{"report_id":"c2b95176-5f99-410d-bb49-5dab8fd12551","version":6,"status":"done","tags":["phishing","kali365","aitm"],"date":"2026-04-01T00:17:50Z","url":{"schema":"http","addr":"c4.xkrmec2.click/909","fqdn":"c4.xkrmec2.click","domain":"xkrmec2.click","tld":"click"},"ip":{"addr":"66.116.210.66","port":0,"asn":394695,"as":"PUBLIC-DOMAIN-REGISTRY","country":"United Arab Emirates","country_code":"AE"},"final":{"url":{"schema":"https","addr":"file.newmarys.com/l/LvjdC7bMirE","fqdn":"file.newmarys.com","domain":"newmarys.com","tld":"com"},"title":"Loading...","dom":{"size":6774,"mime_type":"text/html; charset=utf-8","magic":"JavaScript source, Unicode text, UTF-8 text, with very long lines (1015)","md5":"daf3dddf204e0d564b93732347e4876f","sha1":"f9d5e86e0e3f86e6f222c374d639d904380bc36e","sha256":"386bce492ee1dfc6ecdcb25e9c386814606321b32bd510a1907dedd1a422f912","sha512":"54d14bae12ea4caaa69493399dfee05404f83e83f8a1d00b1c8cc1192ce6ca20b3dea50ef01f8f790b830b21064d67f24018d6705970428426fdb2152fbd2524","ssdeep":"192:mWOZSvWlMMA1xMJ149CKqXz0FMp+SvtgxS:JOkeF4M4qXz8Mp+uGxS","tlshash":"9fe1b6b2f2991039f57bc8d2f530a7df34808a1bf4978a00daa96635d5c1dd36a36784","dom_hash":"domhash8b162288231f38f7cc5ec67a6d7f97b9","first_seen":"2026-04-01T00:17:51.360524Z","last_seen":"2026-04-01T00:17:51.360524Z","times_seen":1,"resource_available":false,"data":null}},"submit":{"url":{"schema":"http","addr":"c4.xkrmec2.click/909","fqdn":"c4.xkrmec2.click","domain":"xkrmec2.click","tld":"click"},"ip":{"addr":"66.116.210.66","port":0,"asn":394695,"as":"PUBLIC-DOMAIN-REGISTRY","country":"United Arab Emirates","country_code":"AE"},"tags":null,"meta":null},"settings":{"access":"public","device_type":"desktop","expires_at":"2027-05-06T00:17:50Z","useragent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0","referer":"","cookies":null,"exit_node":"z0yflva4pidy47h"},"stats":{"alert_count":{"ids":0,"urlquery":2,"analyzer":3}},"detection":{"ids":null,"analyzer":[{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-03-31","alert":"Sinkholed","trigger":"c4.xkrmec2.click","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-03-31","alert":"Sinkholed","trigger":"c4.xkrmec2.click","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-03-31","alert":"Sinkholed","trigger":"file.newmarys.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":[{"sensor_name":"urlquery","alert":"Phishing - Kali365 Phishing Kit","verdict":"phishing","severity":"high","comment":"","tags":["phishing","kali365","aitm"],"meta":null},{"sensor_name":"urlquery","alert":"Phishing - Kali365 Phishing Kit","verdict":"phishing","severity":"high","comment":"","tags":["phishing","kali365","aitm"],"meta":null}]},"summary":[{"fqdn":"c4.xkrmec2.click","ip":{"addr":"66.116.210.66","port":443,"asn":394695,"as":"PUBLIC-DOMAIN-REGISTRY","country":"United Arab Emirates","country_code":"AE"},"domain_registered":"2026-02-15","domain_rank":0,"first_seen":"2026-03-31T14:41:47.618886Z","last_seen":"2026-03-31T14:41:47.618886Z","alert_count":4,"request_count":2,"received_data":19324,"sent_data":977,"comment":"","tags":null,"fingerprints":[{"name":"Apache HTTP Server","description":"Apache is a free and open-source cross-platform web server software.","website":"https://httpd.apache.org/","common_platform_enumeration":"cpe:2.3:a:apache:http_server:*:*:*:*:*:*:*:*","icon":"Apache.svg","categories":["Web servers"]}]},{"fqdn":"file.newmarys.com","ip":{"addr":"157.230.53.233","port":443,"asn":14061,"as":"DIGITALOCEAN-ASN","country":"United States","country_code":"US"},"domain_registered":"2026-03-27","domain_rank":0,"first_seen":"2026-03-31T14:41:47.614947Z","last_seen":"2026-03-31T14:41:47.614947Z","alert_count":12,"request_count":6,"received_data":106582,"sent_data":2729,"comment":"","tags":null,"fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}]}],"files":null,"artifacts":{"windows_shortcuts":null,"files":null,"telegram":null,"pdfs":null,"clipboard":null},"sensors":{"ids":null,"analyzer":null,"urlquery":[{"sensor_name":"urlquery","alert":"Phishing - Kali365 Phishing Kit","verdict":"phishing","severity":"high","comment":"","tags":["phishing","kali365","aitm"],"meta":null}]},"javascript":{"script":[{"url":{"schema":"https","addr":"c4.xkrmec2.click/909/","fqdn":"c4.xkrmec2.click","domain":"xkrmec2.click","tld":"click"},"ip":{"addr":"66.116.210.66","port":443,"asn":394695,"as":"PUBLIC-DOMAIN-REGISTRY","country":"United Arab Emirates","country_code":"AE"},"introduction_type":"scriptElement","is_inline":true,"md5":"a7187f51905c230bbfd747bdfda3187c","sha1":"e84f96f1194a89ab533f810db706aefaa2d793d7","sha256":"74e878c91cab14c28fc0a973d2c2c704ef8610099dbd7272ca530c7e1e6d4fa6","sha512":"16b709223bacf411a31d68329ce8795d49b05f344a47262219fb78f942bcb31685be1426680fff267f97ab114f4cc6a5c98e3e64beca9b3cbf7a87f4bf2616be","ssdeep":"96:G4vZTW6IRGzupZs5ewpcVwpXmfXgo0yKeBk5YqnNFGH:GoTW6bzGMe3FqybyY3","tlshash":"8181baf23051122a796be93f72a68104f272f4007549d422f95df8845fece0e52ba8f4","size":4145,"data":"","first_seen":"2026-03-31T14:41:50.575328Z","last_seen":"2026-04-01T19:02:15.664415Z","times_seen":4,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"file.newmarys.com/l/LvjdC7bMirE","fqdn":"file.newmarys.com","domain":"newmarys.com","tld":"com"},"ip":{"addr":"157.230.53.233","port":443,"asn":14061,"as":"DIGITALOCEAN-ASN","country":"United States","country_code":"US"},"introduction_type":"scriptElement","is_inline":false,"md5":"62fcc252a72a69e6f25017595bb00385","sha1":"7dd0746c57e363423b5ff10af222927278a71e5f","sha256":"40c6e3a6763890c195eac5bdbad3c6ee533baae994f687c1b85f82ba03b22f3e","sha512":"11b2b653de768cc4a59dd62f8618aeb590ac1ee1f4caddd6c5e2935b9527522e943a919904e0c75aba1756d4c87858b80fd16aeb8d1b158a6ec21dbedd3f97e8","ssdeep":"","tlshash":"1a3143e6f2ba14398ad922f7a87d5789bc324a16fd47c005d83d0c2855a4f87613aed0","size":1796,"data":"","first_seen":"2026-04-01T00:17:51.386057Z","last_seen":"2026-04-01T00:17:51.386057Z","times_seen":1,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"file.newmarys.com/l/LvjdC7bMirE","fqdn":"file.newmarys.com","domain":"newmarys.com","tld":"com"},"ip":{"addr":"157.230.53.233","port":443,"asn":14061,"as":"DIGITALOCEAN-ASN","country":"United States","country_code":"US"},"introduction_type":"scriptElement","is_inline":true,"md5":"817ff540e30b5d41808116b5f8233644","sha1":"8b9aa5ab9b05831126289ca15e3cdff6bcaba331","sha256":"f184aba45fb640aeea8173d2a25868fbfeae2abf4787ed07c526beaf6b9f8237","sha512":"73cdd06b2d0c7ce0a7a81c976f14689072ea5f7628fcfcc0a2513577f4f4c0785c19b7f7d5c53f7a9ac6733ca0ae0fe93bb0b520dedfb78d403c59ee34a04cd4","ssdeep":"3072:CA15FrUh1s8s/Szpas9ORS72wIn1x0tM67KVTsGAdM7XUCaFNcshcHDZPgxa8K:CA288qSFWmYutM8F27m4sK5b","tlshash":"c7a3d63262c8512e781384e0fa21679af17886b7f1938670d7983779c5c6997ab333cd","size":103909,"data":"","first_seen":"2026-04-01T00:17:51.389123Z","last_seen":"2026-04-01T00:17:51.389123Z","times_seen":1,"alerts":{"ids":null,"analyzer":null,"urlquery":null}}],"eval":null,"write":[{"md5":"81bfed918e7b497cc0a053cb4f6abb25","sha1":"85a66275fcf0210b7ebaabeca146ed15644a0721","sha256":"439a03a0e6d4aa6bb31333aa7392cd682cdfafe2f50e0bfa271326cecccb3c4e","sha512":"8b68b9d8f310d2fb363a2910e45885d8f3ef6971b4e7e38d2919873d68bdaef4eb1239812e4e41cb7f83ab2e3a00507f638980c0450016104237e2582240cde5","ssdeep":"192:6WOZSvWlMMA1xMJ149CKqj0FMp+SvtgxS:VOkeF4M4qj8Mp+uGxS","tlshash":"3fe1b7b2f2991039f57bc8e2b930a7df34804b1bf4978a00daa57635d5c1ed36a36784","size":6783,"data":"","first_seen":"2026-04-01T00:17:51.392024Z","last_seen":"2026-04-01T00:17:51.392024Z","times_seen":1,"alerts":{"ids":null,"analyzer":null,"urlquery":null}}],"console":null},"http":[{"url":{"schema":"https","addr":"c4.xkrmec2.click/909/","fqdn":"c4.xkrmec2.click","domain":"xkrmec2.click","tld":"click"},"ip":{"addr":"66.116.210.66","port":443,"asn":394695,"as":"PUBLIC-DOMAIN-REGISTRY","country":"United Arab Emirates","country_code":"AE"},"is_navigation_request":true,"resource_type":"document","requested_by":"","date":"2026-04-01T00:17:28.146Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"c4.xkrmec2.click","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Thu, 26 Mar 2026 12:30:52 GMT","end":"Wed, 24 Jun 2026 12:30:51 GMT"},"fingerprint":{"sha1":"F7:94:EE:05:AA:AD:6C:7E:E9:6A:AD:29:DA:9F:CD:3E:55:31:C2:C8","sha256":"B6:59:78:38:A4:89:22:AB:79:DC:A2:3C:7E:E8:15:27:7D:BA:0C:D6:8F:34:B8:44:AA:7C:7E:73:CE:05:89:38"}}},"request":{"raw":"GET /909/ HTTP/1.1\r\nHost: c4.xkrmec2.click\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nUpgrade-Insecure-Requests: 1\r\nSec-Fetch-Dest: document\r\nSec-Fetch-Mode: navigate\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Wed, 01 Apr 2026 00:17:28 GMT\r\nServer: Apache\r\nLast-Modified: Mon, 30 Mar 2026 16:32:07 GMT\r\nAccept-Ranges: bytes\r\nContent-Length: 9416\r\nKeep-Alive: timeout=5, max=99\r\nConnection: Keep-Alive\r\nContent-Type: text/html\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Apache HTTP Server","description":"Apache is a free and open-source cross-platform web server software.","website":"https://httpd.apache.org/","common_platform_enumeration":"cpe:2.3:a:apache:http_server:*:*:*:*:*:*:*:*","icon":"Apache.svg","categories":["Web servers"]}],"data":{"size":9416,"size_decoded":0,"mime_type":"text/html","magic":"HTML document, Unicode text, UTF-8 text, with very long lines (340)","md5":"f20c40719d66f7d77fe7ed86e21136a1","sha1":"f1c7b5070d9368cb48964c15c4d7782439be47aa","sha256":"716b29759cc1c51dd1b1d5cc14a12b9728aabe79f069763d0f7276cc0c32144e","sha512":"a3d7c0ab06256bf88e0388dd61b2f588309a9fe8e7bb4c8125ffe309f8898fa86c66158f0417cca51429a25e16d5d37d50f0fa9227a705bc2257dc19e42bee81","ssdeep":"192:rn6NLfWvCX+AYXU0p8oTW6bzGMe3FqybyYu:KfTX+7XUUTW6bzdenyYu","tlshash":"8f12d7b12050212af42bc4af71f99b4a70e1f402f64b5516b68db688cbdce835e736f4","first_seen":"2026-03-31T14:41:50.570045Z","last_seen":"2026-04-01T19:02:15.662885Z","times_seen":4,"resource_available":false,"data":null}},"time_used":149,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":148,"receive":1,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-03-31","alert":"Sinkholed","trigger":"c4.xkrmec2.click","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-03-31","alert":"Sinkholed","trigger":"c4.xkrmec2.click","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"file.newmarys.com/l/LvjdC7bMirE","fqdn":"file.newmarys.com","domain":"newmarys.com","tld":"com"},"ip":{"addr":"157.230.53.233","port":443,"asn":14061,"as":"DIGITALOCEAN-ASN","country":"United States","country_code":"US"},"is_navigation_request":true,"resource_type":"document","requested_by":"","date":"2026-04-01T00:17:32.241Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"file.newmarys.com","organization":""},"issuer":{"commonName":"E8","organization":"Let's Encrypt"},"validity":{"start":"Mon, 30 Mar 2026 03:13:49 GMT","end":"Sun, 28 Jun 2026 03:13:48 GMT"},"fingerprint":{"sha1":"56:78:B5:60:27:76:36:C7:10:FB:C3:1B:A0:16:71:38:2C:11:AB:77","sha256":"95:26:5C:46:3D:62:92:F5:76:D7:5B:F0:F9:AB:06:95:BB:BA:C1:FF:C0:7F:9A:F4:54:F2:0B:3D:BF:D8:92:CA"}}},"request":{"raw":"GET /l/LvjdC7bMirE HTTP/1.1\r\nHost: file.newmarys.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://c4.xkrmec2.click/\r\nUpgrade-Insecure-Requests: 1\r\nSec-Fetch-Dest: document\r\nSec-Fetch-Mode: navigate\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nServer: nginx\r\nDate: Wed, 01 Apr 2026 00:17:35 GMT\r\nContent-Type: text/html; charset=utf-8\r\nTransfer-Encoding: chunked\r\nConnection: keep-alive\r\nVary: Accept-Encoding, Accept-Encoding\r\nCache-Control: no-store, no-cache, must-revalidate, private\r\nX-Robots-Tag: noindex, nofollow, noarchive\r\nContent-Encoding: gzip\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":104749,"size_decoded":0,"mime_type":"text/html; charset=utf-8","magic":"HTML document, ASCII text, with very long lines (1016)","md5":"9b0a18f67a7116c229730eb4bab7a288","sha1":"18dd5d16962faa7444e8dddee1ec0029600da2a9","sha256":"7604ab893800b6abde2c8733241d88f0e5ea7c794f5d1a6dbf0f9e8682aa9c15","sha512":"64a25a52925994a039f7c1bcd748898eeb0862520063236f4363d14e222da1a329501eefb3540b3fb2c7bd7c1312443a304d64407e15def24e42acdb00531e7d","ssdeep":"3072:HA15FrUh1s8s/Szpas9ORS72wIn1x0tM67KVTsGAdM7XUCaFNcshcHDZPgxa8T:HA288qSFWmYutM8F27m4sK5A","tlshash":"5ca3c63262c8512e781384e0fa21679af17886b7f1938670d7983779c5c6997ab333cd","first_seen":"2026-04-01T00:17:51.372268Z","last_seen":"2026-04-01T00:17:51.372268Z","times_seen":1,"resource_available":false,"data":null}},"time_used":3956,"timings":{"blocked":289,"dns":69,"connect":103,"send":0,"wait":3376,"receive":3,"ssl":113},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-03-31","alert":"Sinkholed","trigger":"file.newmarys.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":[{"sensor_name":"urlquery","alert":"Phishing - Kali365 Phishing Kit","verdict":"phishing","severity":"high","comment":"","tags":["phishing","kali365","aitm"],"meta":null}]}},{"url":{"schema":"https","addr":"file.newmarys.com/api/status/430095","fqdn":"file.newmarys.com","domain":"newmarys.com","tld":"com"},"ip":{"addr":"157.230.53.233","port":443,"asn":14061,"as":"DIGITALOCEAN-ASN","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"fetch","requested_by":"https://file.newmarys.com/l/LvjdC7bMirE","date":"2026-04-01T00:17:39.258Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"file.newmarys.com","organization":""},"issuer":{"commonName":"E8","organization":"Let's Encrypt"},"validity":{"start":"Mon, 30 Mar 2026 03:13:49 GMT","end":"Sun, 28 Jun 2026 03:13:48 GMT"},"fingerprint":{"sha1":"56:78:B5:60:27:76:36:C7:10:FB:C3:1B:A0:16:71:38:2C:11:AB:77","sha256":"95:26:5C:46:3D:62:92:F5:76:D7:5B:F0:F9:AB:06:95:BB:BA:C1:FF:C0:7F:9A:F4:54:F2:0B:3D:BF:D8:92:CA"}}},"request":{"raw":"GET /api/status/430095 HTTP/1.1\r\nHost: file.newmarys.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://file.newmarys.com/l/LvjdC7bMirE\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nServer: nginx\r\nDate: Wed, 01 Apr 2026 00:17:39 GMT\r\nContent-Type: application/json\r\nTransfer-Encoding: chunked\r\nConnection: keep-alive\r\nVary: Accept-Encoding, Accept-Encoding, Cookie\r\nAccess-Control-Allow-Origin: *\r\nContent-Encoding: gzip\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":21,"size_decoded":0,"mime_type":"application/json","magic":"JSON text data","md5":"1991b7c8ec390f5af45312fc0e09944c","sha1":"d61cf78973a9c26e718fb9fe1cb3c8533893d95f","sha256":"e83c12db5ee3c62282c295c521fa51a10e6cfff8e247c64f09838dbc134bd385","sha512":"80bed01bd6f8fecdcfe32308c4dc471907a48a7418c73be4874046c51c9bcf013cbc53bd0e4fc92afb3020d0c08fb675611712f81799a9a1bf593c4dfd8c8480","ssdeep":"","tlshash":"e9700022280800000ac80800e0000238baa0ca80002ba0c0280c80288820880e008000","first_seen":"2026-03-04T14:57:38.603599Z","last_seen":"2026-08-10T17:56:18.555789Z","times_seen":1687,"resource_available":false,"data":null}},"time_used":109,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":108,"receive":1,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-03-31","alert":"Sinkholed","trigger":"file.newmarys.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":[{"sensor_name":"urlquery","alert":"Phishing - Kali365 Phishing Kit","verdict":"phishing","severity":"high","comment":"","tags":["phishing","kali365","aitm"],"meta":null}]}},{"url":{"schema":"https","addr":"file.newmarys.com/api/status/430095","fqdn":"file.newmarys.com","domain":"newmarys.com","tld":"com"},"ip":{"addr":"157.230.53.233","port":443,"asn":14061,"as":"DIGITALOCEAN-ASN","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"fetch","requested_by":"https://file.newmarys.com/l/LvjdC7bMirE","date":"2026-04-01T00:17:42.373Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"file.newmarys.com","organization":""},"issuer":{"commonName":"E8","organization":"Let's Encrypt"},"validity":{"start":"Mon, 30 Mar 2026 03:13:49 GMT","end":"Sun, 28 Jun 2026 03:13:48 GMT"},"fingerprint":{"sha1":"56:78:B5:60:27:76:36:C7:10:FB:C3:1B:A0:16:71:38:2C:11:AB:77","sha256":"95:26:5C:46:3D:62:92:F5:76:D7:5B:F0:F9:AB:06:95:BB:BA:C1:FF:C0:7F:9A:F4:54:F2:0B:3D:BF:D8:92:CA"}}},"request":{"raw":"GET /api/status/430095 HTTP/1.1\r\nHost: file.newmarys.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://file.newmarys.com/l/LvjdC7bMirE\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nServer: nginx\r\nDate: Wed, 01 Apr 2026 00:17:42 GMT\r\nContent-Type: application/json\r\nTransfer-Encoding: chunked\r\nConnection: keep-alive\r\nVary: Accept-Encoding, Accept-Encoding, Cookie\r\nAccess-Control-Allow-Origin: *\r\nContent-Encoding: gzip\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":21,"size_decoded":0,"mime_type":"application/json","magic":"JSON text data","md5":"1991b7c8ec390f5af45312fc0e09944c","sha1":"d61cf78973a9c26e718fb9fe1cb3c8533893d95f","sha256":"e83c12db5ee3c62282c295c521fa51a10e6cfff8e247c64f09838dbc134bd385","sha512":"80bed01bd6f8fecdcfe32308c4dc471907a48a7418c73be4874046c51c9bcf013cbc53bd0e4fc92afb3020d0c08fb675611712f81799a9a1bf593c4dfd8c8480","ssdeep":"","tlshash":"e9700022280800000ac80800e0000238baa0ca80002ba0c0280c80288820880e008000","first_seen":"2026-03-04T14:57:38.603599Z","last_seen":"2026-08-10T17:56:18.555789Z","times_seen":1687,"resource_available":false,"data":null}},"time_used":108,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":108,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-03-31","alert":"Sinkholed","trigger":"file.newmarys.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":[{"sensor_name":"urlquery","alert":"Phishing - Kali365 Phishing Kit","verdict":"phishing","severity":"high","comment":"","tags":["phishing","kali365","aitm"],"meta":null}]}},{"url":{"schema":"https","addr":"c4.xkrmec2.click/909","fqdn":"c4.xkrmec2.click","domain":"xkrmec2.click","tld":"click"},"ip":{"addr":"66.116.210.66","port":443,"asn":394695,"as":"PUBLIC-DOMAIN-REGISTRY","country":"United Arab Emirates","country_code":"AE"},"is_navigation_request":true,"resource_type":"document","requested_by":"","date":"2026-04-01T00:17:27.646Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"c4.xkrmec2.click","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Thu, 26 Mar 2026 12:30:52 GMT","end":"Wed, 24 Jun 2026 12:30:51 GMT"},"fingerprint":{"sha1":"F7:94:EE:05:AA:AD:6C:7E:E9:6A:AD:29:DA:9F:CD:3E:55:31:C2:C8","sha256":"B6:59:78:38:A4:89:22:AB:79:DC:A2:3C:7E:E8:15:27:7D:BA:0C:D6:8F:34:B8:44:AA:7C:7E:73:CE:05:89:38"}}},"request":{"raw":"GET /909 HTTP/1.1\r\nHost: c4.xkrmec2.click\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nUpgrade-Insecure-Requests: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: document\r\nSec-Fetch-Mode: navigate\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 301 Moved Permanently\r\nDate: Wed, 01 Apr 2026 00:17:28 GMT\r\nServer: Apache\r\nLocation: https://c4.xkrmec2.click/909/\r\nContent-Length: 277\r\nKeep-Alive: timeout=5, max=100\r\nConnection: Keep-Alive\r\nContent-Type: text/html; charset=iso-8859-1\r\n\r\n","headers":null,"cookies":null,"status_code":"301","status_text":"Moved Permanently","fingerprints":[{"name":"Apache HTTP Server","description":"Apache is a free and open-source cross-platform web server software.","website":"https://httpd.apache.org/","common_platform_enumeration":"cpe:2.3:a:apache:http_server:*:*:*:*:*:*:*:*","icon":"Apache.svg","categories":["Web servers"]}],"data":{"size":9416,"size_decoded":0,"mime_type":"text/html","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-08-11T00:57:15.584388Z","times_seen":17827927,"resource_available":true,"data":null}},"time_used":845,"timings":{"blocked":349,"dns":47,"connect":148,"send":0,"wait":147,"receive":0,"ssl":151},"alerts":{"ids":null,"analyzer":[{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-03-31","alert":"Sinkholed","trigger":"c4.xkrmec2.click","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-03-31","alert":"Sinkholed","trigger":"c4.xkrmec2.click","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"file.newmarys.com/api/status/430095","fqdn":"file.newmarys.com","domain":"newmarys.com","tld":"com"},"ip":{"addr":"157.230.53.233","port":443,"asn":14061,"as":"DIGITALOCEAN-ASN","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"fetch","requested_by":"https://file.newmarys.com/l/LvjdC7bMirE","date":"2026-04-01T00:17:36.142Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"file.newmarys.com","organization":""},"issuer":{"commonName":"E8","organization":"Let's Encrypt"},"validity":{"start":"Mon, 30 Mar 2026 03:13:49 GMT","end":"Sun, 28 Jun 2026 03:13:48 GMT"},"fingerprint":{"sha1":"56:78:B5:60:27:76:36:C7:10:FB:C3:1B:A0:16:71:38:2C:11:AB:77","sha256":"95:26:5C:46:3D:62:92:F5:76:D7:5B:F0:F9:AB:06:95:BB:BA:C1:FF:C0:7F:9A:F4:54:F2:0B:3D:BF:D8:92:CA"}}},"request":{"raw":"GET /api/status/430095 HTTP/1.1\r\nHost: file.newmarys.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://file.newmarys.com/l/LvjdC7bMirE\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nServer: nginx\r\nDate: Wed, 01 Apr 2026 00:17:36 GMT\r\nContent-Type: application/json\r\nTransfer-Encoding: chunked\r\nConnection: keep-alive\r\nVary: Accept-Encoding, Accept-Encoding, Cookie\r\nAccess-Control-Allow-Origin: *\r\nContent-Encoding: gzip\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":21,"size_decoded":0,"mime_type":"application/json","magic":"JSON text data","md5":"1991b7c8ec390f5af45312fc0e09944c","sha1":"d61cf78973a9c26e718fb9fe1cb3c8533893d95f","sha256":"e83c12db5ee3c62282c295c521fa51a10e6cfff8e247c64f09838dbc134bd385","sha512":"80bed01bd6f8fecdcfe32308c4dc471907a48a7418c73be4874046c51c9bcf013cbc53bd0e4fc92afb3020d0c08fb675611712f81799a9a1bf593c4dfd8c8480","ssdeep":"","tlshash":"e9700022280800000ac80800e0000238baa0ca80002ba0c0280c80288820880e008000","first_seen":"2026-03-04T14:57:38.603599Z","last_seen":"2026-08-10T17:56:18.555789Z","times_seen":1687,"resource_available":false,"data":null}},"time_used":110,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":110,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-03-31","alert":"Sinkholed","trigger":"file.newmarys.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":[{"sensor_name":"urlquery","alert":"Phishing - Kali365 Phishing Kit","verdict":"phishing","severity":"high","comment":"","tags":["phishing","kali365","aitm"],"meta":null}]}},{"url":{"schema":"https","addr":"file.newmarys.com/favicon.ico","fqdn":"file.newmarys.com","domain":"newmarys.com","tld":"com"},"ip":{"addr":"157.230.53.233","port":443,"asn":14061,"as":"DIGITALOCEAN-ASN","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://file.newmarys.com/l/LvjdC7bMirE","date":"2026-04-01T00:17:36.162Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"file.newmarys.com","organization":""},"issuer":{"commonName":"E8","organization":"Let's Encrypt"},"validity":{"start":"Mon, 30 Mar 2026 03:13:49 GMT","end":"Sun, 28 Jun 2026 03:13:48 GMT"},"fingerprint":{"sha1":"56:78:B5:60:27:76:36:C7:10:FB:C3:1B:A0:16:71:38:2C:11:AB:77","sha256":"95:26:5C:46:3D:62:92:F5:76:D7:5B:F0:F9:AB:06:95:BB:BA:C1:FF:C0:7F:9A:F4:54:F2:0B:3D:BF:D8:92:CA"}}},"request":{"raw":"GET /favicon.ico HTTP/1.1\r\nHost: file.newmarys.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://file.newmarys.com/l/LvjdC7bMirE\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 404 NOT FOUND\r\nServer: nginx\r\nDate: Wed, 01 Apr 2026 00:17:36 GMT\r\nContent-Type: text/html\r\nTransfer-Encoding: chunked\r\nConnection: keep-alive\r\nVary: Accept-Encoding, Accept-Encoding\r\nContent-Encoding: gzip\r\n\r\n","headers":null,"cookies":null,"status_code":"404","status_text":"NOT FOUND","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":162,"size_decoded":0,"mime_type":"text/html","magic":"HTML document, ASCII text, with no line terminators","md5":"ce2be0483312a794aad520d725792a56","sha1":"a9870bb4c9630089e4ab5a7b959ff74083399afc","sha256":"b8bf04dbc33f6e3add3112a79b69a306a9a27da4e454044ac0cb74145c5cb63c","sha512":"205922538811fc9f2c20e797541c4845f513489ff1e71bdd721e6851f274a9195b6fff9f8bccaf8e99b0700027afe8a4f2eac34b3ab49f121d3112a8a6255fee","ssdeep":"","tlshash":"74c080a880435709e96154552af153174054c1849d85d7901556393ed5c61970f903cd","first_seen":"2026-03-24T17:27:00.578404Z","last_seen":"2026-08-10T12:58:25.866447Z","times_seen":535,"resource_available":true,"data":null}},"time_used":199,"timings":{"blocked":0,"dns":1,"connect":107,"send":0,"wait":108,"receive":1,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-03-31","alert":"Sinkholed","trigger":"file.newmarys.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":[{"sensor_name":"urlquery","alert":"Phishing - Kali365 Phishing Kit","verdict":"phishing","severity":"high","comment":"","tags":["phishing","kali365","aitm"],"meta":null}]}},{"url":{"schema":"https","addr":"file.newmarys.com/api/status/430095","fqdn":"file.newmarys.com","domain":"newmarys.com","tld":"com"},"ip":{"addr":"157.230.53.233","port":443,"asn":14061,"as":"DIGITALOCEAN-ASN","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"fetch","requested_by":"https://file.newmarys.com/l/LvjdC7bMirE","date":"2026-04-01T00:17:45.490Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"file.newmarys.com","organization":""},"issuer":{"commonName":"E8","organization":"Let's Encrypt"},"validity":{"start":"Mon, 30 Mar 2026 03:13:49 GMT","end":"Sun, 28 Jun 2026 03:13:48 GMT"},"fingerprint":{"sha1":"56:78:B5:60:27:76:36:C7:10:FB:C3:1B:A0:16:71:38:2C:11:AB:77","sha256":"95:26:5C:46:3D:62:92:F5:76:D7:5B:F0:F9:AB:06:95:BB:BA:C1:FF:C0:7F:9A:F4:54:F2:0B:3D:BF:D8:92:CA"}}},"request":{"raw":"GET /api/status/430095 HTTP/1.1\r\nHost: file.newmarys.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://file.newmarys.com/l/LvjdC7bMirE\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nServer: nginx\r\nDate: Wed, 01 Apr 2026 00:17:45 GMT\r\nContent-Type: application/json\r\nTransfer-Encoding: chunked\r\nConnection: keep-alive\r\nVary: Accept-Encoding, Accept-Encoding, Cookie\r\nAccess-Control-Allow-Origin: *\r\nContent-Encoding: gzip\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":21,"size_decoded":0,"mime_type":"application/json","magic":"JSON text data","md5":"1991b7c8ec390f5af45312fc0e09944c","sha1":"d61cf78973a9c26e718fb9fe1cb3c8533893d95f","sha256":"e83c12db5ee3c62282c295c521fa51a10e6cfff8e247c64f09838dbc134bd385","sha512":"80bed01bd6f8fecdcfe32308c4dc471907a48a7418c73be4874046c51c9bcf013cbc53bd0e4fc92afb3020d0c08fb675611712f81799a9a1bf593c4dfd8c8480","ssdeep":"","tlshash":"e9700022280800000ac80800e0000238baa0ca80002ba0c0280c80288820880e008000","first_seen":"2026-03-04T14:57:38.603599Z","last_seen":"2026-08-10T17:56:18.555789Z","times_seen":1687,"resource_available":false,"data":null}},"time_used":109,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":109,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-03-31","alert":"Sinkholed","trigger":"file.newmarys.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":[{"sensor_name":"urlquery","alert":"Phishing - Kali365 Phishing Kit","verdict":"phishing","severity":"high","comment":"","tags":["phishing","kali365","aitm"],"meta":null}]}}]}