{"report_id":"c637e834-aa99-4c2d-a9a2-916834ce4364","version":6,"status":"done","tags":[],"date":"2024-05-15T16:04:14Z","url":{"schema":"http","addr":"myallcdn01.xyz/cdn/down/ca135e347983ca1a4413efa7fd697d81/720p/720p91.html","fqdn":"myallcdn01.xyz","domain":"myallcdn01.xyz","tld":"xyz"},"ip":{"addr":"188.114.96.1","port":0,"asn":13335,"as":"CLOUDFLARENET","country":"The Netherlands","country_code":"NL"},"final":{"url":{"schema":"https","addr":"myallcdn01.xyz/cdn/down/ca135e347983ca1a4413efa7fd697d81/720p/720p91.html","fqdn":"myallcdn01.xyz","domain":"myallcdn01.xyz","tld":"xyz"},"title":"myallcdn01.xyz/cdn/down/ca135e347983ca1a4413efa7fd697d81/720p/720p91.html"},"submit":{"url":{"schema":"","addr":"","fqdn":"","domain":"","tld":""},"ip":{"addr":"","port":0,"asn":0,"as":"","country":"","country_code":""},"tags":null,"meta":null},"settings":{"access":"public","device_type":"desktop","expires_at":"2026-10-25T16:50:54Z","useragent":"Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0","referer":"","cookies":null,"exit_node":"z0yflva4pidy47h"},"stats":{"alert_count":{"ids":0,"urlquery":0,"analyzer":0}},"detection":{"ids":null,"analyzer":null,"urlquery":null},"summary":[{"fqdn":"myallcdn01.xyz","ip":{"addr":"188.114.96.1","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"The Netherlands","country_code":"NL"},"domain_registered":"2024-02-21","domain_rank":0,"first_seen":"2024-02-21 15:02:42","last_seen":"2024-03-20 13:23:08","alert_count":2,"request_count":2,"received_data":424485,"sent_data":1022,"comment":"","tags":null,"fingerprints":null}],"files":null,"artifacts":{"windows_shortcuts":null,"files":null,"telegram":null,"pdfs":null,"clipboard":null},"sensors":{"ids":[{"sensor_name":"suricata","description":"Suricata /w Emerging Threats Pro","alerts":null}],"analyzer":[{"sensor_name":"infosec_yara","type":"yara","description":"Public InfoSec YARA rules","link":"","alerts":null},{"sensor_name":"openphish","type":"url","description":"OpenPhish","link":"","alerts":null},{"sensor_name":"phishtank","type":"url","description":"PhishTank","link":"","alerts":null},{"sensor_name":"mnemonic_dns","type":"domain","description":"mnemonic secure dns","link":"","alerts":null},{"sensor_name":"quad9","type":"domain","description":"Quad9 DNS","link":"","alerts":[{"sensor_name":"quad9","sensor_type":"domain","title":"","description":"Quad9 DNS","scan_date":"2024-05-15","alert":"Sinkholed","trigger":"myallcdn01.xyz","verdict":"malicious","severity":"medium","comment":"Sinkholed","link":"https://www.quad9.net","meta":null},{"sensor_name":"quad9","sensor_type":"domain","title":"","description":"Quad9 DNS","scan_date":"2024-05-15","alert":"Sinkholed","trigger":"myallcdn01.xyz","verdict":"malicious","severity":"medium","comment":"Sinkholed","link":"https://www.quad9.net","meta":null}]},{"sensor_name":"threatfox","type":"url","description":"ThreatFox","link":"","alerts":null}],"urlquery":null},"javascript":{"script":null,"eval":null,"write":null,"console":null},"http":[{"url":{"schema":"https","addr":"myallcdn01.xyz/favicon.ico","fqdn":"myallcdn01.xyz","domain":"myallcdn01.xyz","tld":"xyz"},"ip":{"addr":"188.114.96.1","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"The Netherlands","country_code":"NL"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://myallcdn01.xyz/cdn/down/ca135e347983ca1a4413efa7fd697d81/720p/720p91.html","date":"2024-05-15T16:03:50.305Z","timestamp":1715789030305,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"myallcdn01.xyz","organization":""},"issuer":{"commonName":"E1","organization":"Let's Encrypt"},"validity":{"start":"Sat, 20 Apr 2024 12:47:04 GMT","end":"Fri, 19 Jul 2024 12:47:03 GMT"},"fingerprint":{"sha1":"FE:D4:A6:5F:C7:0D:BB:71:66:46:A9:05:40:BA:BE:B4:7C:A6:C9:C1","sha256":"E9:58:CD:3D:1C:29:77:EE:63:40:57:A2:E9:06:01:01:26:F4:9D:F3:31:30:22:F8:5F:6B:1D:36:B9:C2:A0:94"}}},"request":{"raw":"GET /favicon.ico HTTP/1.1\r\nHost: myallcdn01.xyz\r\nUser-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://myallcdn01.xyz/cdn/down/ca135e347983ca1a4413efa7fd697d81/720p/720p91.html\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\nTE: trailers\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 404 Not Found\r\ndate: Wed, 15 May 2024 16:03:50 GMT\r\ncontent-type: text/html\r\ncache-control: max-age=31536000\r\ncf-cache-status: HIT\r\nage: 39\r\nreport-to: {\"endpoints\":[{\"url\":\"https:\\/\\/a.nel.cloudflare.com\\/report\\/v4?s=NYgbdRcpzHhLVWNj5KFu4T%2FQsnaPqjKu7ShYP6QDHmN8XzqJsrWYcPYFeNmPnU702hYKA4MZX41y%2F9PjpwKPkEHVpvPJHqcesYbmVh6F9FROabYhcLIgeRc5T6E4yxBQCQ%3D%3D\"}],\"group\":\"cf-nel\",\"max_age\":604800}\r\nnel: {\"success_fraction\":0,\"report_to\":\"cf-nel\",\"max_age\":604800}\r\nvary: Accept-Encoding\r\nserver: cloudflare\r\ncf-ray: 88445c3f6bdb56b1-OSL\r\ncontent-encoding: br\r\nalt-svc: h3=\":443\"; ma=86400\r\n","headers":null,"cookies":null,"status_code":"404","status_text":"Not Found","fingerprints":null,"data":{"size":7298,"size_decoded":162,"mime_type":"text/html","magic":"HTML document, ASCII text, with CRLF line terminators","md5":"70461da8b94c6ca5d2fda3260c5a8c3b","sha1":"994bc667720c21257500e29038c1a5f61e25da1e","sha256":"f33c27745f2bd87344be790465ef984a972fd539dc83bd4f61d4242c607ef1ee","sha512":"ee993842123fa9b1905fe6b111aca70c1ea3e7f4fefeff889cb803887c6ccdccbc9a8e1025cc98528b7790e973436ac650c733421a168d0cd0dba22141b43179","ssdeep":"","tlshash":"aac08c6d6513ac8dca53223827c3a180c1a6832baaaa451105809143b0cb2998ac239a","first_seen":"2023-03-07T16:03:30Z","last_seen":"2026-09-18T03:13:28.471293Z","times_seen":27684,"resource_available":true,"data":null}},"time_used":25,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":24,"receive":1,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"domain","title":"","description":"Quad9 DNS","scan_date":"2024-05-15","alert":"Sinkholed","trigger":"myallcdn01.xyz","verdict":"malicious","severity":"medium","comment":"Sinkholed","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"myallcdn01.xyz/cdn/down/ca135e347983ca1a4413efa7fd697d81/720p/720p91.html","fqdn":"myallcdn01.xyz","domain":"myallcdn01.xyz","tld":"xyz"},"ip":{"addr":"188.114.96.1","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"The Netherlands","country_code":"NL"},"is_navigation_request":true,"resource_type":"document","requested_by":"","date":"2024-05-15T16:03:49.062Z","timestamp":1715789029062,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"myallcdn01.xyz","organization":""},"issuer":{"commonName":"E1","organization":"Let's Encrypt"},"validity":{"start":"Sat, 20 Apr 2024 12:47:04 GMT","end":"Fri, 19 Jul 2024 12:47:03 GMT"},"fingerprint":{"sha1":"FE:D4:A6:5F:C7:0D:BB:71:66:46:A9:05:40:BA:BE:B4:7C:A6:C9:C1","sha256":"E9:58:CD:3D:1C:29:77:EE:63:40:57:A2:E9:06:01:01:26:F4:9D:F3:31:30:22:F8:5F:6B:1D:36:B9:C2:A0:94"}}},"request":{"raw":"GET /cdn/down/ca135e347983ca1a4413efa7fd697d81/720p/720p91.html HTTP/1.1\r\nHost: myallcdn01.xyz\r\nUser-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0\r\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nUpgrade-Insecure-Requests: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: document\r\nSec-Fetch-Mode: navigate\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ndate: Wed, 15 May 2024 16:03:49 GMT\r\ncontent-type: text/html\r\nlast-modified: Mon, 11 Jan 2021 08:50:23 GMT\r\naccess-control-allow-origin: https://i11lli.com\r\ncache-control: public, max-age=31536000, s-maxage=31536000\r\ncf-cache-status: MISS\r\nreport-to: {\"endpoints\":[{\"url\":\"https:\\/\\/a.nel.cloudflare.com\\/report\\/v4?s=2YCybVOvE7Z%2BkgmtPfTvMJizV%2BAQadq5JeIAfjRgYmzc0%2FGut5Nmo8b5HEjiBByM9wOTLO27DhIVsZINX%2B6vtxVXWf7CsC7ieEaGl%2FFSM2nySPr9r1r6hGg3GbsiQx8dCw%3D%3D\"}],\"group\":\"cf-nel\",\"max_age\":604800}\r\nnel: {\"success_fraction\":0,\"report_to\":\"cf-nel\",\"max_age\":604800}\r\nvary: Accept-Encoding\r\nserver: cloudflare\r\ncf-ray: 88445c37df1f712e-OSL\r\ncontent-encoding: br\r\nalt-svc: h3=\":443\"; ma=86400\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":null,"data":{"size":415856,"size_decoded":415856,"mime_type":"text/html","magic":"data","md5":"7cec3f7e2f017bc9c7b65e19d53aabf0","sha1":"3a5aa0c18358efaabacf798f09cf5f6ac1359e5f","sha256":"4285fdfd3aee7bc82061bfb36f7e7ef80d1d75e4b259cfa5b1d754fe7793be73","sha512":"dee180c4efaefdfc92037f272817bf9e8a29e0cd938f02319cef6245db4119a255eb145cedb794d8c8d7633f4ebb4248433b6f6d071c5161baeb027611b1edc8","ssdeep":"12288:gW20aEFN79+l/p2gVtpL6NMnZvNDnTHAqZx0Y8nsfbHrsopduIdDZhEBS0:LxHnkFvJH1Zx0Y8q/si05","tlshash":"7ad4f0035350f330caea93fa6c0253d476018798e69bbe51e934d6605daf12e72df8da","first_seen":"2024-08-19T22:52:16.235243Z","last_seen":"2024-08-19T22:52:16.235243Z","times_seen":1,"resource_available":false,"data":null}},"time_used":303,"timings":{"blocked":33,"dns":1,"connect":5,"send":0,"wait":233,"receive":0,"ssl":28},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"domain","title":"","description":"Quad9 DNS","scan_date":"2024-05-15","alert":"Sinkholed","trigger":"myallcdn01.xyz","verdict":"malicious","severity":"medium","comment":"Sinkholed","link":"https://www.quad9.net","meta":null}],"urlquery":null}}]}