FB:2D:47:E5:AB:26:43:69:EE:F9:25:68:43:6C:37:33:E0:27","sha256":"5F:56:F3:F2:1D:41:8C:81:50:14:FD:E9:8F:8B:9D:DE:D9:20:E0:31:79:83:6A:83:40:69:B7:A5:EB:5E:B4:18"}}},"request":{"raw":"GET /lop/admin%20verify/files/id.png HTTP/1.1\r\nHost: mandalacraft.ro\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://mandalacraft.ro/lop/admin%20verify/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\ncache-control: public, max-age=604800\r\nexpires: Tue, 19 May 2026 01:58:59 GMT\r\ncontent-type: image/png\r\nlast-modified: Mon, 13 Mar 2017 03:40:06 GMT\r\naccept-ranges: bytes\r\ncontent-length: 4545\r\ndate: Tue, 12 May 2026 01:58:59 GMT\r\nserver: LiteSpeed\r\nx-xss-protection: 1; mode=block\r\nx-content-type-options: nosniff\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"LiteSpeed","description":"LiteSpeed is a high-scalability web server.","website":"https://litespeedtech.com","common_platform_enumeration":"cpe:2.3:a:litespeedtech:litespeed_web_server:*:*:*:*:*:*:*:*","icon":"LiteSpeed.svg","categories":["Web servers"]}],"data":{"size":4545,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 200 x 200, 8-bit/color RGBA, non-interlaced","md5":"20012b70e82c499b433b37b2a98b9079","sha1":"847a4aa7495440eeca16eb6211ec72c7dea2e22b","sha256":"272c9a8ee9faf4bb46b70403cda777ce98f24fd48b2083ee133478461261d5dd","sha512":"945eea20183a0f698e691395fdd6ccbddfd216906e1349b1db1d46a6a7154825df15e370f5f8729363848d3749b997b9e8f7704bbb045c9c971cb1f1b09090a6","ssdeep":"96:kId9viKmNuAlugFx86YPARZxlZfYbZI2YMWM+aZLu:kyiKWu1Ux8HIDdYG/MWr","tlshash":"0f918e75d375aea3f00da92669aad331cc6f181445221c9f227bc56f42b328e82f0770","first_seen":"2023-05-01T12:03:36Z","last_seen":"2026-07-13T07:35:51.79364Z","times_seen":461,"resource_available":false,"data":null}},"time_used":67,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":66,"receive":1,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-05-12","alert":"Sinkholed","trigger":"mandalacraft.ro","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-05-12","alert":"Sinkholed","trigger":"mandalacraft.ro","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"mandalacraft.ro/lop/admin%20verify/","fqdn":"mandalacraft.ro","domain":"mandalacraft.ro","tld":"ro"},"ip":{"addr":"89.42.218.9","port":443,"asn":205275,"as":"ROMARG SRL","country":"Romania","country_code":"RO"},"is_navigation_request":true,"resource_type":"document","requested_by":"","date":"2026-05-12T01:58:59.955Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"indochina-art.ro","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Mon, 30 Mar 2026 17:44:08 GMT","end":"Sun, 28 Jun 2026 17:44:07 GMT"},"fingerprint":{"sha1":"A3:24:FB:2D:47:E5:AB:26:43:69:EE:F9:25:68:43:6C:37:33:E0:27","sha256":"5F:56:F3:F2:1D:41:8C:81:50:14:FD:E9:8F:8B:9D:DE:D9:20:E0:31:79:83:6A:83:40:69:B7:A5:EB:5E:B4:18"}}},"request":{"raw":"GET /lop/admin%20verify/ HTTP/1.1\r\nHost: mandalacraft.ro\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nUpgrade-Insecure-Requests: 1\r\nSec-Fetch-Dest: document\r\nSec-Fetch-Mode: navigate\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ncontent-type: text/html\r\nlast-modified: Mon, 13 Mar 2017 03:40:04 GMT\r\naccept-ranges: bytes\r\ncontent-encoding: br\r\nvary: Accept-Encoding\r\ncontent-length: 1791\r\ndate: Tue, 12 May 2026 01:58:59 GMT\r\nserver: LiteSpeed\r\nx-xss-protection: 1; mode=block\r\nx-content-type-options: nosniff\r\nalt-svc: h3=\":443\"; ma=2592000, h3-29=\":443\"; ma=2592000, h3-Q050=\":443\"; ma=2592000, h3-Q046=\":443\"; ma=2592000, h3-Q043=\":443\"; ma=2592000, quic=\":443\"; ma=2592000; v=\"43,46\"\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"LiteSpeed","description":"LiteSpeed is a high-scalability web server.","website":"https://litespeedtech.com","common_platform_enumeration":"cpe:2.3:a:litespeedtech:litespeed_web_server:*:*:*:*:*:*:*:*","icon":"LiteSpeed.svg","categories":["Web servers"]}],"data":{"size":13697,"size_decoded":0,"mime_type":"text/html","magic":"HTML document, ASCII text, with very long lines (5198)","md5":"45ce213cdcbfb5685c140f9f91d6c028","sha1":"6b3daa5c68bc26e5eb40c6a30b6072d92b0674e5","sha256":"3943467f91fb43e1bad6101dd2a5b82cef264eb9c776ba2a1df8b17ef2173d33","sha512":"70e51cd3387ebf0dc4b7854232a5d14c26c774bf7c20346379f3f2e53e5327cd762c1b85d98aa390369eb9d730690a86f5cd19f2a249cc46c004c3d20ba35627","ssdeep":"192:NaWsN6tpy000Eipy000EYp6PN68IGpZrpjaqplaAp/zt2r000X1IU000MaTPWjp9:ltQiQ5Ps8zfrNj1z0amVPWj7","tlshash":"72526b3c75a1d4ad747b0abbede66a15d8480f57c6ce674800ecc67c2bf8f5a3100a96","first_seen":"2023-04-13T09:21:38Z","last_seen":"2026-05-12T01:59:23.402743Z","times_seen":29,"resource_available":true,"data":null}},"time_used":540,"timings":{"blocked":233,"dns":97,"connect":66,"send":0,"wait":68,"receive":1,"ssl":73},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-05-12","alert":"Sinkholed","trigger":"mandalacraft.ro","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-05-12","alert":"Sinkholed","trigger":"mandalacraft.ro","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}}]}