{"report_id":"bc5a97e6-ca5d-4fe2-b0f8-9dff7b8f93f0","version":6,"status":"done","tags":[],"date":"2026-03-08T12:10:54Z","url":{"schema":"http","addr":"f4krw6wfqi327wcozwyvnwxtl46mnt7kcicpd6tuuqp5cwzb5ekq.mrciga.com","fqdn":"f4krw6wfqi327wcozwyvnwxtl46mnt7kcicpd6tuuqp5cwzb5ekq.mrciga.com","domain":"mrciga.com","tld":"com"},"ip":{"addr":"116.203.98.181","port":0,"asn":24940,"as":"Hetzner Online GmbH","country":"Germany","country_code":"DE"},"final":{"url":{"schema":"https","addr":"f4krw6wfqi327wcozwyvnwxtl46mnt7kcicpd6tuuqp5cwzb5ekq.mrciga.com/","fqdn":"f4krw6wfqi327wcozwyvnwxtl46mnt7kcicpd6tuuqp5cwzb5ekq.mrciga.com","domain":"mrciga.com","tld":"com"},"title":"f4krw6wfqi327wcozwyvnwxtl46mnt7kcicpd6tuuqp5cwzb5ekq.mrciga.com/","dom":{"size":22667,"mime_type":"text/html; charset=utf-8","magic":"HTML document, ASCII text, with very long lines (22667), with no line terminators","md5":"63782fba3307a6b1e9953e45b341f4b0","sha1":"4861e0bfd68693364fe3e98d17c99e1378639dbe","sha256":"467d494873ed2a3bff4e4d2853b098de30e97d4dab6c25e90532f0074ae49f5f","sha512":"0734c2633e855b41d72f779a9d134bfab40bdc2f502ac5cd87f0520fbb2046aac77707a3cffcf6335347fbba95c0f6ef1889970faad02a8b913090f670b56f43","ssdeep":"96:H5rFrLDjV+CZXUgpk5POtQw07/4P4lHFjySgSTfBHhSTqnrIsk8STcsk5rcfnk81:LDj9X04P4lHFjZdQvO3HNO","tlshash":"bca2cee17dd28c39e44616c8f0f0da29a0d3f69fdca2d884eed502fc27da994750d1a9","dom_hash":"domhash28085af6d1da0e32477dead0b0eb95c4","first_seen":"2026-03-08T12:10:55.160191Z","last_seen":"2026-03-08T12:10:55.160191Z","times_seen":1,"resource_available":false,"data":null}},"submit":{"url":{"schema":"http","addr":"f4krw6wfqi327wcozwyvnwxtl46mnt7kcicpd6tuuqp5cwzb5ekq.mrciga.com","fqdn":"f4krw6wfqi327wcozwyvnwxtl46mnt7kcicpd6tuuqp5cwzb5ekq.mrciga.com","domain":"mrciga.com","tld":"com"},"ip":{"addr":"116.203.98.181","port":0,"asn":24940,"as":"Hetzner Online GmbH","country":"Germany","country_code":"DE"},"tags":null,"meta":null},"settings":{"access":"public","device_type":"desktop","expires_at":"2027-04-12T12:10:54Z","useragent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0","referer":"","cookies":null,"exit_node":"z0yflva4pidy47h"},"stats":{"alert_count":{"ids":0,"urlquery":0,"analyzer":4}},"detection":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-03-08","alert":"Sinkholed","trigger":"f4krw6wfqi327wcozwyvnwxtl46mnt7kcicpd6tuuqp5cwzb5ekq.mrciga.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-03-08","alert":"Sinkholed","trigger":"f4krw6wfqi327wcozwyvnwxtl46mnt7kcicpd6tuuqp5cwzb5ekq.mrciga.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-03-08","alert":"Phishing Block","trigger":"f4krw6wfqi327wcozwyvnwxtl46mnt7kcicpd6tuuqp5cwzb5ekq.mrciga.com","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-03-08","alert":"Sinkholed","trigger":"f4krw6wfqi327wcozwyvnwxtl46mnt7kcicpd6tuuqp5cwzb5ekq.mrciga.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null},"summary":[{"fqdn":"f4krw6wfqi327wcozwyvnwxtl46mnt7kcicpd6tuuqp5cwzb5ekq.mrciga.com","ip":{"addr":"116.203.98.181","port":443,"asn":24940,"as":"Hetzner Online GmbH","country":"Germany","country_code":"DE"},"domain_registered":"unknown","domain_rank":0,"first_seen":"2026-02-10T11:06:25.536589Z","last_seen":"2026-02-10T11:06:25.536589Z","alert_count":4,"request_count":1,"received_data":1237,"sent_data":532,"comment":"","tags":null,"fingerprints":[{"name":"Envoy","description":"Envoy is an open-source edge and service proxy, designed for cloud-native applications.","website":"https://www.envoyproxy.io/","common_platform_enumeration":"cpe:2.3:a:envoyproxy:envoy:*:*:*:*:*:*:*:*","icon":"Envoy.png","categories":["Reverse proxies"]},{"name":"Ubuntu","description":"Ubuntu is a free and open-source operating system on Linux for the enterprise server, desktop, cloud, and IoT.","website":"https://www.ubuntu.com/server","common_platform_enumeration":"cpe:2.3:o:canonical:ubuntu_linux:*:*:*:*:*:*:*:*","icon":"Ubuntu.svg","categories":["Operating systems"]},{"name":"Nginx:1.18.0","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"Express","description":"Express is a web application framework for Node.js, released as free and open-source software under the MIT License. It is designed for building web applications and APIs.","website":"https://expressjs.com","common_platform_enumeration":"cpe:2.3:a:expressjs:express:*:*:*:*:*:*:*:*","icon":"Express.svg","categories":["Web frameworks","Web servers"]},{"name":"Node.js","description":"Node.js is an open-source, cross-platform, JavaScript runtime environment that executes JavaScript code outside a web browser.","website":"https://nodejs.org","common_platform_enumeration":"cpe:2.3:a:nodejs:node.js:*:*:*:*:*:*:*:*","icon":"Node.js.svg","categories":["Programming languages"]}]}],"files":null,"artifacts":{"windows_shortcuts":null,"files":null,"telegram":null,"pdfs":null,"clipboard":null},"sensors":{"ids":null,"analyzer":null,"urlquery":null},"javascript":{"script":null,"eval":null,"write":null,"console":null},"http":[{"url":{"schema":"https","addr":"f4krw6wfqi327wcozwyvnwxtl46mnt7kcicpd6tuuqp5cwzb5ekq.mrciga.com/","fqdn":"f4krw6wfqi327wcozwyvnwxtl46mnt7kcicpd6tuuqp5cwzb5ekq.mrciga.com","domain":"mrciga.com","tld":"com"},"ip":{"addr":"116.203.98.181","port":443,"asn":24940,"as":"Hetzner Online GmbH","country":"Germany","country_code":"DE"},"is_navigation_request":true,"resource_type":"document","requested_by":"","date":"2026-03-08T12:10:33.549Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"mrciga.com","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Tue, 06 Jan 2026 22:08:38 GMT","end":"Mon, 06 Apr 2026 22:08:37 GMT"},"fingerprint":{"sha1":"B0:9A:69:05:67:45:71:7C:6D:E6:B3:5D:4C:E1:86:AA:7E:75:08:0E","sha256":"F5:FC:73:9E:42:C4:22:0B:CD:ED:CE:B7:EA:9F:A5:59:61:08:7B:5C:4A:F6:BE:B6:0F:15:06:52:60:AF:4B:D3"}}},"request":{"raw":"GET / HTTP/1.1\r\nHost: f4krw6wfqi327wcozwyvnwxtl46mnt7kcicpd6tuuqp5cwzb5ekq.mrciga.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nUpgrade-Insecure-Requests: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: document\r\nSec-Fetch-Mode: navigate\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nServer: nginx/1.18.0 (Ubuntu)\r\nDate: Sun, 08 Mar 2026 12:10:33 GMT\r\nContent-Type: application/json; charset=utf-8\r\nContent-Length: 249\r\nConnection: keep-alive\r\nx-powered-by: Express\r\naccess-control-allow-origin: *\r\naccess-control-expose-headers: content-length,content-encoding,X-Payment,X-Payment-Response,X-AR-IO-Hops,X-AR-IO-Origin,X-AR-IO-Origin-Node-Release,X-AR-IO-Digest,Content-Digest,X-AR-IO-Expected-Digest,X-AR-IO-Stable,X-AR-IO-Verified,X-AR-IO-Trusted,X-Cache,X-AR-IO-Chunk-Source-Type,X-AR-IO-Chunk-Host,X-AR-IO-Root-Transaction-Id,X-AR-IO-Data-Item-Data-Offset,X-AR-IO-Data-Item-Root-Parent-Offset,X-AR-IO-Data-Item-Offset,X-AR-IO-Data-Item-Size,X-AR-IO-Root-Data-Item-Offset,X-AR-IO-Root-Data-Offset,X-ArNS-TTL-Seconds,X-ArNS-Name,X-ArNS-Basename,X-ArNS-Record,X-ArNS-Resolved-Id,X-AR-IO-Data-Id,X-ArNS-Process-Id,X-ArNS-Resolved-At,X-ArNS-Undername-Limit,X-ArNS-Record-Index\r\netag: W/\"f9-lNGfDShbNzWK9O6yy85pvj7ThbM\"\r\nx-envoy-upstream-service-time: 1\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Envoy","description":"Envoy is an open-source edge and service proxy, designed for cloud-native applications.","website":"https://www.envoyproxy.io/","common_platform_enumeration":"cpe:2.3:a:envoyproxy:envoy:*:*:*:*:*:*:*:*","icon":"Envoy.png","categories":["Reverse proxies"]},{"name":"Ubuntu","description":"Ubuntu is a free and open-source operating system on Linux for the enterprise server, desktop, cloud, and IoT.","website":"https://www.ubuntu.com/server","common_platform_enumeration":"cpe:2.3:o:canonical:ubuntu_linux:*:*:*:*:*:*:*:*","icon":"Ubuntu.svg","categories":["Operating systems"]},{"name":"Nginx:1.18.0","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"Express","description":"Express is a web application framework for Node.js, released as free and open-source software under the MIT License. It is designed for building web applications and APIs.","website":"https://expressjs.com","common_platform_enumeration":"cpe:2.3:a:expressjs:express:*:*:*:*:*:*:*:*","icon":"Express.svg","categories":["Web frameworks","Web servers"]},{"name":"Node.js","description":"Node.js is an open-source, cross-platform, JavaScript runtime environment that executes JavaScript code outside a web browser.","website":"https://nodejs.org","common_platform_enumeration":"cpe:2.3:a:nodejs:node.js:*:*:*:*:*:*:*:*","icon":"Node.js.svg","categories":["Programming languages"]}],"data":{"size":249,"size_decoded":0,"mime_type":"application/vnd.mozilla.json.view; charset=utf-8","magic":"JSON text data","md5":"ff9e95cc24c132901326a0370066e38c","sha1":"94d19f0d285b37358af4eeb2cbce69be3ed385b3","sha256":"1c0eddc75cf2e2d62a373170dd5541c7969e16dd9b75450ae12d8745c8e4ea40","sha512":"23fd4fd768a81019a365ee30665ced8331d9241010344ba59eadf55a29adcef703f9540e82b5693f9fa69c0b3f31f35f82d7e55e77b07edef486188e7a52eb7e","ssdeep":"","tlshash":"d1d02e022aae02a1e8e0428ab2451a1f996202bb27a48b9d048c302081aa02d89338e3","first_seen":"2026-02-10T13:27:25.185247Z","last_seen":"2026-03-08T13:39:10.035494Z","times_seen":3,"resource_available":false,"data":null}},"time_used":205,"timings":{"blocked":84,"dns":5,"connect":36,"send":0,"wait":37,"receive":0,"ssl":40},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-03-08","alert":"Sinkholed","trigger":"f4krw6wfqi327wcozwyvnwxtl46mnt7kcicpd6tuuqp5cwzb5ekq.mrciga.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-03-08","alert":"Sinkholed","trigger":"f4krw6wfqi327wcozwyvnwxtl46mnt7kcicpd6tuuqp5cwzb5ekq.mrciga.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-03-08","alert":"Phishing Block","trigger":"f4krw6wfqi327wcozwyvnwxtl46mnt7kcicpd6tuuqp5cwzb5ekq.mrciga.com","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-03-08","alert":"Sinkholed","trigger":"f4krw6wfqi327wcozwyvnwxtl46mnt7kcicpd6tuuqp5cwzb5ekq.mrciga.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}}]}