{"report_id":"db5c5993-7bec-4772-9701-bd790f6d32c5","version":0,"status":"done","tags":[],"date":"2026-09-19T08:16:48Z","url":{"schema":"http","addr":"rnatcha.org/","fqdn":"rnatcha.org","domain":"rnatcha.org","tld":"org"},"ip":{"addr":"104.168.142.173","port":0,"asn":54290,"as":"Hostwinds LLC.","country":"United States","country_code":"US"},"final":{"url":{"schema":"https","addr":"rnatcha.org/","fqdn":"rnatcha.org","domain":"rnatcha.org","tld":"org"},"title":"Matcha | DEX aggregator by 0x | Search, trade, done.","dom":{"size":29842,"mime_type":"text/html; charset=utf-8","magic":"HTML document, Unicode text, UTF-8 text, with very long lines (596)","md5":"13fe9d941cd1aa5e4670d6d81a5c4e3c","sha1":"fc9a4e6b4fd3da7944f3035b0314901d5342d6c5","sha256":"585f5f40ca359876c0b3a3d0e17d2047c143f224b8cc7440ce7335662560c873","sha512":"154786bd16336f9ed7d5b0027a4f96492d0f95d749f854a5928d6d033cdd67b4197c5ab6b230d12459eb0d5925a04bda88454dd3d8626d1deee9b266ea8efbdc","ssdeep":"384:hvLwMRptcV4upVlwCqalotqPYMLOKfitJqONC2Is92aEOtVMHirYtpOBtiha:NjR/UNV03+RLvfiNFjvHrPBV","tlshash":"95d2e8b7a2d82360061241167a4e97f2df4bc02bd32115517aacc07c7f85a8dcabbf9d","dom_hash":"domhash4af711a712fbb09bb1f3d36de9893d08","first_seen":"2026-09-19T07:18:17.305218Z","last_seen":"2026-09-19T08:16:51.419581Z","times_seen":2,"resource_available":false,"data":null}},"submit":{"url":{"schema":"http","addr":"rnatcha.org/","fqdn":"rnatcha.org","domain":"rnatcha.org","tld":"org"},"ip":{"addr":"104.168.142.173","port":0,"asn":54290,"as":"Hostwinds LLC.","country":"United States","country_code":"US"},"tags":null,"meta":null},"settings":{"access":"public","device_type":"desktop","expires_at":"2027-10-24T08:16:48Z","useragent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0","referer":"","cookies":null,"exit_node":"qguvgzjxzsgb3vs"},"stats":{"alert_count":{"ids":0,"urlquery":0,"analyzer":1}},"detection":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-19","alert":"Sinkholed","trigger":"rnatcha.org","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null},"summary":[{"fqdn":"rnatcha.org","ip":{"addr":"104.168.142.173","port":443,"asn":54290,"as":"HOSTWINDS","country":"United States","country_code":"US"},"domain_registered":"2026-08-18","domain_rank":0,"first_seen":"2026-09-19T07:18:11.727641Z","last_seen":"2026-09-19T07:18:11.727641Z","alert_count":8,"request_count":8,"received_data":774483,"sent_data":3944,"comment":"","tags":null,"fingerprints":[{"name":"Nginx:1.30.5","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}]}],"files":null,"artifacts":{"windows_shortcuts":null,"files":null,"telegram":null,"pdfs":null,"clipboard":null},"sensors":{"ids":null,"analyzer":null,"urlquery":null},"javascript":{"script":null,"eval":null,"write":null,"console":null},"http":[{"url":{"schema":"https","addr":"rnatcha.org/logo512.png","fqdn":"rnatcha.org","domain":"rnatcha.org","tld":"org"},"ip":{"addr":"104.168.142.173","port":443,"asn":54290,"as":"HOSTWINDS","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://rnatcha.org/","date":"2026-09-19T08:16:19.885Z","timestamp":1789805779885,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"rnatcha.org","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Tue, 18 Aug 2026 07:48:30 GMT","end":"Mon, 16 Nov 2026 07:48:29 GMT"},"fingerprint":{"sha1":"44:BD:6E:A0:B2:0C:71:76:02:F2:6C:E2:56:82:A2:8B:54:9C:AB:52","sha256":"0A:51:1C:3C:3F:E4:C6:69:8A:11:D2:2D:E2:3E:C8:DF:E4:5A:10:D1:75:20:76:B1:1D:40:82:0C:E6:13:C5:DD"}}},"request":{"raw":"GET /logo512.png HTTP/1.1\r\nHost: rnatcha.org\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://rnatcha.org/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=6\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nServer: nginx/1.30.5\r\nDate: Sat, 19 Sep 2026 08:16:19 GMT\r\nContent-Type: image/png\r\nLast-Modified: Sat, 13 Jun 2026 21:15:29 GMT\r\nTransfer-Encoding: chunked\r\nConnection: keep-alive\r\nETag: W/\"6a2dc871-13883\"\r\nContent-Encoding: gzip\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx:1.30.5","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":80003,"size_decoded":79375,"mime_type":"image/png","magic":"PNG image data, 512 x 512, 8-bit/color RGBA, non-interlaced","md5":"d99e7147c0ef73b708c3f3cce20e5e22","sha1":"bcbcdeb12cdd002827f6a05ef41c638b6f0a974d","sha256":"0eed14dc85ee2d247bac571a442c3a64e185c7e2962f3ed38a948db1a3363446","sha512":"3485d09e159605cc9fa79309a4e93ebd94ed5b379c2d3a4a15d88690cad6dc372dd08e057d165444907defabb4c01d64215924992d0fcbf53554d190b2471366","ssdeep":"1536:c12bqOlU4l+S675bu3eGoUSRNxF9oCG6OobSItoRkcilm5EkG/HdoWnV6m:c1POS4l7C5PGbSXxMCG6Oo2ItMkXoSFR","tlshash":"c273f17394945bfc6bf168dda8720f281bf72e368415a220cf57acad2394b52d17e086","first_seen":"2026-09-19T07:18:17.307766Z","last_seen":"2026-09-19T08:16:51.42517Z","times_seen":2,"resource_available":false,"data":null}},"time_used":457,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":304,"receive":153,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-19","alert":"Sinkholed","trigger":"rnatcha.org","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"rnatcha.org/favicon.ico","fqdn":"rnatcha.org","domain":"rnatcha.org","tld":"org"},"ip":{"addr":"104.168.142.173","port":443,"asn":54290,"as":"HOSTWINDS","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://rnatcha.org/","date":"2026-09-19T08:16:19.886Z","timestamp":1789805779886,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"rnatcha.org","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Tue, 18 Aug 2026 07:48:30 GMT","end":"Mon, 16 Nov 2026 07:48:29 GMT"},"fingerprint":{"sha1":"44:BD:6E:A0:B2:0C:71:76:02:F2:6C:E2:56:82:A2:8B:54:9C:AB:52","sha256":"0A:51:1C:3C:3F:E4:C6:69:8A:11:D2:2D:E2:3E:C8:DF:E4:5A:10:D1:75:20:76:B1:1D:40:82:0C:E6:13:C5:DD"}}},"request":{"raw":"GET /favicon.ico HTTP/1.1\r\nHost: rnatcha.org\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://rnatcha.org/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=6\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nServer: nginx/1.30.5\r\nDate: Sat, 19 Sep 2026 08:16:20 GMT\r\nContent-Type: image/x-icon\r\nContent-Length: 15406\r\nLast-Modified: Sat, 13 Jun 2026 21:14:36 GMT\r\nConnection: keep-alive\r\nETag: \"6a2dc83c-3c2e\"\r\nAccept-Ranges: bytes\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx:1.30.5","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":15406,"size_decoded":15650,"mime_type":"image/x-icon","magic":"MS Windows icon resource - 3 icons, 16x16, 32 bits/pixel, 32x32, 32 bits/pixel","md5":"61312808fec02f68b96ed0c800efdc84","sha1":"37881c5044e775d43fd5e0f6b2a0ac9a6052c7f5","sha256":"b10c409c16de069d50d295f9d00e90ecd4c636c9e4233809081106511969928d","sha512":"85f96ce27b29eea9b57285b60b2a7a13df20d4ae6e67ca2038323e0cca19720cca2c326d09200b1c68d3e224f551e151655137468b624d5fc8b937df46190e9b","ssdeep":"384:muuu/uuuuuu4uuuuuuuuLuuuuuuuuuyuuuuPuuulsYf+uWuuuzBuruuuhuuuuuuh:muuu/uuuuuu4uuuuuuuuLuuuuuuuuuyq","tlshash":"4f62b80667f10958f35cdb3411827e3eb724cbc7beaca6a663929db32cd73860125748","first_seen":"2026-06-27T06:11:27.15351Z","last_seen":"2026-09-19T08:16:51.427349Z","times_seen":7,"resource_available":false,"data":null}},"time_used":611,"timings":{"blocked":0,"dns":0,"connect":152,"send":0,"wait":302,"receive":0,"ssl":156},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-19","alert":"Sinkholed","trigger":"rnatcha.org","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"rnatcha.org/","fqdn":"rnatcha.org","domain":"rnatcha.org","tld":"org"},"ip":{"addr":"104.168.142.173","port":443,"asn":54290,"as":"HOSTWINDS","country":"United States","country_code":"US"},"is_navigation_request":true,"resource_type":"document","requested_by":"","date":"2026-09-19T08:16:18.301Z","timestamp":1789805778301,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"rnatcha.org","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Tue, 18 Aug 2026 07:48:30 GMT","end":"Mon, 16 Nov 2026 07:48:29 GMT"},"fingerprint":{"sha1":"44:BD:6E:A0:B2:0C:71:76:02:F2:6C:E2:56:82:A2:8B:54:9C:AB:52","sha256":"0A:51:1C:3C:3F:E4:C6:69:8A:11:D2:2D:E2:3E:C8:DF:E4:5A:10:D1:75:20:76:B1:1D:40:82:0C:E6:13:C5:DD"}}},"request":{"raw":"GET / HTTP/1.1\r\nHost: rnatcha.org\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nUpgrade-Insecure-Requests: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: document\r\nSec-Fetch-Mode: navigate\r\nSec-Fetch-Site: none\r\nPriority: u=0, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nServer: nginx/1.30.5\r\nDate: Sat, 19 Sep 2026 08:16:18 GMT\r\nContent-Type: text/html; charset=UTF-8\r\nContent-Length: 9770\r\nConnection: keep-alive\r\nVary: Accept-Encoding\r\nContent-Encoding: gzip\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx:1.30.5","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":29859,"size_decoded":9981,"mime_type":"text/html; charset=UTF-8","magic":"HTML document, Unicode text, UTF-8 text, with very long lines (596)","md5":"43b87bcd299c7e6a16f2ab448abf30d1","sha1":"b4ae04369d68749aa020183699cb9b5b6dda503d","sha256":"2f468501ce5608bd82c43da785052d5227b16150247339baf2c68e58d8101580","sha512":"66119809ef513a5817702cf6f99bc384e394a385b03159dd42bc4422e727f310a224318b51d17051a14544a29fe7b13da723ad80e57e6ea448a428f9a657d247","ssdeep":"384:DvLwMRptcV4upVlwCqalotqPYMLOKfitJqONC2Is92aEOtVMHirYtpOBtihi:njR/UNV03+RLvfiNFjvHrPB5","tlshash":"0fd2e8b7a2d82360061241167a4e97f2df4bc02bd32115517aacc17c7f85a8dcabbf9d","first_seen":"2026-09-19T07:18:17.31238Z","last_seen":"2026-09-19T08:16:51.434339Z","times_seen":2,"resource_available":true,"data":null}},"time_used":841,"timings":{"blocked":0,"dns":64,"connect":151,"send":0,"wait":319,"receive":0,"ssl":306},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-19","alert":"Sinkholed","trigger":"rnatcha.org","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"rnatcha.org/index.css","fqdn":"rnatcha.org","domain":"rnatcha.org","tld":"org"},"ip":{"addr":"104.168.142.173","port":443,"asn":54290,"as":"HOSTWINDS","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://rnatcha.org/","date":"2026-09-19T08:16:19.332Z","timestamp":1789805779332,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"rnatcha.org","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Tue, 18 Aug 2026 07:48:30 GMT","end":"Mon, 16 Nov 2026 07:48:29 GMT"},"fingerprint":{"sha1":"44:BD:6E:A0:B2:0C:71:76:02:F2:6C:E2:56:82:A2:8B:54:9C:AB:52","sha256":"0A:51:1C:3C:3F:E4:C6:69:8A:11:D2:2D:E2:3E:C8:DF:E4:5A:10:D1:75:20:76:B1:1D:40:82:0C:E6:13:C5:DD"}}},"request":{"raw":"GET /index.css HTTP/1.1\r\nHost: rnatcha.org\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://rnatcha.org/\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=2\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nServer: nginx/1.30.5\r\nDate: Sat, 19 Sep 2026 08:16:19 GMT\r\nContent-Type: text/css\r\nLast-Modified: Sat, 13 Jun 2026 23:05:35 GMT\r\nTransfer-Encoding: chunked\r\nConnection: keep-alive\r\nETag: W/\"6a2de23f-44a\"\r\nContent-Encoding: gzip\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx:1.30.5","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":1098,"size_decoded":784,"mime_type":"text/css","magic":"ASCII text","md5":"fc90662460a4cd738f72b25400b523b9","sha1":"841b9848b88bce8699857497ee2f5401e5b02d66","sha256":"a4b46888c0c3b1a046446614021987b5cd831dc78078e04e2a25ccaff65a04b3","sha512":"a2274b32ef3deaf60a048b23ae4659894c26e33d374f9059d7c3388b27b8d8c9ae32bd7cc38d0a8bb5c1d57102ec7bae08e5067f81ca79202b37a77b67148d1a","ssdeep":"","tlshash":"cf118014d7e32d16f046c4982afa92903b5d254b458acb2d3a6db758cf0e6608572d94","first_seen":"2026-07-20T11:22:02.999262Z","last_seen":"2026-09-19T08:16:51.435292Z","times_seen":6,"resource_available":true,"data":null}},"time_used":151,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":151,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-19","alert":"Sinkholed","trigger":"rnatcha.org","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"rnatcha.org/img/matcha.png","fqdn":"rnatcha.org","domain":"rnatcha.org","tld":"org"},"ip":{"addr":"104.168.142.173","port":443,"asn":54290,"as":"HOSTWINDS","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://rnatcha.org/","date":"2026-09-19T08:16:19.338Z","timestamp":1789805779338,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"rnatcha.org","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Tue, 18 Aug 2026 07:48:30 GMT","end":"Mon, 16 Nov 2026 07:48:29 GMT"},"fingerprint":{"sha1":"44:BD:6E:A0:B2:0C:71:76:02:F2:6C:E2:56:82:A2:8B:54:9C:AB:52","sha256":"0A:51:1C:3C:3F:E4:C6:69:8A:11:D2:2D:E2:3E:C8:DF:E4:5A:10:D1:75:20:76:B1:1D:40:82:0C:E6:13:C5:DD"}}},"request":{"raw":"GET /img/matcha.png HTTP/1.1\r\nHost: rnatcha.org\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://rnatcha.org/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nServer: nginx/1.30.5\r\nDate: Sat, 19 Sep 2026 08:16:19 GMT\r\nContent-Type: image/png\r\nLast-Modified: Sat, 13 Jun 2026 21:09:09 GMT\r\nTransfer-Encoding: chunked\r\nConnection: keep-alive\r\nETag: W/\"6a2dc6f5-15b6c\"\r\nContent-Encoding: gzip\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx:1.30.5","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":88940,"size_decoded":87308,"mime_type":"image/png","magic":"PNG image data, 640 x 335, 16-bit/color RGB, non-interlaced","md5":"4cc9cfe373963e12b77400dc9b0730b1","sha1":"ec239f7289770ffdb0ad59e6ee43cdb97fedce6d","sha256":"2bc3d17c35f4bec8fb7db6579cfde923ead0b706991831eae8169a5bffb0286a","sha512":"3f318ced0cf2695c9f7e9867f1f6f3656929891d68837dcccd53f13029e6812ad19bd4274b3e4f8338ee08f2759b0939824acb688d07c968b5fad39f1fe8a2af","ssdeep":"1536:CsNL5ehNTle8tzI63sV99GcKNaKxuOn811sPU+Dhf+w/tRXorhFa9083JI9:Ck5KT1t0599rKvn8wPMWpI9","tlshash":"939302998029c5c95937b72fff474fc6c0613df705ea87f6a63b72a26818d913a901c4","first_seen":"2026-09-19T07:18:17.316981Z","last_seen":"2026-09-19T08:16:51.439347Z","times_seen":2,"resource_available":false,"data":null}},"time_used":1068,"timings":{"blocked":135,"dns":0,"connect":151,"send":0,"wait":317,"receive":304,"ssl":159},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-19","alert":"Sinkholed","trigger":"rnatcha.org","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"rnatcha.org/img/defi.jpg","fqdn":"rnatcha.org","domain":"rnatcha.org","tld":"org"},"ip":{"addr":"104.168.142.173","port":443,"asn":54290,"as":"HOSTWINDS","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://rnatcha.org/","date":"2026-09-19T08:16:19.345Z","timestamp":1789805779345,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"rnatcha.org","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Tue, 18 Aug 2026 07:48:30 GMT","end":"Mon, 16 Nov 2026 07:48:29 GMT"},"fingerprint":{"sha1":"44:BD:6E:A0:B2:0C:71:76:02:F2:6C:E2:56:82:A2:8B:54:9C:AB:52","sha256":"0A:51:1C:3C:3F:E4:C6:69:8A:11:D2:2D:E2:3E:C8:DF:E4:5A:10:D1:75:20:76:B1:1D:40:82:0C:E6:13:C5:DD"}}},"request":{"raw":"GET /img/defi.jpg HTTP/1.1\r\nHost: rnatcha.org\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://rnatcha.org/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nServer: nginx/1.30.5\r\nDate: Sat, 19 Sep 2026 08:16:19 GMT\r\nContent-Type: image/jpeg\r\nLast-Modified: Sat, 13 Jun 2026 21:12:07 GMT\r\nTransfer-Encoding: chunked\r\nConnection: keep-alive\r\nETag: W/\"6a2dc7a7-1a356\"\r\nContent-Encoding: gzip\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx:1.30.5","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":107350,"size_decoded":105313,"mime_type":"image/jpeg","magic":"JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, Exif Standard: [TIFF image data, little-endian, direntries=1, hostcomputer=imagery4], baseline, precision 8, 1707x960, components 3","md5":"e56cff1164f7d1e9fa5adaadd0841994","sha1":"7cff900995b1681d5db182171729c2b8e9bd11c0","sha256":"5b9ee2f8b4b053cfe407d6da90e77cdabf8af88b9f4ec787fa7b2715d4f2ce47","sha512":"5dbe281339bba8485e9dad39a0b906498c525c2b14575a3d95b5999344d62c98e8e210be3d1f382f58640793722daed9ac5c269e019adee20df5553093cdb33f","ssdeep":"1536:SJqyJ2h6CWtFaO8SzzWDy7GCiquybAFySGmkm2C+kjbdAMKSsd81Ni6RtLcyrYGl:lM0aaOtWDyibM3mMgsd8tPcy52bk","tlshash":"f3a30157f38500f2eecf5b72fcdf2230fba85941a8e943164b85393269447927c76a86","first_seen":"2026-09-19T07:18:17.31942Z","last_seen":"2026-09-19T08:16:51.441491Z","times_seen":2,"resource_available":false,"data":null}},"time_used":1054,"timings":{"blocked":134,"dns":0,"connect":151,"send":0,"wait":311,"receive":303,"ssl":155},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-19","alert":"Sinkholed","trigger":"rnatcha.org","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"rnatcha.org/img/best-way.jpg","fqdn":"rnatcha.org","domain":"rnatcha.org","tld":"org"},"ip":{"addr":"104.168.142.173","port":443,"asn":54290,"as":"HOSTWINDS","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://rnatcha.org/","date":"2026-09-19T08:16:19.346Z","timestamp":1789805779346,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"rnatcha.org","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Tue, 18 Aug 2026 07:48:30 GMT","end":"Mon, 16 Nov 2026 07:48:29 GMT"},"fingerprint":{"sha1":"44:BD:6E:A0:B2:0C:71:76:02:F2:6C:E2:56:82:A2:8B:54:9C:AB:52","sha256":"0A:51:1C:3C:3F:E4:C6:69:8A:11:D2:2D:E2:3E:C8:DF:E4:5A:10:D1:75:20:76:B1:1D:40:82:0C:E6:13:C5:DD"}}},"request":{"raw":"GET /img/best-way.jpg HTTP/1.1\r\nHost: rnatcha.org\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://rnatcha.org/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nServer: nginx/1.30.5\r\nDate: Sat, 19 Sep 2026 08:16:19 GMT\r\nContent-Type: image/jpeg\r\nLast-Modified: Sat, 13 Jun 2026 21:10:52 GMT\r\nTransfer-Encoding: chunked\r\nConnection: keep-alive\r\nETag: W/\"6a2dc75c-26516\"\r\nContent-Encoding: gzip\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx:1.30.5","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":156950,"size_decoded":112132,"mime_type":"image/jpeg","magic":"JPEG image data, JFIF standard 1.02, aspect ratio, density 1x1, segment length 16, baseline, precision 8, 1999x1457, components 3","md5":"3879ef5e76bb42fd466d935bfc79c556","sha1":"8e8c8d5d89a6deb7f875a6e1c23fde52884a97a9","sha256":"e202f7e501f2305668b3008e422328f95b5ced784842bbecaae9330035e7ef64","sha512":"10670d2bf27e6b7e16492c90121b2054725c130e39d411151efc556432827b1e011e2e2d49d82f7ee71f362130728d66dff013a399842494c24b87575d013ec8","ssdeep":"3072:aDTeLUiqJtEdIbleYVEyzj1reuvDWEEV/W9jj:OeQJtBfqyP1aiRW+F","tlshash":"c2e312035c099b87546897e5be071e6c2f1b6b0cd8827aff10260edf7e652625cde12e","first_seen":"2026-09-19T07:18:17.321564Z","last_seen":"2026-09-19T08:16:51.443909Z","times_seen":2,"resource_available":false,"data":null}},"time_used":1070,"timings":{"blocked":134,"dns":0,"connect":151,"send":0,"wait":319,"receive":304,"ssl":159},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-19","alert":"Sinkholed","trigger":"rnatcha.org","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"rnatcha.org/img/gasless-swaps.png","fqdn":"rnatcha.org","domain":"rnatcha.org","tld":"org"},"ip":{"addr":"104.168.142.173","port":443,"asn":54290,"as":"HOSTWINDS","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://rnatcha.org/","date":"2026-09-19T08:16:19.348Z","timestamp":1789805779348,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"rnatcha.org","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Tue, 18 Aug 2026 07:48:30 GMT","end":"Mon, 16 Nov 2026 07:48:29 GMT"},"fingerprint":{"sha1":"44:BD:6E:A0:B2:0C:71:76:02:F2:6C:E2:56:82:A2:8B:54:9C:AB:52","sha256":"0A:51:1C:3C:3F:E4:C6:69:8A:11:D2:2D:E2:3E:C8:DF:E4:5A:10:D1:75:20:76:B1:1D:40:82:0C:E6:13:C5:DD"}}},"request":{"raw":"GET /img/gasless-swaps.png HTTP/1.1\r\nHost: rnatcha.org\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://rnatcha.org/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nServer: nginx/1.30.5\r\nDate: Sat, 19 Sep 2026 08:16:19 GMT\r\nContent-Type: image/png\r\nLast-Modified: Sat, 13 Jun 2026 21:11:15 GMT\r\nTransfer-Encoding: chunked\r\nConnection: keep-alive\r\nETag: W/\"6a2dc773-47835\"\r\nContent-Encoding: gzip\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx:1.30.5","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":292917,"size_decoded":264928,"mime_type":"image/png","magic":"PNG image data, 3486 x 2418, 8-bit/color RGBA, non-interlaced","md5":"b83b234e280d9a4ffe554ce2b12c1124","sha1":"e73d42f16042d3ecc6f62dea4ede97f2a299cfe1","sha256":"467082f525d0db8f28c219f885218de1ff3ea623f872c2ddda6e2081c7d30fa1","sha512":"8f78510717d543fe518f5b7eace2bdfd61209cc5969e2e72f6518ba8b32c28eb898a2e994463ea035fa4ddfc37764b6788b95d977af0994526ba720d5fec0821","ssdeep":"6144:HGeOxeetxKZwb9hv0ssscP3zquf0otjMBYtCP7c94dNhGS9l:H9Oxeei6nvy3zquf0oyxYuXL","tlshash":"525402d31065e8f9fd9c4535dafb7b7c22b4869b40500f365b30a7e19cbac29a40197b","first_seen":"2026-09-19T07:18:17.323633Z","last_seen":"2026-09-19T08:16:51.44742Z","times_seen":2,"resource_available":false,"data":null}},"time_used":767,"timings":{"blocked":134,"dns":0,"connect":153,"send":0,"wait":153,"receive":480,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-19","alert":"Sinkholed","trigger":"rnatcha.org","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}}]}