{"report_id":"dcbf39d5-5aca-445b-b331-dcfe3a5b498e","version":6,"status":"done","tags":[],"date":"2024-07-10T10:01:39Z","url":{"schema":"http","addr":"104.21.58.214","fqdn":"104.21.58.214","domain":"104.21.58.214","tld":""},"ip":{"addr":"104.21.58.214","port":0,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"final":{"url":{"schema":"http","addr":"104.21.58.214/","fqdn":"104.21.58.214","domain":"104.21.58.214","tld":"214"},"title":"Direct IP access not allowed | Cloudflare"},"submit":{"url":{"schema":"","addr":"","fqdn":"","domain":"","tld":""},"ip":{"addr":"","port":0,"asn":0,"as":"","country":"","country_code":""},"tags":null,"meta":null},"settings":{"access":"public","device_type":"desktop","expires_at":"2026-10-25T10:15:52Z","useragent":"Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0","referer":"","cookies":null,"exit_node":"z0yflva4pidy47h"},"stats":{"alert_count":{"ids":0,"urlquery":0,"analyzer":0}},"detection":{"ids":null,"analyzer":null,"urlquery":null},"summary":[{"fqdn":"r10.o.lencr.org","ip":{"addr":"23.36.77.32","port":0,"asn":20940,"as":"Akamai International B.V.","country":"Norway","country_code":"NO"},"domain_registered":"2020-06-29","domain_rank":0,"first_seen":"2024-06-06 21:45:11","last_seen":"2024-07-08 18:12:20","alert_count":0,"request_count":7,"received_data":6212,"sent_data":2289,"comment":"","tags":null,"fingerprints":null},{"fqdn":"104.21.58.214","ip":{"addr":"104.21.58.214","port":0,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"domain_registered":"unknown","domain_rank":0,"first_seen":"No data","last_seen":"No data","alert_count":3,"request_count":3,"received_data":7689,"sent_data":1063,"comment":"","tags":null,"fingerprints":null},{"fqdn":"performance.radar.cloudflare.com","ip":{"addr":"104.18.30.78","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"domain_registered":"2009-02-17","domain_rank":0,"first_seen":"2022-06-29 12:44:51","last_seen":"2024-07-09 08:11:56","alert_count":0,"request_count":1,"received_data":13696,"sent_data":381,"comment":"","tags":null,"fingerprints":null}],"files":null,"artifacts":{"windows_shortcuts":null,"files":null,"telegram":null,"pdfs":null,"clipboard":null},"sensors":{"ids":[{"sensor_name":"suricata","description":"Suricata /w Emerging Threats Pro","alerts":[{"sensor_name":"suricata","title":"","description":"","date":"2024-07-10T10:01:14Z","timestamp":1720605674,"ip_dst":{"addr":"Client IP","port":40982,"asn":0,"as":"","country":"","country_code":"zz"},"ip_src":{"addr":"104.21.58.214","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"severity":"medium","alert":"ET INFO TLS Handshake Failure","source":"{\"timestamp\":\"2024-07-10T10:01:14.257004+0000\",\"flow_id\":372025166844732,\"in_iface\":\"br-31613a7ed13b\",\"event_type\":\"alert\",\"src_ip\":\"104.21.58.214\",\"src_port\":443,\"dest_ip\":\"172.18.0.18\",\"dest_port\":40982,\"proto\":\"TCP\",\"alert\":{\"action\":\"allowed\",\"gid\":1,\"signature_id\":2029340,\"rev\":2,\"signature\":\"ET INFO TLS Handshake Failure\",\"category\":\"Potentially Bad Traffic\",\"severity\":2,\"metadata\":{\"attack_target\":[\"Client_Endpoint\"],\"created_at\":[\"2020_01_30\"],\"deployment\":[\"Perimeter\"],\"signature_severity\":[\"Informational\"],\"updated_at\":[\"2020_01_30\"]}},\"tls\":{\"version\":\"UNDETERMINED\",\"ja3\":{\"hash\":\"3271cf62f45f551e79405f26e227ebda\",\"string\":\"771,4865-4867-4866-49195-49199-52393-52392-49196-49200-49171-49172-156-157-47-53,23-65281-10-11-16-5-34-51-43-13-28-65037,29-23-24-25-256-257,0\"},\"ja3s\":{}},\"app_proto\":\"tls\",\"flow\":{\"pkts_toserver\":3,\"pkts_toclient\":3,\"bytes_toserver\":795,\"bytes_toclient\":213,\"start\":\"2024-07-10T10:01:14.250684+0000\"}}"},{"sensor_name":"suricata","title":"","description":"","date":"2024-07-10T10:01:14Z","timestamp":1720605674,"ip_dst":{"addr":"Client IP","port":40994,"asn":0,"as":"","country":"","country_code":"zz"},"ip_src":{"addr":"104.21.58.214","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"severity":"medium","alert":"ET INFO TLS Handshake Failure","source":"{\"timestamp\":\"2024-07-10T10:01:14.261937+0000\",\"flow_id\":1305729582165765,\"in_iface\":\"br-31613a7ed13b\",\"event_type\":\"alert\",\"src_ip\":\"104.21.58.214\",\"src_port\":443,\"dest_ip\":\"172.18.0.18\",\"dest_port\":40994,\"proto\":\"TCP\",\"alert\":{\"action\":\"allowed\",\"gid\":1,\"signature_id\":2029340,\"rev\":2,\"signature\":\"ET INFO TLS Handshake Failure\",\"category\":\"Potentially Bad Traffic\",\"severity\":2,\"metadata\":{\"attack_target\":[\"Client_Endpoint\"],\"created_at\":[\"2020_01_30\"],\"deployment\":[\"Perimeter\"],\"signature_severity\":[\"Informational\"],\"updated_at\":[\"2020_01_30\"]}},\"tls\":{\"version\":\"UNDETERMINED\",\"ja3\":{\"hash\":\"ddb7e3d96a12de225f5c4fca1d2607f1\",\"string\":\"771,4865-4867-4866-49195-49199-52393-52392-49196-49200-49171-49172-156-157-47-53,23-65281-10-11-16-5-34-51-43-13-28-21,29-23-24-25-256-257,0\"},\"ja3s\":{}},\"app_proto\":\"tls\",\"flow\":{\"pkts_toserver\":3,\"pkts_toclient\":3,\"bytes_toserver\":723,\"bytes_toclient\":213,\"start\":\"2024-07-10T10:01:14.257797+0000\"}}"}]}],"analyzer":[{"sensor_name":"infosec_yara","type":"yara","description":"Public InfoSec YARA rules","link":"","alerts":null},{"sensor_name":"openphish","type":"url","description":"OpenPhish","link":"","alerts":null},{"sensor_name":"phishtank","type":"url","description":"PhishTank","link":"","alerts":null},{"sensor_name":"mnemonic_dns","type":"domain","description":"mnemonic secure dns","link":"","alerts":null},{"sensor_name":"quad9","type":"domain","description":"Quad9 DNS","link":"","alerts":[{"sensor_name":"quad9","sensor_type":"domain","title":"","description":"Quad9 DNS","scan_date":"2024-07-10","alert":"Sinkholed","trigger":"104.21.58.214","verdict":"malicious","severity":"medium","comment":"Sinkholed","link":"https://www.quad9.net","meta":null},{"sensor_name":"quad9","sensor_type":"domain","title":"","description":"Quad9 DNS","scan_date":"2024-07-10","alert":"Sinkholed","trigger":"104.21.58.214","verdict":"malicious","severity":"medium","comment":"Sinkholed","link":"https://www.quad9.net","meta":null},{"sensor_name":"quad9","sensor_type":"domain","title":"","description":"Quad9 DNS","scan_date":"2024-07-10","alert":"Sinkholed","trigger":"104.21.58.214","verdict":"malicious","severity":"medium","comment":"Sinkholed","link":"https://www.quad9.net","meta":null}]},{"sensor_name":"threatfox","type":"url","description":"ThreatFox","link":"","alerts":null}],"urlquery":null},"javascript":{"script":[{"url":{"schema":"https","addr":"performance.radar.cloudflare.com/beacon.js","fqdn":"performance.radar.cloudflare.com","domain":"cloudflare.com","tld":"com"},"ip":{"addr":"104.18.30.78","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"scriptElement","is_inline":false,"md5":"cd581d86812ceafd8795caf0d5a9e141","sha1":"f6feb8281311c23c6fe15ffd9f335258248058de","sha256":"14cc2e8c4fe6902a50d0c03961866ada2f106ed1d9ed90184ee80d789446d2a6","sha512":"0f858bea034128591ec3452186fbd24c4a0a38e98b17ec75d339e853be5ca549704c1d49821b532b09b0a8e016c04edce03fefa601187c753dccd3913384bd5f","ssdeep":"192:834d1an1U1Kf88Kvmv1IygAVAWb97RAEFHY1hJanFHYUTPUxd1K:ey1an1U1Kf88KOvCytsEF41hJanF4UTz","tlshash":"21f10a77bb40c502c9860859047abe7f3525f14a07c252ad761fcd2ab6a4df2b2f1367","size":7542,"data":"","first_seen":"2024-08-19T17:23:40.31598Z","last_seen":"2024-08-19T17:23:40.31598Z","times_seen":1,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"http","addr":"104.21.58.214/","fqdn":"104.21.58.214","domain":"104.21.58.214","tld":"214"},"ip":{"addr":"104.21.58.214","port":0,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"scriptElement","is_inline":true,"md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","size":0,"data":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-06-25T02:14:30.679539Z","times_seen":16696957,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"http","addr":"104.21.58.214/","fqdn":"104.21.58.214","domain":"104.21.58.214","tld":"214"},"ip":{"addr":"104.21.58.214","port":0,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"scriptElement","is_inline":true,"md5":"34ad0a116707d3b794129a6720af92d7","sha1":"424de9dbb8bc774e2a2d4ade100d90f5ac0ecbf4","sha256":"d011a9449a990f2086894be870adc6fbb53595dc593b410a83e45e40bfbc7262","sha512":"4d7cca00f0d83452fe3513c0c07c97ca5318dfcda0937df40626e49c9e15ef9a4287e6aa98da4c873d46248a20418b0ef793704c6619efad43c8b338a515cb37","ssdeep":"","tlshash":"43e0226b3b45293456f7aab3337fe37c3a22e0969cc015201968cd5ccd2bac042352c4","size":393,"data":"","first_seen":"2023-04-05T04:39:40Z","last_seen":"2025-03-02T06:13:46.994369Z","times_seen":143291,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"http","addr":"104.21.58.214/","fqdn":"104.21.58.214","domain":"104.21.58.214","tld":"214"},"ip":{"addr":"104.21.58.214","port":0,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"scriptElement","is_inline":true,"md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","size":0,"data":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-06-25T02:14:30.679539Z","times_seen":16696957,"alerts":{"ids":null,"analyzer":null,"urlquery":null}}],"eval":null,"write":null,"console":null},"http":[{"url":{"schema":"http","addr":"r10.o.lencr.org/","fqdn":"r10.o.lencr.org","domain":"lencr.org","tld":"org"},"ip":{"addr":"23.36.77.32","port":0,"asn":20940,"as":"Akamai International B.V.","country":"Norway","country_code":"NO"},"is_navigation_request":false,"resource_type":"","requested_by":"","date":"2024-07-10T10:01:13.711376874Z","timestamp":1720605673711,"http_version":"","security_state":"","security_info":null,"request":{"raw":"POST / HTTP/1.1\r\nHost: r10.o.lencr.org\r\nUser-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate\r\nContent-Type: application/ocsp-request\r\nContent-Length: 85\r\nConnection: keep-alive\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n","headers":null,"cookies":null,"method":""},"response":{"raw":"HTTP/1.1 200 OK\r\nServer: nginx\r\nContent-Type: application/ocsp-response\r\nContent-Length: 504\r\nETag: \"41E6A348AAC9E9DB44BFA14B3AA29D411F4489B375AE1F1BE6B0D280AF98541D\"\r\nLast-Modified: Mon, 08 Jul 2024 01:53:00 UTC\r\nCache-Control: public, no-transform, must-revalidate, max-age=6408\r\nExpires: Wed, 10 Jul 2024 11:48:01 GMT\r\nDate: Wed, 10 Jul 2024 10:01:13 GMT\r\nConnection: keep-alive\r\n","headers":null,"cookies":null,"status_code":"","status_text":"","fingerprints":null,"data":{"size":504,"size_decoded":504,"mime_type":"application/octet-stream","magic":"data","md5":"b34ca6af54e2b9fea57d418f5d1928f7","sha1":"510b69f4470789a573217726d6f1a3d6ee765460","sha256":"41e6a348aac9e9db44bfa14b3aa29d411f4489b375ae1f1be6b0d280af98541d","sha512":"56fc288af1ca048d6ad95019c5fe4a6be829ae0e6d834e51d920e79cb96aa3de97763b94d41b4c691f461b7a46ef961dd157b791947e0463310e5d0abd1422c8","ssdeep":"","tlshash":"def0055627d5a6016a710a911de5d31a1e2058fb305018f223d451e33923bbe1ec8446","first_seen":"2024-07-08T05:19:45Z","last_seen":"2024-08-19T17:39:41.553406Z","times_seen":34939,"resource_available":false,"data":null}},"time_used":0,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":0,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"http","addr":"r10.o.lencr.org/","fqdn":"r10.o.lencr.org","domain":"lencr.org","tld":"org"},"ip":{"addr":"23.36.77.32","port":0,"asn":20940,"as":"Akamai International B.V.","country":"Norway","country_code":"NO"},"is_navigation_request":false,"resource_type":"","requested_by":"","date":"2024-07-10T10:01:13.712548492Z","timestamp":1720605673712,"http_version":"","security_state":"","security_info":null,"request":{"raw":"POST / HTTP/1.1\r\nHost: r10.o.lencr.org\r\nUser-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate\r\nContent-Type: application/ocsp-request\r\nContent-Length: 85\r\nConnection: keep-alive\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n","headers":null,"cookies":null,"method":""},"response":{"raw":"HTTP/1.1 200 OK\r\nServer: nginx\r\nContent-Type: application/ocsp-response\r\nContent-Length: 504\r\nETag: \"5F9FEB641B1E74A7C14EEE1104953D1E9FAA0341D1F27FDBD50FA8207E6C0AC8\"\r\nLast-Modified: Tue, 09 Jul 2024 15:27:00 UTC\r\nCache-Control: public, no-transform, must-revalidate, max-age=8879\r\nExpires: Wed, 10 Jul 2024 12:29:12 GMT\r\nDate: Wed, 10 Jul 2024 10:01:13 GMT\r\nConnection: keep-alive\r\n","headers":null,"cookies":null,"status_code":"","status_text":"","fingerprints":null,"data":{"size":504,"size_decoded":504,"mime_type":"application/octet-stream","magic":"data","md5":"c2f3e4e1f94efa7a80f9deeb3d459176","sha1":"7a8f013a3d13ffe4241b8e2a8b9ca63daeeace53","sha256":"5f9feb641b1e74a7c14eee1104953d1e9faa0341d1f27fdbd50fa8207e6c0ac8","sha512":"b31001673f2a70424a77c868b62170411fff1d9ced6cee20cb26b7538d349bc4573cbb80b198779afa9ff558e6719d8d04b694a26cb451f792e8895bf9b29f5f","ssdeep":"","tlshash":"b9f0054712a5ff50a2f0175515f1ea05dd207d792c5015c2759443f23869bf4d5c840e","first_seen":"2024-07-09T21:40:33Z","last_seen":"2024-08-19T17:27:56.105485Z","times_seen":18846,"resource_available":false,"data":null}},"time_used":0,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":0,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"http","addr":"r10.o.lencr.org/","fqdn":"r10.o.lencr.org","domain":"lencr.org","tld":"org"},"ip":{"addr":"23.36.77.32","port":0,"asn":20940,"as":"Akamai International B.V.","country":"Norway","country_code":"NO"},"is_navigation_request":false,"resource_type":"","requested_by":"","date":"2024-07-10T10:01:14.077761039Z","timestamp":1720605674077,"http_version":"","security_state":"","security_info":null,"request":{"raw":"POST / HTTP/1.1\r\nHost: r10.o.lencr.org\r\nUser-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate\r\nContent-Type: application/ocsp-request\r\nContent-Length: 85\r\nConnection: keep-alive\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n","headers":null,"cookies":null,"method":""},"response":{"raw":"HTTP/1.1 200 OK\r\nServer: nginx\r\nContent-Type: application/ocsp-response\r\nContent-Length: 504\r\nETag: \"5D1BC1C01894FD88A0D4680490977488D6458BB58A98ACE24EF8AA103538BC1F\"\r\nLast-Modified: Tue, 09 Jul 2024 23:47:00 UTC\r\nCache-Control: public, no-transform, must-revalidate, max-age=4351\r\nExpires: Wed, 10 Jul 2024 11:13:45 GMT\r\nDate: Wed, 10 Jul 2024 10:01:14 GMT\r\nConnection: keep-alive\r\n","headers":null,"cookies":null,"status_code":"","status_text":"","fingerprints":null,"data":{"size":504,"size_decoded":504,"mime_type":"application/octet-stream","magic":"data","md5":"e7492695b5254a3a63fcffb4f1ee8cec","sha1":"0361713c6d8129210245347284c7c6babfd28fb7","sha256":"5d1bc1c01894fd88a0d4680490977488d6458bb58a98ace24ef8aa103538bc1f","sha512":"ec0e52128f983dbd74415511de8ce735b2b718b43605e9ac47400438cd5e97c87e35eb9ba74da906afc0cc7f6d28beca431b3cd9f15b958bce49500f659db147","ssdeep":"","tlshash":"d5f0549736b6bc516ab835253dfbda3e7a309924b15049bceca51291ec383a7418040c","first_seen":"2024-07-10T02:50:08Z","last_seen":"2024-08-19T17:26:17.073472Z","times_seen":39709,"resource_available":false,"data":null}},"time_used":0,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":0,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"http","addr":"r10.o.lencr.org/","fqdn":"r10.o.lencr.org","domain":"lencr.org","tld":"org"},"ip":{"addr":"23.36.77.32","port":0,"asn":20940,"as":"Akamai International B.V.","country":"Norway","country_code":"NO"},"is_navigation_request":false,"resource_type":"","requested_by":"","date":"2024-07-10T10:01:14.235740461Z","timestamp":1720605674235,"http_version":"","security_state":"","security_info":null,"request":{"raw":"POST / HTTP/1.1\r\nHost: r10.o.lencr.org\r\nUser-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate\r\nContent-Type: application/ocsp-request\r\nContent-Length: 85\r\nConnection: keep-alive\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n","headers":null,"cookies":null,"method":""},"response":{"raw":"HTTP/1.1 200 OK\r\nServer: nginx\r\nContent-Type: application/ocsp-response\r\nContent-Length: 504\r\nETag: \"22F599883DC87540746708049EA46EC4EB88C81C924BA145A58BEBD5EE3199CB\"\r\nLast-Modified: Tue, 09 Jul 2024 16:21:00 UTC\r\nCache-Control: public, no-transform, must-revalidate, max-age=4680\r\nExpires: Wed, 10 Jul 2024 11:19:14 GMT\r\nDate: Wed, 10 Jul 2024 10:01:14 GMT\r\nConnection: keep-alive\r\n","headers":null,"cookies":null,"status_code":"","status_text":"","fingerprints":null,"data":{"size":504,"size_decoded":504,"mime_type":"application/octet-stream","magic":"data","md5":"9b556e25e514a3cd5829bc4d938e5517","sha1":"85eeba07dc1438e7433ce7a145500164d842d5db","sha256":"22f599883dc87540746708049ea46ec4eb88c81c924ba145a58bebd5ee3199cb","sha512":"75b458449c7f8a18c99e53cbb9d4e5b8fdb1f10a8ade5519dbf3e6d1af98b058d7c3d6cb1c193a1db1b5647af3b0cdb0cdd0bfa08b2dd8af44895f225fe59f02","ssdeep":"","tlshash":"d2f0759324a5fd6039f00d1419a4f60c3d414aed281440f9e0a507ff2c51396890c84c","first_seen":"2024-07-09T19:23:51Z","last_seen":"2024-08-19T17:28:50.065285Z","times_seen":12065,"resource_available":false,"data":null}},"time_used":0,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":0,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"104.21.58.214/","fqdn":"104.21.58.214","domain":"104.21.58.214","tld":"214"},"ip":{"addr":"104.21.58.214","port":0,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":true,"resource_type":"document","requested_by":"","date":"2024-07-10T10:01:14.251Z","timestamp":1720605674251,"http_version":"","security_state":"broken","security_info":null,"request":{"raw":"GET / HTTP/1.1\r\nHost: 104.21.58.214\r\nUser-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0\r\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate\r\nDNT: 1\r\nConnection: keep-alive\r\nUpgrade-Insecure-Requests: 1\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 403 Forbidden\r\nDate: Wed, 10 Jul 2024 10:01:14 GMT\r\nContent-Type: text/html; charset=UTF-8\r\nTransfer-Encoding: chunked\r\nConnection: close\r\nX-Frame-Options: SAMEORIGIN\r\nReferrer-Policy: same-origin\r\nCache-Control: private, max-age=0, no-store, no-cache, must-revalidate, post-check=0, pre-check=0\r\nExpires: Thu, 01 Jan 1970 00:00:01 GMT\r\nVary: Accept-Encoding\r\nServer: cloudflare\r\nCF-RAY: 8a0fb6183af6568a-OSL\r\nContent-Encoding: gzip\r\n","headers":null,"cookies":null,"status_code":"","status_text":"","fingerprints":null,"data":{"size":2098,"size_decoded":5893,"mime_type":"","magic":"HTML document, ASCII text, with very long lines (501)","md5":"389f136dab478a578697fd2141fe8963","sha1":"4fb61a2e70114f31b36ca7827684271c96dfe9d0","sha256":"643949898be3e71274943605f2e1232ee104499c66073f49818695f416117c56","sha512":"802581a930334ccd9498871ad026cdb14dfe7ec89c726ead6f2327afff7f603c7777cb28e56a9e5dcc1c76b4b72d148c9fc18455464c03883473f90a0be3762d","ssdeep":"96:1j9jwIjYj0DK/D6laa+hXOlQUpp8HZywoDwo90jdJgPUwftvZU0mtrR79PaQxJb0:1j9jhjYjoK/kaaFlVKyzDz9ufgPlL0t0","tlshash":"f4c19563f5fc257a1093c2a33199a71979f4c123daa700d5baadc4721f9de85fe07181","first_seen":"2024-08-19T17:23:40.312478Z","last_seen":"2024-08-19T17:23:40.312478Z","times_seen":1,"resource_available":false,"data":null}},"time_used":6,"timings":{"blocked":6,"dns":0,"connect":1,"send":0,"wait":0,"receive":0,"ssl":4},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"domain","title":"","description":"Quad9 DNS","scan_date":"2024-07-10","alert":"Sinkholed","trigger":"104.21.58.214","verdict":"malicious","severity":"medium","comment":"Sinkholed","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"http","addr":"104.21.58.214/cdn-cgi/styles/main.css","fqdn":"104.21.58.214","domain":"104.21.58.214","tld":"214"},"ip":{"addr":"104.21.58.214","port":80,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"http://104.21.58.214/","date":"2024-07-10T10:01:14.553Z","timestamp":1720605674553,"http_version":"HTTP/1.1","security_state":"insecure","security_info":null,"request":{"raw":"GET /cdn-cgi/styles/main.css HTTP/1.1\r\nHost: 104.21.58.214\r\nUser-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate\r\nReferer: http://104.21.58.214/\r\nDNT: 1\r\nConnection: keep-alive\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Wed, 10 Jul 2024 10:01:14 GMT\r\nContent-Type: text/css\r\nTransfer-Encoding: chunked\r\nConnection: keep-alive\r\nLast-Modified: Fri, 05 Jul 2024 14:29:35 GMT\r\nETag: W/\"6688034f-1f4d\"\r\nServer: cloudflare\r\nCF-RAY: 8a0fb619e80a568d-OSL\r\nX-Frame-Options: DENY\r\nX-Content-Type-Options: nosniff\r\nVary: Accept-Encoding\r\nExpires: Wed, 10 Jul 2024 12:01:14 GMT\r\nCache-Control: max-age=7200, public\r\nContent-Encoding: gzip\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":null,"data":{"size":2176,"size_decoded":8013,"mime_type":"text/css","magic":"ASCII text, with very long lines (8012)","md5":"ff26f59e28a5fe6ea4ab23586415696b","sha1":"4182675484d175e363cd34b43041b7b1af93d0cd","sha256":"d30b4ea6f68456672f5abb35e9dcf7d54226372b66e9d60a7ee26b7a52568e74","sha512":"92c58eef6d1f885806450acd2927c57ebea2e8762c98b0826192555674bd4478e42add192834285d5934c0a76db8eac5eee1a65dc34b6f69246fad6c91a5fba4","ssdeep":"96:1jMh3JNJinvaE5TQRGxfldudududEtCbnaimpSpIplDO6bU6b16bE6bb6bNdkd94:1jMFJiva655dimwqjlP0/mGTZxRbC","tlshash":"75f1851bbf49104e3023886ae2c5a78d912dd282ee535bfff7173561cbc52fa1552b24","first_seen":"2023-04-05T04:39:40Z","last_seen":"2026-06-25T02:14:29.788605Z","times_seen":89354,"resource_available":false,"data":null}},"time_used":3,"timings":{"blocked":-1,"dns":0,"connect":1,"send":0,"wait":2,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"domain","title":"","description":"Quad9 DNS","scan_date":"2024-07-10","alert":"Sinkholed","trigger":"104.21.58.214","verdict":"malicious","severity":"medium","comment":"Sinkholed","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"http","addr":"104.21.58.214/favicon.ico","fqdn":"104.21.58.214","domain":"104.21.58.214","tld":"214"},"ip":{"addr":"104.21.58.214","port":80,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"http://104.21.58.214/","date":"2024-07-10T10:01:14.790Z","timestamp":1720605674790,"http_version":"HTTP/1.1","security_state":"insecure","security_info":null,"request":{"raw":"GET /favicon.ico HTTP/1.1\r\nHost: 104.21.58.214\r\nUser-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate\r\nReferer: http://104.21.58.214/\r\nDNT: 1\r\nConnection: keep-alive\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 403 Forbidden\r\nDate: Wed, 10 Jul 2024 10:01:14 GMT\r\nContent-Type: text/html; charset=UTF-8\r\nTransfer-Encoding: chunked\r\nConnection: close\r\nX-Frame-Options: SAMEORIGIN\r\nReferrer-Policy: same-origin\r\nCache-Control: private, max-age=0, no-store, no-cache, must-revalidate, post-check=0, pre-check=0\r\nExpires: Thu, 01 Jan 1970 00:00:01 GMT\r\nVary: Accept-Encoding\r\nServer: cloudflare\r\nCF-RAY: 8a0fb61b391a568d-OSL\r\nContent-Encoding: gzip\r\n","headers":null,"cookies":null,"status_code":"403","status_text":"Forbidden","fingerprints":null,"data":{"size":2098,"size_decoded":5893,"mime_type":"text/html; charset=UTF-8","magic":"HTML document, ASCII text, with very long lines (501)","md5":"ebe86c712b119072e79dc18bedcf6bf7","sha1":"1a9b4dd4a10d358c4af69fb682841b0d00310bb8","sha256":"08e133c32c9881e1d24f13a552a401a19d5f6c5189d98daedd19064d6ee3e7ef","sha512":"b8ceec84be0c32739eed0b31053a13304cca3ced1f4f2d536a6f9c4abfe327bb5a2f6a9337176295946f951409bb8eb8c401650e55766174def84ebbe0f91f82","ssdeep":"96:1j9jwIjYj0DK/D6laa+hXOlQUpp8HZywoewo90jdJgPUwftvZU0mIrR79PaQxJb0:1j9jhjYjoK/kaaFlVKyzez9ufgPlL0I0","tlshash":"1bc19563f9fc257a1093c2a3319aa71979f48123daa704d5baadc4721f8df85fe07181","first_seen":"2024-08-19T17:23:40.314008Z","last_seen":"2024-08-19T17:23:40.314008Z","times_seen":1,"resource_available":false,"data":null}},"time_used":7,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":2,"receive":5,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"domain","title":"","description":"Quad9 DNS","scan_date":"2024-07-10","alert":"Sinkholed","trigger":"104.21.58.214","verdict":"malicious","severity":"medium","comment":"Sinkholed","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"http","addr":"r10.o.lencr.org/","fqdn":"r10.o.lencr.org","domain":"lencr.org","tld":"org"},"ip":{"addr":"23.36.77.32","port":0,"asn":20940,"as":"Akamai International B.V.","country":"Norway","country_code":"NO"},"is_navigation_request":false,"resource_type":"","requested_by":"","date":"2024-07-10T10:01:16.024200326Z","timestamp":1720605676024,"http_version":"","security_state":"","security_info":null,"request":{"raw":"POST / HTTP/1.1\r\nHost: r10.o.lencr.org\r\nUser-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate\r\nContent-Type: application/ocsp-request\r\nContent-Length: 85\r\nConnection: keep-alive\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n","headers":null,"cookies":null,"method":""},"response":{"raw":"HTTP/1.1 200 OK\r\nServer: nginx\r\nContent-Type: application/ocsp-response\r\nContent-Length: 504\r\nETag: \"317F60A1498C7B52833955E8A54A0BA66B5B8DC9E9862C2AC262B874D491FCE2\"\r\nLast-Modified: Mon, 08 Jul 2024 05:32:00 UTC\r\nCache-Control: public, no-transform, must-revalidate, max-age=16331\r\nExpires: Wed, 10 Jul 2024 14:33:27 GMT\r\nDate: Wed, 10 Jul 2024 10:01:16 GMT\r\nConnection: keep-alive\r\n","headers":null,"cookies":null,"status_code":"","status_text":"","fingerprints":null,"data":{"size":504,"size_decoded":504,"mime_type":"application/octet-stream","magic":"data","md5":"d7b2c37e4b6c062d80ad32046f42d3d8","sha1":"131cd5c2ca2a258c3cf11746f94cfd43a6a4f04c","sha256":"317f60a1498c7b52833955e8a54a0ba66b5b8dc9e9862c2ac262b874d491fce2","sha512":"e8d8acac8c0eb8cc7d365eca9121ee37756ccf1d8b77d6177f316593c50a660d3af8ab40f67f47a8fd9fe0fe75f51070e6cf3c69b49f57aed1b4afc155ca5cd3","ssdeep":"","tlshash":"02f00e023df7bd80b3e944911ebde63bf8107aa7305075e630c0828328b87a74744c9a","first_seen":"2024-07-08T09:56:38Z","last_seen":"2024-08-19T17:38:29.907666Z","times_seen":36963,"resource_available":false,"data":null}},"time_used":0,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":0,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"http","addr":"r10.o.lencr.org/","fqdn":"r10.o.lencr.org","domain":"lencr.org","tld":"org"},"ip":{"addr":"23.36.77.32","port":0,"asn":20940,"as":"Akamai International B.V.","country":"Norway","country_code":"NO"},"is_navigation_request":false,"resource_type":"","requested_by":"","date":"2024-07-10T10:01:16.025117755Z","timestamp":1720605676025,"http_version":"","security_state":"","security_info":null,"request":{"raw":"POST / HTTP/1.1\r\nHost: r10.o.lencr.org\r\nUser-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate\r\nContent-Type: application/ocsp-request\r\nContent-Length: 85\r\nConnection: keep-alive\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n","headers":null,"cookies":null,"method":""},"response":{"raw":"HTTP/1.1 200 OK\r\nServer: nginx\r\nContent-Type: application/ocsp-response\r\nContent-Length: 504\r\nETag: \"317F60A1498C7B52833955E8A54A0BA66B5B8DC9E9862C2AC262B874D491FCE2\"\r\nLast-Modified: Mon, 08 Jul 2024 05:32:00 UTC\r\nCache-Control: public, no-transform, must-revalidate, max-age=16331\r\nExpires: Wed, 10 Jul 2024 14:33:27 GMT\r\nDate: Wed, 10 Jul 2024 10:01:16 GMT\r\nConnection: keep-alive\r\n","headers":null,"cookies":null,"status_code":"","status_text":"","fingerprints":null,"data":{"size":504,"size_decoded":504,"mime_type":"application/octet-stream","magic":"data","md5":"d7b2c37e4b6c062d80ad32046f42d3d8","sha1":"131cd5c2ca2a258c3cf11746f94cfd43a6a4f04c","sha256":"317f60a1498c7b52833955e8a54a0ba66b5b8dc9e9862c2ac262b874d491fce2","sha512":"e8d8acac8c0eb8cc7d365eca9121ee37756ccf1d8b77d6177f316593c50a660d3af8ab40f67f47a8fd9fe0fe75f51070e6cf3c69b49f57aed1b4afc155ca5cd3","ssdeep":"","tlshash":"02f00e023df7bd80b3e944911ebde63bf8107aa7305075e630c0828328b87a74744c9a","first_seen":"2024-07-08T09:56:38Z","last_seen":"2024-08-19T17:38:29.907666Z","times_seen":36963,"resource_available":false,"data":null}},"time_used":0,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":0,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"http","addr":"r10.o.lencr.org/","fqdn":"r10.o.lencr.org","domain":"lencr.org","tld":"org"},"ip":{"addr":"23.36.77.32","port":0,"asn":20940,"as":"Akamai International B.V.","country":"Norway","country_code":"NO"},"is_navigation_request":false,"resource_type":"","requested_by":"","date":"2024-07-10T10:01:16.026018532Z","timestamp":1720605676026,"http_version":"","security_state":"","security_info":null,"request":{"raw":"POST / HTTP/1.1\r\nHost: r10.o.lencr.org\r\nUser-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate\r\nContent-Type: application/ocsp-request\r\nContent-Length: 85\r\nConnection: keep-alive\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n","headers":null,"cookies":null,"method":""},"response":{"raw":"HTTP/1.1 200 OK\r\nServer: nginx\r\nContent-Type: application/ocsp-response\r\nContent-Length: 504\r\nETag: \"317F60A1498C7B52833955E8A54A0BA66B5B8DC9E9862C2AC262B874D491FCE2\"\r\nLast-Modified: Mon, 08 Jul 2024 05:32:00 UTC\r\nCache-Control: public, no-transform, must-revalidate, max-age=16331\r\nExpires: Wed, 10 Jul 2024 14:33:27 GMT\r\nDate: Wed, 10 Jul 2024 10:01:16 GMT\r\nConnection: keep-alive\r\n","headers":null,"cookies":null,"status_code":"","status_text":"","fingerprints":null,"data":{"size":504,"size_decoded":504,"mime_type":"application/octet-stream","magic":"data","md5":"d7b2c37e4b6c062d80ad32046f42d3d8","sha1":"131cd5c2ca2a258c3cf11746f94cfd43a6a4f04c","sha256":"317f60a1498c7b52833955e8a54a0ba66b5b8dc9e9862c2ac262b874d491fce2","sha512":"e8d8acac8c0eb8cc7d365eca9121ee37756ccf1d8b77d6177f316593c50a660d3af8ab40f67f47a8fd9fe0fe75f51070e6cf3c69b49f57aed1b4afc155ca5cd3","ssdeep":"","tlshash":"02f00e023df7bd80b3e944911ebde63bf8107aa7305075e630c0828328b87a74744c9a","first_seen":"2024-07-08T09:56:38Z","last_seen":"2024-08-19T17:38:29.907666Z","times_seen":36963,"resource_available":false,"data":null}},"time_used":0,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":0,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"performance.radar.cloudflare.com/beacon.js","fqdn":"performance.radar.cloudflare.com","domain":"cloudflare.com","tld":"com"},"ip":{"addr":"104.18.30.78","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"script","requested_by":"http://104.21.58.214/","date":"2024-07-10T10:01:14.557Z","timestamp":1720605674557,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"radar.cloudflare.com","organization":""},"issuer":{"commonName":"E1","organization":"Let's Encrypt"},"validity":{"start":"Mon, 20 May 2024 23:14:59 GMT","end":"Sun, 18 Aug 2024 23:14:58 GMT"},"fingerprint":{"sha1":"34:8D:F3:56:13:F8:4E:E7:30:6E:52:45:B6:3E:4D:08:90:1B:D9:AD","sha256":"D1:59:E7:78:6D:B8:8E:F1:78:31:E9:51:7E:0A:6F:4F:F4:98:1D:2A:67:A4:50:FB:F4:BB:2B:52:B8:16:43:BA"}}},"request":{"raw":"GET /beacon.js HTTP/1.1\r\nHost: performance.radar.cloudflare.com\r\nUser-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ndate: Wed, 10 Jul 2024 10:01:14 GMT\r\ncontent-type: text/javascript;charset=UTF-8\r\naccess-control-allow-origin: *\r\ncache-control: no-store, max-age=0\r\naccess-control-allow-headers: *\r\naccess-control-allow-methods: *\r\nreferrer-policy: no-referrer\r\ntiming-allow-origin: *\r\nset-cookie: __cf_bm=EjvNUO.k5IdRAktiV3M4JfcWeTPXop3nymBtjrgm9N8-1720605674-1.0.1.1-zkZ3hpP0oPT5jdI3d0OdCz1._rlZLkVovxctZwMarL74tEIaCbzpRXxieY6FFKmUuT5j24XMznHhULyBwW5qTw; path=/; expires=Wed, 10-Jul-24 10:31:14 GMT; domain=.radar.cloudflare.com; HttpOnly; Secure; SameSite=None\r\nvary: Accept-Encoding\r\nstrict-transport-security: max-age=15552000; includeSubDomains\r\nx-content-type-options: nosniff\r\nserver: cloudflare\r\ncf-ray: 8a0fb61a3eb87129-OSL\r\ncontent-encoding: br\r\nalt-svc: h3=\":443\"; ma=86400\r\nX-Firefox-Spdy: h2\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":null,"data":{"size":12890,"size_decoded":7542,"mime_type":"text/javascript; charset=UTF-8","magic":"JavaScript source, ASCII text, with very long lines (7541)","md5":"cd581d86812ceafd8795caf0d5a9e141","sha1":"f6feb8281311c23c6fe15ffd9f335258248058de","sha256":"14cc2e8c4fe6902a50d0c03961866ada2f106ed1d9ed90184ee80d789446d2a6","sha512":"0f858bea034128591ec3452186fbd24c4a0a38e98b17ec75d339e853be5ca549704c1d49821b532b09b0a8e016c04edce03fefa601187c753dccd3913384bd5f","ssdeep":"192:834d1an1U1Kf88Kvmv1IygAVAWb97RAEFHY1hJanFHYUTPUxd1K:ey1an1U1Kf88KOvCytsEF41hJanF4UTz","tlshash":"21f10a77bb40c502c9860859047abe7f3525f14a07c252ad761fcd2ab6a4df2b2f1367","first_seen":"2024-08-19T17:23:40.31598Z","last_seen":"2024-08-19T17:23:40.31598Z","times_seen":1,"resource_available":true,"data":null}},"time_used":141,"timings":{"blocked":45,"dns":28,"connect":1,"send":0,"wait":45,"receive":0,"ssl":19},"alerts":{"ids":null,"analyzer":null,"urlquery":null}}]}