{"report_id":"f4df4bd4-5e63-427b-aae4-b87e7660afa6","version":6,"status":"done","tags":[],"date":"2026-03-20T18:54:37Z","url":{"schema":"http","addr":"phantomwallet.listing-check.com","fqdn":"phantomwallet.listing-check.com","domain":"listing-check.com","tld":"com"},"ip":{"addr":"85.187.142.69","port":0,"asn":55293,"as":"A2HOSTING","country":"United States","country_code":"US"},"final":{"url":{"schema":"https","addr":"phantomwallet.listing-check.com/","fqdn":"phantomwallet.listing-check.com","domain":"listing-check.com","tld":"com"},"title":"Claim reward","dom":{"size":2228,"mime_type":"text/html; charset=utf-8","magic":"HTML document, ASCII text","md5":"33dc6c46f77c2e6a4de0a606c35d9d3b","sha1":"a904da67b0a9d6fedc79b59ed9c08be913663ab8","sha256":"85316804b60c2f8caef6714893941c6f6f9b765641ca2b6ee55b9fa637534564","sha512":"e3abce4e572f4d75225b96821f0c2e3562c572989817bfa3ca19e7f476f95b17eb4571e416dcac653291120ab11f3a7278f814298e8fd2a2bab64fb813fa8d0d","ssdeep":"","tlshash":"954122da9a970506b61393603bf7939633a4d007955ac8347fcc71eccf8639889a778e","dom_hash":"domhashba62d72f82caee3b801e481367bd7c72","first_seen":"","last_seen":"","times_seen":0,"resource_available":false,"data":null}},"submit":{"url":{"schema":"http","addr":"phantomwallet.listing-check.com","fqdn":"phantomwallet.listing-check.com","domain":"listing-check.com","tld":"com"},"ip":{"addr":"85.187.142.69","port":0,"asn":55293,"as":"A2HOSTING","country":"United States","country_code":"US"},"tags":null,"meta":null},"settings":{"access":"public","device_type":"desktop","expires_at":"2027-04-24T18:54:37Z","useragent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0","referer":"","cookies":null,"exit_node":"z0yflva4pidy47h"},"stats":{"alert_count":{"ids":0,"urlquery":0,"analyzer":1}},"detection":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-03-20","alert":"Sinkholed","trigger":"phantomwallet.listing-check.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null},"summary":[{"fqdn":"phantomwallet.listing-check.com","ip":{"addr":"85.187.142.69","port":443,"asn":55293,"as":"A2HOSTING","country":"United States","country_code":"US"},"domain_registered":"2026-01-31","domain_rank":0,"first_seen":"2026-03-20T18:54:37.573261Z","last_seen":"2026-03-20T18:54:37.573261Z","alert_count":3,"request_count":3,"received_data":203459,"sent_data":1433,"comment":"","tags":null,"fingerprints":[{"name":"Apache HTTP Server","description":"Apache is a free and open-source cross-platform web server software.","website":"https://httpd.apache.org/","common_platform_enumeration":"cpe:2.3:a:apache:http_server:*:*:*:*:*:*:*:*","icon":"Apache.svg","categories":["Web servers"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}]}],"files":null,"artifacts":{"windows_shortcuts":null,"files":null,"telegram":null,"pdfs":null,"clipboard":null},"sensors":{"ids":null,"analyzer":null,"urlquery":null},"javascript":{"script":[{"url":{"schema":"https","addr":"phantomwallet.listing-check.com/","fqdn":"phantomwallet.listing-check.com","domain":"listing-check.com","tld":"com"},"ip":{"addr":"85.187.142.69","port":443,"asn":55293,"as":"A2HOSTING","country":"United States","country_code":"US"},"introduction_type":"scriptElement","is_inline":true,"md5":"5ab99e83fb5deb7a96770a5419dd14fd","sha1":"c31d3657dc3189b60b1c23f8592e1a5bc18d5042","sha256":"ad7627b7c44a8b45d62d5a87090cf319fed8e59efa5b86866dd8f239897baee1","sha512":"7eb5185a71c0d9c9cd06ad1f43410962d0e78c235f89f693e93e2f98a6aa87180dc53fa7496d431ad4573dfaf5a9b3c6723525fc2208d5879a2adf80ab24b525","ssdeep":"","tlshash":"aec012d94450523887731a85a3c751857bb150476491e044360c86856fe27a6256facf","size":189,"data":"","first_seen":"2026-03-20T18:54:39.598269Z","last_seen":"2026-03-20T19:56:44.593247Z","times_seen":2,"alerts":{"ids":null,"analyzer":null,"urlquery":null}}],"eval":null,"write":null,"console":null},"http":[{"url":{"schema":"https","addr":"phantomwallet.listing-check.com/pw.png","fqdn":"phantomwallet.listing-check.com","domain":"listing-check.com","tld":"com"},"ip":{"addr":"85.187.142.69","port":443,"asn":55293,"as":"A2HOSTING","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://phantomwallet.listing-check.com/","date":"2026-03-20T18:54:16.423Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"phantomwallet.listing-check.com","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Fri, 20 Mar 2026 11:27:18 GMT","end":"Thu, 18 Jun 2026 11:27:17 GMT"},"fingerprint":{"sha1":"B6:29:52:6F:F5:F5:20:FF:C3:9A:6E:D3:66:83:21:F6:E0:61:69:29","sha256":"39:41:FD:03:4E:A4:06:9C:BE:42:30:C0:2E:89:27:67:D0:73:55:48:1B:4A:63:43:82:96:D5:4C:85:BE:27:0D"}}},"request":{"raw":"GET /pw.png HTTP/1.1\r\nHost: phantomwallet.listing-check.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://phantomwallet.listing-check.com/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Fri, 20 Mar 2026 18:54:16 GMT\r\nServer: Apache\r\nStrict-Transport-Security: max-age=63072000; includeSubDomains\r\nX-Frame-Options: SAMEORIGIN\r\nX-Content-Type-Options: nosniff\r\nLast-Modified: Fri, 20 Mar 2026 12:06:15 GMT\r\nAccept-Ranges: bytes\r\nVary: Accept-Encoding\r\nContent-Encoding: gzip\r\nCache-Control: max-age=604800, public\r\nKeep-Alive: timeout=3, max=499\r\nConnection: Keep-Alive\r\nTransfer-Encoding: chunked\r\nContent-Type: image/png\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Apache HTTP Server","description":"Apache is a free and open-source cross-platform web server software.","website":"https://httpd.apache.org/","common_platform_enumeration":"cpe:2.3:a:apache:http_server:*:*:*:*:*:*:*:*","icon":"Apache.svg","categories":["Web servers"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":199603,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 1920 x 1080, 8-bit colormap, non-interlaced","md5":"af1055738a46c4dd3ee28e9cd2fd536c","sha1":"94622cb46656cf3d8cc87ed1b2d7d7b920bdc5aa","sha256":"830dc3f94d2cbed25ee91eb454c8ddb3d5b48dbcc4da8822a1c2bc8b93b3d742","sha512":"030840fab55543c2e34c034b4d9d0bafe9d8ec769afaec1fb88991ca95701f3d59012a7e2b66cb8deb2fe309b8f997b38b73f6f39785a6ef526db60e58a94d83","ssdeep":"3072:eFlUdhks4eLlqUDBypyJK0aWs08kFJlul7CnpBWlk3fgAcWDSHOC/ebNQfFnqTah:nGecxAJK0aWsD+OlsphHDSufJQ1tAm3","tlshash":"48141215c5bc709531828be6b4bb5f3fe233a5e597608bcb2d21e0e211a02f6512dfe0","first_seen":"2026-03-20T18:54:39.595607Z","last_seen":"2026-03-20T19:56:44.591207Z","times_seen":2,"resource_available":false,"data":null}},"time_used":100,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":25,"receive":75,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-03-20","alert":"Sinkholed","trigger":"phantomwallet.listing-check.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"phantomwallet.listing-check.com/favicon.ico","fqdn":"phantomwallet.listing-check.com","domain":"listing-check.com","tld":"com"},"ip":{"addr":"85.187.142.69","port":443,"asn":55293,"as":"A2HOSTING","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://phantomwallet.listing-check.com/","date":"2026-03-20T18:54:16.536Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"phantomwallet.listing-check.com","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Fri, 20 Mar 2026 11:27:18 GMT","end":"Thu, 18 Jun 2026 11:27:17 GMT"},"fingerprint":{"sha1":"B6:29:52:6F:F5:F5:20:FF:C3:9A:6E:D3:66:83:21:F6:E0:61:69:29","sha256":"39:41:FD:03:4E:A4:06:9C:BE:42:30:C0:2E:89:27:67:D0:73:55:48:1B:4A:63:43:82:96:D5:4C:85:BE:27:0D"}}},"request":{"raw":"GET /favicon.ico HTTP/1.1\r\nHost: phantomwallet.listing-check.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://phantomwallet.listing-check.com/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 404 Not Found\r\nDate: Fri, 20 Mar 2026 18:54:16 GMT\r\nServer: Apache\r\nStrict-Transport-Security: max-age=63072000; includeSubDomains\r\nX-Frame-Options: SAMEORIGIN\r\nX-Content-Type-Options: nosniff\r\nContent-Length: 355\r\nKeep-Alive: timeout=3, max=498\r\nConnection: Keep-Alive\r\nContent-Type: text/html; charset=iso-8859-1\r\n\r\n","headers":null,"cookies":null,"status_code":"404","status_text":"Not Found","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Apache HTTP Server","description":"Apache is a free and open-source cross-platform web server software.","website":"https://httpd.apache.org/","common_platform_enumeration":"cpe:2.3:a:apache:http_server:*:*:*:*:*:*:*:*","icon":"Apache.svg","categories":["Web servers"]}],"data":{"size":355,"size_decoded":0,"mime_type":"text/html; charset=iso-8859-1","magic":"HTML document, ASCII text","md5":"4525b2d648f7c457a689fd96421783a5","sha1":"11bfe30ce44585a15a38e86bc094224ddfe2c08e","sha256":"cc0b4e42510d49c6decd464123ecf3b14ae9b47f9b4ed2ee64893e2d6520a264","sha512":"94e3e8246cf38ff7740e51aa115c8c455b14f78e672c2686b782c0ce30b6fa2dbd91a78b29b3964d9c0414aabd4b9391fd5db326665e25b4b8e73dae60ffe979","ssdeep":"","tlshash":"71e0c04f4057b3474011a2907dc01291e505236b38a152f93ac09467500897dc4aa2dd","first_seen":"2025-12-09T03:51:58.5943Z","last_seen":"2026-06-08T21:09:34.29946Z","times_seen":39328,"resource_available":true,"data":null}},"time_used":27,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":26,"receive":1,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-03-20","alert":"Sinkholed","trigger":"phantomwallet.listing-check.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"phantomwallet.listing-check.com/","fqdn":"phantomwallet.listing-check.com","domain":"listing-check.com","tld":"com"},"ip":{"addr":"85.187.142.69","port":443,"asn":55293,"as":"A2HOSTING","country":"United States","country_code":"US"},"is_navigation_request":true,"resource_type":"document","requested_by":"","date":"2026-03-20T18:54:16.162Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"phantomwallet.listing-check.com","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Fri, 20 Mar 2026 11:27:18 GMT","end":"Thu, 18 Jun 2026 11:27:17 GMT"},"fingerprint":{"sha1":"B6:29:52:6F:F5:F5:20:FF:C3:9A:6E:D3:66:83:21:F6:E0:61:69:29","sha256":"39:41:FD:03:4E:A4:06:9C:BE:42:30:C0:2E:89:27:67:D0:73:55:48:1B:4A:63:43:82:96:D5:4C:85:BE:27:0D"}}},"request":{"raw":"GET / HTTP/1.1\r\nHost: phantomwallet.listing-check.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nUpgrade-Insecure-Requests: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: document\r\nSec-Fetch-Mode: navigate\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Fri, 20 Mar 2026 18:54:16 GMT\r\nServer: Apache\r\nStrict-Transport-Security: max-age=63072000; includeSubDomains\r\nX-Frame-Options: SAMEORIGIN\r\nX-Content-Type-Options: nosniff\r\nLast-Modified: Fri, 20 Mar 2026 12:08:24 GMT\r\nAccept-Ranges: bytes\r\nVary: Accept-Encoding\r\nContent-Encoding: gzip\r\nCache-Control: max-age=3600, must-revalidate\r\nContent-Length: 1028\r\nKeep-Alive: timeout=3, max=500\r\nConnection: Keep-Alive\r\nContent-Type: text/html\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Apache HTTP Server","description":"Apache is a free and open-source cross-platform web server software.","website":"https://httpd.apache.org/","common_platform_enumeration":"cpe:2.3:a:apache:http_server:*:*:*:*:*:*:*:*","icon":"Apache.svg","categories":["Web servers"]}],"data":{"size":2251,"size_decoded":0,"mime_type":"text/html","magic":"HTML document, ASCII text","md5":"c4e34cf67748a331a4c33b8bdabeb29c","sha1":"1f0dbba97d0968136f1b4e5c759e6cffe454a113","sha256":"95b7141fc9ca6559f72851a674271b5782ca0a3073bf14d99bb5862313e8a944","sha512":"2707a4df96ab9abeb25f5527a0d5f92898d6bf3f02b2bb3f93fe4322fe00210c354fd34ff7fb0898b57ab5f9a0a3cc35f676c236650c0480cd87c56aaceb2544","ssdeep":"","tlshash":"364133da5a970506b61393603be7939633a4d003955ac8347fcc71accf8638889a73ce","first_seen":"2026-03-20T18:54:39.597257Z","last_seen":"2026-03-20T19:56:44.58921Z","times_seen":2,"resource_available":false,"data":null}},"time_used":132,"timings":{"blocked":53,"dns":9,"connect":18,"send":0,"wait":25,"receive":1,"ssl":24},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-03-20","alert":"Sinkholed","trigger":"phantomwallet.listing-check.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}}]}