{"report_id":"d074c643-b918-4501-8ed3-5b8b536e1b79","version":6,"status":"done","tags":[],"date":"2025-11-07T19:55:56Z","url":{"schema":"https","addr":"four-memes.sbs/","fqdn":"four-memes.sbs","domain":"four-memes.sbs","tld":"sbs"},"ip":{"addr":"94.154.35.60","port":0,"asn":215567,"as":"Emirhan Kurt","country":"Ukraine","country_code":"UA"},"final":{"url":{"schema":"https","addr":"four-memes.sbs/","fqdn":"four-memes.sbs","domain":"four-memes.sbs","tld":"sbs"},"title":"Ray Ecommerce Solutions","dom":{"size":3977,"mime_type":"text/html; charset=utf-8","magic":"HTML document, Unicode text, UTF-8 text","md5":"3e861734fbc12ca90fe37689d18298c1","sha1":"991a864cb7bde348d42bda44aade941769bb2f39","sha256":"ef35a9dfe0f79f306927dd67f6a240c0eed3da518e4c0d23138b623dcb78ba24","sha512":"a539df1b8d3afa0ed57cb2be8138ebb327ed08fbe2016fcfd505e6270644e711ee1bcd8293b9a0f8f8e24582c7ad4176c76556a7f5b0515310a4e3637591ef4b","ssdeep":"","tlshash":"4881111a25f125bf61c365b3b6613779acccc11bc60b8946b2bc56c4afe3c818a87319","dom_hash":"domhash66884580e9376707984a26ad976ebda5","first_seen":"2025-11-07T19:34:54.228658Z","last_seen":"2025-11-07T19:56:01.149559Z","times_seen":7,"resource_available":false,"data":null}},"submit":{"url":{"schema":"https","addr":"four-memes.sbs/","fqdn":"four-memes.sbs","domain":"four-memes.sbs","tld":"sbs"},"ip":{"addr":"94.154.35.60","port":0,"asn":215567,"as":"Emirhan Kurt","country":"Ukraine","country_code":"UA"},"tags":null,"meta":null,"user":{"user_id":"akbkyowd9geqr98","country_code":"zz"}},"settings":{"access":"public","device_type":"desktop","expires_at":"2026-12-12T19:55:56Z","useragent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0","referer":"","cookies":null,"exit_node":"z0yflva4pidy47h"},"stats":{"alert_count":{"ids":0,"urlquery":0,"analyzer":1}},"detection":{"ids":null,"analyzer":[{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-11-07","alert":"Sinkholed","trigger":"four-memes.sbs","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null},"summary":[{"fqdn":"four-memes.sbs","ip":{"addr":"94.154.35.60","port":443,"asn":215567,"as":"Emirhan Kurt","country":"Ukraine","country_code":"UA"},"domain_registered":"unknown","domain_rank":0,"first_seen":"No data","last_seen":"No data","alert_count":2,"request_count":2,"received_data":4730,"sent_data":918,"comment":"","tags":null,"fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}]},{"fqdn":"cdn.jsdelivr.net","ip":{"addr":"151.101.65.229","port":443,"asn":54113,"as":"FASTLY","country":"United States","country_code":"US"},"domain_registered":"2012-05-16","domain_rank":1678,"first_seen":"2012-09-30T00:15:09Z","last_seen":"2025-11-02T22:17:55.857863Z","alert_count":0,"request_count":1,"received_data":2934800,"sent_data":462,"comment":"","tags":null,"fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}]}],"files":null,"artifacts":{"windows_shortcuts":null,"files":null,"telegram":null,"pdfs":null,"clipboard":null},"sensors":{"ids":[{"sensor_name":"suricata","description":"Suricata /w Emerging Threats Pro","alerts":null}],"analyzer":null,"urlquery":null},"javascript":{"script":null,"eval":null,"write":null,"console":null},"http":[{"url":{"schema":"https","addr":"four-memes.sbs/","fqdn":"four-memes.sbs","domain":"four-memes.sbs","tld":"sbs"},"ip":{"addr":"94.154.35.60","port":443,"asn":215567,"as":"Emirhan Kurt","country":"Ukraine","country_code":"UA"},"is_navigation_request":true,"resource_type":"document","requested_by":"","date":"2025-11-07T19:55:35.075Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"four-memes.sbs","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Tue, 21 Oct 2025 13:36:09 GMT","end":"Mon, 19 Jan 2026 13:36:08 GMT"},"fingerprint":{"sha1":"77:2E:E3:19:45:2A:10:DC:05:0A:1B:26:EA:46:C6:43:41:54:FA:29","sha256":"30:ED:E0:A0:59:6D:F7:A0:0C:C7:D3:0D:2F:E8:2F:99:C1:35:4D:1B:AC:A4:F5:C6:95:FD:80:FA:AD:9C:ED:66"}}},"request":{"raw":"GET / HTTP/1.1\r\nHost: four-memes.sbs\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nUpgrade-Insecure-Requests: 1\r\nSec-Fetch-Dest: document\r\nSec-Fetch-Mode: navigate\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Fri, 07 Nov 2025 19:55:35 GMT\r\ncontent-type: text/html\r\nlast-modified: Sat, 25 Oct 2025 13:06:11 GMT\r\nvary: Accept-Encoding\r\netag: W/\"68fccb43-f9e\"\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: quic=\":443\"; h3=\":443\"; h3-29=\":443\"; h3-27=\":443\";h3-25=\":443\"; h3-T050=\":443\"; h3-Q050=\":443\";h3-Q049=\":443\";h3-Q048=\":443\"; h3-Q046=\":443\"; h3-Q043=\":443\"\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":3998,"size_decoded":0,"mime_type":"text/html","magic":"HTML document, ASCII text","md5":"4ce5850cce0a4ceca14be84b6c857a83","sha1":"cd6c00a4201cf18b7fb57b7fae66d17806b5e540","sha256":"e5d54d7be7822bd4ea0f4d203e6c0612b9acc5dbd87f7e55c00a308bd3286f6c","sha512":"69516d4948c37a4f4d856f2424b773d4663fa7b3036f0c4484483d861ce1dcc3048ef22e0d7c8a35d369299dc5d0f11945e8fbc5f137d3f84155f58487a3ca5b","ssdeep":"","tlshash":"7681231a25f125bf61c365b3b7613779acccc11bc60b8946b2bc56c4afe3c818a87319","first_seen":"2025-06-13T05:26:43.59863Z","last_seen":"2025-11-07T19:56:01.151952Z","times_seen":8,"resource_available":false,"data":null}},"time_used":690,"timings":{"blocked":289,"dns":84,"connect":111,"send":0,"wait":105,"receive":0,"ssl":98},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-11-07","alert":"Sinkholed","trigger":"four-memes.sbs","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"cdn.jsdelivr.net/npm/tailwindcss@2.2.19/dist/tailwind.min.css","fqdn":"cdn.jsdelivr.net","domain":"jsdelivr.net","tld":"net"},"ip":{"addr":"151.101.65.229","port":443,"asn":54113,"as":"FASTLY","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://four-memes.sbs/","date":"2025-11-07T19:55:35.671Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"jsdelivr.net","organization":""},"issuer":{"commonName":"GlobalSign Atlas R3 DV TLS CA 2025 Q2","organization":"GlobalSign nv-sa"},"validity":{"start":"Mon, 02 Jun 2025 15:43:52 GMT","end":"Sat, 04 Jul 2026 15:43:51 GMT"},"fingerprint":{"sha1":"21:17:81:78:41:C6:8F:86:D6:CF:8D:98:CC:74:A8:F1:03:F8:C9:D4","sha256":"D0:E6:8D:08:11:05:7E:0C:2A:0D:C7:E0:ED:AE:9E:18:C8:74:32:12:3D:56:43:98:62:CD:A2:08:6F:64:5B:B0"}}},"request":{"raw":"GET /npm/tailwindcss@2.2.19/dist/tailwind.min.css HTTP/1.1\r\nHost: cdn.jsdelivr.net\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://four-memes.sbs/\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\naccess-control-allow-origin: *\r\naccess-control-expose-headers: *\r\ntiming-allow-origin: *\r\ncache-control: public, max-age=31536000, s-maxage=31536000, immutable\r\ncross-origin-resource-policy: cross-origin\r\nx-content-type-options: nosniff\r\nstrict-transport-security: max-age=31536000; includeSubDomains; preload\r\ncontent-type: text/css; charset=utf-8\r\nx-jsd-version: 2.2.19\r\nx-jsd-version-type: version\r\netag: W/\"2cc503-cyTPK4s7rX9aC3Y3NNaHIxjV1fQ\"\r\ncontent-encoding: br\r\naccept-ranges: bytes\r\ndate: Fri, 07 Nov 2025 19:55:35 GMT\r\nage: 3184328\r\nx-served-by: cache-fra-etou8220049-FRA, cache-hel1410021-HEL\r\nx-cache: HIT, HIT\r\nvary: Accept-Encoding\r\nalt-svc: h3=\":443\";ma=86400,h3-29=\":443\";ma=86400,h3-27=\":443\";ma=86400\r\ncontent-length: 255702\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":2934019,"size_decoded":0,"mime_type":"text/css; charset=utf-8","magic":"ASCII text, with very long lines (65536), with no line terminators","md5":"fd1515a3d70a9d3d1efe23553fb559ab","sha1":"56977de783ee69a0dbd14635c5a34fa3946b2252","sha256":"9209ca41f0f277ebe6b6e87354dc667081a638b83945f4531807bf06046227c7","sha512":"d3f9747c4e662b5dc6bf2e4e88b68425f82c89cc01c4a088574bcae8fa6c9896052b26355c2a1d93f4b6e8a5a4e589378f004c8d33299a0a53e0e5e63731c78b","ssdeep":"24576:TNmEvSBlsi1KhVzbweQgx+oaiM8eMkEcnxnF/DlZKmTKvxg4hahhDAeYYL24qC0s:TNmEvSBlsi1KhV6xnF/DlZKmTKvxg4hc","tlshash":"31255f3cabb1253baca7a1e9e145fdacd50762d8ed3005e7bc9221019be13f7c947264","first_seen":"2025-07-26T19:06:20.805876Z","last_seen":"2026-08-11T21:29:21.67991Z","times_seen":4547,"resource_available":false,"data":null}},"time_used":133,"timings":{"blocked":35,"dns":1,"connect":13,"send":0,"wait":16,"receive":45,"ssl":20},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"four-memes.sbs/favicon.ico","fqdn":"four-memes.sbs","domain":"four-memes.sbs","tld":"sbs"},"ip":{"addr":"94.154.35.60","port":443,"asn":215567,"as":"Emirhan Kurt","country":"Ukraine","country_code":"UA"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://four-memes.sbs/","date":"2025-11-07T19:55:35.810Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"four-memes.sbs","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Tue, 21 Oct 2025 13:36:09 GMT","end":"Mon, 19 Jan 2026 13:36:08 GMT"},"fingerprint":{"sha1":"77:2E:E3:19:45:2A:10:DC:05:0A:1B:26:EA:46:C6:43:41:54:FA:29","sha256":"30:ED:E0:A0:59:6D:F7:A0:0C:C7:D3:0D:2F:E8:2F:99:C1:35:4D:1B:AC:A4:F5:C6:95:FD:80:FA:AD:9C:ED:66"}}},"request":{"raw":"GET /favicon.ico HTTP/1.1\r\nHost: four-memes.sbs\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://four-memes.sbs/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 404 Not Found\r\nserver: nginx\r\ndate: Fri, 07 Nov 2025 19:55:35 GMT\r\ncontent-type: text/html\r\ncontent-length: 146\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"404","status_text":"Not Found","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":146,"size_decoded":0,"mime_type":"text/html","magic":"HTML document, ASCII text, with CRLF line terminators","md5":"8eec510e57f5f732fd2cce73df7b73ef","sha1":"3c0af39ecb3753c5fee3b53d063c7286019eac3b","sha256":"55f7d9e99b8e2d4e0e193b2f0275501e6d9c1ebd29cadbea6a0da48a8587e3e0","sha512":"73bbf698482132b5fd60a0b58926fddec9055f8095a53bc52714e211e9340c3419736ceafd6b279667810114d306bfccdcfcddf51c0b67fe9e3c73c54583e574","ssdeep":"","tlshash":"b7c02b2d35133c4cc563313423c37140c0d6833b687a41110400c00371cf2998ec3397","first_seen":"2023-03-07T12:05:15Z","last_seen":"2026-08-12T03:59:14.629162Z","times_seen":549500,"resource_available":true,"data":null}},"time_used":80,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":80,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-11-07","alert":"Sinkholed","trigger":"four-memes.sbs","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}}]}