{"report_id":"da863209-3c27-4fa4-ad5d-344cf356b1e8","version":0,"status":"done","tags":[],"date":"2026-09-08T20:29:05Z","url":{"schema":"http","addr":"rnorpho.com/","fqdn":"rnorpho.com","domain":"rnorpho.com","tld":"com"},"ip":{"addr":"104.168.142.173","port":0,"asn":54290,"as":"HOSTWINDS","country":"United States","country_code":"US"},"final":{"url":{"schema":"https","addr":"rnorpho.com/","fqdn":"rnorpho.com","domain":"rnorpho.com","tld":"com"},"title":"Morpho | The open credit network for the world","dom":{"size":25915,"mime_type":"text/html; charset=utf-8","magic":"HTML document, Unicode text, UTF-8 text, with very long lines (734)","md5":"408922a404873d788601a325bb8ae16f","sha1":"f69fcd833b7ea3cfc3c645077a4de7969868b74f","sha256":"150976dd47d5f1199e9577fac10a421a473dc7b5b6592c7fea9509139a96632e","sha512":"efc308ea35917dbcedc5f7dc7cd50c28c8ff4af6933ec34985c7c7e3e6e5d1607b79fd53f56bb9e792e957b5cf3044808f45e530548c044cac516c6485a8b9a6","ssdeep":"384:UjK6BBk+NnDktBH38dAxSkDpJPsUEPBznqJnwHyceSuEmA4bBycgJ:UjKcBk+StBX8s9gBxHmA4bgcgJ","tlshash":"afc2093367d922a50a412265a1e86f82fe2c845ff3003096762dc9ff1f92929c73fe55","dom_hash":"domhash26212bb8fb1de69e1d7169c1f263e55b","first_seen":"2026-09-08T19:59:51.938953Z","last_seen":"2026-09-08T20:29:07.406196Z","times_seen":2,"resource_available":false,"data":null}},"submit":{"url":{"schema":"http","addr":"rnorpho.com/","fqdn":"rnorpho.com","domain":"rnorpho.com","tld":"com"},"ip":{"addr":"104.168.142.173","port":0,"asn":54290,"as":"HOSTWINDS","country":"United States","country_code":"US"},"tags":null,"meta":null},"settings":{"access":"public","device_type":"desktop","expires_at":"2027-10-13T20:29:05Z","useragent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0","referer":"","cookies":null,"exit_node":"qguvgzjxzsgb3vs"},"stats":{"alert_count":{"ids":0,"urlquery":0,"analyzer":1}},"detection":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-08","alert":"Sinkholed","trigger":"rnorpho.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null},"summary":[{"fqdn":"rnorpho.com","ip":{"addr":"104.168.142.173","port":443,"asn":54290,"as":"HOSTWINDS","country":"United States","country_code":"US"},"domain_registered":"2026-07-31","domain_rank":0,"first_seen":"2026-09-08T19:59:48.089146Z","last_seen":"2026-09-08T19:59:48.089146Z","alert_count":10,"request_count":10,"received_data":2599579,"sent_data":4888,"comment":"","tags":null,"fingerprints":[{"name":"Nginx:1.28.2","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}]}],"files":null,"artifacts":{"windows_shortcuts":null,"files":null,"telegram":null,"pdfs":null,"clipboard":null},"sensors":{"ids":null,"analyzer":null,"urlquery":null},"javascript":{"script":[{"url":{"schema":"https","addr":"rnorpho.com/scripts.js","fqdn":"rnorpho.com","domain":"rnorpho.com","tld":"com"},"ip":{"addr":"104.168.142.173","port":443,"asn":54290,"as":"HOSTWINDS","country":"United States","country_code":"US"},"introduction_type":"scriptElement","is_inline":false,"md5":"365cb4a7cc97c1c57efc986c1e3b791a","sha1":"78e75954f5172ccea9efc4fc10f1d172016ddba2","sha256":"e4acfcae3506e96c83eb71ce65bef7a020da72fec674188ccc4eaab98a11ace9","sha512":"fb52d258c11b034d150f5c4221669729bee21441732b53265743adde5860d1cb8872634c1da96a8505c3af4051ef4acc2a1b7ae7c5ce866ca2a5382ba173056a","ssdeep":"","tlshash":"80f0245d2ef105624abb33798b8f965836369093014ace153edd8648dfd84be0b75ec8","size":605,"data":"","first_seen":"2026-07-08T03:27:01.326213Z","last_seen":"2026-09-08T20:29:07.40731Z","times_seen":7,"alerts":{"ids":null,"analyzer":null,"urlquery":null}}],"eval":null,"write":null,"console":null},"http":[{"url":{"schema":"https","addr":"rnorpho.com/scripts.js","fqdn":"rnorpho.com","domain":"rnorpho.com","tld":"com"},"ip":{"addr":"104.168.142.173","port":443,"asn":54290,"as":"HOSTWINDS","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://rnorpho.com/","date":"2026-09-08T20:28:35.501Z","timestamp":1788899315501,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"rnorpho.com","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Fri, 31 Jul 2026 14:12:21 GMT","end":"Thu, 29 Oct 2026 14:12:20 GMT"},"fingerprint":{"sha1":"4D:81:8F:E5:8A:B8:0A:7F:4A:5C:FB:5C:B3:66:51:3B:FB:B1:27:F8","sha256":"7E:0B:1D:D8:DE:3F:18:FB:EA:84:10:CF:33:72:20:24:FA:D0:F7:8F:78:B1:60:02:AC:49:B7:20:11:B9:20:36"}}},"request":{"raw":"GET /scripts.js HTTP/1.1\r\nHost: rnorpho.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://rnorpho.com/\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nServer: nginx/1.28.2\r\nDate: Tue, 08 Sep 2026 20:28:35 GMT\r\nContent-Type: application/javascript; charset=utf-8\r\nContent-Length: 605\r\nLast-Modified: Mon, 03 Aug 2026 10:21:38 GMT\r\nConnection: keep-alive\r\nETag: \"6a706bb2-25d\"\r\nAccept-Ranges: bytes\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx:1.28.2","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":605,"size_decoded":871,"mime_type":"application/javascript; charset=utf-8","magic":"JavaScript source, ASCII text","md5":"365cb4a7cc97c1c57efc986c1e3b791a","sha1":"78e75954f5172ccea9efc4fc10f1d172016ddba2","sha256":"e4acfcae3506e96c83eb71ce65bef7a020da72fec674188ccc4eaab98a11ace9","sha512":"fb52d258c11b034d150f5c4221669729bee21441732b53265743adde5860d1cb8872634c1da96a8505c3af4051ef4acc2a1b7ae7c5ce866ca2a5382ba173056a","ssdeep":"","tlshash":"80f0245d2ef105624abb33798b8f965836369093014ace153edd8648dfd84be0b75ec8","first_seen":"2026-07-08T03:27:01.326213Z","last_seen":"2026-09-08T20:29:07.40731Z","times_seen":7,"resource_available":true,"data":null}},"time_used":291,"timings":{"blocked":-1,"dns":0,"connect":146,"send":0,"wait":146,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-08","alert":"Sinkholed","trigger":"rnorpho.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"rnorpho.com/img/morpho.png","fqdn":"rnorpho.com","domain":"rnorpho.com","tld":"com"},"ip":{"addr":"104.168.142.173","port":443,"asn":54290,"as":"HOSTWINDS","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://rnorpho.com/","date":"2026-09-08T20:28:35.509Z","timestamp":1788899315509,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"rnorpho.com","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Fri, 31 Jul 2026 14:12:21 GMT","end":"Thu, 29 Oct 2026 14:12:20 GMT"},"fingerprint":{"sha1":"4D:81:8F:E5:8A:B8:0A:7F:4A:5C:FB:5C:B3:66:51:3B:FB:B1:27:F8","sha256":"7E:0B:1D:D8:DE:3F:18:FB:EA:84:10:CF:33:72:20:24:FA:D0:F7:8F:78:B1:60:02:AC:49:B7:20:11:B9:20:36"}}},"request":{"raw":"GET /img/morpho.png HTTP/1.1\r\nHost: rnorpho.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://rnorpho.com/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nServer: nginx/1.28.2\r\nDate: Tue, 08 Sep 2026 20:28:35 GMT\r\nContent-Type: image/png\r\nLast-Modified: Fri, 26 Jun 2026 10:00:20 GMT\r\nTransfer-Encoding: chunked\r\nConnection: keep-alive\r\nETag: W/\"6a3e4db4-21731e\"\r\nContent-Encoding: gzip\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx:1.28.2","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":2192158,"size_decoded":2192796,"mime_type":"image/png","magic":"PNG image data, 1600 x 900, 8-bit/color RGB, non-interlaced","md5":"bd89dcbe446d0a9903572dc9d7ae0707","sha1":"a1b93b1059029c133cf76df74c672759506bac5e","sha256":"6c04821c5ee202e86bb2af3ca692cd9634227cdf761233e8ef4a18fb4d2ce54a","sha512":"cff108ad1a8369ab028e7f7435f2657ac71b6249959a3728869aa39b9342c91b7638b87239a1a77d30c51a3cee41b869ce5e066eb5bfa9a90a37589c6a7c29b3","ssdeep":"24576:zVxSbMrmjOkwQqFWijmSlMrsQuShx/x7vW9zXR4Pqh:zVl3kwQejXur1uwNxvW99V","tlshash":"bc253361a81e157f125be88f324359093398b69fdf5fb676042bf19c1a1a2c327367c1","first_seen":"2026-08-28T13:14:41.143622Z","last_seen":"2026-09-08T20:29:07.408023Z","times_seen":4,"resource_available":false,"data":null}},"time_used":1310,"timings":{"blocked":128,"dns":0,"connect":146,"send":0,"wait":148,"receive":888,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-08","alert":"Sinkholed","trigger":"rnorpho.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"rnorpho.com/img/what_is_morpho.webp","fqdn":"rnorpho.com","domain":"rnorpho.com","tld":"com"},"ip":{"addr":"104.168.142.173","port":443,"asn":54290,"as":"HOSTWINDS","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://rnorpho.com/","date":"2026-09-08T20:28:35.510Z","timestamp":1788899315510,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"rnorpho.com","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Fri, 31 Jul 2026 14:12:21 GMT","end":"Thu, 29 Oct 2026 14:12:20 GMT"},"fingerprint":{"sha1":"4D:81:8F:E5:8A:B8:0A:7F:4A:5C:FB:5C:B3:66:51:3B:FB:B1:27:F8","sha256":"7E:0B:1D:D8:DE:3F:18:FB:EA:84:10:CF:33:72:20:24:FA:D0:F7:8F:78:B1:60:02:AC:49:B7:20:11:B9:20:36"}}},"request":{"raw":"GET /img/what_is_morpho.webp HTTP/1.1\r\nHost: rnorpho.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://rnorpho.com/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nServer: nginx/1.28.2\r\nDate: Tue, 08 Sep 2026 20:28:36 GMT\r\nContent-Type: image/webp\r\nContent-Length: 40562\r\nLast-Modified: Fri, 26 Jun 2026 10:02:13 GMT\r\nConnection: keep-alive\r\nETag: \"6a3e4e25-9e72\"\r\nAccept-Ranges: bytes\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx:1.28.2","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":40562,"size_decoded":40804,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image, VP8 encoding, 720x405, Scaling: [none]x[none], YUV color, decoders should clamp","md5":"4d6f2825add7a78e76391a2545d675b6","sha1":"c99a453a78174f1cab5768ca9b2300c70e8a74f1","sha256":"86143373bb41ec3cdc438624af27f1511f97f6990999e51d3235416ebb3fd207","sha512":"b21052be07bc7ed1371040bb869bede2a3d2dc0a9c28ee4aac98c018778457b2d96398d233152308fdd8e44377071233f3cf691a65c6fc4f08f0951581a9aaba","ssdeep":"768:YNp0o//KHM4cutKd1yHSJp/CcxbDo8V1ALpmsciSeM5kGk4tin8Npkn1S8yxmNVo:VoqH08Kr3/FbD1V1OmsG5Zk4tinL4p+q","tlshash":"2c03027e804d0f4763f3b2401f6f0b27b953b9c0a96cca3105a727b4996666f8f66806","first_seen":"2026-08-28T13:14:41.112658Z","last_seen":"2026-09-08T20:29:07.40865Z","times_seen":4,"resource_available":false,"data":null}},"time_used":880,"timings":{"blocked":128,"dns":0,"connect":146,"send":0,"wait":292,"receive":146,"ssl":169},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-08","alert":"Sinkholed","trigger":"rnorpho.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"rnorpho.com/favicon.ico","fqdn":"rnorpho.com","domain":"rnorpho.com","tld":"com"},"ip":{"addr":"104.168.142.173","port":443,"asn":54290,"as":"HOSTWINDS","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://rnorpho.com/","date":"2026-09-08T20:28:36.304Z","timestamp":1788899316304,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"rnorpho.com","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Fri, 31 Jul 2026 14:12:21 GMT","end":"Thu, 29 Oct 2026 14:12:20 GMT"},"fingerprint":{"sha1":"4D:81:8F:E5:8A:B8:0A:7F:4A:5C:FB:5C:B3:66:51:3B:FB:B1:27:F8","sha256":"7E:0B:1D:D8:DE:3F:18:FB:EA:84:10:CF:33:72:20:24:FA:D0:F7:8F:78:B1:60:02:AC:49:B7:20:11:B9:20:36"}}},"request":{"raw":"GET /favicon.ico HTTP/1.1\r\nHost: rnorpho.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://rnorpho.com/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=6\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nServer: nginx/1.28.2\r\nDate: Tue, 08 Sep 2026 20:28:36 GMT\r\nContent-Type: image/x-icon\r\nContent-Length: 4286\r\nLast-Modified: Fri, 26 Jun 2026 10:09:29 GMT\r\nConnection: keep-alive\r\nETag: \"6a3e4fd9-10be\"\r\nAccept-Ranges: bytes\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx:1.28.2","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":4286,"size_decoded":4529,"mime_type":"image/x-icon","magic":"MS Windows icon resource - 1 icon, 32x32, 32 bits/pixel","md5":"7d23f001864d0f471867ef8d216b40d6","sha1":"2fec518ff33e088461a98ba5219ed2a041965bea","sha256":"4f9e1d92806375656e14cb2277c92a22963d9074bfa708fe0787e1b9c8a4aaed","sha512":"09c4e534202a1aaf7910567e7d2895a89da283191d3dfb97c1027c1374837f30482123082f14d24e933321ddb6211a19becc37b302a473d0d767596019d374b4","ssdeep":"12:suHjFrkWAyj+V0tkAyjsziebuBNykqLq+SV9TLGKu1TF3EPIGT3OkckTaOUHxLL8:suHjdBXE0+XqiXB0IXLGKunkV+YGHh8","tlshash":"34913a5365c8f2a1dce04cf8415403714b6f1e3ad8ef2a51c6407ba9c93d4806f1a2ca","first_seen":"2026-08-28T13:14:41.12596Z","last_seen":"2026-09-08T20:29:07.409302Z","times_seen":4,"resource_available":false,"data":null}},"time_used":254,"timings":{"blocked":95,"dns":0,"connect":0,"send":0,"wait":159,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-08","alert":"Sinkholed","trigger":"rnorpho.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"rnorpho.com/","fqdn":"rnorpho.com","domain":"rnorpho.com","tld":"com"},"ip":{"addr":"104.168.142.173","port":443,"asn":54290,"as":"HOSTWINDS","country":"United States","country_code":"US"},"is_navigation_request":true,"resource_type":"document","requested_by":"","date":"2026-09-08T20:28:34.529Z","timestamp":1788899314529,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"rnorpho.com","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Fri, 31 Jul 2026 14:12:21 GMT","end":"Thu, 29 Oct 2026 14:12:20 GMT"},"fingerprint":{"sha1":"4D:81:8F:E5:8A:B8:0A:7F:4A:5C:FB:5C:B3:66:51:3B:FB:B1:27:F8","sha256":"7E:0B:1D:D8:DE:3F:18:FB:EA:84:10:CF:33:72:20:24:FA:D0:F7:8F:78:B1:60:02:AC:49:B7:20:11:B9:20:36"}}},"request":{"raw":"GET / HTTP/1.1\r\nHost: rnorpho.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nUpgrade-Insecure-Requests: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: document\r\nSec-Fetch-Mode: navigate\r\nSec-Fetch-Site: none\r\nPriority: u=0, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nServer: nginx/1.28.2\r\nDate: Tue, 08 Sep 2026 20:28:35 GMT\r\nContent-Type: text/html; charset=UTF-8\r\nContent-Length: 8475\r\nConnection: keep-alive\r\nVary: Accept-Encoding\r\nContent-Encoding: gzip\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx:1.28.2","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":25929,"size_decoded":8686,"mime_type":"text/html; charset=UTF-8","magic":"HTML document, Unicode text, UTF-8 text, with very long lines (734)","md5":"0869f3d39d76fe1d7a8bc1e5c280463a","sha1":"c52fab972ff6b3d7649fd8f019058e45647433cb","sha256":"b2ce5ec4a5320541ea503837bbacc45c2d1d6d7d2823b18a0b009ab9f8260ab6","sha512":"8d0725e70c9876de8219ff0bbf1c909092a435f1e8a83ca77d93b6ba48c5cbb9b27622b9f3a87e3c73ae687013b50b0804d1a411de8b9145242a6d83b186759c","ssdeep":"384:6jK6BBk+NnDktBH38dAxSkDpJPsUEPBznqJnwHyceSuEmA4bBycg4:6jKcBk+StBX8s9gBxHmA4bgcg4","tlshash":"37c2093367d522a50a412265a1e86f82fe2c445ff3003196752dc9ff1f92929c73fe59","first_seen":"2026-09-08T19:59:51.948151Z","last_seen":"2026-09-08T20:29:07.410419Z","times_seen":2,"resource_available":false,"data":null}},"time_used":809,"timings":{"blocked":-1,"dns":78,"connect":146,"send":0,"wait":288,"receive":0,"ssl":297},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-08","alert":"Sinkholed","trigger":"rnorpho.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"rnorpho.com/articles.css","fqdn":"rnorpho.com","domain":"rnorpho.com","tld":"com"},"ip":{"addr":"104.168.142.173","port":443,"asn":54290,"as":"HOSTWINDS","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://rnorpho.com/","date":"2026-09-08T20:28:35.498Z","timestamp":1788899315498,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"rnorpho.com","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Fri, 31 Jul 2026 14:12:21 GMT","end":"Thu, 29 Oct 2026 14:12:20 GMT"},"fingerprint":{"sha1":"4D:81:8F:E5:8A:B8:0A:7F:4A:5C:FB:5C:B3:66:51:3B:FB:B1:27:F8","sha256":"7E:0B:1D:D8:DE:3F:18:FB:EA:84:10:CF:33:72:20:24:FA:D0:F7:8F:78:B1:60:02:AC:49:B7:20:11:B9:20:36"}}},"request":{"raw":"GET /articles.css HTTP/1.1\r\nHost: rnorpho.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://rnorpho.com/\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=2\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nServer: nginx/1.28.2\r\nDate: Tue, 08 Sep 2026 20:28:35 GMT\r\nContent-Type: text/css\r\nLast-Modified: Mon, 03 Aug 2026 10:23:15 GMT\r\nTransfer-Encoding: chunked\r\nConnection: keep-alive\r\nETag: W/\"6a706c13-1954\"\r\nContent-Encoding: gzip\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx:1.28.2","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":6484,"size_decoded":2391,"mime_type":"text/css","magic":"ASCII text","md5":"d7ffeb04f1edea667e86267562a234b8","sha1":"7caea92899df45c19687056f650c8367577043f0","sha256":"5fb8819b77b9c266285438b91aed3f7e4e05e9a1c034c64f5e12aed772431af7","sha512":"91490aebf41b906cacc06f23378bba2c2c1f317d8f9d6a668781fd6461fda7cd94fd1eda1effbb9d50937534fc473cd30a7ce35b17fb838319c8b93c17517ec8","ssdeep":"96:S2YXyyHacliWlheGArT0L7G+9XBeVpudyzL2Z/xFgfnPkp+/hs:S2YXVac0WfK0LxBeVpkyzLQjynPVs","tlshash":"7ad1131857a32ea1bc57959ca3ef93c8338c70874c45ca6d7ddaa2448f4d3b66990f8c","first_seen":"2026-09-08T19:59:51.949379Z","last_seen":"2026-09-08T20:29:07.411315Z","times_seen":2,"resource_available":false,"data":null}},"time_used":147,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":147,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-08","alert":"Sinkholed","trigger":"rnorpho.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"rnorpho.com/img/morpho-architecture.jpg","fqdn":"rnorpho.com","domain":"rnorpho.com","tld":"com"},"ip":{"addr":"104.168.142.173","port":443,"asn":54290,"as":"HOSTWINDS","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://rnorpho.com/","date":"2026-09-08T20:28:35.512Z","timestamp":1788899315512,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"rnorpho.com","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Fri, 31 Jul 2026 14:12:21 GMT","end":"Thu, 29 Oct 2026 14:12:20 GMT"},"fingerprint":{"sha1":"4D:81:8F:E5:8A:B8:0A:7F:4A:5C:FB:5C:B3:66:51:3B:FB:B1:27:F8","sha256":"7E:0B:1D:D8:DE:3F:18:FB:EA:84:10:CF:33:72:20:24:FA:D0:F7:8F:78:B1:60:02:AC:49:B7:20:11:B9:20:36"}}},"request":{"raw":"GET /img/morpho-architecture.jpg HTTP/1.1\r\nHost: rnorpho.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://rnorpho.com/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nServer: nginx/1.28.2\r\nDate: Tue, 08 Sep 2026 20:28:35 GMT\r\nContent-Type: image/jpeg\r\nLast-Modified: Fri, 26 Jun 2026 10:03:00 GMT\r\nTransfer-Encoding: chunked\r\nConnection: keep-alive\r\nETag: W/\"6a3e4e54-1aefd\"\r\nContent-Encoding: gzip\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx:1.28.2","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":110333,"size_decoded":90928,"mime_type":"image/jpeg","magic":"JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, comment: \"CREATOR: gd-jpeg v1.0 (using IJG JPEG v80), default quality\", baseline, precision 8, 1449x1022, components 3","md5":"f0e5085e001124d44c577fe149f8b32b","sha1":"c09bb4416bd5a52564b5cb3f631b66023edfdee8","sha256":"a03ef626b0ae6d7a7dbe2a4813511cfc4dc71c5b5145ecf8e288de6607957222","sha512":"2894057a7e2a460418598915dfa43a59ba3a79f0c70d9805a2d79507b625e6930ea0f495e9aab3aa826a90bc80e5cc0dd163b49bc98fbd13b9a5c01e963f7a7c","ssdeep":"3072:xi/k6PA58n3gYqxABRDF9JRQzTz5GNvvvvvvvvvvvppK:UsOA5y3gYqoRDszTdG8","tlshash":"e3b34a0799459b83a46993e5fe074dad1f166a0df9c23aff54134ecb3e646220c9e03e","first_seen":"2026-08-28T13:14:41.114608Z","last_seen":"2026-09-08T20:29:07.41187Z","times_seen":4,"resource_available":false,"data":null}},"time_used":874,"timings":{"blocked":280,"dns":0,"connect":0,"send":0,"wait":303,"receive":291,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-08","alert":"Sinkholed","trigger":"rnorpho.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"rnorpho.com/img/projects.jpeg","fqdn":"rnorpho.com","domain":"rnorpho.com","tld":"com"},"ip":{"addr":"104.168.142.173","port":443,"asn":54290,"as":"HOSTWINDS","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://rnorpho.com/","date":"2026-09-08T20:28:35.514Z","timestamp":1788899315514,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"rnorpho.com","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Fri, 31 Jul 2026 14:12:21 GMT","end":"Thu, 29 Oct 2026 14:12:20 GMT"},"fingerprint":{"sha1":"4D:81:8F:E5:8A:B8:0A:7F:4A:5C:FB:5C:B3:66:51:3B:FB:B1:27:F8","sha256":"7E:0B:1D:D8:DE:3F:18:FB:EA:84:10:CF:33:72:20:24:FA:D0:F7:8F:78:B1:60:02:AC:49:B7:20:11:B9:20:36"}}},"request":{"raw":"GET /img/projects.jpeg HTTP/1.1\r\nHost: rnorpho.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://rnorpho.com/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nServer: nginx/1.28.2\r\nDate: Tue, 08 Sep 2026 20:28:36 GMT\r\nContent-Type: image/jpeg\r\nLast-Modified: Fri, 26 Jun 2026 10:06:00 GMT\r\nTransfer-Encoding: chunked\r\nConnection: keep-alive\r\nETag: W/\"6a3e4f08-1b7ae\"\r\nContent-Encoding: gzip\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx:1.28.2","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":112558,"size_decoded":107785,"mime_type":"image/jpeg","magic":"JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 1404x820, components 3","md5":"7046aa90034037b5cd8619ff54545415","sha1":"e5169012ff4d947d817c70cbbf046e666c63487b","sha256":"8371d2191127a66abd2d76784a2781c0a5566d47a2a8426546d5d19ee0cc4fd9","sha512":"e8abe07f36e1c43f13430e996cb002712cfd8ec365292ccae687a71ffb805ddfee2508ab344040b91f7f5d53d22a10f95904f9e7dbf7b79eedcfe33bbfff8320","ssdeep":"3072:qBfrQvhjBUA0FXK+vRocVKQRsSHXhfX2Zl1:qBkyJFpvRRKQWEhfX2n1","tlshash":"b5b3019b7a4b8008c46a86bc5266e771f7504ce0f771a5d26fff8c70f420b0d19eaa48","first_seen":"2026-08-28T13:14:41.116696Z","last_seen":"2026-09-08T20:29:07.412529Z","times_seen":4,"resource_available":false,"data":null}},"time_used":1021,"timings":{"blocked":437,"dns":0,"connect":0,"send":0,"wait":293,"receive":291,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-08","alert":"Sinkholed","trigger":"rnorpho.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"rnorpho.com/img/funding.webp","fqdn":"rnorpho.com","domain":"rnorpho.com","tld":"com"},"ip":{"addr":"104.168.142.173","port":443,"asn":54290,"as":"HOSTWINDS","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://rnorpho.com/","date":"2026-09-08T20:28:35.515Z","timestamp":1788899315515,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"rnorpho.com","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Fri, 31 Jul 2026 14:12:21 GMT","end":"Thu, 29 Oct 2026 14:12:20 GMT"},"fingerprint":{"sha1":"4D:81:8F:E5:8A:B8:0A:7F:4A:5C:FB:5C:B3:66:51:3B:FB:B1:27:F8","sha256":"7E:0B:1D:D8:DE:3F:18:FB:EA:84:10:CF:33:72:20:24:FA:D0:F7:8F:78:B1:60:02:AC:49:B7:20:11:B9:20:36"}}},"request":{"raw":"GET /img/funding.webp HTTP/1.1\r\nHost: rnorpho.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://rnorpho.com/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nServer: nginx/1.28.2\r\nDate: Tue, 08 Sep 2026 20:28:36 GMT\r\nContent-Type: image/webp\r\nContent-Length: 86654\r\nLast-Modified: Fri, 26 Jun 2026 10:04:40 GMT\r\nConnection: keep-alive\r\nETag: \"6a3e4eb8-1527e\"\r\nAccept-Ranges: bytes\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx:1.28.2","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":86654,"size_decoded":86897,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image","md5":"bd26b6e7aa6a12df895e2f7e81edbe69","sha1":"5d51bf4c865fa084596701e5384c96a8f8051d94","sha256":"e2e1c90ce472cbb9257f134fda122d82b824681f52af09c52625e9ae025931cf","sha512":"1f87b7bb96750d6fcad9009066c12b323c727ffea848f467cbe53f8a00bc55f5ce1c191b60d6b0be24340cdfe495fa55ee6eb69cf1b87381e693fe11df139f8b","ssdeep":"1536:eudu1FQS32nJKthhCurTaq4HWGp3gJD/CW5Z3Dl6oQFEohNakFkBq0dP54DpTse/:bdYFQu2niCuaGGdGD/Pbh6zEohNakFWs","tlshash":"8d8313057f8c003f89a85b7e622e0a5de847b55ba3ef8b31c596c5c41f4ea01bb591e3","first_seen":"2026-08-28T13:14:41.118441Z","last_seen":"2026-09-08T20:29:07.413609Z","times_seen":4,"resource_available":false,"data":null}},"time_used":1024,"timings":{"blocked":128,"dns":0,"connect":146,"send":0,"wait":296,"receive":291,"ssl":161},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-08","alert":"Sinkholed","trigger":"rnorpho.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"rnorpho.com/logo512.png","fqdn":"rnorpho.com","domain":"rnorpho.com","tld":"com"},"ip":{"addr":"104.168.142.173","port":443,"asn":54290,"as":"HOSTWINDS","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://rnorpho.com/","date":"2026-09-08T20:28:36.302Z","timestamp":1788899316302,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"rnorpho.com","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Fri, 31 Jul 2026 14:12:21 GMT","end":"Thu, 29 Oct 2026 14:12:20 GMT"},"fingerprint":{"sha1":"4D:81:8F:E5:8A:B8:0A:7F:4A:5C:FB:5C:B3:66:51:3B:FB:B1:27:F8","sha256":"7E:0B:1D:D8:DE:3F:18:FB:EA:84:10:CF:33:72:20:24:FA:D0:F7:8F:78:B1:60:02:AC:49:B7:20:11:B9:20:36"}}},"request":{"raw":"GET /logo512.png HTTP/1.1\r\nHost: rnorpho.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://rnorpho.com/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=6\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nServer: nginx/1.28.2\r\nDate: Tue, 08 Sep 2026 20:28:36 GMT\r\nContent-Type: image/png\r\nLast-Modified: Fri, 26 Jun 2026 10:09:06 GMT\r\nTransfer-Encoding: chunked\r\nConnection: keep-alive\r\nETag: W/\"6a3e4fc2-448e\"\r\nContent-Encoding: gzip\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx:1.28.2","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":17550,"size_decoded":16333,"mime_type":"image/png","magic":"PNG image data, 512 x 512, 8-bit/color RGBA, non-interlaced","md5":"1a6bd20e49ecee578e324c44e37f49e4","sha1":"9ad50eca87ae60fa396d653bce72121fb81b0013","sha256":"f37a243e87c2516c65da859500afa747e921e4ead1128f097c7cdc0bf12700e5","sha512":"6655cf9f2fbf0102e14d3c417244e7793bdd22fdc6d8701ca0c8089d58a2a8bc9be79204b241bf0fff6701909685ade25e573a3659daef5045c32af7031e5e73","ssdeep":"384:7kXDwR5vxX0PlH60x0vFljZTxWq918FStSj:7kzY1ep0x5/te","tlshash":"fb728d57cad37e8fa84b60d087c73b866870584ba3c30e4fcfb2117a614749bba75852","first_seen":"2026-08-28T13:14:41.123938Z","last_seen":"2026-09-08T20:29:07.414545Z","times_seen":4,"resource_available":false,"data":null}},"time_used":255,"timings":{"blocked":-1,"dns":0,"connect":146,"send":0,"wait":166,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-08","alert":"Sinkholed","trigger":"rnorpho.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}}]}