{"report_id":"007f9d5b-7824-4823-9385-437626d0e24a","version":6,"status":"done","tags":[],"date":"2025-08-15T04:53:51Z","url":{"schema":"http","addr":"distribute-shib.xyz/","fqdn":"distribute-shib.xyz","domain":"distribute-shib.xyz","tld":"xyz"},"ip":{"addr":"213.111.154.75","port":0,"asn":0,"as":"","country":"Ukraine","country_code":"UA"},"final":{"url":{"schema":"https","addr":"distribute-shib.xyz/","fqdn":"distribute-shib.xyz","domain":"distribute-shib.xyz","tld":"xyz"},"title":"Blockstreet - Bridging Wall Street to Web3"},"submit":{"url":{"schema":"http","addr":"distribute-shib.xyz/","fqdn":"distribute-shib.xyz","domain":"distribute-shib.xyz","tld":"xyz"},"ip":{"addr":"213.111.154.75","port":0,"asn":0,"as":"","country":"Ukraine","country_code":"UA"},"tags":null,"meta":null},"settings":{"access":"public","device_type":"desktop","expires_at":"2026-09-19T04:53:51Z","useragent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0","referer":"","cookies":null,"exit_node":"z0yflva4pidy47h"},"stats":{"alert_count":{"ids":6,"urlquery":0,"analyzer":1}},"detection":{"ids":[{"sensor_name":"suricata","title":"Suricata IDS","description":"Suricata /w Emerging Threats Pro","date":"2025-08-15T04:53:28Z","timestamp":1755233608,"ip_dst":{"addr":"172.67.74.152","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"ip_src":{"addr":"172.18.0.15","port":53944,"asn":0,"as":"","country":"","country_code":"zz"},"severity":"low","alert":"ET INFO External IP Address Lookup Domain (ipify .org) in TLS SNI","source":"{\"timestamp\":\"2025-08-15T04:53:28.281848+0000\",\"flow_id\":1166185580738546,\"in_iface\":\"br-31613a7ed13b\",\"event_type\":\"alert\",\"src_ip\":\"172.18.0.15\",\"src_port\":53944,\"dest_ip\":\"172.67.74.152\",\"dest_port\":443,\"proto\":\"TCP\",\"tx_id\":0,\"alert\":{\"action\":\"allowed\",\"gid\":1,\"signature_id\":2047703,\"rev\":1,\"signature\":\"ET INFO External IP Address Lookup Domain (ipify .org) in TLS SNI\",\"category\":\"Misc activity\",\"severity\":3,\"metadata\":{\"affected_product\":[\"Any\"],\"attack_target\":[\"Client_and_Server\"],\"confidence\":[\"High\"],\"created_at\":[\"2023_08_22\"],\"deployment\":[\"Perimeter\"],\"performance_impact\":[\"Low\"],\"reviewed_at\":[\"2023_08_22\"],\"signature_severity\":[\"Informational\"],\"tag\":[\"External_IP_Lookup\"],\"updated_at\":[\"2023_08_22\"]}},\"tls\":{\"sni\":\"api.ipify.org\",\"version\":\"TLS 1.3\",\"ja3\":{\"hash\":\"0faf2a91198d40dbd58b9308f3fca2fd\",\"string\":\"771,4865-4867-4866-49195-49199-52393-52392-49196-49200-49171-49172-156-157-47-53,0-23-65281-10-11-16-5-34-51-43-13-28-65037,29-23-24-25-256-257,0\"},\"ja3s\":{\"hash\":\"eb1d94daa7e0344597e756a1fb6e7054\",\"string\":\"771,4865,51-43\"}},\"app_proto\":\"tls\",\"flow\":{\"pkts_toserver\":4,\"pkts_toclient\":5,\"bytes_toserver\":915,\"bytes_toclient\":3515,\"start\":\"2025-08-15T04:53:28.276466+0000\"}}"},{"sensor_name":"suricata","title":"Suricata IDS","description":"Suricata /w Emerging Threats Pro","date":"2025-08-15T04:53:28Z","timestamp":1755233608,"ip_dst":{"addr":"172.67.74.152","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"ip_src":{"addr":"172.18.0.15","port":53946,"asn":0,"as":"","country":"","country_code":"zz"},"severity":"low","alert":"ET INFO External IP Address Lookup Domain (ipify .org) in TLS SNI","source":"{\"timestamp\":\"2025-08-15T04:53:28.284795+0000\",\"flow_id\":2112195077359247,\"in_iface\":\"br-31613a7ed13b\",\"event_type\":\"alert\",\"src_ip\":\"172.18.0.15\",\"src_port\":53946,\"dest_ip\":\"172.67.74.152\",\"dest_port\":443,\"proto\":\"TCP\",\"tx_id\":0,\"alert\":{\"action\":\"allowed\",\"gid\":1,\"signature_id\":2047703,\"rev\":1,\"signature\":\"ET INFO External IP Address Lookup Domain (ipify .org) in TLS SNI\",\"category\":\"Misc activity\",\"severity\":3,\"metadata\":{\"affected_product\":[\"Any\"],\"attack_target\":[\"Client_and_Server\"],\"confidence\":[\"High\"],\"created_at\":[\"2023_08_22\"],\"deployment\":[\"Perimeter\"],\"performance_impact\":[\"Low\"],\"reviewed_at\":[\"2023_08_22\"],\"signature_severity\":[\"Informational\"],\"tag\":[\"External_IP_Lookup\"],\"updated_at\":[\"2023_08_22\"]}},\"tls\":{\"sni\":\"api.ipify.org\",\"version\":\"TLS 1.3\",\"ja3\":{\"hash\":\"650c82854aed91a22996035b295a0c3e\",\"string\":\"771,4865-4867-4866-49195-49199-52393-52392-49196-49200-49171-49172-156-157-47-53,0-23-65281-10-11-16-5-34-51-43-13-28-21,29-23-24-25-256-257,0\"},\"ja3s\":{\"hash\":\"eb1d94daa7e0344597e756a1fb6e7054\",\"string\":\"771,4865,51-43\"}},\"app_proto\":\"tls\",\"flow\":{\"pkts_toserver\":4,\"pkts_toclient\":5,\"bytes_toserver\":789,\"bytes_toclient\":3438,\"start\":\"2025-08-15T04:53:28.280207+0000\"}}"},{"sensor_name":"suricata","title":"Suricata IDS","description":"Suricata /w Emerging Threats Pro","date":"2025-08-15T04:53:28Z","timestamp":1755233608,"ip_dst":{"addr":"104.20.24.117","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"ip_src":{"addr":"172.18.0.15","port":33188,"asn":0,"as":"","country":"","country_code":"zz"},"severity":"low","alert":"ET INFO Observed Smart Chain Domain in TLS SNI (bsc-rpc .publicnode .com)","source":"{\"timestamp\":\"2025-08-15T04:53:28.301397+0000\",\"flow_id\":778556192354548,\"in_iface\":\"br-31613a7ed13b\",\"event_type\":\"alert\",\"src_ip\":\"172.18.0.15\",\"src_port\":33188,\"dest_ip\":\"104.20.24.117\",\"dest_port\":443,\"proto\":\"TCP\",\"tx_id\":0,\"alert\":{\"action\":\"allowed\",\"gid\":1,\"signature_id\":2058806,\"rev\":1,\"signature\":\"ET INFO Observed Smart Chain Domain in TLS SNI (bsc-rpc .publicnode .com)\",\"category\":\"Misc activity\",\"severity\":3,\"metadata\":{\"affected_product\":[\"Windows_XP_Vista_7_8_10_Server_32_64_Bit\"],\"attack_target\":[\"Client_Endpoint\"],\"confidence\":[\"High\"],\"created_at\":[\"2025_01_03\"],\"deployment\":[\"Perimeter\"],\"performance_impact\":[\"Low\"],\"signature_severity\":[\"Informational\"],\"tag\":[\"Description_Generated_By_Proofpoint_Nexus\",\"TA_Abused_Service\"],\"updated_at\":[\"2025_01_03\"]}},\"tls\":{\"sni\":\"bsc-rpc.publicnode.com\",\"version\":\"TLS 1.3\",\"ja3\":{\"hash\":\"650c82854aed91a22996035b295a0c3e\",\"string\":\"771,4865-4867-4866-49195-49199-52393-52392-49196-49200-49171-49172-156-157-47-53,0-23-65281-10-11-16-5-34-51-43-13-28-21,29-23-24-25-256-257,0\"},\"ja3s\":{\"hash\":\"eb1d94daa7e0344597e756a1fb6e7054\",\"string\":\"771,4865,51-43\"}},\"app_proto\":\"tls\",\"flow\":{\"pkts_toserver\":4,\"pkts_toclient\":5,\"bytes_toserver\":789,\"bytes_toclient\":3451,\"start\":\"2025-08-15T04:53:28.291060+0000\"}}"},{"sensor_name":"suricata","title":"Suricata IDS","description":"Suricata /w Emerging Threats Pro","date":"2025-08-15T04:53:28Z","timestamp":1755233608,"ip_dst":{"addr":"104.20.24.117","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"ip_src":{"addr":"172.18.0.15","port":33190,"asn":0,"as":"","country":"","country_code":"zz"},"severity":"low","alert":"ET INFO Observed Smart Chain Domain in TLS SNI (bsc-rpc .publicnode .com)","source":"{\"timestamp\":\"2025-08-15T04:53:28.312696+0000\",\"flow_id\":1230300852554784,\"in_iface\":\"br-31613a7ed13b\",\"event_type\":\"alert\",\"src_ip\":\"172.18.0.15\",\"src_port\":33190,\"dest_ip\":\"104.20.24.117\",\"dest_port\":443,\"proto\":\"TCP\",\"tx_id\":0,\"alert\":{\"action\":\"allowed\",\"gid\":1,\"signature_id\":2058806,\"rev\":1,\"signature\":\"ET INFO Observed Smart Chain Domain in TLS SNI (bsc-rpc .publicnode .com)\",\"category\":\"Misc activity\",\"severity\":3,\"metadata\":{\"affected_product\":[\"Windows_XP_Vista_7_8_10_Server_32_64_Bit\"],\"attack_target\":[\"Client_Endpoint\"],\"confidence\":[\"High\"],\"created_at\":[\"2025_01_03\"],\"deployment\":[\"Perimeter\"],\"performance_impact\":[\"Low\"],\"signature_severity\":[\"Informational\"],\"tag\":[\"Description_Generated_By_Proofpoint_Nexus\",\"TA_Abused_Service\"],\"updated_at\":[\"2025_01_03\"]}},\"tls\":{\"sni\":\"bsc-rpc.publicnode.com\",\"version\":\"TLS 1.3\",\"ja3\":{\"hash\":\"0faf2a91198d40dbd58b9308f3fca2fd\",\"string\":\"771,4865-4867-4866-49195-49199-52393-52392-49196-49200-49171-49172-156-157-47-53,0-23-65281-10-11-16-5-34-51-43-13-28-65037,29-23-24-25-256-257,0\"},\"ja3s\":{\"hash\":\"eb1d94daa7e0344597e756a1fb6e7054\",\"string\":\"771,4865,51-43\"}},\"app_proto\":\"tls\",\"flow\":{\"pkts_toserver\":4,\"pkts_toclient\":5,\"bytes_toserver\":924,\"bytes_toclient\":3526,\"start\":\"2025-08-15T04:53:28.298016+0000\"}}"},{"sensor_name":"suricata","title":"Suricata IDS","description":"Suricata /w Emerging Threats Pro","date":"2025-08-15T04:53:28Z","timestamp":1755233608,"ip_dst":{"addr":"3.254.213.200","port":443,"asn":16509,"as":"AMAZON-02","country":"Ireland","country_code":"IE"},"ip_src":{"addr":"172.18.0.15","port":56236,"asn":0,"as":"","country":"","country_code":"zz"},"severity":"low","alert":"ET INFO Observed Smart Chain Domain in TLS SNI (bsc-dataseed4 .bnbchain .org)","source":"{\"timestamp\":\"2025-08-15T04:53:28.387118+0000\",\"flow_id\":882670494601668,\"in_iface\":\"br-31613a7ed13b\",\"event_type\":\"alert\",\"src_ip\":\"172.18.0.15\",\"src_port\":56236,\"dest_ip\":\"3.254.213.200\",\"dest_port\":443,\"proto\":\"TCP\",\"tx_id\":0,\"alert\":{\"action\":\"allowed\",\"gid\":1,\"signature_id\":2058798,\"rev\":1,\"signature\":\"ET INFO Observed Smart Chain Domain in TLS SNI (bsc-dataseed4 .bnbchain .org)\",\"category\":\"Misc activity\",\"severity\":3,\"metadata\":{\"affected_product\":[\"Windows_XP_Vista_7_8_10_Server_32_64_Bit\"],\"attack_target\":[\"Client_Endpoint\"],\"confidence\":[\"High\"],\"created_at\":[\"2025_01_03\"],\"deployment\":[\"Perimeter\"],\"performance_impact\":[\"Low\"],\"signature_severity\":[\"Informational\"],\"tag\":[\"Description_Generated_By_Proofpoint_Nexus\",\"TA_Abused_Service\"],\"updated_at\":[\"2025_01_03\"]}},\"tls\":{\"sni\":\"bsc-dataseed4.bnbchain.org\",\"version\":\"TLS 1.2\",\"ja3\":{\"hash\":\"650c82854aed91a22996035b295a0c3e\",\"string\":\"771,4865-4867-4866-49195-49199-52393-52392-49196-49200-49171-49172-156-157-47-53,0-23-65281-10-11-16-5-34-51-43-13-28-21,29-23-24-25-256-257,0\"},\"ja3s\":{\"hash\":\"50a9e7b112931e541503e8a2499252b9\",\"string\":\"771,49199,0-11-65281-16-23\"}},\"app_proto\":\"tls\",\"flow\":{\"pkts_toserver\":4,\"pkts_toclient\":4,\"bytes_toserver\":789,\"bytes_toclient\":3168,\"start\":\"2025-08-15T04:53:28.315844+0000\"}}"},{"sensor_name":"suricata","title":"Suricata IDS","description":"Suricata /w Emerging Threats Pro","date":"2025-08-15T04:53:28Z","timestamp":1755233608,"ip_dst":{"addr":"3.254.213.200","port":443,"asn":16509,"as":"AMAZON-02","country":"Ireland","country_code":"IE"},"ip_src":{"addr":"172.18.0.15","port":56224,"asn":0,"as":"","country":"","country_code":"zz"},"severity":"low","alert":"ET INFO Observed Smart Chain Domain in TLS SNI (bsc-dataseed4 .bnbchain .org)","source":"{\"timestamp\":\"2025-08-15T04:53:28.390111+0000\",\"flow_id\":272969822163265,\"in_iface\":\"br-31613a7ed13b\",\"event_type\":\"alert\",\"src_ip\":\"172.18.0.15\",\"src_port\":56224,\"dest_ip\":\"3.254.213.200\",\"dest_port\":443,\"proto\":\"TCP\",\"tx_id\":0,\"alert\":{\"action\":\"allowed\",\"gid\":1,\"signature_id\":2058798,\"rev\":1,\"signature\":\"ET INFO Observed Smart Chain Domain in TLS SNI (bsc-dataseed4 .bnbchain .org)\",\"category\":\"Misc activity\",\"severity\":3,\"metadata\":{\"affected_product\":[\"Windows_XP_Vista_7_8_10_Server_32_64_Bit\"],\"attack_target\":[\"Client_Endpoint\"],\"confidence\":[\"High\"],\"created_at\":[\"2025_01_03\"],\"deployment\":[\"Perimeter\"],\"performance_impact\":[\"Low\"],\"signature_severity\":[\"Informational\"],\"tag\":[\"Description_Generated_By_Proofpoint_Nexus\",\"TA_Abused_Service\"],\"updated_at\":[\"2025_01_03\"]}},\"tls\":{\"sni\":\"bsc-dataseed4.bnbchain.org\",\"version\":\"TLS 1.2\",\"ja3\":{\"hash\":\"0faf2a91198d40dbd58b9308f3fca2fd\",\"string\":\"771,4865-4867-4866-49195-49199-52393-52392-49196-49200-49171-49172-156-157-47-53,0-23-65281-10-11-16-5-34-51-43-13-28-65037,29-23-24-25-256-257,0\"},\"ja3s\":{\"hash\":\"50a9e7b112931e541503e8a2499252b9\",\"string\":\"771,49199,0-11-65281-16-23\"}},\"app_proto\":\"tls\",\"flow\":{\"pkts_toserver\":4,\"pkts_toclient\":4,\"bytes_toserver\":928,\"bytes_toclient\":3168,\"start\":\"2025-08-15T04:53:28.315713+0000\"}}"}],"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2025-08-15","alert":"Sinkholed","trigger":"distribute-shib.xyz","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null},"summary":[{"fqdn":"cdnjs.cloudflare.com","ip":{"addr":"104.17.25.14","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"domain_registered":"2009-02-17","domain_rank":1222,"first_seen":"2012-05-23T12:49:49Z","last_seen":"2025-08-13T15:20:17.649055Z","alert_count":0,"request_count":2,"received_data":798854,"sent_data":908,"comment":"","tags":null,"fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}]},{"fqdn":"api.ipwho.org","ip":{"addr":"69.62.76.167","port":443,"asn":0,"as":"","country":"United States","country_code":"US"},"domain_registered":"2025-05-08","domain_rank":0,"first_seen":"2025-07-11T11:18:46.569057Z","last_seen":"2025-08-13T13:06:08.210473Z","alert_count":0,"request_count":1,"received_data":405,"sent_data":441,"comment":"","tags":null,"fingerprints":[{"name":"Nginx:1.24.0","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"Ubuntu","description":"Ubuntu is a free and open-source operating system on Linux for the enterprise server, desktop, cloud, and IoT.","website":"https://www.ubuntu.com/server","common_platform_enumeration":"cpe:2.3:o:canonical:ubuntu_linux:*:*:*:*:*:*:*:*","icon":"Ubuntu.svg","categories":["Operating systems"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}]},{"fqdn":"bsc-dataseed4.bnbchain.org","ip":{"addr":"3.254.213.200","port":443,"asn":16509,"as":"AMAZON-02","country":"Ireland","country_code":"IE"},"domain_registered":"2020-01-13","domain_rank":4946679,"first_seen":"2023-09-19T15:40:37Z","last_seen":"2025-08-10T05:56:20.76621Z","alert_count":0,"request_count":2,"received_data":5971,"sent_data":1045,"comment":"","tags":null,"fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}]},{"fqdn":"distribute-shib.xyz","ip":{"addr":"213.111.154.75","port":443,"asn":0,"as":"","country":"Ukraine","country_code":"UA"},"domain_registered":"2025-08-12","domain_rank":0,"first_seen":"2025-08-15T03:59:33.160251Z","last_seen":"2025-08-15T03:59:33.160251Z","alert_count":24,"request_count":24,"received_data":8642476,"sent_data":11264,"comment":"","tags":null,"fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}]},{"fqdn":"www.blockstreet.xyz","ip":{"addr":"104.21.52.225","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"domain_registered":"2024-05-15","domain_rank":0,"first_seen":"2025-08-15T03:59:33.158495Z","last_seen":"2025-08-15T03:59:33.158495Z","alert_count":0,"request_count":1,"received_data":44258,"sent_data":441,"comment":"","tags":null,"fingerprints":[{"name":"Amazon CloudFront","description":"Amazon CloudFront is a fast content delivery network (CDN) service that securely delivers data, videos, applications, and APIs to customers globally with low latency, high transfer speeds.","website":"https://aws.amazon.com/cloudfront/","common_platform_enumeration":"","icon":"Amazon Cloudfront.svg","categories":["CDN"]},{"name":"Amazon Web Services","description":"Amazon Web Services (AWS) is a comprehensive cloud services platform offering compute power, database storage, content delivery and other functionality.","website":"https://aws.amazon.com/","common_platform_enumeration":"","icon":"Amazon Web Services.svg","categories":["PaaS"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}]},{"fqdn":"bsc-rpc.publicnode.com","ip":{"addr":"104.20.24.117","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"domain_registered":"2016-08-16","domain_rank":2142410,"first_seen":"2024-05-08T23:22:55Z","last_seen":"2025-08-13T19:33:07.659421Z","alert_count":0,"request_count":4,"received_data":15022,"sent_data":2074,"comment":"","tags":null,"fingerprints":[{"name":"Envoy","description":"Envoy is an open-source edge and service proxy, designed for cloud-native applications.","website":"https://www.envoyproxy.io/","common_platform_enumeration":"cpe:2.3:a:envoyproxy:envoy:*:*:*:*:*:*:*:*","icon":"Envoy.png","categories":["Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}]},{"fqdn":"cdn.jsdelivr.net","ip":{"addr":"104.16.174.226","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"domain_registered":"2012-05-16","domain_rank":1678,"first_seen":"2012-09-30T00:15:09Z","last_seen":"2025-08-13T15:26:13.000794Z","alert_count":0,"request_count":2,"received_data":994768,"sent_data":894,"comment":"","tags":null,"fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}]},{"fqdn":"api.ipify.org","ip":{"addr":"172.67.74.152","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"domain_registered":"2014-01-05","domain_rank":8166,"first_seen":"2014-10-06T12:38:43Z","last_seen":"2025-08-13T23:19:33.708908Z","alert_count":0,"request_count":2,"received_data":939,"sent_data":878,"comment":"","tags":null,"fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}]}],"files":null,"artifacts":{"windows_shortcuts":null,"files":null,"telegram":null,"pdfs":null,"clipboard":null},"sensors":{"ids":[{"sensor_name":"suricata","description":"Suricata /w Emerging Threats Pro","alerts":[{"sensor_name":"suricata","title":"Suricata IDS","description":"Suricata /w Emerging Threats Pro","date":"2025-08-15T04:53:28Z","timestamp":1755233608,"ip_dst":{"addr":"172.67.74.152","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"ip_src":{"addr":"172.18.0.15","port":53944,"asn":0,"as":"","country":"","country_code":"zz"},"severity":"low","alert":"ET INFO External IP Address Lookup Domain (ipify .org) in TLS SNI","source":"{\"timestamp\":\"2025-08-15T04:53:28.281848+0000\",\"flow_id\":1166185580738546,\"in_iface\":\"br-31613a7ed13b\",\"event_type\":\"alert\",\"src_ip\":\"172.18.0.15\",\"src_port\":53944,\"dest_ip\":\"172.67.74.152\",\"dest_port\":443,\"proto\":\"TCP\",\"tx_id\":0,\"alert\":{\"action\":\"allowed\",\"gid\":1,\"signature_id\":2047703,\"rev\":1,\"signature\":\"ET INFO External IP Address Lookup Domain (ipify .org) in TLS SNI\",\"category\":\"Misc activity\",\"severity\":3,\"metadata\":{\"affected_product\":[\"Any\"],\"attack_target\":[\"Client_and_Server\"],\"confidence\":[\"High\"],\"created_at\":[\"2023_08_22\"],\"deployment\":[\"Perimeter\"],\"performance_impact\":[\"Low\"],\"reviewed_at\":[\"2023_08_22\"],\"signature_severity\":[\"Informational\"],\"tag\":[\"External_IP_Lookup\"],\"updated_at\":[\"2023_08_22\"]}},\"tls\":{\"sni\":\"api.ipify.org\",\"version\":\"TLS 1.3\",\"ja3\":{\"hash\":\"0faf2a91198d40dbd58b9308f3fca2fd\",\"string\":\"771,4865-4867-4866-49195-49199-52393-52392-49196-49200-49171-49172-156-157-47-53,0-23-65281-10-11-16-5-34-51-43-13-28-65037,29-23-24-25-256-257,0\"},\"ja3s\":{\"hash\":\"eb1d94daa7e0344597e756a1fb6e7054\",\"string\":\"771,4865,51-43\"}},\"app_proto\":\"tls\",\"flow\":{\"pkts_toserver\":4,\"pkts_toclient\":5,\"bytes_toserver\":915,\"bytes_toclient\":3515,\"start\":\"2025-08-15T04:53:28.276466+0000\"}}"},{"sensor_name":"suricata","title":"Suricata IDS","description":"Suricata /w Emerging Threats Pro","date":"2025-08-15T04:53:28Z","timestamp":1755233608,"ip_dst":{"addr":"172.67.74.152","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"ip_src":{"addr":"172.18.0.15","port":53946,"asn":0,"as":"","country":"","country_code":"zz"},"severity":"low","alert":"ET INFO External IP Address Lookup Domain (ipify .org) in TLS SNI","source":"{\"timestamp\":\"2025-08-15T04:53:28.284795+0000\",\"flow_id\":2112195077359247,\"in_iface\":\"br-31613a7ed13b\",\"event_type\":\"alert\",\"src_ip\":\"172.18.0.15\",\"src_port\":53946,\"dest_ip\":\"172.67.74.152\",\"dest_port\":443,\"proto\":\"TCP\",\"tx_id\":0,\"alert\":{\"action\":\"allowed\",\"gid\":1,\"signature_id\":2047703,\"rev\":1,\"signature\":\"ET INFO External IP Address Lookup Domain (ipify .org) in TLS SNI\",\"category\":\"Misc activity\",\"severity\":3,\"metadata\":{\"affected_product\":[\"Any\"],\"attack_target\":[\"Client_and_Server\"],\"confidence\":[\"High\"],\"created_at\":[\"2023_08_22\"],\"deployment\":[\"Perimeter\"],\"performance_impact\":[\"Low\"],\"reviewed_at\":[\"2023_08_22\"],\"signature_severity\":[\"Informational\"],\"tag\":[\"External_IP_Lookup\"],\"updated_at\":[\"2023_08_22\"]}},\"tls\":{\"sni\":\"api.ipify.org\",\"version\":\"TLS 1.3\",\"ja3\":{\"hash\":\"650c82854aed91a22996035b295a0c3e\",\"string\":\"771,4865-4867-4866-49195-49199-52393-52392-49196-49200-49171-49172-156-157-47-53,0-23-65281-10-11-16-5-34-51-43-13-28-21,29-23-24-25-256-257,0\"},\"ja3s\":{\"hash\":\"eb1d94daa7e0344597e756a1fb6e7054\",\"string\":\"771,4865,51-43\"}},\"app_proto\":\"tls\",\"flow\":{\"pkts_toserver\":4,\"pkts_toclient\":5,\"bytes_toserver\":789,\"bytes_toclient\":3438,\"start\":\"2025-08-15T04:53:28.280207+0000\"}}"},{"sensor_name":"suricata","title":"Suricata IDS","description":"Suricata /w Emerging Threats Pro","date":"2025-08-15T04:53:28Z","timestamp":1755233608,"ip_dst":{"addr":"104.20.24.117","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"ip_src":{"addr":"172.18.0.15","port":33188,"asn":0,"as":"","country":"","country_code":"zz"},"severity":"low","alert":"ET INFO Observed Smart Chain Domain in TLS SNI (bsc-rpc .publicnode .com)","source":"{\"timestamp\":\"2025-08-15T04:53:28.301397+0000\",\"flow_id\":778556192354548,\"in_iface\":\"br-31613a7ed13b\",\"event_type\":\"alert\",\"src_ip\":\"172.18.0.15\",\"src_port\":33188,\"dest_ip\":\"104.20.24.117\",\"dest_port\":443,\"proto\":\"TCP\",\"tx_id\":0,\"alert\":{\"action\":\"allowed\",\"gid\":1,\"signature_id\":2058806,\"rev\":1,\"signature\":\"ET INFO Observed Smart Chain Domain in TLS SNI (bsc-rpc .publicnode .com)\",\"category\":\"Misc activity\",\"severity\":3,\"metadata\":{\"affected_product\":[\"Windows_XP_Vista_7_8_10_Server_32_64_Bit\"],\"attack_target\":[\"Client_Endpoint\"],\"confidence\":[\"High\"],\"created_at\":[\"2025_01_03\"],\"deployment\":[\"Perimeter\"],\"performance_impact\":[\"Low\"],\"signature_severity\":[\"Informational\"],\"tag\":[\"Description_Generated_By_Proofpoint_Nexus\",\"TA_Abused_Service\"],\"updated_at\":[\"2025_01_03\"]}},\"tls\":{\"sni\":\"bsc-rpc.publicnode.com\",\"version\":\"TLS 1.3\",\"ja3\":{\"hash\":\"650c82854aed91a22996035b295a0c3e\",\"string\":\"771,4865-4867-4866-49195-49199-52393-52392-49196-49200-49171-49172-156-157-47-53,0-23-65281-10-11-16-5-34-51-43-13-28-21,29-23-24-25-256-257,0\"},\"ja3s\":{\"hash\":\"eb1d94daa7e0344597e756a1fb6e7054\",\"string\":\"771,4865,51-43\"}},\"app_proto\":\"tls\",\"flow\":{\"pkts_toserver\":4,\"pkts_toclient\":5,\"bytes_toserver\":789,\"bytes_toclient\":3451,\"start\":\"2025-08-15T04:53:28.291060+0000\"}}"},{"sensor_name":"suricata","title":"Suricata IDS","description":"Suricata /w Emerging Threats Pro","date":"2025-08-15T04:53:28Z","timestamp":1755233608,"ip_dst":{"addr":"104.20.24.117","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"ip_src":{"addr":"172.18.0.15","port":33190,"asn":0,"as":"","country":"","country_code":"zz"},"severity":"low","alert":"ET INFO Observed Smart Chain Domain in TLS SNI (bsc-rpc .publicnode .com)","source":"{\"timestamp\":\"2025-08-15T04:53:28.312696+0000\",\"flow_id\":1230300852554784,\"in_iface\":\"br-31613a7ed13b\",\"event_type\":\"alert\",\"src_ip\":\"172.18.0.15\",\"src_port\":33190,\"dest_ip\":\"104.20.24.117\",\"dest_port\":443,\"proto\":\"TCP\",\"tx_id\":0,\"alert\":{\"action\":\"allowed\",\"gid\":1,\"signature_id\":2058806,\"rev\":1,\"signature\":\"ET INFO Observed Smart Chain Domain in TLS SNI (bsc-rpc .publicnode .com)\",\"category\":\"Misc activity\",\"severity\":3,\"metadata\":{\"affected_product\":[\"Windows_XP_Vista_7_8_10_Server_32_64_Bit\"],\"attack_target\":[\"Client_Endpoint\"],\"confidence\":[\"High\"],\"created_at\":[\"2025_01_03\"],\"deployment\":[\"Perimeter\"],\"performance_impact\":[\"Low\"],\"signature_severity\":[\"Informational\"],\"tag\":[\"Description_Generated_By_Proofpoint_Nexus\",\"TA_Abused_Service\"],\"updated_at\":[\"2025_01_03\"]}},\"tls\":{\"sni\":\"bsc-rpc.publicnode.com\",\"version\":\"TLS 1.3\",\"ja3\":{\"hash\":\"0faf2a91198d40dbd58b9308f3fca2fd\",\"string\":\"771,4865-4867-4866-49195-49199-52393-52392-49196-49200-49171-49172-156-157-47-53,0-23-65281-10-11-16-5-34-51-43-13-28-65037,29-23-24-25-256-257,0\"},\"ja3s\":{\"hash\":\"eb1d94daa7e0344597e756a1fb6e7054\",\"string\":\"771,4865,51-43\"}},\"app_proto\":\"tls\",\"flow\":{\"pkts_toserver\":4,\"pkts_toclient\":5,\"bytes_toserver\":924,\"bytes_toclient\":3526,\"start\":\"2025-08-15T04:53:28.298016+0000\"}}"},{"sensor_name":"suricata","title":"Suricata IDS","description":"Suricata /w Emerging Threats Pro","date":"2025-08-15T04:53:28Z","timestamp":1755233608,"ip_dst":{"addr":"3.254.213.200","port":443,"asn":16509,"as":"AMAZON-02","country":"Ireland","country_code":"IE"},"ip_src":{"addr":"172.18.0.15","port":56236,"asn":0,"as":"","country":"","country_code":"zz"},"severity":"low","alert":"ET INFO Observed Smart Chain Domain in TLS SNI (bsc-dataseed4 .bnbchain .org)","source":"{\"timestamp\":\"2025-08-15T04:53:28.387118+0000\",\"flow_id\":882670494601668,\"in_iface\":\"br-31613a7ed13b\",\"event_type\":\"alert\",\"src_ip\":\"172.18.0.15\",\"src_port\":56236,\"dest_ip\":\"3.254.213.200\",\"dest_port\":443,\"proto\":\"TCP\",\"tx_id\":0,\"alert\":{\"action\":\"allowed\",\"gid\":1,\"signature_id\":2058798,\"rev\":1,\"signature\":\"ET INFO Observed Smart Chain Domain in TLS SNI (bsc-dataseed4 .bnbchain .org)\",\"category\":\"Misc activity\",\"severity\":3,\"metadata\":{\"affected_product\":[\"Windows_XP_Vista_7_8_10_Server_32_64_Bit\"],\"attack_target\":[\"Client_Endpoint\"],\"confidence\":[\"High\"],\"created_at\":[\"2025_01_03\"],\"deployment\":[\"Perimeter\"],\"performance_impact\":[\"Low\"],\"signature_severity\":[\"Informational\"],\"tag\":[\"Description_Generated_By_Proofpoint_Nexus\",\"TA_Abused_Service\"],\"updated_at\":[\"2025_01_03\"]}},\"tls\":{\"sni\":\"bsc-dataseed4.bnbchain.org\",\"version\":\"TLS 1.2\",\"ja3\":{\"hash\":\"650c82854aed91a22996035b295a0c3e\",\"string\":\"771,4865-4867-4866-49195-49199-52393-52392-49196-49200-49171-49172-156-157-47-53,0-23-65281-10-11-16-5-34-51-43-13-28-21,29-23-24-25-256-257,0\"},\"ja3s\":{\"hash\":\"50a9e7b112931e541503e8a2499252b9\",\"string\":\"771,49199,0-11-65281-16-23\"}},\"app_proto\":\"tls\",\"flow\":{\"pkts_toserver\":4,\"pkts_toclient\":4,\"bytes_toserver\":789,\"bytes_toclient\":3168,\"start\":\"2025-08-15T04:53:28.315844+0000\"}}"},{"sensor_name":"suricata","title":"Suricata IDS","description":"Suricata /w Emerging Threats Pro","date":"2025-08-15T04:53:28Z","timestamp":1755233608,"ip_dst":{"addr":"3.254.213.200","port":443,"asn":16509,"as":"AMAZON-02","country":"Ireland","country_code":"IE"},"ip_src":{"addr":"172.18.0.15","port":56224,"asn":0,"as":"","country":"","country_code":"zz"},"severity":"low","alert":"ET INFO Observed Smart Chain Domain in TLS SNI (bsc-dataseed4 .bnbchain .org)","source":"{\"timestamp\":\"2025-08-15T04:53:28.390111+0000\",\"flow_id\":272969822163265,\"in_iface\":\"br-31613a7ed13b\",\"event_type\":\"alert\",\"src_ip\":\"172.18.0.15\",\"src_port\":56224,\"dest_ip\":\"3.254.213.200\",\"dest_port\":443,\"proto\":\"TCP\",\"tx_id\":0,\"alert\":{\"action\":\"allowed\",\"gid\":1,\"signature_id\":2058798,\"rev\":1,\"signature\":\"ET INFO Observed Smart Chain Domain in TLS SNI (bsc-dataseed4 .bnbchain .org)\",\"category\":\"Misc activity\",\"severity\":3,\"metadata\":{\"affected_product\":[\"Windows_XP_Vista_7_8_10_Server_32_64_Bit\"],\"attack_target\":[\"Client_Endpoint\"],\"confidence\":[\"High\"],\"created_at\":[\"2025_01_03\"],\"deployment\":[\"Perimeter\"],\"performance_impact\":[\"Low\"],\"signature_severity\":[\"Informational\"],\"tag\":[\"Description_Generated_By_Proofpoint_Nexus\",\"TA_Abused_Service\"],\"updated_at\":[\"2025_01_03\"]}},\"tls\":{\"sni\":\"bsc-dataseed4.bnbchain.org\",\"version\":\"TLS 1.2\",\"ja3\":{\"hash\":\"0faf2a91198d40dbd58b9308f3fca2fd\",\"string\":\"771,4865-4867-4866-49195-49199-52393-52392-49196-49200-49171-49172-156-157-47-53,0-23-65281-10-11-16-5-34-51-43-13-28-65037,29-23-24-25-256-257,0\"},\"ja3s\":{\"hash\":\"50a9e7b112931e541503e8a2499252b9\",\"string\":\"771,49199,0-11-65281-16-23\"}},\"app_proto\":\"tls\",\"flow\":{\"pkts_toserver\":4,\"pkts_toclient\":4,\"bytes_toserver\":928,\"bytes_toclient\":3168,\"start\":\"2025-08-15T04:53:28.315713+0000\"}}"}]}],"analyzer":null,"urlquery":null},"javascript":{"script":[{"url":{"schema":"https","addr":"distribute-shib.xyz/d2b7839a-ebbd-4db4-9939-ae8b76368edf","fqdn":"distribute-shib.xyz","domain":"distribute-shib.xyz","tld":"xyz"},"ip":{"addr":"0.0.0.0","port":0,"asn":0,"as":"","country":"","country_code":"ZZ"},"introduction_type":"scriptElement","is_inline":false,"md5":"05997da4a9c3d58ef33a7cf3d716af57","sha1":"3a7a7913c31aa2787a11dc6ba6fb5b5f2c525ac1","sha256":"e268ded9f58238c3885b4e0e83ddf10ea9552c488dd25538c8569ec2beff7eb9","sha512":"83413571115e6b39abe7e3b6573a81b3198125b35ae13e31d14c7cb3c81790b24a11cd81531a58922386bbf6e2d41ab6e449fc3206c8b7f20932820cdf58aefe","ssdeep":"49152:D+2KKNjyR5WP4CQjNn9GU6lCLsSPOnLUfJ8KZTcbQQqG7r8aQO/iSJNHoRO2sxSQ:RD8ew45JV","tlshash":"20f591496bf660358213f0795e6f8801b234a40b2949ed5c7e9c92f09f4953c8bf6fe9","size":3517001,"data":"","first_seen":"2025-07-12T22:38:09.134446Z","last_seen":"2026-06-18T09:20:21.342859Z","times_seen":4173,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"distribute-shib.xyz/0e1adb70-cdd6-43ba-84b3-f2187813d5c8","fqdn":"distribute-shib.xyz","domain":"distribute-shib.xyz","tld":"xyz"},"ip":{"addr":"0.0.0.0","port":0,"asn":0,"as":"","country":"","country_code":"ZZ"},"introduction_type":"scriptElement","is_inline":false,"md5":"6787d3ab20158bc57c6aa8a35f803e0a","sha1":"eabf50fb0c695399a63d8154f79ac5792d8be796","sha256":"9b1603009d301f897e75eeddeb94987081fd36c95e4e61d86dcd870d3fb56224","sha512":"8249eef3d9a49dc75312118ab5f1fb64eab71404c5903a81043317a95243d3eeda7b55d1076e27d5c75e912d20df2840846ac44121970f182a6c9eb4e5869cdc","ssdeep":"24576:eGBdahj3cTH5EZHsqc3E+PVBOH+YzTWUm:5xfnAHEb","tlshash":"012674c4f1084e20add203bd5376a8648b50a7a1e43a77cd767e69e773c6b23c49bd12","size":4811140,"data":"","first_seen":"2025-08-14T22:39:38.258155Z","last_seen":"2025-08-17T01:54:39.81173Z","times_seen":8,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"cdnjs.cloudflare.com/ajax/libs/crypto-js/4.2.0/crypto-js.min.js","fqdn":"cdnjs.cloudflare.com","domain":"cloudflare.com","tld":"com"},"ip":{"addr":"104.17.25.14","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"scriptElement","is_inline":false,"md5":"d9c6de0df2bf028d93924aff92487904","sha1":"6596050516dd12af52d9b0e7b18ed837f1d81300","sha256":"769a555de553babc35a3338f344dd7aa16260c93cea2c7db290707c90484e7cc","sha512":"6be4940eec0dcd70efcf85eb21c5c7b827f4f3dfe2240a0de259ab5c9835f179ddb8a2ba6250c73516a5bf8c9dd4de3438a23cd2d162745faba9314a18fa1615","ssdeep":"1536:R8K6Znxmj9rlvCOhI64j7AtSPtNPU9ArHMLlk:RV6+jKOh4z","tlshash":"65535bc0629c5491a3b76480087f740b7073353b0a1d5aacf658faefacacad6907cd39","size":60819,"data":"","first_seen":"2023-11-02T21:20:28Z","last_seen":"2026-07-27T15:59:00.355812Z","times_seen":31772,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"distribute-shib.xyz/","fqdn":"distribute-shib.xyz","domain":"distribute-shib.xyz","tld":"xyz"},"ip":{"addr":"213.111.154.75","port":443,"asn":0,"as":"","country":"Ukraine","country_code":"UA"},"introduction_type":"Function","is_inline":false,"md5":"aa049e2749b8531cb8f233c2f64fc2b2","sha1":"b611a5a62c1813ae5b4763378b3a4a565556530a","sha256":"e52e51d5897d7a179089ddcf8f5de7aeb3ef4f27b054b63e937cf308b685c9e2","sha512":"fa951f3911de780608d6235a597758320388dff58cf18dd584a6941ac88cc36cac7d52caa72b678ee6f4dff47ee23955ab282714d03e713ae2bed4cb73a3c14e","ssdeep":"","tlshash":"71a0128471d6e4004b7320e40437448490396c60348c848051048c721c651108236c1c","size":79,"data":"","first_seen":"2023-04-11T21:38:58Z","last_seen":"2026-07-28T13:54:00.955714Z","times_seen":236415,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"cdn.jsdelivr.net/npm/merkletreejs@latest/merkletree.js","fqdn":"cdn.jsdelivr.net","domain":"jsdelivr.net","tld":"net"},"ip":{"addr":"104.16.174.226","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"scriptElement","is_inline":false,"md5":"d1e3cfb6bf3c22627d948eaec2e66c34","sha1":"6dbc88ab26ecac18b14c77532ac45319b69cf25c","sha256":"6f224452ec299dce9182e36012e233e797c31214d1ede5e53d19d48660b07811","sha512":"acb90b1c775d73bb4544318e39c23d21bb698767e2021d62c1565149389d558044b80e91dff2c7f021ed57026e68f0001f95426db27cc58f793768a92fc67819","ssdeep":"","tlshash":"ef11ebcd33e1b0d697cb66a8421f910ff032a93580dc8840c66984f53df005e8293f0c","size":1000,"data":"","first_seen":"2025-05-04T18:53:27.88867Z","last_seen":"2026-06-06T05:53:08.193907Z","times_seen":814,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"distribute-shib.xyz/fpbundle.js","fqdn":"distribute-shib.xyz","domain":"distribute-shib.xyz","tld":"xyz"},"ip":{"addr":"213.111.154.75","port":443,"asn":0,"as":"","country":"Ukraine","country_code":"UA"},"introduction_type":"scriptElement","is_inline":false,"md5":"1c59909ad8d56060bf239a34a275da3d","sha1":"1164057a0631f6b5dd80387a1c3a9e332fb00bb4","sha256":"126a8b465ef8734b4d7a289781e0535cd283ccf24394e08c44f23ae300be3a5a","sha512":"39d33737c908bf2a1430f157990f931a0644471a0cf20de61721596e1330fe5867108db7e47d1869576710a72f886ef42e7492a2c0ed05fde2644f6d338e3eac","ssdeep":"768:v8UXI0Nc5VArhXDh1bnUsAq1++umYUT15+2gT/RcKrNcFV3BT/Vo:vN/NcnArV7f5+9cxT6","tlshash":"a413c7a873c67139a217b0719dcf4845b67d6d182289884dca2ec4a4b879d3dc77ecec","size":45503,"data":"","first_seen":"2025-07-11T11:18:53.943693Z","last_seen":"2026-07-27T10:14:24.525948Z","times_seen":744,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"cdn.jsdelivr.net/npm/ethers@5.7.2/dist/ethers.umd.min.js","fqdn":"cdn.jsdelivr.net","domain":"jsdelivr.net","tld":"net"},"ip":{"addr":"104.16.174.226","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"scriptElement","is_inline":false,"md5":"71f8c498e792c6179d4e2840228f777a","sha1":"b651545587f6257345dc3de9ddaa444b10dedf3e","sha256":"a66293a6a2bb4dee061a68612be0be3c5c0ab7e4068ab8d98a4a357baf664c73","sha512":"14371563e83bbdce425c035bad34a0d4ae6a2f2ae20ac183602134d8b8b5b5711874d40fbcb3c7344fab4f63237a2f0dedf65b7b458b870dbb8f64ab191a5d32","ssdeep":"12288:TfamYTKkkAJs8P+H8Xb2F/nNuwEYtnob6qQr:TfjkhPaNnN9EYtwo","tlshash":"35f43b80b3b1b0b583c729a4143f6046f63af46a505840a8f659faf279f9d4c957bb3c","size":760171,"data":"","first_seen":"2023-03-13T00:48:53Z","last_seen":"2026-07-28T12:21:58.280386Z","times_seen":3722,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"cdnjs.cloudflare.com/ajax/libs/ethers/5.6.9/ethers.umd.min.js","fqdn":"cdnjs.cloudflare.com","domain":"cloudflare.com","tld":"com"},"ip":{"addr":"104.17.25.14","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"scriptElement","is_inline":false,"md5":"268d19762594655239a29d058a7e8b44","sha1":"f06da2f7a68114b8dda38a0d782d65ddacc9c0e8","sha256":"95c66625ee20f53d542e23dded002b021b24e9d28c3d193a076d45cba4dc8618","sha512":"55e6b3e48536891a5ad0106b26525e4607c9ece0075ad5496535ef81d1fbb377dfb0b50286594c0aa0b405bf9e791c4696b674ea260813f4772ac7220ab82fdc","ssdeep":"12288:TfLmYQI/yjP+H8Xb29/nNUgE6te1R5WJW:TfCPalnNfE6taD","tlshash":"29f42b80b3b1b0b583c729a4143f6046f63af46a505840a8f659faf279f9d4c957bb3c","size":735973,"data":"","first_seen":"2023-03-07T12:58:29Z","last_seen":"2026-07-15T21:03:46.662531Z","times_seen":8481,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"distribute-shib.xyz/f5b436e7-b405-43c4-8d68-89331d93db69","fqdn":"distribute-shib.xyz","domain":"distribute-shib.xyz","tld":"xyz"},"ip":{"addr":"0.0.0.0","port":0,"asn":0,"as":"","country":"","country_code":"ZZ"},"introduction_type":"scriptElement","is_inline":false,"md5":"ec26a722169cb2cef03353fcf8dd144a","sha1":"6eec6673abcde3d29547796a38361256d9efde1c","sha256":"01861fcd47bc63bb7be76c480bad4c6cc987c8996ab0e023a4e692b68c94b05c","sha512":"c885e5d94bd96fa4a573524356e0ca7398b1489f5a39fc1120cf7f4e469950630ad3e9f48dd0392acd36da390c27a4be1e81da943d1d9ecd48890d1691e416cf","ssdeep":"6144:Ufg7z90bnvLZqnWTI9esVTMuyEvtzXNglxQP92L:VzBe6kEdOxQoL","tlshash":"bf740980b261b07247da24e10477540af339e96c744a40acf6a8d8fb7dbd589957ff38","size":357754,"data":"","first_seen":"2025-07-12T22:38:09.13306Z","last_seen":"2026-06-28T16:47:47.454007Z","times_seen":5087,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"distribute-shib.xyz/","fqdn":"distribute-shib.xyz","domain":"distribute-shib.xyz","tld":"xyz"},"ip":{"addr":"213.111.154.75","port":443,"asn":0,"as":"","country":"Ukraine","country_code":"UA"},"introduction_type":"Function","is_inline":false,"md5":"246fcc53d52e9aa29572c0a8f4907f36","sha1":"531849fc0917c0702e84916e0e1f816bbe340a12","sha256":"3edcfd564129e6ecc5df446c4e13a82f16b9f1e1493a32ebeaaacb3788b121f6","sha512":"49b1964978a649c6402c3e27398aec82a84359e434e19bdd4c0743c1dd6ed9c4bf14a0b680f76c5f5b3234fb7087853b9ef02ca2f5cd80bd3eade57bbb72871b","ssdeep":"3072:9E1Aw4GqEUYGT3ONN3K5Xd7i3RinUNyvUzoC+:K+1TT3ONN3mXd7i3Rinuym+","tlshash":"be44eac7238b30d4e34610ba0166d9fd97a1fc8dd6469b0f6de8bd9fa759e4087e6002","size":264066,"data":"","first_seen":"2025-08-14T22:51:38.052232Z","last_seen":"2025-08-17T01:54:39.810107Z","times_seen":4,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"distribute-shib.xyz/modals.js","fqdn":"distribute-shib.xyz","domain":"distribute-shib.xyz","tld":"xyz"},"ip":{"addr":"213.111.154.75","port":443,"asn":0,"as":"","country":"Ukraine","country_code":"UA"},"introduction_type":"scriptElement","is_inline":false,"md5":"ecbc5043a1e25f2bd5bbd6e3c3be49f0","sha1":"d66eb695679871221c52958d94029c6358b7613d","sha256":"6d0c2c8d032982e9a86a1bed14f709911058b6b693abb5d46335a0106c12c411","sha512":"38b9aedf74859ade1e5445634b338f560c4d0520ab126de202ad98942bc0f34e740b93c7123a3bc53dcdded31944c174ad06bf1ca006e137cb4e06a949e86088","ssdeep":"768:ywjvL/eQ0ae2vBKRDpoKvTQv4n59+Y44U7kFlaoGHv5:ywz2n59J4inM5","tlshash":"943311071cbe31361daf0fa3b7cc1a1b4e2eb351e612aaee71bd1446438bd74c5a5618","size":52833,"data":"","first_seen":"2025-07-20T10:23:41.460008Z","last_seen":"2026-07-27T10:14:24.496223Z","times_seen":746,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"distribute-shib.xyz/","fqdn":"distribute-shib.xyz","domain":"distribute-shib.xyz","tld":"xyz"},"ip":{"addr":"213.111.154.75","port":443,"asn":0,"as":"","country":"Ukraine","country_code":"UA"},"introduction_type":"Function","is_inline":false,"md5":"29d0c84b9d1d8da446a6062c6a840ad9","sha1":"6d6b3a6065667c7c50d92f3889c85ed65a9ad784","sha256":"3c3cbdb71d0d2c22f504f4d63d8a6ffe8d250cde7e58300619be35b6bbab26a1","sha512":"52cfcbf2f7c3521c5a6c6120099ee6822d16e04ffbc04720da925a11242c8c2050f9cfc8d864a6d39a0036ac599f701080195a29a7c5e8d3e9308b91f9f0390f","ssdeep":"","tlshash":"428004d533c350004753117c04571cc4d034447014444d405040d4531c570315115c7c","size":37,"data":"","first_seen":"2023-04-11T21:31:25Z","last_seen":"2026-07-28T13:54:00.95665Z","times_seen":734672,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"distribute-shib.xyz/main.js","fqdn":"distribute-shib.xyz","domain":"distribute-shib.xyz","tld":"xyz"},"ip":{"addr":"213.111.154.75","port":443,"asn":0,"as":"","country":"Ukraine","country_code":"UA"},"introduction_type":"scriptElement","is_inline":false,"md5":"d5804ffc3fd4e92a842919b6cad70dee","sha1":"e5b9e96bb487c32293b5ad40a7f77e1828c2a577","sha256":"719f4931910c5975b60c0331fe9769019cc7f92ce264826e84b681d00ff5ed84","sha512":"4ad83b485238726e6260e2ed7eeca2412511279ea5a3083d8046a89341502a8bf02ea242de30bcc7c6699d53450e6d174c7e2c3413b994f876dfcccde4489602","ssdeep":"3072:zKzSGdYNRW+sT3ONN30XXd7i3Rm9GBULUzme6:z09T3ONN3QXd7i3Rm9IU46","tlshash":"2644e9c7238b70d0e34610ba0162ddfd5b91f88dd6469b0f6de8ed9fa759e6087e6002","size":267882,"data":"","first_seen":"2025-08-14T22:51:38.012727Z","last_seen":"2025-08-17T01:54:39.795747Z","times_seen":4,"alerts":{"ids":null,"analyzer":null,"urlquery":null}}],"eval":null,"write":null,"console":null},"http":[{"url":{"schema":"https","addr":"bsc-dataseed4.bnbchain.org/","fqdn":"bsc-dataseed4.bnbchain.org","domain":"bnbchain.org","tld":"org"},"ip":{"addr":"3.254.213.200","port":443,"asn":16509,"as":"AMAZON-02","country":"Ireland","country_code":"IE"},"is_navigation_request":false,"resource_type":"fetch","requested_by":"https://distribute-shib.xyz/","date":"2025-08-15T04:53:28.575Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256","key_group_name":"P256","signature_name":"RSA-PKCS1-SHA256","protocol":"TLSv1.2","cert":{"subject":{"commonName":"bnbchain.org","organization":""},"issuer":{"commonName":"Amazon RSA 2048 M02","organization":"Amazon"},"validity":{"start":"Fri, 09 May 2025 00:00:00 GMT","end":"Mon, 08 Jun 2026 23:59:59 GMT"},"fingerprint":{"sha1":"60:A4:BE:0F:33:E9:DC:36:3B:B7:3C:5A:E4:42:EE:DE:F1:46:52:E4","sha256":"15:55:B7:24:9E:06:40:29:6B:D0:0D:FD:D2:2B:02:D8:1B:63:50:F2:26:B3:56:69:5D:9D:DF:3E:40:64:99:5E"}}},"request":{"raw":"POST / HTTP/1.1\r\nHost: bsc-dataseed4.bnbchain.org\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://distribute-shib.xyz/\r\nContent-Type: application/json\r\nContent-Length: 136\r\nOrigin: https://distribute-shib.xyz\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"POST"},"response":{"raw":"HTTP/2 200 OK\r\ndate: Fri, 15 Aug 2025 04:53:28 GMT\r\ncontent-type: application/json; charset=utf-8\r\nvary: Accept-Encoding\r\naccess-control-allow-credentials: true\r\naccess-control-allow-headers: *\r\naccess-control-allow-methods: POST, GET, OPTIONS\r\naccess-control-allow-origin: *\r\naccess-control-max-age: 600\r\nx-nr-trace-id: f449bc0bef2ff866877d229b132966ff\r\nx-frame-options: SAMEORIGIN\r\nx-xss-protection: 1; mode=block\r\nx-content-type-options: nosniff\r\nreferrer-policy: origin-when-cross-origin\r\nstrict-transport-security: max-age=31536000; includeSubdomains\r\ncontent-encoding: br\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":4902,"size_decoded":0,"mime_type":"application/json; charset=utf-8","magic":"JSON text data","md5":"2188b7f1b90a143020f7faf12d10e91f","sha1":"e6a95e4d574d05948b7c8517861a71e6f69b38b8","sha256":"4a8dd94310fc027a042dc9ca0311f20e9341084839e00b8d7a830ab52cdc8096","sha512":"08e8f648099fac2b075f96396f2f9056ac526f12e5843bc16d07fd725fcd74abeed4021a9ed64f53ef3e1dbb57a707ebee71bc51b230f5b5ee4200c2da1d7b1c","ssdeep":"96:oigW53TB2SzrZYpTbDaOTkSO6mdSInccYGS9FzelVLY:r5TB2SzAT/7kSRRrze3k","tlshash":"e6a179f0ee02c891f1be4768f2ddbe0461383726eedc5a4604b45a991ee5a51bd0dccd","first_seen":"2025-01-17T17:24:07.906471Z","last_seen":"2026-07-11T04:16:11.451036Z","times_seen":4821,"resource_available":false,"data":null}},"time_used":38,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":38,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"distribute-shib.xyz/","fqdn":"distribute-shib.xyz","domain":"distribute-shib.xyz","tld":"xyz"},"ip":{"addr":"213.111.154.75","port":443,"asn":0,"as":"","country":"Ukraine","country_code":"UA"},"is_navigation_request":false,"resource_type":"fetch","requested_by":"https://distribute-shib.xyz/","date":"2025-08-15T04:53:29.276Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.distribute-shib.xyz","organization":""},"issuer":{"commonName":"R11","organization":"Let's Encrypt"},"validity":{"start":"Tue, 12 Aug 2025 22:24:50 GMT","end":"Mon, 10 Nov 2025 22:24:49 GMT"},"fingerprint":{"sha1":"D9:12:5F:47:E4:D9:25:F9:9E:15:0F:E4:33:59:24:CC:A5:11:F8:F4","sha256":"F8:02:32:D4:5A:7B:48:98:F8:29:DD:49:59:9B:AB:20:5A:B7:96:4B:3C:2C:C9:FA:68:B9:57:D1:0E:1F:FC:08"}}},"request":{"raw":"HEAD / HTTP/1.1\r\nHost: distribute-shib.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://distribute-shib.xyz/\r\nDNT: 1\r\nConnection: keep-alive\r\nCookie: gacfxdn1x7=d4jCu6df6Vur6cY\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"HEAD"},"response":{"raw":"HTTP/1.1 200 OK\r\nServer: nginx\r\nDate: Fri, 15 Aug 2025 04:53:29 GMT\r\nContent-Type: text/html\r\nContent-Length: 42182\r\nConnection: keep-alive\r\nLast-Modified: Tue, 12 Aug 2025 18:39:58 GMT\r\nAccept-Ranges: bytes\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":0,"size_decoded":0,"mime_type":"text/html","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-07-28T14:56:16.902508Z","times_seen":17581573,"resource_available":true,"data":null}},"time_used":17,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":17,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2025-08-15","alert":"Sinkholed","trigger":"distribute-shib.xyz","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"distribute-shib.xyz/TT_Firs_Neue_Medium.woff2","fqdn":"distribute-shib.xyz","domain":"distribute-shib.xyz","tld":"xyz"},"ip":{"addr":"213.111.154.75","port":443,"asn":0,"as":"","country":"Ukraine","country_code":"UA"},"is_navigation_request":false,"resource_type":"font","requested_by":"https://distribute-shib.xyz/","date":"2025-08-15T04:53:26.988Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.distribute-shib.xyz","organization":""},"issuer":{"commonName":"R11","organization":"Let's Encrypt"},"validity":{"start":"Tue, 12 Aug 2025 22:24:50 GMT","end":"Mon, 10 Nov 2025 22:24:49 GMT"},"fingerprint":{"sha1":"D9:12:5F:47:E4:D9:25:F9:9E:15:0F:E4:33:59:24:CC:A5:11:F8:F4","sha256":"F8:02:32:D4:5A:7B:48:98:F8:29:DD:49:59:9B:AB:20:5A:B7:96:4B:3C:2C:C9:FA:68:B9:57:D1:0E:1F:FC:08"}}},"request":{"raw":"GET /TT_Firs_Neue_Medium.woff2 HTTP/1.1\r\nHost: distribute-shib.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: identity\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://distribute-shib.xyz/index-Dl2sAo6z.css\r\nSec-Fetch-Dest: font\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nServer: nginx\r\nDate: Fri, 15 Aug 2025 04:53:26 GMT\r\nContent-Type: font/woff2\r\nContent-Length: 79688\r\nConnection: keep-alive\r\nLast-Modified: Tue, 12 Aug 2025 18:40:40 GMT\r\nAccept-Ranges: bytes\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":79688,"size_decoded":0,"mime_type":"font/woff2","magic":"Web Open Font Format (Version 2), TrueType, length 79688, version 2.0","md5":"ff7304fb7b98b55845101400acc2fbbc","sha1":"395ab0ca2b59ec49f1ed2abc457bb49524382203","sha256":"4a3b46a825a9dea5c54b110fc1067f17526dd45d01deeb5431aee9d321318ff3","sha512":"ae68dc5d9b57b77979bac2f2a59437167cb38f028e30fbb800fb199b922dbd8a4fa16e0d41b50698a4cb600cfdc4b2af1c13a1b206e80a749c590d2cf969edce","ssdeep":"1536:OCJ1W/P7brwvLFPc61k6KNYm6KQgNvorX08oLVjX0hc6uyjbErHSxPd:hNLFE6eVLG9diT0wyErHST","tlshash":"7e7302d4f2074519caec2335fa7531ccabb86c097e2ca570213fbc1a5c58c6e8e56da5","first_seen":"2025-06-26T14:09:51.860491Z","last_seen":"2026-06-27T11:40:33.159027Z","times_seen":30,"resource_available":false,"data":null}},"time_used":60,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":38,"receive":22,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2025-08-15","alert":"Sinkholed","trigger":"distribute-shib.xyz","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"distribute-shib.xyz/TT_Firs_Neue_Medium.woff2","fqdn":"distribute-shib.xyz","domain":"distribute-shib.xyz","tld":"xyz"},"ip":{"addr":"213.111.154.75","port":443,"asn":0,"as":"","country":"Ukraine","country_code":"UA"},"is_navigation_request":false,"resource_type":"font","requested_by":"https://distribute-shib.xyz/","date":"2025-08-15T04:53:27.003Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.distribute-shib.xyz","organization":""},"issuer":{"commonName":"R11","organization":"Let's Encrypt"},"validity":{"start":"Tue, 12 Aug 2025 22:24:50 GMT","end":"Mon, 10 Nov 2025 22:24:49 GMT"},"fingerprint":{"sha1":"D9:12:5F:47:E4:D9:25:F9:9E:15:0F:E4:33:59:24:CC:A5:11:F8:F4","sha256":"F8:02:32:D4:5A:7B:48:98:F8:29:DD:49:59:9B:AB:20:5A:B7:96:4B:3C:2C:C9:FA:68:B9:57:D1:0E:1F:FC:08"}}},"request":{"raw":"GET /TT_Firs_Neue_Medium.woff2 HTTP/1.1\r\nHost: distribute-shib.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: identity\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://distribute-shib.xyz/index-Dl2sAo6z.css\r\nSec-Fetch-Dest: font\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nServer: nginx\r\nDate: Fri, 15 Aug 2025 04:53:27 GMT\r\nContent-Type: font/woff2\r\nContent-Length: 79688\r\nConnection: keep-alive\r\nLast-Modified: Tue, 12 Aug 2025 18:40:40 GMT\r\nAccept-Ranges: bytes\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":79688,"size_decoded":0,"mime_type":"font/woff2","magic":"Web Open Font Format (Version 2), TrueType, length 79688, version 2.0","md5":"ff7304fb7b98b55845101400acc2fbbc","sha1":"395ab0ca2b59ec49f1ed2abc457bb49524382203","sha256":"4a3b46a825a9dea5c54b110fc1067f17526dd45d01deeb5431aee9d321318ff3","sha512":"ae68dc5d9b57b77979bac2f2a59437167cb38f028e30fbb800fb199b922dbd8a4fa16e0d41b50698a4cb600cfdc4b2af1c13a1b206e80a749c590d2cf969edce","ssdeep":"1536:OCJ1W/P7brwvLFPc61k6KNYm6KQgNvorX08oLVjX0hc6uyjbErHSxPd:hNLFE6eVLG9diT0wyErHST","tlshash":"7e7302d4f2074519caec2335fa7531ccabb86c097e2ca570213fbc1a5c58c6e8e56da5","first_seen":"2025-06-26T14:09:51.860491Z","last_seen":"2026-06-27T11:40:33.159027Z","times_seen":30,"resource_available":false,"data":null}},"time_used":78,"timings":{"blocked":37,"dns":0,"connect":0,"send":0,"wait":20,"receive":21,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2025-08-15","alert":"Sinkholed","trigger":"distribute-shib.xyz","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"www.blockstreet.xyz/logo.png","fqdn":"www.blockstreet.xyz","domain":"blockstreet.xyz","tld":"xyz"},"ip":{"addr":"104.21.52.225","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://distribute-shib.xyz/","date":"2025-08-15T04:53:27.133Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"blockstreet.xyz","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Sat, 12 Jul 2025 10:08:05 GMT","end":"Fri, 10 Oct 2025 11:06:45 GMT"},"fingerprint":{"sha1":"FE:27:4D:F3:99:6A:8E:FA:9F:8B:43:51:2C:63:D2:57:F2:87:0F:9A","sha256":"73:A8:66:A8:1C:05:F2:D7:51:3A:EE:6D:AB:0B:96:33:01:1A:91:95:66:6D:B6:7D:34:E2:06:CA:84:79:8A:8E"}}},"request":{"raw":"GET /logo.png HTTP/1.1\r\nHost: www.blockstreet.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://distribute-shib.xyz/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ndate: Fri, 15 Aug 2025 04:53:27 GMT\r\ncontent-type: image/png\r\ncontent-length: 43338\r\ncache-control: public, max-age=14400, s-maxage=31536000\r\nserver: cloudflare\r\naccept-ranges: bytes\r\netag: \"64ea5c65d0d49e0280ca9a607aa4b503\"\r\nlast-modified: Sat, 02 Aug 2025 17:22:22 GMT\r\nx-cache: Hit from cloudfront\r\nvia: 1.1 94eee494c19905cb6933ec8a32a577a0.cloudfront.net (CloudFront)\r\nx-amz-cf-pop: OSL50-P1\r\nalt-svc: h3=\":443\"; ma=86400\r\nx-amz-cf-id: tj7iYay9Oa795yRn7S2oeml_o5gzL2AzVoNTB6hbvrK5TedJ54y-Tw==\r\nage: 247292\r\ncf-cache-status: HIT\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nvary: accept-encoding\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=yjw6Zg9oCi%2F4ISNZQL%2FGQR8HUilzq7iyFSqkplN0L79zQoP2qPg3jasS85f9p52jK15dgImBOfpHiM1ABEAchq%2FDOFW5FkNgw1KQxIVX5AJq\"}]}\r\ncf-ray: 96f6169ceae5b51e-OSL\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Amazon CloudFront","description":"Amazon CloudFront is a fast content delivery network (CDN) service that securely delivers data, videos, applications, and APIs to customers globally with low latency, high transfer speeds.","website":"https://aws.amazon.com/cloudfront/","common_platform_enumeration":"","icon":"Amazon Cloudfront.svg","categories":["CDN"]},{"name":"Amazon Web Services","description":"Amazon Web Services (AWS) is a comprehensive cloud services platform offering compute power, database storage, content delivery and other functionality.","website":"https://aws.amazon.com/","common_platform_enumeration":"","icon":"Amazon Web Services.svg","categories":["PaaS"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":43338,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 2080 x 283, 8-bit/color RGBA, non-interlaced","md5":"64ea5c65d0d49e0280ca9a607aa4b503","sha1":"83f2c34c39773649dbaf7f3bdfc0bd4c25161e92","sha256":"20f9fb0b9d15d93e2cea7dd85b1b510006c3164c4064e906e3b27bf8dae99888","sha512":"98f359f16cd836cbf610bd9b322f4a88eafd12ddebb9e9511b0eaf5409310ba1e373433d2be691dd90e22f92681d5bfc6e1e0262f9c3f7ea139ae2aa37abf284","ssdeep":"768:IIRykxDP50BxU1NTAcYofbW2U4Sk8Lmw009eKTeXf/Nldb7xTQxH80YF3:BRBVKB8UqjWNC8LmheeKTenNldZ/J","tlshash":"9613df87dda031efd884872a579770c6e17808573a250f5f6f11a6786e83ac1f1b6e28","first_seen":"2025-07-26T22:44:20.567784Z","last_seen":"2025-09-16T17:57:41.606834Z","times_seen":13,"resource_available":false,"data":null}},"time_used":68,"timings":{"blocked":-1,"dns":30,"connect":2,"send":0,"wait":14,"receive":2,"ssl":20},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"distribute-shib.xyz/main.js","fqdn":"distribute-shib.xyz","domain":"distribute-shib.xyz","tld":"xyz"},"ip":{"addr":"213.111.154.75","port":443,"asn":0,"as":"","country":"Ukraine","country_code":"UA"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://distribute-shib.xyz/","date":"2025-08-15T04:53:24.208Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.distribute-shib.xyz","organization":""},"issuer":{"commonName":"R11","organization":"Let's Encrypt"},"validity":{"start":"Tue, 12 Aug 2025 22:24:50 GMT","end":"Mon, 10 Nov 2025 22:24:49 GMT"},"fingerprint":{"sha1":"D9:12:5F:47:E4:D9:25:F9:9E:15:0F:E4:33:59:24:CC:A5:11:F8:F4","sha256":"F8:02:32:D4:5A:7B:48:98:F8:29:DD:49:59:9B:AB:20:5A:B7:96:4B:3C:2C:C9:FA:68:B9:57:D1:0E:1F:FC:08"}}},"request":{"raw":"GET /main.js HTTP/1.1\r\nHost: distribute-shib.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://distribute-shib.xyz/\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nServer: nginx\r\nDate: Fri, 15 Aug 2025 04:53:24 GMT\r\nContent-Type: text/javascript\r\nContent-Length: 267882\r\nConnection: keep-alive\r\nLast-Modified: Tue, 12 Aug 2025 18:39:46 GMT\r\nAccept-Ranges: bytes\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":267882,"size_decoded":0,"mime_type":"text/javascript","magic":"JavaScript source, ASCII text, with very long lines (65536), with no line terminators","md5":"d5804ffc3fd4e92a842919b6cad70dee","sha1":"e5b9e96bb487c32293b5ad40a7f77e1828c2a577","sha256":"719f4931910c5975b60c0331fe9769019cc7f92ce264826e84b681d00ff5ed84","sha512":"4ad83b485238726e6260e2ed7eeca2412511279ea5a3083d8046a89341502a8bf02ea242de30bcc7c6699d53450e6d174c7e2c3413b994f876dfcccde4489602","ssdeep":"3072:zKzSGdYNRW+sT3ONN30XXd7i3Rm9GBULUzme6:z09T3ONN3QXd7i3Rm9IU46","tlshash":"2644e9c7238b70d0e34610ba0162ddfd5b91f88dd6469b0f6de8ed9fa759e6087e6002","first_seen":"2025-08-14T22:51:38.012727Z","last_seen":"2025-08-17T01:54:39.795747Z","times_seen":4,"resource_available":true,"data":null}},"time_used":378,"timings":{"blocked":50,"dns":1,"connect":17,"send":0,"wait":37,"receive":232,"ssl":34},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2025-08-15","alert":"Sinkholed","trigger":"distribute-shib.xyz","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"bsc-rpc.publicnode.com/","fqdn":"bsc-rpc.publicnode.com","domain":"publicnode.com","tld":"com"},"ip":{"addr":"104.20.24.117","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"fetch","requested_by":"https://distribute-shib.xyz/","date":"2025-08-15T04:53:28.740Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"publicnode.com","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Thu, 19 Jun 2025 08:56:01 GMT","end":"Wed, 17 Sep 2025 09:55:57 GMT"},"fingerprint":{"sha1":"4E:C6:C8:AF:D7:68:98:F6:BC:1F:7A:02:FF:9D:87:43:53:C8:4A:EB","sha256":"10:15:05:73:55:F6:0B:BC:0F:B7:5C:69:4D:A8:BA:75:FA:56:A6:4A:89:07:1B:C5:F5:81:A9:2E:48:17:B7:E0"}}},"request":{"raw":"POST / HTTP/1.1\r\nHost: bsc-rpc.publicnode.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://distribute-shib.xyz/\r\nContent-Type: application/json\r\nContent-Length: 136\r\nOrigin: https://distribute-shib.xyz\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"POST"},"response":{"raw":"HTTP/2 200 OK\r\ndate: Fri, 15 Aug 2025 04:53:28 GMT\r\ncontent-type: application/json\r\naccess-control-allow-credentials: true\r\naccess-control-allow-origin: *\r\naccess-control-max-age: 1728000\r\nserver: cloudflare\r\nstrict-transport-security: max-age=31536000; includeSubDomains; preload\r\nvary: Origin, accept-encoding\r\nx-envoy-upstream-service-time: 0\r\ncf-cache-status: DYNAMIC\r\nx-content-type-options: nosniff\r\ncontent-encoding: br\r\ncf-ray: 96f616a69e32b505-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Envoy","description":"Envoy is an open-source edge and service proxy, designed for cloud-native applications.","website":"https://www.envoyproxy.io/","common_platform_enumeration":"cpe:2.3:a:envoyproxy:envoy:*:*:*:*:*:*:*:*","icon":"Envoy.png","categories":["Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":6375,"size_decoded":0,"mime_type":"application/json","magic":"JSON text data","md5":"a1f94f1c2297a4df109752a45651de90","sha1":"c0d4d98f8a96b05938bf8ce8806163be96960eab","sha256":"52c3241020c36022b778ab2971d4e7174609eb960a062ec7842ec7474de80b76","sha512":"d2fd226b2f9186efd45ad6e15d84aad22f5775e76ed1cb0fbdee00576285e489c0c213799ac87d4a575d5f668f53dac76e725ce31b01c04be99263801f0d86a2","ssdeep":"24:YytXa257vaoWH3eGZsthXvUzZ5+hdex1qx1xxNU6xvQaNBtXX60jR:Ygam3QytxvU15+doY1jNNTt9jR","tlshash":"c2d108f098c98e50f19b6a81b798bc9440213caf7bdf8f40415cf8b6a0f54a176a458f","first_seen":"2025-04-07T12:04:27.278736Z","last_seen":"2025-09-12T16:59:34.086661Z","times_seen":41,"resource_available":false,"data":null}},"time_used":131,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":131,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"distribute-shib.xyz/logo.png","fqdn":"distribute-shib.xyz","domain":"distribute-shib.xyz","tld":"xyz"},"ip":{"addr":"213.111.154.75","port":443,"asn":0,"as":"","country":"Ukraine","country_code":"UA"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://distribute-shib.xyz/","date":"2025-08-15T04:53:25.185Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.distribute-shib.xyz","organization":""},"issuer":{"commonName":"R11","organization":"Let's Encrypt"},"validity":{"start":"Tue, 12 Aug 2025 22:24:50 GMT","end":"Mon, 10 Nov 2025 22:24:49 GMT"},"fingerprint":{"sha1":"D9:12:5F:47:E4:D9:25:F9:9E:15:0F:E4:33:59:24:CC:A5:11:F8:F4","sha256":"F8:02:32:D4:5A:7B:48:98:F8:29:DD:49:59:9B:AB:20:5A:B7:96:4B:3C:2C:C9:FA:68:B9:57:D1:0E:1F:FC:08"}}},"request":{"raw":"GET /logo.png HTTP/1.1\r\nHost: distribute-shib.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://distribute-shib.xyz/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nServer: nginx\r\nDate: Fri, 15 Aug 2025 04:53:25 GMT\r\nContent-Type: image/png\r\nContent-Length: 43338\r\nConnection: keep-alive\r\nLast-Modified: Tue, 12 Aug 2025 18:36:38 GMT\r\nAccept-Ranges: bytes\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":43338,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 2080 x 283, 8-bit/color RGBA, non-interlaced","md5":"64ea5c65d0d49e0280ca9a607aa4b503","sha1":"83f2c34c39773649dbaf7f3bdfc0bd4c25161e92","sha256":"20f9fb0b9d15d93e2cea7dd85b1b510006c3164c4064e906e3b27bf8dae99888","sha512":"98f359f16cd836cbf610bd9b322f4a88eafd12ddebb9e9511b0eaf5409310ba1e373433d2be691dd90e22f92681d5bfc6e1e0262f9c3f7ea139ae2aa37abf284","ssdeep":"768:IIRykxDP50BxU1NTAcYofbW2U4Sk8Lmw009eKTeXf/Nldb7xTQxH80YF3:BRBVKB8UqjWNC8LmheeKTenNldZ/J","tlshash":"9613df87dda031efd884872a579770c6e17808573a250f5f6f11a6786e83ac1f1b6e28","first_seen":"2025-07-26T22:44:20.567784Z","last_seen":"2025-09-16T17:57:41.606834Z","times_seen":13,"resource_available":false,"data":null}},"time_used":19,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":18,"receive":1,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2025-08-15","alert":"Sinkholed","trigger":"distribute-shib.xyz","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"distribute-shib.xyz/UcC73FwrK3iLTeHuS_nVMrMxCp50SjIa1ZL7W0I5nvwU.woff2","fqdn":"distribute-shib.xyz","domain":"distribute-shib.xyz","tld":"xyz"},"ip":{"addr":"213.111.154.75","port":443,"asn":0,"as":"","country":"Ukraine","country_code":"UA"},"is_navigation_request":false,"resource_type":"font","requested_by":"https://distribute-shib.xyz/","date":"2025-08-15T04:53:26.992Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.distribute-shib.xyz","organization":""},"issuer":{"commonName":"R11","organization":"Let's Encrypt"},"validity":{"start":"Tue, 12 Aug 2025 22:24:50 GMT","end":"Mon, 10 Nov 2025 22:24:49 GMT"},"fingerprint":{"sha1":"D9:12:5F:47:E4:D9:25:F9:9E:15:0F:E4:33:59:24:CC:A5:11:F8:F4","sha256":"F8:02:32:D4:5A:7B:48:98:F8:29:DD:49:59:9B:AB:20:5A:B7:96:4B:3C:2C:C9:FA:68:B9:57:D1:0E:1F:FC:08"}}},"request":{"raw":"GET /UcC73FwrK3iLTeHuS_nVMrMxCp50SjIa1ZL7W0I5nvwU.woff2 HTTP/1.1\r\nHost: distribute-shib.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: identity\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://distribute-shib.xyz/css2.css\r\nSec-Fetch-Dest: font\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nServer: nginx\r\nDate: Fri, 15 Aug 2025 04:53:27 GMT\r\nContent-Type: font/woff2\r\nContent-Length: 48532\r\nConnection: keep-alive\r\nLast-Modified: Tue, 12 Aug 2025 18:40:44 GMT\r\nAccept-Ranges: bytes\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":48532,"size_decoded":0,"mime_type":"font/woff2","magic":"Web Open Font Format (Version 2), TrueType, length 48532, version 1.0","md5":"225835e6e0496c54dc2aca9f3d533892","sha1":"942ef5298bbe74bfe44e445def5f2bfc94027fa8","sha256":"acc60d454f46f2ba233c516aa3299aa60e1f49ffd0f06b8392a7c772a5694087","sha512":"ea2ff96ed5ac965c1846b4b33990beab3d4ced66806fa44321f5dd59d9a29a8ae1a67a5816d40165af8a896677b6a24bb74ea6db53cd5e686080165db9fd62c2","ssdeep":"768:b9tYsJ6BxVEpu8sqEkvfXRGEBqH7KxpxA07hQv2bSokjQx2AOWUVOv7UeFHOpIsR:LsEcy7fXRGqqHmr7qv32UC7UetOGLkF","tlshash":"03230178cf9f85b3d33b153afaf4d20562a9067de76c4a803831051a2a55770b89dc0e","first_seen":"2025-05-29T17:27:56.345238Z","last_seen":"2026-07-28T13:58:04.056061Z","times_seen":248229,"resource_available":false,"data":null}},"time_used":58,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":37,"receive":21,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2025-08-15","alert":"Sinkholed","trigger":"distribute-shib.xyz","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"distribute-shib.xyz/","fqdn":"distribute-shib.xyz","domain":"distribute-shib.xyz","tld":"xyz"},"ip":{"addr":"213.111.154.75","port":443,"asn":0,"as":"","country":"Ukraine","country_code":"UA"},"is_navigation_request":true,"resource_type":"document","requested_by":"","date":"2025-08-15T04:53:23.960Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.distribute-shib.xyz","organization":""},"issuer":{"commonName":"R11","organization":"Let's Encrypt"},"validity":{"start":"Tue, 12 Aug 2025 22:24:50 GMT","end":"Mon, 10 Nov 2025 22:24:49 GMT"},"fingerprint":{"sha1":"D9:12:5F:47:E4:D9:25:F9:9E:15:0F:E4:33:59:24:CC:A5:11:F8:F4","sha256":"F8:02:32:D4:5A:7B:48:98:F8:29:DD:49:59:9B:AB:20:5A:B7:96:4B:3C:2C:C9:FA:68:B9:57:D1:0E:1F:FC:08"}}},"request":{"raw":"GET / HTTP/1.1\r\nHost: distribute-shib.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nUpgrade-Insecure-Requests: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: document\r\nSec-Fetch-Mode: navigate\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nServer: nginx\r\nDate: Fri, 15 Aug 2025 04:53:24 GMT\r\nContent-Type: text/html\r\nContent-Length: 42182\r\nConnection: keep-alive\r\nLast-Modified: Tue, 12 Aug 2025 18:39:58 GMT\r\nAccept-Ranges: bytes\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":42182,"size_decoded":0,"mime_type":"text/html","magic":"HTML document, Unicode text, UTF-8 text, with very long lines (330)","md5":"35626f1b5df9b2eb65a3151c4ffbeaf6","sha1":"dde58b2bb7222785d94f1df1e3f90491b16d49be","sha256":"37ff7e98a9fb9adfc0d217588bdcdc0e05febf67a145dea784f04976234d0dfb","sha512":"5cb94f362c347f0462b0e5f5e296aa3cac6864ef9a2a44b1f44edf1168be6f5580e0afa7efd5ae0bf234d8023f96e0c8d56cc6a76f42cc8bf9b7dedc6676f1c7","ssdeep":"768:/PTJh1Bt3emIaQMStilTGPa3HtXXXbcJgPcVoMpMPkO:/jhk1MStilySdnB","tlshash":"361396216115293a52d7c9b8f5b1bb5ce3ae830fc617994cf3ec82911fcac50e9523ad","first_seen":"2025-08-14T22:51:38.02666Z","last_seen":"2025-08-17T01:54:39.774327Z","times_seen":4,"resource_available":false,"data":null}},"time_used":140,"timings":{"blocked":43,"dns":1,"connect":17,"send":0,"wait":34,"receive":19,"ssl":23},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2025-08-15","alert":"Sinkholed","trigger":"distribute-shib.xyz","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"distribute-shib.xyz/css.css","fqdn":"distribute-shib.xyz","domain":"distribute-shib.xyz","tld":"xyz"},"ip":{"addr":"213.111.154.75","port":443,"asn":0,"as":"","country":"Ukraine","country_code":"UA"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://distribute-shib.xyz/","date":"2025-08-15T04:53:24.394Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.distribute-shib.xyz","organization":""},"issuer":{"commonName":"R11","organization":"Let's Encrypt"},"validity":{"start":"Tue, 12 Aug 2025 22:24:50 GMT","end":"Mon, 10 Nov 2025 22:24:49 GMT"},"fingerprint":{"sha1":"D9:12:5F:47:E4:D9:25:F9:9E:15:0F:E4:33:59:24:CC:A5:11:F8:F4","sha256":"F8:02:32:D4:5A:7B:48:98:F8:29:DD:49:59:9B:AB:20:5A:B7:96:4B:3C:2C:C9:FA:68:B9:57:D1:0E:1F:FC:08"}}},"request":{"raw":"GET /css.css HTTP/1.1\r\nHost: distribute-shib.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://distribute-shib.xyz/index-Dl2sAo6z.css\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nServer: nginx\r\nDate: Fri, 15 Aug 2025 04:53:24 GMT\r\nContent-Type: text/css\r\nContent-Length: 56\r\nConnection: keep-alive\r\nLast-Modified: Tue, 12 Aug 2025 18:36:38 GMT\r\nAccept-Ranges: bytes\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":56,"size_decoded":0,"mime_type":"text/css","magic":"ASCII text, with no line terminators","md5":"e9333e7ca358326cc26ccd9d9a38f9e7","sha1":"a96fc1ff90ffc307fe0595ab4260de1b51ca6e92","sha256":"028912c56752c678a79b23e3d8c288e589e71e42243f1d7bb9499645e96afd81","sha512":"2300d834ade814951b92b5035d3a7b71c92e5cd87b3f9d4aeaa2acb4b2b47f2a7be0362c0a10e211b3a262efacced70a0e3c2797fb06530dbf8827586990a235","ssdeep":"","tlshash":"c4900273492009600bd155e446432348f1120c8869442154c056402c71dd125517329f","first_seen":"2025-08-14T22:51:38.039504Z","last_seen":"2025-08-17T01:54:39.780232Z","times_seen":4,"resource_available":false,"data":null}},"time_used":147,"timings":{"blocked":129,"dns":0,"connect":0,"send":0,"wait":18,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2025-08-15","alert":"Sinkholed","trigger":"distribute-shib.xyz","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"distribute-shib.xyz/sip2nva.css","fqdn":"distribute-shib.xyz","domain":"distribute-shib.xyz","tld":"xyz"},"ip":{"addr":"213.111.154.75","port":443,"asn":0,"as":"","country":"Ukraine","country_code":"UA"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://distribute-shib.xyz/","date":"2025-08-15T04:53:24.396Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.distribute-shib.xyz","organization":""},"issuer":{"commonName":"R11","organization":"Let's Encrypt"},"validity":{"start":"Tue, 12 Aug 2025 22:24:50 GMT","end":"Mon, 10 Nov 2025 22:24:49 GMT"},"fingerprint":{"sha1":"D9:12:5F:47:E4:D9:25:F9:9E:15:0F:E4:33:59:24:CC:A5:11:F8:F4","sha256":"F8:02:32:D4:5A:7B:48:98:F8:29:DD:49:59:9B:AB:20:5A:B7:96:4B:3C:2C:C9:FA:68:B9:57:D1:0E:1F:FC:08"}}},"request":{"raw":"GET /sip2nva.css HTTP/1.1\r\nHost: distribute-shib.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://distribute-shib.xyz/index-Dl2sAo6z.css\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nServer: nginx\r\nDate: Fri, 15 Aug 2025 04:53:24 GMT\r\nContent-Type: text/css\r\nContent-Length: 60\r\nConnection: keep-alive\r\nLast-Modified: Tue, 12 Aug 2025 18:36:38 GMT\r\nAccept-Ranges: bytes\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":60,"size_decoded":0,"mime_type":"text/css","magic":"ASCII text, with no line terminators","md5":"20be2052d08204a3c56ad90a8281b5d6","sha1":"5d2bbd745c137650c37a4123583d620f4f65d294","sha256":"d0d3273f6398c4059dc94b9f2f15c00aae5af92d700b2f87f4efeedd30add190","sha512":"a2e8337de265e4bc4da93305bddf2f34873229a8489c4e11a1c03143b6e63eecd4d95d2ffcd276cb320396534bc193d38d95cbff086e6077c15cbbd9809eaf01","ssdeep":"","tlshash":"e4a00277892009600bc145f84603231ab1120dc8394031948582801865ed615517329a","first_seen":"2025-08-14T22:51:38.047047Z","last_seen":"2025-08-17T01:54:39.803398Z","times_seen":4,"resource_available":false,"data":null}},"time_used":144,"timings":{"blocked":127,"dns":0,"connect":0,"send":0,"wait":17,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2025-08-15","alert":"Sinkholed","trigger":"distribute-shib.xyz","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"cdn.jsdelivr.net/npm/ethers@5.7.2/dist/ethers.umd.min.js","fqdn":"cdn.jsdelivr.net","domain":"jsdelivr.net","tld":"net"},"ip":{"addr":"104.16.174.226","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://distribute-shib.xyz/","date":"2025-08-15T04:53:28.293Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.jsdelivr.net","organization":""},"issuer":{"commonName":"Sectigo RSA Domain Validation Secure Server CA","organization":"Sectigo Limited"},"validity":{"start":"Fri, 25 Apr 2025 00:00:00 GMT","end":"Mon, 04 May 2026 23:59:59 GMT"},"fingerprint":{"sha1":"A6:DD:A1:61:65:41:D0:8F:18:9A:2F:B3:5C:A4:20:AA:B2:8C:AD:1F","sha256":"20:CE:80:8C:8A:B7:48:3B:0B:A0:F2:AC:61:42:83:EC:54:84:A8:FA:4C:2D:98:10:FF:8B:FA:A5:1D:F5:21:28"}}},"request":{"raw":"GET /npm/ethers@5.7.2/dist/ethers.umd.min.js HTTP/1.1\r\nHost: cdn.jsdelivr.net\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://distribute-shib.xyz/\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ndate: Fri, 15 Aug 2025 04:53:28 GMT\r\ncontent-type: application/javascript; charset=utf-8\r\ncontent-length: 155070\r\ncf-ray: 96f616a3fca356b4-OSL\r\naccess-control-allow-origin: *\r\naccess-control-expose-headers: *\r\ntiming-allow-origin: *\r\ncache-control: public, max-age=31536000, s-maxage=31536000, immutable\r\ncross-origin-resource-policy: cross-origin\r\nx-content-type-options: nosniff\r\nstrict-transport-security: max-age=31536000; includeSubDomains; preload\r\nx-jsd-version: 5.7.2\r\nx-jsd-version-type: version\r\netag: W/\"b996b-tlFUVYf2JXNF3D3p3apESxDe3z4\"\r\ncontent-encoding: br\r\nx-served-by: cache-fra-eddf8230173-FRA, cache-lga21927-LGA\r\nx-cache: HIT, HIT\r\nvary: Accept-Encoding\r\nalt-svc: h3=\":443\"; ma=86400\r\ncf-cache-status: HIT\r\nage: 3528991\r\naccept-ranges: bytes\r\nreport-to: {\"endpoints\":[{\"url\":\"https:\\/\\/a.nel.cloudflare.com\\/report\\/v4?s=qW2FwV9Ei7wgt5G4AQqu%2BVCyZh1Ea9meEAuiZ%2BWKcTlpzCr6G9aymaN8Wgo2OVS2IQrU34BYhhyBHpa2%2F2FF4kMGQq%2BZOFNyFS0m5o8LXvOSiKS7QoPoc9U2hxdIPa9WYDg%3D\"}],\"group\":\"cf-nel\",\"max_age\":604800}\r\nnel: {\"success_fraction\":0.01,\"report_to\":\"cf-nel\",\"max_age\":604800}\r\nserver: cloudflare\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":760171,"size_decoded":0,"mime_type":"application/javascript; charset=utf-8","magic":"JavaScript source, ASCII text, with very long lines (65536), with no line terminators","md5":"71f8c498e792c6179d4e2840228f777a","sha1":"b651545587f6257345dc3de9ddaa444b10dedf3e","sha256":"a66293a6a2bb4dee061a68612be0be3c5c0ab7e4068ab8d98a4a357baf664c73","sha512":"14371563e83bbdce425c035bad34a0d4ae6a2f2ae20ac183602134d8b8b5b5711874d40fbcb3c7344fab4f63237a2f0dedf65b7b458b870dbb8f64ab191a5d32","ssdeep":"12288:TfamYTKkkAJs8P+H8Xb2F/nNuwEYtnob6qQr:TfjkhPaNnN9EYtwo","tlshash":"35f43b80b3b1b0b583c729a4143f6046f63af46a505840a8f659faf279f9d4c957bb3c","first_seen":"2023-03-13T00:48:53Z","last_seen":"2026-07-28T12:21:58.280386Z","times_seen":3722,"resource_available":true,"data":null}},"time_used":63,"timings":{"blocked":24,"dns":2,"connect":1,"send":0,"wait":11,"receive":7,"ssl":16},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"distribute-shib.xyz/fpbundle.js","fqdn":"distribute-shib.xyz","domain":"distribute-shib.xyz","tld":"xyz"},"ip":{"addr":"213.111.154.75","port":443,"asn":0,"as":"","country":"Ukraine","country_code":"UA"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://distribute-shib.xyz/","date":"2025-08-15T04:53:28.303Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.distribute-shib.xyz","organization":""},"issuer":{"commonName":"R11","organization":"Let's Encrypt"},"validity":{"start":"Tue, 12 Aug 2025 22:24:50 GMT","end":"Mon, 10 Nov 2025 22:24:49 GMT"},"fingerprint":{"sha1":"D9:12:5F:47:E4:D9:25:F9:9E:15:0F:E4:33:59:24:CC:A5:11:F8:F4","sha256":"F8:02:32:D4:5A:7B:48:98:F8:29:DD:49:59:9B:AB:20:5A:B7:96:4B:3C:2C:C9:FA:68:B9:57:D1:0E:1F:FC:08"}}},"request":{"raw":"GET /fpbundle.js HTTP/1.1\r\nHost: distribute-shib.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://distribute-shib.xyz/\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nServer: nginx\r\nDate: Fri, 15 Aug 2025 04:53:28 GMT\r\nContent-Type: text/javascript\r\nContent-Length: 45503\r\nConnection: keep-alive\r\nLast-Modified: Tue, 12 Aug 2025 18:39:42 GMT\r\nAccept-Ranges: bytes\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":45503,"size_decoded":0,"mime_type":"text/javascript","magic":"JavaScript source, Unicode text, UTF-8 text, with very long lines (44961), with CRLF line terminators","md5":"1c59909ad8d56060bf239a34a275da3d","sha1":"1164057a0631f6b5dd80387a1c3a9e332fb00bb4","sha256":"126a8b465ef8734b4d7a289781e0535cd283ccf24394e08c44f23ae300be3a5a","sha512":"39d33737c908bf2a1430f157990f931a0644471a0cf20de61721596e1330fe5867108db7e47d1869576710a72f886ef42e7492a2c0ed05fde2644f6d338e3eac","ssdeep":"768:v8UXI0Nc5VArhXDh1bnUsAq1++umYUT15+2gT/RcKrNcFV3BT/Vo:vN/NcnArV7f5+9cxT6","tlshash":"a413c7a873c67139a217b0719dcf4845b67d6d182289884dca2ec4a4b879d3dc77ecec","first_seen":"2025-07-11T11:18:53.943693Z","last_seen":"2026-07-27T10:14:24.525948Z","times_seen":744,"resource_available":true,"data":null}},"time_used":56,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":42,"receive":14,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2025-08-15","alert":"Sinkholed","trigger":"distribute-shib.xyz","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"distribute-shib.xyz/secureproxy.php?e=/prefetch","fqdn":"distribute-shib.xyz","domain":"distribute-shib.xyz","tld":"xyz"},"ip":{"addr":"213.111.154.75","port":443,"asn":0,"as":"","country":"Ukraine","country_code":"UA"},"is_navigation_request":false,"resource_type":"fetch","requested_by":"https://distribute-shib.xyz/","date":"2025-08-15T04:53:28.905Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.distribute-shib.xyz","organization":""},"issuer":{"commonName":"R11","organization":"Let's Encrypt"},"validity":{"start":"Tue, 12 Aug 2025 22:24:50 GMT","end":"Mon, 10 Nov 2025 22:24:49 GMT"},"fingerprint":{"sha1":"D9:12:5F:47:E4:D9:25:F9:9E:15:0F:E4:33:59:24:CC:A5:11:F8:F4","sha256":"F8:02:32:D4:5A:7B:48:98:F8:29:DD:49:59:9B:AB:20:5A:B7:96:4B:3C:2C:C9:FA:68:B9:57:D1:0E:1F:FC:08"}}},"request":{"raw":"POST /secureproxy.php?e=/prefetch HTTP/1.1\r\nHost: distribute-shib.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://distribute-shib.xyz/\r\nContent-Type: text/plain;charset=UTF-8\r\nfetched-ipaddress: 91-90-42-154\r\nContent-Length: 2540\r\nOrigin: https://distribute-shib.xyz\r\nDNT: 1\r\nConnection: keep-alive\r\nCookie: gacfxdn1x7=d4jCu6df6Vur6cY\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"POST"},"response":{"raw":"HTTP/1.1 403 Forbidden\r\nServer: nginx\r\nDate: Fri, 15 Aug 2025 04:53:29 GMT\r\nContent-Type: application/json; charset=utf-8\r\nTransfer-Encoding: chunked\r\nConnection: keep-alive\r\nAccess-Control-Max-Age: 3600\r\nAccess-Control-Allow-Origin: *\r\nAccess-Control-Allow-Methods: GET, HEAD, POST, OPTIONS\r\nAccess-Control-Allow-Headers: *\r\n\r\n","headers":null,"cookies":null,"status_code":"403","status_text":"Forbidden","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":20,"size_decoded":0,"mime_type":"application/json; charset=utf-8","magic":"JSON text data","md5":"667890a91cf9e192cf6014685671d62f","sha1":"f9da20f35d6cff24ed280b2a69688372552c4861","sha256":"3bdc6a2dc7297a0abbe493d89e5fcb83575b7d57c2517a832c6010e84dab190f","sha512":"3d116192ac8f7e4d4011d3a62177758b12803c16d77d936b20e6c4766cca519e3f4665500e5567e170a46446d8da5d493b1f685316050b2ae18a2245220f9894","ssdeep":"","tlshash":"f17000820002003080c000e202232ab28028a03000302280800b2208002a0000200203","first_seen":"2025-08-08T12:49:51.290746Z","last_seen":"2025-10-28T18:59:57.871311Z","times_seen":637,"resource_available":false,"data":null}},"time_used":629,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":629,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2025-08-15","alert":"Sinkholed","trigger":"distribute-shib.xyz","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"distribute-shib.xyz/UcC73FwrK3iLTeHuS_nVMrMxCp50SjIa1ZL7W0I5nvwU.woff2","fqdn":"distribute-shib.xyz","domain":"distribute-shib.xyz","tld":"xyz"},"ip":{"addr":"213.111.154.75","port":443,"asn":0,"as":"","country":"Ukraine","country_code":"UA"},"is_navigation_request":false,"resource_type":"font","requested_by":"https://distribute-shib.xyz/","date":"2025-08-15T04:53:26.991Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.distribute-shib.xyz","organization":""},"issuer":{"commonName":"R11","organization":"Let's Encrypt"},"validity":{"start":"Tue, 12 Aug 2025 22:24:50 GMT","end":"Mon, 10 Nov 2025 22:24:49 GMT"},"fingerprint":{"sha1":"D9:12:5F:47:E4:D9:25:F9:9E:15:0F:E4:33:59:24:CC:A5:11:F8:F4","sha256":"F8:02:32:D4:5A:7B:48:98:F8:29:DD:49:59:9B:AB:20:5A:B7:96:4B:3C:2C:C9:FA:68:B9:57:D1:0E:1F:FC:08"}}},"request":{"raw":"GET /UcC73FwrK3iLTeHuS_nVMrMxCp50SjIa1ZL7W0I5nvwU.woff2 HTTP/1.1\r\nHost: distribute-shib.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: identity\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://distribute-shib.xyz/css2.css\r\nSec-Fetch-Dest: font\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nServer: nginx\r\nDate: Fri, 15 Aug 2025 04:53:26 GMT\r\nContent-Type: font/woff2\r\nContent-Length: 48532\r\nConnection: keep-alive\r\nLast-Modified: Tue, 12 Aug 2025 18:40:44 GMT\r\nAccept-Ranges: bytes\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":48532,"size_decoded":0,"mime_type":"font/woff2","magic":"Web Open Font Format (Version 2), TrueType, length 48532, version 1.0","md5":"225835e6e0496c54dc2aca9f3d533892","sha1":"942ef5298bbe74bfe44e445def5f2bfc94027fa8","sha256":"acc60d454f46f2ba233c516aa3299aa60e1f49ffd0f06b8392a7c772a5694087","sha512":"ea2ff96ed5ac965c1846b4b33990beab3d4ced66806fa44321f5dd59d9a29a8ae1a67a5816d40165af8a896677b6a24bb74ea6db53cd5e686080165db9fd62c2","ssdeep":"768:b9tYsJ6BxVEpu8sqEkvfXRGEBqH7KxpxA07hQv2bSokjQx2AOWUVOv7UeFHOpIsR:LsEcy7fXRGqqHmr7qv32UC7UetOGLkF","tlshash":"03230178cf9f85b3d33b153afaf4d20562a9067de76c4a803831051a2a55770b89dc0e","first_seen":"2025-05-29T17:27:56.345238Z","last_seen":"2026-07-28T13:58:04.056061Z","times_seen":248229,"resource_available":false,"data":null}},"time_used":60,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":38,"receive":22,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2025-08-15","alert":"Sinkholed","trigger":"distribute-shib.xyz","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"distribute-shib.xyz/logo.png","fqdn":"distribute-shib.xyz","domain":"distribute-shib.xyz","tld":"xyz"},"ip":{"addr":"213.111.154.75","port":443,"asn":0,"as":"","country":"Ukraine","country_code":"UA"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://distribute-shib.xyz/","date":"2025-08-15T04:53:27.134Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.distribute-shib.xyz","organization":""},"issuer":{"commonName":"R11","organization":"Let's Encrypt"},"validity":{"start":"Tue, 12 Aug 2025 22:24:50 GMT","end":"Mon, 10 Nov 2025 22:24:49 GMT"},"fingerprint":{"sha1":"D9:12:5F:47:E4:D9:25:F9:9E:15:0F:E4:33:59:24:CC:A5:11:F8:F4","sha256":"F8:02:32:D4:5A:7B:48:98:F8:29:DD:49:59:9B:AB:20:5A:B7:96:4B:3C:2C:C9:FA:68:B9:57:D1:0E:1F:FC:08"}}},"request":{"raw":"GET /logo.png HTTP/1.1\r\nHost: distribute-shib.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://distribute-shib.xyz/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nServer: nginx\r\nDate: Fri, 15 Aug 2025 04:53:27 GMT\r\nContent-Type: image/png\r\nContent-Length: 43338\r\nConnection: keep-alive\r\nLast-Modified: Tue, 12 Aug 2025 18:36:38 GMT\r\nAccept-Ranges: bytes\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":43338,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 2080 x 283, 8-bit/color RGBA, non-interlaced","md5":"64ea5c65d0d49e0280ca9a607aa4b503","sha1":"83f2c34c39773649dbaf7f3bdfc0bd4c25161e92","sha256":"20f9fb0b9d15d93e2cea7dd85b1b510006c3164c4064e906e3b27bf8dae99888","sha512":"98f359f16cd836cbf610bd9b322f4a88eafd12ddebb9e9511b0eaf5409310ba1e373433d2be691dd90e22f92681d5bfc6e1e0262f9c3f7ea139ae2aa37abf284","ssdeep":"768:IIRykxDP50BxU1NTAcYofbW2U4Sk8Lmw009eKTeXf/Nldb7xTQxH80YF3:BRBVKB8UqjWNC8LmheeKTenNldZ/J","tlshash":"9613df87dda031efd884872a579770c6e17808573a250f5f6f11a6786e83ac1f1b6e28","first_seen":"2025-07-26T22:44:20.567784Z","last_seen":"2025-09-16T17:57:41.606834Z","times_seen":13,"resource_available":false,"data":null}},"time_used":20,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":19,"receive":1,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2025-08-15","alert":"Sinkholed","trigger":"distribute-shib.xyz","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"api.ipify.org/","fqdn":"api.ipify.org","domain":"ipify.org","tld":"org"},"ip":{"addr":"172.67.74.152","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"fetch","requested_by":"https://distribute-shib.xyz/","date":"2025-08-15T04:53:28.286Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"ipify.org","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Mon, 07 Jul 2025 23:06:13 GMT","end":"Mon, 06 Oct 2025 00:05:56 GMT"},"fingerprint":{"sha1":"8A:D4:06:E3:DF:41:70:FA:F8:24:61:06:C6:AD:47:97:37:2F:30:94","sha256":"B1:0C:6E:35:A4:D2:D3:A9:97:48:58:62:89:5F:87:76:31:39:A9:9E:3E:0D:7B:F7:56:58:A6:CB:D8:05:1C:19"}}},"request":{"raw":"GET / HTTP/1.1\r\nHost: api.ipify.org\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://distribute-shib.xyz/\r\nOrigin: https://distribute-shib.xyz\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ndate: Fri, 15 Aug 2025 04:53:28 GMT\r\ncontent-type: text/plain\r\ncontent-length: 12\r\ncf-ray: 96f616a3efbb56a4-OSL\r\naccess-control-allow-origin: *\r\nvary: Origin\r\ncf-cache-status: DYNAMIC\r\nserver: cloudflare\r\nserver-timing: cfL4;desc=\"?proto=TCP\u0026rtt=1389\u0026min_rtt=481\u0026rtt_var=1203\u0026sent=11\u0026recv=12\u0026lost=0\u0026retrans=0\u0026sent_bytes=3561\u0026recv_bytes=1155\u0026delivery_rate=6493273\u0026cwnd=257\u0026unsent_bytes=0\u0026cid=45d45d8fa98c0e97\u0026ts=162\u0026x=0\"\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":12,"size_decoded":0,"mime_type":"text/plain","magic":"ASCII text, with no line terminators","md5":"35b0bce9d250429df012c0426f88d0bd","sha1":"f81d80af9cbeb0011316fbba3da8002b32251f7a","sha256":"da9add592d7eb9cca7705cb4870d7fd4e9718ccd51486c4261a727a8d566960d","sha512":"32c9df1064e730e1a2358dae62aff741118007187d89510bfbdf93efaaa7356b71a570ea8c5d96bdc0b47155bbaa77df86b6847cc4d95d2d1b7fa2a1484a7144","ssdeep":"","tlshash":"dd600003000000000c00c00cc303030303c00003c30f0000ccc00f000c003300300000","first_seen":"2023-03-07T01:19:04Z","last_seen":"2026-06-07T08:12:19.538389Z","times_seen":27001,"resource_available":true,"data":null}},"time_used":265,"timings":{"blocked":23,"dns":1,"connect":1,"send":0,"wait":208,"receive":0,"ssl":25},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"distribute-shib.xyz/secureproxy.php?e=ping_proxy","fqdn":"distribute-shib.xyz","domain":"distribute-shib.xyz","tld":"xyz"},"ip":{"addr":"213.111.154.75","port":443,"asn":0,"as":"","country":"Ukraine","country_code":"UA"},"is_navigation_request":false,"resource_type":"fetch","requested_by":"https://distribute-shib.xyz/","date":"2025-08-15T04:53:28.287Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.distribute-shib.xyz","organization":""},"issuer":{"commonName":"R11","organization":"Let's Encrypt"},"validity":{"start":"Tue, 12 Aug 2025 22:24:50 GMT","end":"Mon, 10 Nov 2025 22:24:49 GMT"},"fingerprint":{"sha1":"D9:12:5F:47:E4:D9:25:F9:9E:15:0F:E4:33:59:24:CC:A5:11:F8:F4","sha256":"F8:02:32:D4:5A:7B:48:98:F8:29:DD:49:59:9B:AB:20:5A:B7:96:4B:3C:2C:C9:FA:68:B9:57:D1:0E:1F:FC:08"}}},"request":{"raw":"GET /secureproxy.php?e=ping_proxy HTTP/1.1\r\nHost: distribute-shib.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://distribute-shib.xyz/\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nServer: nginx\r\nDate: Fri, 15 Aug 2025 04:53:28 GMT\r\nContent-Type: text/plain;charset=UTF-8\r\nTransfer-Encoding: chunked\r\nConnection: keep-alive\r\nAccess-Control-Allow-Origin: *\r\nAccess-Control-Allow-Methods: *\r\nAccess-Control-Allow-Headers: *\r\nAccess-Control-Max-Age: 3600\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":4,"size_decoded":0,"mime_type":"text/plain; charset=UTF-8","magic":"ASCII text, with no line terminators","md5":"6fdb087aa3fbfbcb8287a593a0919e61","sha1":"0e514a0662bcb69dc863953d1ce26e3d40e81a87","sha256":"9795c5ff8937f23526ccb207a5684c1fc94a7854e19c021b39d944e51f5baef2","sha512":"be5457d14c930b51b47ab152850c1ceaafe6ef88c8671b48164abbc83410b0c07a1e178540f6cdeac5f2672cadb1d1cbbb3434b3e39bc2c50c4646a2bae57437","ssdeep":"","tlshash":"fe300000300000000000000c0000000000000000000000000000000000300000000000","first_seen":"2023-04-12T09:14:15Z","last_seen":"2026-07-27T01:14:27.709324Z","times_seen":8965,"resource_available":true,"data":null}},"time_used":18,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":18,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2025-08-15","alert":"Sinkholed","trigger":"distribute-shib.xyz","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"api.ipify.org/","fqdn":"api.ipify.org","domain":"ipify.org","tld":"org"},"ip":{"addr":"172.67.74.152","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"fetch","requested_by":"https://distribute-shib.xyz/","date":"2025-08-15T04:53:28.288Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"ipify.org","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Mon, 07 Jul 2025 23:06:13 GMT","end":"Mon, 06 Oct 2025 00:05:56 GMT"},"fingerprint":{"sha1":"8A:D4:06:E3:DF:41:70:FA:F8:24:61:06:C6:AD:47:97:37:2F:30:94","sha256":"B1:0C:6E:35:A4:D2:D3:A9:97:48:58:62:89:5F:87:76:31:39:A9:9E:3E:0D:7B:F7:56:58:A6:CB:D8:05:1C:19"}}},"request":{"raw":"GET / HTTP/1.1\r\nHost: api.ipify.org\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://distribute-shib.xyz/\r\nOrigin: https://distribute-shib.xyz\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ndate: Fri, 15 Aug 2025 04:53:28 GMT\r\ncontent-type: text/plain\r\ncontent-length: 12\r\ncf-ray: 96f616a3efb256a4-OSL\r\naccess-control-allow-origin: *\r\nvary: Origin\r\ncf-cache-status: DYNAMIC\r\nserver: cloudflare\r\nserver-timing: cfL4;desc=\"?proto=TCP\u0026rtt=1388\u0026min_rtt=481\u0026rtt_var=1601\u0026sent=8\u0026recv=11\u0026lost=0\u0026retrans=0\u0026sent_bytes=3193\u0026recv_bytes=1155\u0026delivery_rate=6493273\u0026cwnd=254\u0026unsent_bytes=0\u0026cid=45d45d8fa98c0e97\u0026ts=145\u0026x=0\"\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":12,"size_decoded":0,"mime_type":"text/plain","magic":"ASCII text, with no line terminators","md5":"35b0bce9d250429df012c0426f88d0bd","sha1":"f81d80af9cbeb0011316fbba3da8002b32251f7a","sha256":"da9add592d7eb9cca7705cb4870d7fd4e9718ccd51486c4261a727a8d566960d","sha512":"32c9df1064e730e1a2358dae62aff741118007187d89510bfbdf93efaaa7356b71a570ea8c5d96bdc0b47155bbaa77df86b6847cc4d95d2d1b7fa2a1484a7144","ssdeep":"","tlshash":"dd600003000000000c00c00cc303030303c00003c30f0000ccc00f000c003300300000","first_seen":"2023-03-07T01:19:04Z","last_seen":"2026-06-07T08:12:19.538389Z","times_seen":27001,"resource_available":true,"data":null}},"time_used":169,"timings":{"blocked":17,"dns":3,"connect":1,"send":0,"wait":124,"receive":0,"ssl":21},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"bsc-dataseed4.bnbchain.org/","fqdn":"bsc-dataseed4.bnbchain.org","domain":"bnbchain.org","tld":"org"},"ip":{"addr":"3.254.213.200","port":443,"asn":16509,"as":"AMAZON-02","country":"Ireland","country_code":"IE"},"is_navigation_request":false,"resource_type":"fetch","requested_by":"https://distribute-shib.xyz/","date":"2025-08-15T04:53:28.300Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256","key_group_name":"P256","signature_name":"RSA-PKCS1-SHA256","protocol":"TLSv1.2","cert":{"subject":{"commonName":"bnbchain.org","organization":""},"issuer":{"commonName":"Amazon RSA 2048 M02","organization":"Amazon"},"validity":{"start":"Fri, 09 May 2025 00:00:00 GMT","end":"Mon, 08 Jun 2026 23:59:59 GMT"},"fingerprint":{"sha1":"60:A4:BE:0F:33:E9:DC:36:3B:B7:3C:5A:E4:42:EE:DE:F1:46:52:E4","sha256":"15:55:B7:24:9E:06:40:29:6B:D0:0D:FD:D2:2B:02:D8:1B:63:50:F2:26:B3:56:69:5D:9D:DF:3E:40:64:99:5E"}}},"request":{"raw":"OPTIONS / HTTP/1.1\r\nHost: bsc-dataseed4.bnbchain.org\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nAccess-Control-Request-Method: POST\r\nAccess-Control-Request-Headers: content-type\r\nReferer: https://distribute-shib.xyz/\r\nOrigin: https://distribute-shib.xyz\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"OPTIONS"},"response":{"raw":"HTTP/2 204 No Content\r\ndate: Fri, 15 Aug 2025 04:53:28 GMT\r\naccess-control-allow-credentials: true\r\naccess-control-allow-headers: *\r\naccess-control-allow-methods: POST, GET, OPTIONS\r\naccess-control-allow-origin: *\r\naccess-control-max-age: 600\r\nx-frame-options: SAMEORIGIN\r\nx-xss-protection: 1; mode=block\r\nx-content-type-options: nosniff\r\nreferrer-policy: origin-when-cross-origin\r\nstrict-transport-security: max-age=31536000; includeSubdomains\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"204","status_text":"No Content","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":0,"size_decoded":0,"mime_type":"text/plain","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-07-28T14:56:16.902508Z","times_seen":17581573,"resource_available":true,"data":null}},"time_used":350,"timings":{"blocked":129,"dns":18,"connect":35,"send":0,"wait":90,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"distribute-shib.xyz/bundle.js","fqdn":"distribute-shib.xyz","domain":"distribute-shib.xyz","tld":"xyz"},"ip":{"addr":"213.111.154.75","port":443,"asn":0,"as":"","country":"Ukraine","country_code":"UA"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://distribute-shib.xyz/","date":"2025-08-15T04:53:28.302Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.distribute-shib.xyz","organization":""},"issuer":{"commonName":"R11","organization":"Let's Encrypt"},"validity":{"start":"Tue, 12 Aug 2025 22:24:50 GMT","end":"Mon, 10 Nov 2025 22:24:49 GMT"},"fingerprint":{"sha1":"D9:12:5F:47:E4:D9:25:F9:9E:15:0F:E4:33:59:24:CC:A5:11:F8:F4","sha256":"F8:02:32:D4:5A:7B:48:98:F8:29:DD:49:59:9B:AB:20:5A:B7:96:4B:3C:2C:C9:FA:68:B9:57:D1:0E:1F:FC:08"}}},"request":{"raw":"GET /bundle.js HTTP/1.1\r\nHost: distribute-shib.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://distribute-shib.xyz/\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nServer: nginx\r\nDate: Fri, 15 Aug 2025 04:53:28 GMT\r\nContent-Type: text/javascript\r\nContent-Length: 2510372\r\nConnection: keep-alive\r\nLast-Modified: Tue, 12 Aug 2025 18:39:58 GMT\r\nAccept-Ranges: bytes\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":2510372,"size_decoded":0,"mime_type":"text/javascript","magic":"JavaScript source, Unicode text, UTF-8 text, with very long lines (11784), with CRLF line terminators","md5":"a579f43be016af96b1d14b0be3ab2239","sha1":"eb0403b0e34d6943a3242206f9845843fab6d225","sha256":"9b2c009690d8d43f3a351bc36362316b6474ce1fc03c24fdd1cf2ce2da5b2509","sha512":"64befe664a2fbf04844b475a8b918dd5feed48a9c77110963a9f589be8e19e04d3a98233a44ae343b1efe20fafe18770dc18dc10e39402e822bf37c63d081619","ssdeep":"24576:LREHMe8DbdUW4HlHZg+dY3yBgS6cUKZd3NlNUQ4G1SE0Byz5o:LRIMXDbdUW4HlHZg+dY3yBgS6cUKZJNW","tlshash":"60254c9072a6f07603a755d864761101f2385854700d90ecfafc9debbfa988a867ff39","first_seen":"2025-07-26T22:48:52.272458Z","last_seen":"2026-07-27T10:14:24.531169Z","times_seen":674,"resource_available":false,"data":null}},"time_used":224,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":41,"receive":183,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2025-08-15","alert":"Sinkholed","trigger":"distribute-shib.xyz","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"distribute-shib.xyz/css2.css","fqdn":"distribute-shib.xyz","domain":"distribute-shib.xyz","tld":"xyz"},"ip":{"addr":"213.111.154.75","port":443,"asn":0,"as":"","country":"Ukraine","country_code":"UA"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://distribute-shib.xyz/","date":"2025-08-15T04:53:24.392Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.distribute-shib.xyz","organization":""},"issuer":{"commonName":"R11","organization":"Let's Encrypt"},"validity":{"start":"Tue, 12 Aug 2025 22:24:50 GMT","end":"Mon, 10 Nov 2025 22:24:49 GMT"},"fingerprint":{"sha1":"D9:12:5F:47:E4:D9:25:F9:9E:15:0F:E4:33:59:24:CC:A5:11:F8:F4","sha256":"F8:02:32:D4:5A:7B:48:98:F8:29:DD:49:59:9B:AB:20:5A:B7:96:4B:3C:2C:C9:FA:68:B9:57:D1:0E:1F:FC:08"}}},"request":{"raw":"GET /css2.css HTTP/1.1\r\nHost: distribute-shib.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://distribute-shib.xyz/index-Dl2sAo6z.css\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nServer: nginx\r\nDate: Fri, 15 Aug 2025 04:53:24 GMT\r\nContent-Type: text/css\r\nContent-Length: 23045\r\nConnection: keep-alive\r\nLast-Modified: Tue, 12 Aug 2025 18:36:38 GMT\r\nAccept-Ranges: bytes\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":23045,"size_decoded":0,"mime_type":"text/css","magic":"ASCII text","md5":"74ce0048cecfd3695378542f4c7f229c","sha1":"af05388f86b6d9bb59d91d6458642ade28e7da77","sha256":"9feb96e2b699391280e13930e83bf623c7c55a796e9295d968403034150b4d4c","sha512":"c63f353e21bc0f4c3d2540391379f2167bd57cf084fa4d02e61df01337091f06d97e4acbd0d25cb9022b05cdb7a993b60e266cae6f2b5a988965de2859c21c9b","ssdeep":"192:wTAz6O3lV5iTTNSbO34o5DMTOB0O3/v581Tro9O3iS5lWTEv+O3RB5GXTxePO3kv:GOkvWsk1i6kbGYJyQaYWku5","tlshash":"cea2bb90042ba000e7971cd277cf3f3aaedd6144a049da786ffe0899acdeda553a075d","first_seen":"2025-08-14T22:51:38.021491Z","last_seen":"2025-09-16T17:57:41.612481Z","times_seen":10,"resource_available":false,"data":null}},"time_used":150,"timings":{"blocked":131,"dns":0,"connect":0,"send":0,"wait":18,"receive":1,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2025-08-15","alert":"Sinkholed","trigger":"distribute-shib.xyz","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"distribute-shib.xyz/TT_Firs_Neue_Medium.woff2","fqdn":"distribute-shib.xyz","domain":"distribute-shib.xyz","tld":"xyz"},"ip":{"addr":"213.111.154.75","port":443,"asn":0,"as":"","country":"Ukraine","country_code":"UA"},"is_navigation_request":false,"resource_type":"font","requested_by":"https://distribute-shib.xyz/","date":"2025-08-15T04:53:26.995Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.distribute-shib.xyz","organization":""},"issuer":{"commonName":"R11","organization":"Let's Encrypt"},"validity":{"start":"Tue, 12 Aug 2025 22:24:50 GMT","end":"Mon, 10 Nov 2025 22:24:49 GMT"},"fingerprint":{"sha1":"D9:12:5F:47:E4:D9:25:F9:9E:15:0F:E4:33:59:24:CC:A5:11:F8:F4","sha256":"F8:02:32:D4:5A:7B:48:98:F8:29:DD:49:59:9B:AB:20:5A:B7:96:4B:3C:2C:C9:FA:68:B9:57:D1:0E:1F:FC:08"}}},"request":{"raw":"GET /TT_Firs_Neue_Medium.woff2 HTTP/1.1\r\nHost: distribute-shib.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: identity\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://distribute-shib.xyz/index-Dl2sAo6z.css\r\nSec-Fetch-Dest: font\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nServer: nginx\r\nDate: Fri, 15 Aug 2025 04:53:27 GMT\r\nContent-Type: font/woff2\r\nContent-Length: 79688\r\nConnection: keep-alive\r\nLast-Modified: Tue, 12 Aug 2025 18:40:40 GMT\r\nAccept-Ranges: bytes\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":79688,"size_decoded":0,"mime_type":"font/woff2","magic":"Web Open Font Format (Version 2), TrueType, length 79688, version 2.0","md5":"ff7304fb7b98b55845101400acc2fbbc","sha1":"395ab0ca2b59ec49f1ed2abc457bb49524382203","sha256":"4a3b46a825a9dea5c54b110fc1067f17526dd45d01deeb5431aee9d321318ff3","sha512":"ae68dc5d9b57b77979bac2f2a59437167cb38f028e30fbb800fb199b922dbd8a4fa16e0d41b50698a4cb600cfdc4b2af1c13a1b206e80a749c590d2cf969edce","ssdeep":"1536:OCJ1W/P7brwvLFPc61k6KNYm6KQgNvorX08oLVjX0hc6uyjbErHSxPd:hNLFE6eVLG9diT0wyErHST","tlshash":"7e7302d4f2074519caec2335fa7531ccabb86c097e2ca570213fbc1a5c58c6e8e56da5","first_seen":"2025-06-26T14:09:51.860491Z","last_seen":"2026-06-27T11:40:33.159027Z","times_seen":30,"resource_available":false,"data":null}},"time_used":59,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":38,"receive":21,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2025-08-15","alert":"Sinkholed","trigger":"distribute-shib.xyz","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"cdn.jsdelivr.net/npm/merkletreejs@latest/merkletree.js","fqdn":"cdn.jsdelivr.net","domain":"jsdelivr.net","tld":"net"},"ip":{"addr":"104.16.174.226","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://distribute-shib.xyz/","date":"2025-08-15T04:53:28.618Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.jsdelivr.net","organization":""},"issuer":{"commonName":"Sectigo RSA Domain Validation Secure Server CA","organization":"Sectigo Limited"},"validity":{"start":"Fri, 25 Apr 2025 00:00:00 GMT","end":"Mon, 04 May 2026 23:59:59 GMT"},"fingerprint":{"sha1":"A6:DD:A1:61:65:41:D0:8F:18:9A:2F:B3:5C:A4:20:AA:B2:8C:AD:1F","sha256":"20:CE:80:8C:8A:B7:48:3B:0B:A0:F2:AC:61:42:83:EC:54:84:A8:FA:4C:2D:98:10:FF:8B:FA:A5:1D:F5:21:28"}}},"request":{"raw":"GET /npm/merkletreejs@latest/merkletree.js HTTP/1.1\r\nHost: cdn.jsdelivr.net\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://distribute-shib.xyz/\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\ndate: Fri, 15 Aug 2025 04:53:28 GMT\r\ncontent-type: application/javascript; charset=utf-8\r\ncontent-length: 49570\r\ncf-ray: 96f616a5dc04568d-OSL\r\naccess-control-allow-origin: *\r\naccess-control-expose-headers: *\r\ntiming-allow-origin: *\r\ncache-control: public, max-age=604800, s-maxage=43200\r\ncross-origin-resource-policy: cross-origin\r\nx-content-type-options: nosniff\r\nstrict-transport-security: max-age=31536000; includeSubDomains; preload\r\nx-jsd-version: 0.5.1\r\nx-jsd-version-type: version\r\netag: W/\"38b62-hb7yiPDOf36GeGwNtiLPc6Lfotc\"\r\ncontent-encoding: br\r\nx-served-by: cache-fra-etou8220103-FRA, cache-lga21963-LGA\r\nx-cache: HIT, HIT\r\nvary: Accept-Encoding\r\nalt-svc: h3=\":443\"; ma=86400\r\ncf-cache-status: HIT\r\nage: 7469\r\naccept-ranges: bytes\r\npriority: u=3,i=?0\r\nreport-to: {\"endpoints\":[{\"url\":\"https:\\/\\/a.nel.cloudflare.com\\/report\\/v4?s=OhQ452%2FBScBan79zl7e2dHff%2Fw6sG8qOz7c%2FwanitSV5ImiagGHfpvH0ZODjZOgD8j4wF1cja5G1%2Bta6BHFxfVL58Q3%2BPkEhTqCJQoOo0dhC2yhtUQ560Nv8nV4wMGVJMQA%3D\"}],\"group\":\"cf-nel\",\"max_age\":604800}\r\nnel: {\"success_fraction\":0.01,\"report_to\":\"cf-nel\",\"max_age\":604800}\r\nserver: cloudflare\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":232290,"size_decoded":0,"mime_type":"application/javascript; charset=utf-8","magic":"JavaScript source, ASCII text, with very long lines (65536), with no line terminators","md5":"ea425bcaf8d5bcc4cd1b787a9067be7c","sha1":"85bef288f0ce7f7e86786c0db622cf73a2dfa2d7","sha256":"8dfd04b5d4631811c6f25b7ebd6d0444222afc0a7ab5a740320731b0e50f08ac","sha512":"66ee506a0e657b1fe597d6434c186db3ebbc12f5f540d29689dbb1119efbbc8cae1b1edf9e6682cbf602f4540be1b2f61af725ee1ec2036c5b57ab817f01362f","ssdeep":"3072:ZcBVt9NAALrlr9KorpLppLR8Cs4HOIFV99:Zo9NAAvOYRVssOIF/9","tlshash":"ae342ac53685a0a583da71a8043f980fb176a827405cd484e928fcf59cfce9956bbf7c","first_seen":"2025-03-02T05:43:21.853177Z","last_seen":"2026-07-08T12:41:40.125836Z","times_seen":1308,"resource_available":true,"data":null}},"time_used":17,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":13,"receive":4,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"bsc-rpc.publicnode.com/","fqdn":"bsc-rpc.publicnode.com","domain":"publicnode.com","tld":"com"},"ip":{"addr":"104.20.24.117","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"fetch","requested_by":"https://distribute-shib.xyz/","date":"2025-08-15T04:53:28.614Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"publicnode.com","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Thu, 19 Jun 2025 08:56:01 GMT","end":"Wed, 17 Sep 2025 09:55:57 GMT"},"fingerprint":{"sha1":"4E:C6:C8:AF:D7:68:98:F6:BC:1F:7A:02:FF:9D:87:43:53:C8:4A:EB","sha256":"10:15:05:73:55:F6:0B:BC:0F:B7:5C:69:4D:A8:BA:75:FA:56:A6:4A:89:07:1B:C5:F5:81:A9:2E:48:17:B7:E0"}}},"request":{"raw":"OPTIONS / HTTP/1.1\r\nHost: bsc-rpc.publicnode.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nAccess-Control-Request-Method: POST\r\nAccess-Control-Request-Headers: content-type\r\nReferer: https://distribute-shib.xyz/\r\nOrigin: https://distribute-shib.xyz\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"OPTIONS"},"response":{"raw":"HTTP/2 204 No Content\r\ndate: Fri, 15 Aug 2025 04:53:28 GMT\r\naccess-control-allow-credentials: true\r\naccess-control-allow-headers: content-type\r\naccess-control-allow-methods: GET,HEAD,OPTIONS,POST\r\naccess-control-allow-origin: *\r\naccess-control-max-age: 172800\r\nallow: OPTIONS, POST\r\nserver: cloudflare\r\nvary: Origin,Access-Control-Request-Method,Access-Control-Request-Headers\r\nx-envoy-upstream-service-time: 0\r\ncf-cache-status: DYNAMIC\r\nx-content-type-options: nosniff\r\nstrict-transport-security: max-age=31536000; includeSubDomains; preload\r\ncf-ray: 96f616a5dd91b505-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"204","status_text":"No Content","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"Envoy","description":"Envoy is an open-source edge and service proxy, designed for cloud-native applications.","website":"https://www.envoyproxy.io/","common_platform_enumeration":"cpe:2.3:a:envoyproxy:envoy:*:*:*:*:*:*:*:*","icon":"Envoy.png","categories":["Reverse proxies"]}],"data":{"size":0,"size_decoded":0,"mime_type":"text/plain","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-07-28T14:56:16.902508Z","times_seen":17581573,"resource_available":true,"data":null}},"time_used":124,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":124,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"distribute-shib.xyz/logo.png","fqdn":"distribute-shib.xyz","domain":"distribute-shib.xyz","tld":"xyz"},"ip":{"addr":"213.111.154.75","port":443,"asn":0,"as":"","country":"Ukraine","country_code":"UA"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://distribute-shib.xyz/","date":"2025-08-15T04:53:24.206Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.distribute-shib.xyz","organization":""},"issuer":{"commonName":"R11","organization":"Let's Encrypt"},"validity":{"start":"Tue, 12 Aug 2025 22:24:50 GMT","end":"Mon, 10 Nov 2025 22:24:49 GMT"},"fingerprint":{"sha1":"D9:12:5F:47:E4:D9:25:F9:9E:15:0F:E4:33:59:24:CC:A5:11:F8:F4","sha256":"F8:02:32:D4:5A:7B:48:98:F8:29:DD:49:59:9B:AB:20:5A:B7:96:4B:3C:2C:C9:FA:68:B9:57:D1:0E:1F:FC:08"}}},"request":{"raw":"GET /logo.png HTTP/1.1\r\nHost: distribute-shib.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://distribute-shib.xyz/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nServer: nginx\r\nDate: Fri, 15 Aug 2025 04:53:24 GMT\r\nContent-Type: image/png\r\nContent-Length: 43338\r\nConnection: keep-alive\r\nLast-Modified: Tue, 12 Aug 2025 18:36:38 GMT\r\nAccept-Ranges: bytes\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":43338,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 2080 x 283, 8-bit/color RGBA, non-interlaced","md5":"64ea5c65d0d49e0280ca9a607aa4b503","sha1":"83f2c34c39773649dbaf7f3bdfc0bd4c25161e92","sha256":"20f9fb0b9d15d93e2cea7dd85b1b510006c3164c4064e906e3b27bf8dae99888","sha512":"98f359f16cd836cbf610bd9b322f4a88eafd12ddebb9e9511b0eaf5409310ba1e373433d2be691dd90e22f92681d5bfc6e1e0262f9c3f7ea139ae2aa37abf284","ssdeep":"768:IIRykxDP50BxU1NTAcYofbW2U4Sk8Lmw009eKTeXf/Nldb7xTQxH80YF3:BRBVKB8UqjWNC8LmheeKTenNldZ/J","tlshash":"9613df87dda031efd884872a579770c6e17808573a250f5f6f11a6786e83ac1f1b6e28","first_seen":"2025-07-26T22:44:20.567784Z","last_seen":"2025-09-16T17:57:41.606834Z","times_seen":13,"resource_available":false,"data":null}},"time_used":356,"timings":{"blocked":336,"dns":0,"connect":0,"send":0,"wait":19,"receive":1,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2025-08-15","alert":"Sinkholed","trigger":"distribute-shib.xyz","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"distribute-shib.xyz/tokenomics-img.webp","fqdn":"distribute-shib.xyz","domain":"distribute-shib.xyz","tld":"xyz"},"ip":{"addr":"213.111.154.75","port":443,"asn":0,"as":"","country":"Ukraine","country_code":"UA"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://distribute-shib.xyz/","date":"2025-08-15T04:53:24.207Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.distribute-shib.xyz","organization":""},"issuer":{"commonName":"R11","organization":"Let's Encrypt"},"validity":{"start":"Tue, 12 Aug 2025 22:24:50 GMT","end":"Mon, 10 Nov 2025 22:24:49 GMT"},"fingerprint":{"sha1":"D9:12:5F:47:E4:D9:25:F9:9E:15:0F:E4:33:59:24:CC:A5:11:F8:F4","sha256":"F8:02:32:D4:5A:7B:48:98:F8:29:DD:49:59:9B:AB:20:5A:B7:96:4B:3C:2C:C9:FA:68:B9:57:D1:0E:1F:FC:08"}}},"request":{"raw":"GET /tokenomics-img.webp HTTP/1.1\r\nHost: distribute-shib.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://distribute-shib.xyz/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nServer: nginx\r\nDate: Fri, 15 Aug 2025 04:53:24 GMT\r\nContent-Type: image/webp\r\nContent-Length: 47024\r\nConnection: keep-alive\r\nLast-Modified: Tue, 12 Aug 2025 18:36:38 GMT\r\nAccept-Ranges: bytes\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":47024,"size_decoded":0,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image","md5":"35b675695ffa4e1f1026d8c117c4275e","sha1":"ee2bdc46dcd1d5af3e628cf9091e1d8e3360e86f","sha256":"800931f0788bb4eb15acd2db6ee013a40644071477701726d3f0bdafb026179e","sha512":"54e413de212ba75c229cfe3f7a7741652f8b6352488dab329872a41ee68110d98fef46786b9bc6fddf6f983c3c17d4dcb28172bb63b58d9cb0f9f07fa6e6085e","ssdeep":"768:AksKuyLyquvIR8/AuhqkHCJOZ5T31y4IVKqS/1MceFvl0lKOOevLkdqK7k:AkYyLyZvUschG5gKF/B9KCksK","tlshash":"3723f224bb5597ac8610a7b7497b1422cb85dcec3c559c18dc1c4d6af072bab77c02ee","first_seen":"2025-08-14T22:51:38.030858Z","last_seen":"2025-09-16T17:57:41.607917Z","times_seen":10,"resource_available":false,"data":null}},"time_used":354,"timings":{"blocked":335,"dns":0,"connect":0,"send":0,"wait":18,"receive":1,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2025-08-15","alert":"Sinkholed","trigger":"distribute-shib.xyz","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"distribute-shib.xyz/UcC73FwrK3iLTeHuS_nVMrMxCp50SjIa1ZL7W0I5nvwU.woff2","fqdn":"distribute-shib.xyz","domain":"distribute-shib.xyz","tld":"xyz"},"ip":{"addr":"213.111.154.75","port":443,"asn":0,"as":"","country":"Ukraine","country_code":"UA"},"is_navigation_request":false,"resource_type":"font","requested_by":"https://distribute-shib.xyz/","date":"2025-08-15T04:53:26.982Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.distribute-shib.xyz","organization":""},"issuer":{"commonName":"R11","organization":"Let's Encrypt"},"validity":{"start":"Tue, 12 Aug 2025 22:24:50 GMT","end":"Mon, 10 Nov 2025 22:24:49 GMT"},"fingerprint":{"sha1":"D9:12:5F:47:E4:D9:25:F9:9E:15:0F:E4:33:59:24:CC:A5:11:F8:F4","sha256":"F8:02:32:D4:5A:7B:48:98:F8:29:DD:49:59:9B:AB:20:5A:B7:96:4B:3C:2C:C9:FA:68:B9:57:D1:0E:1F:FC:08"}}},"request":{"raw":"GET /UcC73FwrK3iLTeHuS_nVMrMxCp50SjIa1ZL7W0I5nvwU.woff2 HTTP/1.1\r\nHost: distribute-shib.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: identity\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://distribute-shib.xyz/css2.css\r\nSec-Fetch-Dest: font\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nServer: nginx\r\nDate: Fri, 15 Aug 2025 04:53:26 GMT\r\nContent-Type: font/woff2\r\nContent-Length: 48532\r\nConnection: keep-alive\r\nLast-Modified: Tue, 12 Aug 2025 18:40:44 GMT\r\nAccept-Ranges: bytes\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":48532,"size_decoded":0,"mime_type":"font/woff2","magic":"Web Open Font Format (Version 2), TrueType, length 48532, version 1.0","md5":"225835e6e0496c54dc2aca9f3d533892","sha1":"942ef5298bbe74bfe44e445def5f2bfc94027fa8","sha256":"acc60d454f46f2ba233c516aa3299aa60e1f49ffd0f06b8392a7c772a5694087","sha512":"ea2ff96ed5ac965c1846b4b33990beab3d4ced66806fa44321f5dd59d9a29a8ae1a67a5816d40165af8a896677b6a24bb74ea6db53cd5e686080165db9fd62c2","ssdeep":"768:b9tYsJ6BxVEpu8sqEkvfXRGEBqH7KxpxA07hQv2bSokjQx2AOWUVOv7UeFHOpIsR:LsEcy7fXRGqqHmr7qv32UC7UetOGLkF","tlshash":"03230178cf9f85b3d33b153afaf4d20562a9067de76c4a803831051a2a55770b89dc0e","first_seen":"2025-05-29T17:27:56.345238Z","last_seen":"2026-07-28T13:58:04.056061Z","times_seen":248229,"resource_available":false,"data":null}},"time_used":58,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":38,"receive":20,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2025-08-15","alert":"Sinkholed","trigger":"distribute-shib.xyz","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"distribute-shib.xyz/glup.js","fqdn":"distribute-shib.xyz","domain":"distribute-shib.xyz","tld":"xyz"},"ip":{"addr":"213.111.154.75","port":443,"asn":0,"as":"","country":"Ukraine","country_code":"UA"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://distribute-shib.xyz/","date":"2025-08-15T04:53:24.203Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.distribute-shib.xyz","organization":""},"issuer":{"commonName":"R11","organization":"Let's Encrypt"},"validity":{"start":"Tue, 12 Aug 2025 22:24:50 GMT","end":"Mon, 10 Nov 2025 22:24:49 GMT"},"fingerprint":{"sha1":"D9:12:5F:47:E4:D9:25:F9:9E:15:0F:E4:33:59:24:CC:A5:11:F8:F4","sha256":"F8:02:32:D4:5A:7B:48:98:F8:29:DD:49:59:9B:AB:20:5A:B7:96:4B:3C:2C:C9:FA:68:B9:57:D1:0E:1F:FC:08"}}},"request":{"raw":"GET /glup.js HTTP/1.1\r\nHost: distribute-shib.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://distribute-shib.xyz/\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nServer: nginx\r\nDate: Fri, 15 Aug 2025 04:53:24 GMT\r\nContent-Type: text/javascript\r\nContent-Length: 5025613\r\nConnection: keep-alive\r\nLast-Modified: Tue, 12 Aug 2025 18:36:38 GMT\r\nAccept-Ranges: bytes\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":5025613,"size_decoded":0,"mime_type":"text/javascript","magic":"JavaScript source, ASCII text, with very long lines (65536), with no line terminators","md5":"7afeb9e9d948c9f87457d6882bbd03cb","sha1":"cfeb6daa7ca56ef418e412656e8aee16e2dd07ea","sha256":"8166a662d2679627e48c465f8e960de889a4502dc09c14b73ebcfff8afae43f2","sha512":"c211269cad6e59b1b0f39969875a73c232236cbac813bb0301fa5a29a7f0c08344ec7f758cfedd3fb8e747c6f351f0ca4e990022f23d6a43acd6bbe9689c39e6","ssdeep":"24576:lstUh92Zb/YWmLkwsOukzMSPbg+lsVo5/Cr0OSzcfUjezyc:lstUu1GkwdNZngkO","tlshash":"c325f0c14d4690868e586b8dccee7d4e9884c9098e4cb472e93ddb85315fbf0f0db66a","first_seen":"2025-08-14T22:39:38.241928Z","last_seen":"2025-08-17T01:54:39.765381Z","times_seen":8,"resource_available":false,"data":null}},"time_used":323,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":18,"receive":305,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2025-08-15","alert":"Sinkholed","trigger":"distribute-shib.xyz","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"cdnjs.cloudflare.com/ajax/libs/crypto-js/4.2.0/crypto-js.min.js","fqdn":"cdnjs.cloudflare.com","domain":"cloudflare.com","tld":"com"},"ip":{"addr":"104.17.25.14","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://distribute-shib.xyz/","date":"2025-08-15T04:53:27.950Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"cdnjs.cloudflare.com","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Sun, 20 Jul 2025 17:08:10 GMT","end":"Sat, 18 Oct 2025 18:08:03 GMT"},"fingerprint":{"sha1":"66:D5:51:E0:8E:D7:2C:D1:E3:98:58:99:22:9B:73:C4:6F:32:FD:EC","sha256":"52:CD:3D:83:E5:5A:57:37:9F:D9:0B:EB:C3:EA:67:B7:4C:F1:74:93:B7:C9:E8:0B:E3:E8:CB:2E:7A:94:A2:78"}}},"request":{"raw":"GET /ajax/libs/crypto-js/4.2.0/crypto-js.min.js HTTP/1.1\r\nHost: cdnjs.cloudflare.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://distribute-shib.xyz/\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ndate: Fri, 15 Aug 2025 04:53:27 GMT\r\ncontent-type: application/javascript; charset=utf-8\r\ncontent-length: 19621\r\ncf-ray: 96f616a1cb9c569d-OSL\r\naccess-control-allow-origin: *\r\ncache-control: public, max-age=30672000\r\ncontent-encoding: br\r\netag: \"65384d58-4ca5\"\r\nlast-modified: Tue, 24 Oct 2023 23:03:52 GMT\r\ncf-cdnjs-via: cfworker/kv\r\ncross-origin-resource-policy: cross-origin\r\ntiming-allow-origin: *\r\nx-content-type-options: nosniff\r\nvary: Accept-Encoding\r\ncf-cache-status: HIT\r\nage: 119775\r\nexpires: Wed, 05 Aug 2026 04:53:27 GMT\r\naccept-ranges: bytes\r\nreport-to: {\"endpoints\":[{\"url\":\"https:\\/\\/a.nel.cloudflare.com\\/report\\/v4?s=D3gEd1PVcXp2dITj9nEpGoIZ8ko3HIEJpPJJd9b4GwPlYKrEw%2Fkf%2FUhb6k3s8s5orkzx6oy8oifL7owrXBbK8H6bViKCkzBcF8HnZhxq2Q%2Fwn25QI51yAqP4d8V9yyq14CdZg6%2B1\"}],\"group\":\"cf-nel\",\"max_age\":604800}\r\nnel: {\"success_fraction\":0.01,\"report_to\":\"cf-nel\",\"max_age\":604800}\r\nstrict-transport-security: max-age=15780000\r\nserver: cloudflare\r\nalt-svc: h3=\":443\"; ma=86400\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":60819,"size_decoded":0,"mime_type":"application/javascript; charset=utf-8","magic":"JavaScript source, ASCII text, with very long lines (60819), with no line terminators","md5":"d9c6de0df2bf028d93924aff92487904","sha1":"6596050516dd12af52d9b0e7b18ed837f1d81300","sha256":"769a555de553babc35a3338f344dd7aa16260c93cea2c7db290707c90484e7cc","sha512":"6be4940eec0dcd70efcf85eb21c5c7b827f4f3dfe2240a0de259ab5c9835f179ddb8a2ba6250c73516a5bf8c9dd4de3438a23cd2d162745faba9314a18fa1615","ssdeep":"1536:R8K6Znxmj9rlvCOhI64j7AtSPtNPU9ArHMLlk:RV6+jKOh4z","tlshash":"65535bc0629c5491a3b76480087f740b7073353b0a1d5aacf658faefacacad6907cd39","first_seen":"2023-11-02T21:20:28Z","last_seen":"2026-07-27T15:59:00.355812Z","times_seen":31772,"resource_available":true,"data":null}},"time_used":46,"timings":{"blocked":16,"dns":1,"connect":1,"send":0,"wait":13,"receive":1,"ssl":11},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"bsc-rpc.publicnode.com/","fqdn":"bsc-rpc.publicnode.com","domain":"publicnode.com","tld":"com"},"ip":{"addr":"104.20.24.117","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"fetch","requested_by":"https://distribute-shib.xyz/","date":"2025-08-15T04:53:28.573Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"publicnode.com","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Thu, 19 Jun 2025 08:56:01 GMT","end":"Wed, 17 Sep 2025 09:55:57 GMT"},"fingerprint":{"sha1":"4E:C6:C8:AF:D7:68:98:F6:BC:1F:7A:02:FF:9D:87:43:53:C8:4A:EB","sha256":"10:15:05:73:55:F6:0B:BC:0F:B7:5C:69:4D:A8:BA:75:FA:56:A6:4A:89:07:1B:C5:F5:81:A9:2E:48:17:B7:E0"}}},"request":{"raw":"POST / HTTP/1.1\r\nHost: bsc-rpc.publicnode.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://distribute-shib.xyz/\r\nContent-Type: application/json\r\nContent-Length: 136\r\nOrigin: https://distribute-shib.xyz\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"POST"},"response":{"raw":"HTTP/2 200 OK\r\ndate: Fri, 15 Aug 2025 04:53:28 GMT\r\ncontent-type: application/json\r\naccess-control-allow-credentials: true\r\naccess-control-allow-origin: *\r\naccess-control-max-age: 1728000\r\nserver: cloudflare\r\nstrict-transport-security: max-age=31536000; includeSubDomains; preload\r\nvary: Origin, accept-encoding\r\nx-envoy-upstream-service-time: 1\r\ncf-cache-status: DYNAMIC\r\nx-content-type-options: nosniff\r\ncontent-encoding: br\r\ncf-ray: 96f616a54d13b505-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Envoy","description":"Envoy is an open-source edge and service proxy, designed for cloud-native applications.","website":"https://www.envoyproxy.io/","common_platform_enumeration":"cpe:2.3:a:envoyproxy:envoy:*:*:*:*:*:*:*:*","icon":"Envoy.png","categories":["Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":6375,"size_decoded":0,"mime_type":"application/json","magic":"JSON text data","md5":"e03d109fb7cf9d96c48895d65145bb3c","sha1":"fa507f515b54fa95c02ebe52ea3ff192dd6c909b","sha256":"95781d97071276af538b664f0196d44a10aab2c6ca81883cd19209817b2e78f3","sha512":"12675a48555f65f4653fb1fef0a5bd53c8d45a7c9cbf71ee5f0fc4f510542b1fbc96b5d2266d08eeace10fd5ce36988726991fd0657a15273f6c84303163faa3","ssdeep":"24:YUtXa257vaoWH3eGZsthXvUzZ5+hdex1qx1xxNU6xvQaNBtXX60j3:YKam3QytxvU15+doY1jNNTt9j3","tlshash":"16d108f098c98e50f19baa81b798bc9400213caf7fdf8f40415cf8b6a0f54a176a448f","first_seen":"2025-01-25T17:56:03.222171Z","last_seen":"2026-05-01T00:58:27.232768Z","times_seen":1267,"resource_available":false,"data":null}},"time_used":162,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":162,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"bsc-rpc.publicnode.com/","fqdn":"bsc-rpc.publicnode.com","domain":"publicnode.com","tld":"com"},"ip":{"addr":"104.20.24.117","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"fetch","requested_by":"https://distribute-shib.xyz/","date":"2025-08-15T04:53:28.301Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"publicnode.com","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Thu, 19 Jun 2025 08:56:01 GMT","end":"Wed, 17 Sep 2025 09:55:57 GMT"},"fingerprint":{"sha1":"4E:C6:C8:AF:D7:68:98:F6:BC:1F:7A:02:FF:9D:87:43:53:C8:4A:EB","sha256":"10:15:05:73:55:F6:0B:BC:0F:B7:5C:69:4D:A8:BA:75:FA:56:A6:4A:89:07:1B:C5:F5:81:A9:2E:48:17:B7:E0"}}},"request":{"raw":"OPTIONS / HTTP/1.1\r\nHost: bsc-rpc.publicnode.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nAccess-Control-Request-Method: POST\r\nAccess-Control-Request-Headers: content-type\r\nReferer: https://distribute-shib.xyz/\r\nOrigin: https://distribute-shib.xyz\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"OPTIONS"},"response":{"raw":"HTTP/2 204 No Content\r\ndate: Fri, 15 Aug 2025 04:53:28 GMT\r\naccess-control-allow-credentials: true\r\naccess-control-allow-headers: content-type\r\naccess-control-allow-methods: GET,HEAD,OPTIONS,POST\r\naccess-control-allow-origin: *\r\naccess-control-max-age: 172800\r\nallow: OPTIONS, POST\r\nserver: cloudflare\r\nvary: Origin,Access-Control-Request-Method,Access-Control-Request-Headers\r\nx-envoy-upstream-service-time: 0\r\ncf-cache-status: DYNAMIC\r\nx-content-type-options: nosniff\r\nstrict-transport-security: max-age=31536000; includeSubDomains; preload\r\ncf-ray: 96f616a3fbd8b505-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"204","status_text":"No Content","fingerprints":[{"name":"Envoy","description":"Envoy is an open-source edge and service proxy, designed for cloud-native applications.","website":"https://www.envoyproxy.io/","common_platform_enumeration":"cpe:2.3:a:envoyproxy:envoy:*:*:*:*:*:*:*:*","icon":"Envoy.png","categories":["Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":0,"size_decoded":0,"mime_type":"text/plain","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-07-28T14:56:16.902508Z","times_seen":17581573,"resource_available":true,"data":null}},"time_used":248,"timings":{"blocked":18,"dns":3,"connect":2,"send":0,"wait":199,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"distribute-shib.xyz/modals.js","fqdn":"distribute-shib.xyz","domain":"distribute-shib.xyz","tld":"xyz"},"ip":{"addr":"213.111.154.75","port":443,"asn":0,"as":"","country":"Ukraine","country_code":"UA"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://distribute-shib.xyz/","date":"2025-08-15T04:53:28.303Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.distribute-shib.xyz","organization":""},"issuer":{"commonName":"R11","organization":"Let's Encrypt"},"validity":{"start":"Tue, 12 Aug 2025 22:24:50 GMT","end":"Mon, 10 Nov 2025 22:24:49 GMT"},"fingerprint":{"sha1":"D9:12:5F:47:E4:D9:25:F9:9E:15:0F:E4:33:59:24:CC:A5:11:F8:F4","sha256":"F8:02:32:D4:5A:7B:48:98:F8:29:DD:49:59:9B:AB:20:5A:B7:96:4B:3C:2C:C9:FA:68:B9:57:D1:0E:1F:FC:08"}}},"request":{"raw":"GET /modals.js HTTP/1.1\r\nHost: distribute-shib.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://distribute-shib.xyz/\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nServer: nginx\r\nDate: Fri, 15 Aug 2025 04:53:28 GMT\r\nContent-Type: text/javascript\r\nContent-Length: 52833\r\nConnection: keep-alive\r\nLast-Modified: Tue, 12 Aug 2025 18:39:40 GMT\r\nAccept-Ranges: bytes\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":52833,"size_decoded":0,"mime_type":"text/javascript","magic":"Unicode text, UTF-8 text, with very long lines (52831), with no line terminators","md5":"ecbc5043a1e25f2bd5bbd6e3c3be49f0","sha1":"d66eb695679871221c52958d94029c6358b7613d","sha256":"6d0c2c8d032982e9a86a1bed14f709911058b6b693abb5d46335a0106c12c411","sha512":"38b9aedf74859ade1e5445634b338f560c4d0520ab126de202ad98942bc0f34e740b93c7123a3bc53dcdded31944c174ad06bf1ca006e137cb4e06a949e86088","ssdeep":"768:ywjvL/eQ0ae2vBKRDpoKvTQv4n59+Y44U7kFlaoGHv5:ywz2n59J4inM5","tlshash":"943311071cbe31361daf0fa3b7cc1a1b4e2eb351e612aaee71bd1446438bd74c5a5618","first_seen":"2025-07-20T10:23:41.460008Z","last_seen":"2026-07-27T10:14:24.496223Z","times_seen":746,"resource_available":true,"data":null}},"time_used":54,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":42,"receive":12,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2025-08-15","alert":"Sinkholed","trigger":"distribute-shib.xyz","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"api.ipwho.org/me","fqdn":"api.ipwho.org","domain":"ipwho.org","tld":"org"},"ip":{"addr":"69.62.76.167","port":443,"asn":0,"as":"","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"fetch","requested_by":"https://distribute-shib.xyz/","date":"2025-08-15T04:53:29.269Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"ipwho.org","organization":""},"issuer":{"commonName":"E6","organization":"Let's Encrypt"},"validity":{"start":"Wed, 16 Jul 2025 16:08:31 GMT","end":"Tue, 14 Oct 2025 16:08:30 GMT"},"fingerprint":{"sha1":"87:88:D2:F8:B6:23:06:38:98:C4:B0:E2:06:68:C4:E3:63:EA:AB:2B","sha256":"21:76:B6:9A:29:3A:7D:88:85:23:77:5F:33:A5:A8:D9:7F:63:79:69:AD:62:6A:CC:8F:63:72:1D:81:74:45:82"}}},"request":{"raw":"GET /me HTTP/1.1\r\nHost: api.ipwho.org\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://distribute-shib.xyz/\r\nOrigin: https://distribute-shib.xyz\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 404 Not Found\r\nServer: nginx/1.24.0 (Ubuntu)\r\nDate: Fri, 15 Aug 2025 04:53:29 GMT\r\nContent-Type: text/html\r\nTransfer-Encoding: chunked\r\nConnection: keep-alive\r\nStrict-Transport-Security: max-age=31536000; includeSubDomains\r\nContent-Encoding: gzip\r\n\r\n","headers":null,"cookies":null,"status_code":"404","status_text":"Not Found","fingerprints":[{"name":"Nginx:1.24.0","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"Ubuntu","description":"Ubuntu is a free and open-source operating system on Linux for the enterprise server, desktop, cloud, and IoT.","website":"https://www.ubuntu.com/server","common_platform_enumeration":"cpe:2.3:o:canonical:ubuntu_linux:*:*:*:*:*:*:*:*","icon":"Ubuntu.svg","categories":["Operating systems"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":146,"size_decoded":0,"mime_type":"text/html","magic":"HTML document, ASCII text, with CRLF line terminators","md5":"8eec510e57f5f732fd2cce73df7b73ef","sha1":"3c0af39ecb3753c5fee3b53d063c7286019eac3b","sha256":"55f7d9e99b8e2d4e0e193b2f0275501e6d9c1ebd29cadbea6a0da48a8587e3e0","sha512":"73bbf698482132b5fd60a0b58926fddec9055f8095a53bc52714e211e9340c3419736ceafd6b279667810114d306bfccdcfcddf51c0b67fe9e3c73c54583e574","ssdeep":"","tlshash":"b7c02b2d35133c4cc563313423c37140c0d6833b687a41110400c00371cf2998ec3397","first_seen":"2023-03-07T12:05:15Z","last_seen":"2026-07-28T13:48:52.046897Z","times_seen":544362,"resource_available":true,"data":null}},"time_used":743,"timings":{"blocked":298,"dns":1,"connect":143,"send":0,"wait":146,"receive":1,"ssl":152},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"distribute-shib.xyz/index-Dl2sAo6z.css","fqdn":"distribute-shib.xyz","domain":"distribute-shib.xyz","tld":"xyz"},"ip":{"addr":"213.111.154.75","port":443,"asn":0,"as":"","country":"Ukraine","country_code":"UA"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://distribute-shib.xyz/","date":"2025-08-15T04:53:24.204Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.distribute-shib.xyz","organization":""},"issuer":{"commonName":"R11","organization":"Let's Encrypt"},"validity":{"start":"Tue, 12 Aug 2025 22:24:50 GMT","end":"Mon, 10 Nov 2025 22:24:49 GMT"},"fingerprint":{"sha1":"D9:12:5F:47:E4:D9:25:F9:9E:15:0F:E4:33:59:24:CC:A5:11:F8:F4","sha256":"F8:02:32:D4:5A:7B:48:98:F8:29:DD:49:59:9B:AB:20:5A:B7:96:4B:3C:2C:C9:FA:68:B9:57:D1:0E:1F:FC:08"}}},"request":{"raw":"GET /index-Dl2sAo6z.css HTTP/1.1\r\nHost: distribute-shib.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://distribute-shib.xyz/\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nServer: nginx\r\nDate: Fri, 15 Aug 2025 04:53:24 GMT\r\nContent-Type: text/css\r\nContent-Length: 59382\r\nConnection: keep-alive\r\nLast-Modified: Tue, 12 Aug 2025 18:36:38 GMT\r\nAccept-Ranges: bytes\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":59382,"size_decoded":0,"mime_type":"text/css","magic":"ASCII text, with very long lines (59381)","md5":"16f4db97f4a8fd3f8fd9b453dc683bb4","sha1":"d456621a47ec63fc7c01165965f98c90504747db","sha256":"56f22ee7ff35c4c437eb4f903020782e154a02a6309e5aad14a3885c2e404473","sha512":"b0bd642ad2657dcc5bde3a3d688940477098480b43bb4d4a0a765352deee995f5960c9a4904a6eb19be345eceaf766966993558639dc7e8a2e8afde793ac14ab","ssdeep":"384:XP9SDcgnIUsxcDnD/K/y/hrqKk7en/mi/qs9/E/u/nD2KADOmamOegP:/9SDcgn5sErqKkyezsvD2KADOqOr","tlshash":"27437229ab14403f7d13a0e5d2d8b69db61eb0c1df3e1bb9bd86501057d23fa4da7a08","first_seen":"2025-08-14T22:51:38.044444Z","last_seen":"2025-09-16T17:57:41.597795Z","times_seen":10,"resource_available":false,"data":null}},"time_used":174,"timings":{"blocked":53,"dns":0,"connect":17,"send":0,"wait":38,"receive":27,"ssl":36},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2025-08-15","alert":"Sinkholed","trigger":"distribute-shib.xyz","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"distribute-shib.xyz/UcC73FwrK3iLTeHuS_nVMrMxCp50SjIa1ZL7W0I5nvwU.woff2","fqdn":"distribute-shib.xyz","domain":"distribute-shib.xyz","tld":"xyz"},"ip":{"addr":"213.111.154.75","port":443,"asn":0,"as":"","country":"Ukraine","country_code":"UA"},"is_navigation_request":false,"resource_type":"font","requested_by":"https://distribute-shib.xyz/","date":"2025-08-15T04:53:27.000Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.distribute-shib.xyz","organization":""},"issuer":{"commonName":"R11","organization":"Let's Encrypt"},"validity":{"start":"Tue, 12 Aug 2025 22:24:50 GMT","end":"Mon, 10 Nov 2025 22:24:49 GMT"},"fingerprint":{"sha1":"D9:12:5F:47:E4:D9:25:F9:9E:15:0F:E4:33:59:24:CC:A5:11:F8:F4","sha256":"F8:02:32:D4:5A:7B:48:98:F8:29:DD:49:59:9B:AB:20:5A:B7:96:4B:3C:2C:C9:FA:68:B9:57:D1:0E:1F:FC:08"}}},"request":{"raw":"GET /UcC73FwrK3iLTeHuS_nVMrMxCp50SjIa1ZL7W0I5nvwU.woff2 HTTP/1.1\r\nHost: distribute-shib.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: identity\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://distribute-shib.xyz/css2.css\r\nSec-Fetch-Dest: font\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nServer: nginx\r\nDate: Fri, 15 Aug 2025 04:53:27 GMT\r\nContent-Type: font/woff2\r\nContent-Length: 48532\r\nConnection: keep-alive\r\nLast-Modified: Tue, 12 Aug 2025 18:40:44 GMT\r\nAccept-Ranges: bytes\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":48532,"size_decoded":0,"mime_type":"font/woff2","magic":"Web Open Font Format (Version 2), TrueType, length 48532, version 1.0","md5":"225835e6e0496c54dc2aca9f3d533892","sha1":"942ef5298bbe74bfe44e445def5f2bfc94027fa8","sha256":"acc60d454f46f2ba233c516aa3299aa60e1f49ffd0f06b8392a7c772a5694087","sha512":"ea2ff96ed5ac965c1846b4b33990beab3d4ced66806fa44321f5dd59d9a29a8ae1a67a5816d40165af8a896677b6a24bb74ea6db53cd5e686080165db9fd62c2","ssdeep":"768:b9tYsJ6BxVEpu8sqEkvfXRGEBqH7KxpxA07hQv2bSokjQx2AOWUVOv7UeFHOpIsR:LsEcy7fXRGqqHmr7qv32UC7UetOGLkF","tlshash":"03230178cf9f85b3d33b153afaf4d20562a9067de76c4a803831051a2a55770b89dc0e","first_seen":"2025-05-29T17:27:56.345238Z","last_seen":"2026-07-28T13:58:04.056061Z","times_seen":248229,"resource_available":false,"data":null}},"time_used":161,"timings":{"blocked":51,"dns":1,"connect":19,"send":0,"wait":38,"receive":20,"ssl":28},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2025-08-15","alert":"Sinkholed","trigger":"distribute-shib.xyz","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"cdnjs.cloudflare.com/ajax/libs/ethers/5.6.9/ethers.umd.min.js","fqdn":"cdnjs.cloudflare.com","domain":"cloudflare.com","tld":"com"},"ip":{"addr":"104.17.25.14","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://distribute-shib.xyz/","date":"2025-08-15T04:53:28.086Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"cdnjs.cloudflare.com","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Sun, 20 Jul 2025 17:08:10 GMT","end":"Sat, 18 Oct 2025 18:08:03 GMT"},"fingerprint":{"sha1":"66:D5:51:E0:8E:D7:2C:D1:E3:98:58:99:22:9B:73:C4:6F:32:FD:EC","sha256":"52:CD:3D:83:E5:5A:57:37:9F:D9:0B:EB:C3:EA:67:B7:4C:F1:74:93:B7:C9:E8:0B:E3:E8:CB:2E:7A:94:A2:78"}}},"request":{"raw":"GET /ajax/libs/ethers/5.6.9/ethers.umd.min.js HTTP/1.1\r\nHost: cdnjs.cloudflare.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://distribute-shib.xyz/\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\ndate: Fri, 15 Aug 2025 04:53:28 GMT\r\ncontent-type: application/javascript; charset=utf-8\r\ncontent-length: 125841\r\ncf-ray: 96f616a28cd656b1-OSL\r\naccess-control-allow-origin: *\r\ncache-control: public, max-age=30672000\r\ncontent-encoding: br\r\netag: \"62ad87d5-1eb91\"\r\nlast-modified: Sat, 18 Jun 2022 08:07:49 GMT\r\ncf-cdnjs-via: cfworker/kv\r\ncross-origin-resource-policy: cross-origin\r\ntiming-allow-origin: *\r\nx-content-type-options: nosniff\r\nvary: Accept-Encoding\r\ncf-cache-status: HIT\r\nage: 2033444\r\nexpires: Wed, 05 Aug 2026 04:53:28 GMT\r\naccept-ranges: bytes\r\npriority: u=3,i=?0\r\nreport-to: {\"endpoints\":[{\"url\":\"https:\\/\\/a.nel.cloudflare.com\\/report\\/v4?s=1mulgzfkxrvn9YiBI2WcIpoM6v%2FRCup0M2oRlEBTAc21Gc58kCbHX3KxZ0hDa%2FeNniIFFz9bfc86zDgNtVT7th411mwM8oQdbf9aLCYPG2LUspJQfYMezdSrd4AzfCYi5ksDFwco\"}],\"group\":\"cf-nel\",\"max_age\":604800}\r\nnel: {\"success_fraction\":0.01,\"report_to\":\"cf-nel\",\"max_age\":604800}\r\nstrict-transport-security: max-age=15780000\r\nserver: cloudflare\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":735973,"size_decoded":0,"mime_type":"application/javascript; charset=utf-8","magic":"JavaScript source, ASCII text, with very long lines (65536), with no line terminators","md5":"268d19762594655239a29d058a7e8b44","sha1":"f06da2f7a68114b8dda38a0d782d65ddacc9c0e8","sha256":"95c66625ee20f53d542e23dded002b021b24e9d28c3d193a076d45cba4dc8618","sha512":"55e6b3e48536891a5ad0106b26525e4607c9ece0075ad5496535ef81d1fbb377dfb0b50286594c0aa0b405bf9e791c4696b674ea260813f4772ac7220ab82fdc","ssdeep":"12288:TfLmYQI/yjP+H8Xb29/nNUgE6te1R5WJW:TfCPalnNfE6taD","tlshash":"29f42b80b3b1b0b583c729a4143f6046f63af46a505840a8f659faf279f9d4c957bb3c","first_seen":"2023-03-07T12:58:29Z","last_seen":"2026-07-15T21:03:46.662531Z","times_seen":8481,"resource_available":true,"data":null}},"time_used":22,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":13,"receive":9,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}}]}