{"report_id":"fcc6fc89-678b-4e49-a4d8-7cd5fa17774a","version":0,"status":"done","tags":[],"date":"2026-09-23T08:23:15Z","url":{"schema":"http","addr":"walletrecovery.net/","fqdn":"walletrecovery.net","domain":"walletrecovery.net","tld":"net"},"ip":{"addr":"64.89.160.231","port":0,"asn":205759,"as":"Ghosty Networks LLC","country":"United States","country_code":"US"},"final":{"url":{"schema":"https","addr":"walletrecovery.net/","fqdn":"walletrecovery.net","domain":"walletrecovery.net","tld":"net"},"title":"Account Recovery | Coinbase","dom":{"size":58830,"mime_type":"text/html; charset=utf-8","magic":"JavaScript source, Unicode text, UTF-8 text, with very long lines (17235)","md5":"f746bbf7d5b18848c1e22413af08fcaf","sha1":"249c38c5c95692c11d6c42d002b195beac1253e9","sha256":"6437ebd4046d654c48283b5494d4bd17c9d204bd154e92bb1b862bc9317724bd","sha512":"742cf6d730d51b138a6c58a17928dba5115b4bf89ba4b1dae824af456e8d7bdaf7362c2472aef35fbe789e524dbbd2091ea9212d4ca943b56f5f42b66379207e","ssdeep":"768:31HxxFzLIiGa4WL+DxexETCpu099xkjpn5Xe7K8EkJUyto8Vx5F/KPWeaYgLLuKo:31ai2DDwvu099Ceik+ytogx5EaYACKk3","tlshash":"6643f91579794c3a57eb83e934db4e4a77ac0003950a8568beed46984f8efd0b127bcc","dom_hash":"domhash4781a3552c8fd130118fb1bf34a10b4f","first_seen":"2026-09-23T08:09:23.88945Z","last_seen":"2026-09-23T13:12:32.87106Z","times_seen":3,"resource_available":false,"data":null}},"submit":{"url":{"schema":"http","addr":"walletrecovery.net/","fqdn":"walletrecovery.net","domain":"walletrecovery.net","tld":"net"},"ip":{"addr":"64.89.160.231","port":0,"asn":205759,"as":"Ghosty Networks LLC","country":"United States","country_code":"US"},"tags":null,"meta":null},"settings":{"access":"public","device_type":"desktop","expires_at":"2027-10-28T08:23:15Z","useragent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0","referer":"","cookies":null,"exit_node":"qguvgzjxzsgb3vs"},"stats":{"alert_count":{"ids":0,"urlquery":0,"analyzer":4}},"detection":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-23","alert":"Sinkholed","trigger":"walletrecovery.net","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-09-23","alert":"Sinkholed","trigger":"walletrecovery.net","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-09-23","alert":"Sinkholed","trigger":"walletrecovery.net","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"cira_dns","sensor_type":"DNS","title":"CIRA Canadian Shield DNS","description":"CIRA Canadian Shield DNS","scan_date":"2026-09-23","alert":"Sinkholed","trigger":"walletrecovery.net","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cira.ca/en/canadian-shield/","meta":null}],"urlquery":null},"summary":[{"fqdn":"walletrecovery.net","ip":{"addr":"64.89.160.231","port":443,"asn":0,"as":"","country":"United States","country_code":"US"},"domain_registered":"2026-09-22","domain_rank":0,"first_seen":"2026-09-23T08:09:20.43518Z","last_seen":"2026-09-23T08:09:20.43518Z","alert_count":12,"request_count":3,"received_data":71709,"sent_data":1374,"comment":"","tags":null,"fingerprints":null}],"files":null,"artifacts":{"windows_shortcuts":null,"files":null,"telegram":null,"pdfs":null,"clipboard":null},"sensors":{"ids":null,"analyzer":null,"urlquery":null},"javascript":{"script":[{"url":{"schema":"https","addr":"walletrecovery.net/","fqdn":"walletrecovery.net","domain":"walletrecovery.net","tld":"net"},"ip":{"addr":"64.89.160.231","port":443,"asn":0,"as":"","country":"United States","country_code":"US"},"introduction_type":"scriptElement","is_inline":true,"md5":"3178349c38aa9dd3751713a586e457bb","sha1":"13a891d29720462281fa40835c640e59b69b87eb","sha256":"404df3aec556aee36fcf1583d2c70a373950cadaa9fc09f35ade93d3f156e4e3","sha512":"835ebdb004c972a4b775ee2cdd08534b7035fc52105433a10c607498f403ce1e9734e87d4952989553adb8e14a37433b3331a25a59340c939d594eabd242663d","ssdeep":"768:199xkjpn5Xe7K8EkJUyto8Vx5F/KPWeaYgLLuKkI:199Ceik+ytogx5EaYACKkI","tlshash":"1ae2b5196e2e4c3a87ee83ee24db0c0896ac000372055569fddddba45f5eb94a06f7dc","size":32651,"data":"","first_seen":"2026-09-23T08:23:15.996914Z","last_seen":"2026-09-23T13:12:32.887074Z","times_seen":2,"alerts":{"ids":null,"analyzer":null,"urlquery":null}}],"eval":null,"write":null,"console":null},"http":[{"url":{"schema":"https","addr":"walletrecovery.net/","fqdn":"walletrecovery.net","domain":"walletrecovery.net","tld":"net"},"ip":{"addr":"64.89.160.231","port":443,"asn":0,"as":"","country":"United States","country_code":"US"},"is_navigation_request":true,"resource_type":"document","requested_by":"","date":"2026-09-23T08:22:42.129Z","timestamp":1790151762129,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"walletrecovery.net","organization":""},"issuer":{"commonName":"YE1","organization":"Let's Encrypt"},"validity":{"start":"Tue, 22 Sep 2026 22:14:52 GMT","end":"Mon, 21 Dec 2026 22:14:51 GMT"},"fingerprint":{"sha1":"06:A6:8E:67:7E:33:BE:CE:E8:E2:DF:F9:0E:29:15:C8:F0:B2:69:4B","sha256":"CB:C6:EA:5B:DC:A4:53:97:E1:7B:3C:38:0B:B8:0E:F6:A1:0B:01:6A:8B:18:6A:34:39:A2:17:14:6A:C0:F4:1F"}}},"request":{"raw":"GET / HTTP/1.1\r\nHost: walletrecovery.net\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nUpgrade-Insecure-Requests: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: document\r\nSec-Fetch-Mode: navigate\r\nSec-Fetch-Site: none\r\nPriority: u=0, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nalt-svc: h3=\":443\"; ma=2592000\r\ncache-control: no-store\r\ncontent-encoding: gzip\r\ncontent-security-policy: default-src 'self'; img-src 'self' data:; style-src 'self' 'unsafe-inline'; script-src 'self' 'unsafe-inline'; object-src 'none'; frame-ancestors 'none'; form-action 'self'; base-uri 'self'\r\ncontent-type: text/html; charset=utf-8\r\ndate: Wed, 23 Sep 2026 08:22:46 GMT\r\nreferrer-policy: no-referrer\r\nserver: Caddy, wg\r\nvary: Accept-Encoding\r\nx-content-type-options: nosniff\r\nx-frame-options: DENY\r\nx-robots-tag: noindex\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":null,"data":{"size":58867,"size_decoded":20213,"mime_type":"text/html; charset=utf-8","magic":"HTML document, Unicode text, UTF-8 text, with very long lines (17235)","md5":"133c8635abac1c7f012b75d88e5abfcf","sha1":"1c2ac3d9e057eec10d87f05f1f7037b7b04d4eff","sha256":"279c42d587140c62deed9b2e71bc5ad07901739f8c6a064d15397831a624c9f0","sha512":"e9ae603292ef1e6c974893ddd727eb847906d2fb0f79391b18859f65f4f2d2278be1cdec043d3578533e31ab159bdf14b8796c465998841663a6e22e2710385c","ssdeep":"1536:jL1ai2DDwZhB99Ceik+ytogx5EaYACKk7:KOhBTCkC","tlshash":"e843f91579794c3a57eb83e934db4e4a77ac0003950a8568beed86984f8efd0b1277cc","first_seen":"2026-09-23T08:09:23.892198Z","last_seen":"2026-09-23T13:12:32.872272Z","times_seen":3,"resource_available":true,"data":null}},"time_used":4277,"timings":{"blocked":-1,"dns":4046,"connect":73,"send":0,"wait":79,"receive":0,"ssl":79},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-23","alert":"Sinkholed","trigger":"walletrecovery.net","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-09-23","alert":"Sinkholed","trigger":"walletrecovery.net","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-09-23","alert":"Sinkholed","trigger":"walletrecovery.net","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"cira_dns","sensor_type":"DNS","title":"CIRA Canadian Shield DNS","description":"CIRA Canadian Shield DNS","scan_date":"2026-09-23","alert":"Sinkholed","trigger":"walletrecovery.net","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cira.ca/en/canadian-shield/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"walletrecovery.net/cblogo-trim.png","fqdn":"walletrecovery.net","domain":"walletrecovery.net","tld":"net"},"ip":{"addr":"64.89.160.231","port":443,"asn":0,"as":"","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://walletrecovery.net/","date":"2026-09-23T08:22:46.596Z","timestamp":1790151766596,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"walletrecovery.net","organization":""},"issuer":{"commonName":"YE1","organization":"Let's Encrypt"},"validity":{"start":"Tue, 22 Sep 2026 22:14:52 GMT","end":"Mon, 21 Dec 2026 22:14:51 GMT"},"fingerprint":{"sha1":"06:A6:8E:67:7E:33:BE:CE:E8:E2:DF:F9:0E:29:15:C8:F0:B2:69:4B","sha256":"CB:C6:EA:5B:DC:A4:53:97:E1:7B:3C:38:0B:B8:0E:F6:A1:0B:01:6A:8B:18:6A:34:39:A2:17:14:6A:C0:F4:1F"}}},"request":{"raw":"GET /cblogo-trim.png HTTP/1.1\r\nHost: walletrecovery.net\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=4, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nalt-svc: h3=\":443\"; ma=2592000\r\ncache-control: no-store\r\ncontent-security-policy: default-src 'self'; img-src 'self' data:; style-src 'self' 'unsafe-inline'; script-src 'self' 'unsafe-inline'; object-src 'none'; frame-ancestors 'none'; form-action 'self'; base-uri 'self'\r\ncontent-type: image/png\r\ndate: Wed, 23 Sep 2026 08:22:46 GMT\r\nreferrer-policy: no-referrer\r\nserver: Caddy, wg\r\nx-content-type-options: nosniff\r\nx-frame-options: DENY\r\nx-robots-tag: noindex\r\ncontent-length: 11171\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":null,"data":{"size":11171,"size_decoded":11692,"mime_type":"image/png","magic":"PNG image data, 251 x 68, 8-bit/color RGBA, non-interlaced","md5":"f193f5099f381b3789a9da69210038db","sha1":"38b78091982d048965bc85f84063e4991e3b911c","sha256":"43a385087df93a05c1e669a5980a087b8ee61a21f33afbd7718f9310d354cc09","sha512":"537cb7cf4f9100156c9655af27522ac53ec95580ed7a3bcac4b4e8235d8f54464ff321ebb976bdf1055ac238525f7acd4b68baa37a579edc2f3c474eea6ba36a","ssdeep":"192:s7AmX0+L58LpfizoXMtmwyXJXKMiL+A0Ymvwmylcfn9JQ3J9jLkJZ6ziY:a0vfizoXnXRViqAIvgO/9JQ3fvkv6zL","tlshash":"de32aff261bde941c704bc5c86b3c017ceb6298b3d99e7e76057ea01cb00a3976974d1","first_seen":"2026-09-23T08:09:23.893654Z","last_seen":"2026-09-23T13:12:32.87438Z","times_seen":3,"resource_available":false,"data":null}},"time_used":155,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":154,"receive":1,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-09-23","alert":"Sinkholed","trigger":"walletrecovery.net","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-23","alert":"Sinkholed","trigger":"walletrecovery.net","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-09-23","alert":"Sinkholed","trigger":"walletrecovery.net","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"cira_dns","sensor_type":"DNS","title":"CIRA Canadian Shield DNS","description":"CIRA Canadian Shield DNS","scan_date":"2026-09-23","alert":"Sinkholed","trigger":"walletrecovery.net","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cira.ca/en/canadian-shield/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"walletrecovery.net/api/scenario","fqdn":"walletrecovery.net","domain":"walletrecovery.net","tld":"net"},"ip":{"addr":"64.89.160.231","port":443,"asn":0,"as":"","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"fetch","requested_by":"https://walletrecovery.net/","date":"2026-09-23T08:22:46.599Z","timestamp":1790151766599,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"walletrecovery.net","organization":""},"issuer":{"commonName":"YE1","organization":"Let's Encrypt"},"validity":{"start":"Tue, 22 Sep 2026 22:14:52 GMT","end":"Mon, 21 Dec 2026 22:14:51 GMT"},"fingerprint":{"sha1":"06:A6:8E:67:7E:33:BE:CE:E8:E2:DF:F9:0E:29:15:C8:F0:B2:69:4B","sha256":"CB:C6:EA:5B:DC:A4:53:97:E1:7B:3C:38:0B:B8:0E:F6:A1:0B:01:6A:8B:18:6A:34:39:A2:17:14:6A:C0:F4:1F"}}},"request":{"raw":"GET /api/scenario HTTP/1.1\r\nHost: walletrecovery.net\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=4\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nalt-svc: h3=\":443\"; ma=2592000\r\ncache-control: no-store\r\ncontent-security-policy: default-src 'self'; img-src 'self' data:; style-src 'self' 'unsafe-inline'; script-src 'self' 'unsafe-inline'; object-src 'none'; frame-ancestors 'none'; form-action 'self'; base-uri 'self'\r\ncontent-type: application/json\r\ndate: Wed, 23 Sep 2026 08:22:46 GMT\r\nreferrer-policy: no-referrer\r\nserver: Caddy, wg\r\nx-content-type-options: nosniff\r\nx-frame-options: DENY\r\nx-robots-tag: noindex\r\ncontent-length: 65\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":null,"data":{"size":65,"size_decoded":590,"mime_type":"application/json","magic":"JSON text data","md5":"0809f7db86308d57464db529fa3461f1","sha1":"04247b130953cc31f3b1741da5802b2fe18f4483","sha256":"c9105cfa7292ce230baee84c5b61e67d7d947d8403ac4f92e569fa00afba23da","sha512":"563f58a61439938ad8e1b91a6f9e7649bcf88d705cff3a74d36210f645619a8fae22c91abc336589ab5231af2fa2d3deef6b2ae1b26d954cdc6da58573c57e72","ssdeep":"","tlshash":"05a00228590bc7bf108268e165fc126152b5b12959ee0e544ecda6240a5d835562b2e7","first_seen":"2026-09-23T08:09:23.89527Z","last_seen":"2026-09-23T13:12:32.875783Z","times_seen":3,"resource_available":true,"data":null}},"time_used":153,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":153,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-09-23","alert":"Sinkholed","trigger":"walletrecovery.net","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"cira_dns","sensor_type":"DNS","title":"CIRA Canadian Shield DNS","description":"CIRA Canadian Shield DNS","scan_date":"2026-09-23","alert":"Sinkholed","trigger":"walletrecovery.net","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cira.ca/en/canadian-shield/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-23","alert":"Sinkholed","trigger":"walletrecovery.net","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-09-23","alert":"Sinkholed","trigger":"walletrecovery.net","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null}],"urlquery":null}}]}