{"report_id":"023dc02d-61cc-4bad-bcab-787380c6183a","version":6,"status":"done","tags":[],"date":"2026-01-30T12:11:50Z","url":{"schema":"http","addr":"metamaskwallet-restore.com","fqdn":"metamaskwallet-restore.com","domain":"metamaskwallet-restore.com","tld":"com"},"ip":{"addr":"195.250.27.134","port":0,"asn":211126,"as":"WHG Hosting Services Ltd","country":"United Kingdom","country_code":"GB"},"final":{"url":{"schema":"https","addr":"metamaskwallet-restore.com/","fqdn":"metamaskwallet-restore.com","domain":"metamaskwallet-restore.com","tld":"com"},"title":"MetaMask: The Leading Crypto Wallet Platform, Blockchain Wallet","dom":{"size":173512,"mime_type":"text/html; charset=utf-8","magic":"HTML document, Unicode text, UTF-8 text, with very long lines (60858)","md5":"8a50024faaaabf96fc285cec3df631b9","sha1":"38c6a4071e868703c2cbbdeab49f7ae5a9bc25cb","sha256":"7aac51a15f8f1cf0662af099cbc80e057da9987ea647c3bfa41d044aff9b7ce4","sha512":"473ec326c703fabdedabed6e0445bf5a5b742bddef5692176a0f04b11427d6f3601ddfbdc506a0e893746cda8fb5bfa24e351435a4b42a8ef9c0c15711d0792e","ssdeep":"3072:tj2sYslLg6ojLp94JwT2TDCQFA11G0hsMMPMy:Z2njLc","tlshash":"b504e760bb502979312b036ff097761c51aaee97d74d66f5f4fe801885e9fd230b220a","dom_hash":"domhash53adfcc949f3f382a67a7cae4dcb60e0","first_seen":"","last_seen":"","times_seen":0,"resource_available":false,"data":null}},"submit":{"url":{"schema":"http","addr":"metamaskwallet-restore.com","fqdn":"metamaskwallet-restore.com","domain":"metamaskwallet-restore.com","tld":"com"},"ip":{"addr":"195.250.27.134","port":0,"asn":211126,"as":"WHG Hosting Services Ltd","country":"United Kingdom","country_code":"GB"},"tags":null,"meta":null},"settings":{"access":"public","device_type":"desktop","expires_at":"2027-03-06T12:11:50Z","useragent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0","referer":"","cookies":null,"exit_node":"z0yflva4pidy47h"},"stats":{"alert_count":{"ids":0,"urlquery":0,"analyzer":1}},"detection":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-01-30","alert":"Sinkholed","trigger":"metamaskwallet-restore.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null},"summary":[{"fqdn":"metamaskwallet-restore.com","ip":{"addr":"195.250.27.134","port":443,"asn":211126,"as":"WHG Hosting Services Ltd","country":"United Kingdom","country_code":"GB"},"domain_registered":"2026-01-28","domain_rank":0,"first_seen":"2026-01-30T11:46:51.758213Z","last_seen":"2026-01-30T11:46:51.758213Z","alert_count":58,"request_count":58,"received_data":1466592,"sent_data":29609,"comment":"","tags":null,"fingerprints":[{"name":"LiteSpeed","description":"LiteSpeed is a high-scalability web server.","website":"https://litespeedtech.com","common_platform_enumeration":"cpe:2.3:a:litespeedtech:litespeed_web_server:*:*:*:*:*:*:*:*","icon":"LiteSpeed.svg","categories":["Web servers"]},{"name":"MySQL","description":"MySQL is an open-source relational database management system.","website":"https://mysql.com","common_platform_enumeration":"cpe:2.3:a:mysql:mysql:*:*:*:*:*:*:*:*","icon":"MySQL.svg","categories":["Databases"]},{"name":"Font Awesome","description":"Font Awesome is a font and icon toolkit based on CSS and Less.","website":"https://fontawesome.com/","common_platform_enumeration":"","icon":"Font Awesome.svg","categories":["Font scripts"]},{"name":"jQuery Migrate:3.4.1","description":"Query Migrate is a javascript library that allows you to preserve the compatibility of your jQuery code developed for versions of jQuery older than 1.9.","website":"https://github.com/jquery/jquery-migrate","common_platform_enumeration":"","icon":"jQuery.svg","categories":["JavaScript libraries"]},{"name":"jQuery","description":"jQuery is a JavaScript library which is a free, open-source software designed to simplify HTML DOM tree traversal and manipulation, as well as event handling, CSS animation, and Ajax.","website":"https://jquery.com","common_platform_enumeration":"cpe:2.3:a:jquery:jquery:*:*:*:*:*:*:*:*","icon":"jQuery.svg","categories":["JavaScript libraries"]},{"name":"Elementor:3.34.4","description":"Elementor is a website builder platform for professionals on WordPress.","website":"https://elementor.com","common_platform_enumeration":"","icon":"Elementor.svg","categories":["Page builders","WordPress plugins"]},{"name":"WPForms:1.8.7.2","description":"WPForms is a drag and drop WordPress form builder.","website":"https://wpforms.com","common_platform_enumeration":"","icon":"WPForms.svg","categories":["WordPress plugins","Form builders"]},{"name":"PHP","description":"PHP is a general-purpose scripting language used for web development.","website":"https://php.net","common_platform_enumeration":"cpe:2.3:a:php:php:*:*:*:*:*:*:*:*","icon":"PHP.svg","categories":["Programming languages"]},{"name":"WordPress:6.9","description":"WordPress is a free and open-source content management system written in PHP and paired with a MySQL or MariaDB database. Features include a plugin architecture and a template system.","website":"https://wordpress.org","common_platform_enumeration":"cpe:2.3:a:wordpress:wordpress:*:*:*:*:*:*:*:*","icon":"WordPress.svg","categories":["CMS","Blogs"]},{"name":"Underscore.js:1.13.7","description":"Underscore.js is a JavaScript library which provides utility functions for common programming tasks. It is comparable to features provided by Prototype.js and the Ruby language, but opts for a functional programming design instead of extending object prototypes.","website":"https://underscorejs.org","common_platform_enumeration":"","icon":"Underscore.js.png","categories":["JavaScript libraries"]}]},{"fqdn":"fonts.gstatic.com","ip":{"addr":"142.250.74.3","port":443,"asn":15169,"as":"GOOGLE","country":"United States","country_code":"US"},"domain_registered":"2008-02-11","domain_rank":0,"first_seen":"2014-04-02T10:51:04Z","last_seen":"2026-01-25T22:14:35.458366Z","alert_count":0,"request_count":4,"received_data":137188,"sent_data":2267,"comment":"","tags":null,"fingerprints":null},{"fqdn":"fonts.googleapis.com","ip":{"addr":"216.58.211.10","port":443,"asn":15169,"as":"GOOGLE","country":"United States","country_code":"US"},"domain_registered":"2005-01-25","domain_rank":313,"first_seen":"2012-05-23T12:41:44Z","last_seen":"2026-01-25T22:17:37.642954Z","alert_count":0,"request_count":3,"received_data":134250,"sent_data":1694,"comment":"","tags":null,"fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}]}],"files":null,"artifacts":{"windows_shortcuts":null,"files":null,"telegram":null,"pdfs":null,"clipboard":null},"sensors":{"ids":null,"analyzer":null,"urlquery":null},"javascript":{"script":[{"url":{"schema":"https","addr":"metamaskwallet-restore.com/elementor-frontend-js-before","fqdn":"metamaskwallet-restore.com","domain":"metamaskwallet-restore.com","tld":"com"},"ip":{"addr":"0.0.0.0","port":0,"asn":0,"as":"","country":"","country_code":"ZZ"},"introduction_type":"scriptElement","is_inline":false,"md5":"92d1e6207df54619dc805029d97fff7e","sha1":"1003d01b54ed1edd5215bee231ab455c9aff3734","sha256":"68b34ba9651da066c3206820493d05b48bcc960c9cfb3c9de9186c989c4f6b5b","sha512":"2a8829e88ab07ed49d8d4f06d46346ae874464f025d2ac6b4115d97389d52bc14f2d7b25002d34bf226059feebfe0bd538cbfc6267af6803e3412f40d3d62126","ssdeep":"","tlshash":"be618221fa052ebf87e39bb53927bb16686c0a25d0417cb4f0ed487d04b99692207d47","size":3458,"data":"","first_seen":"2026-01-30T12:11:56.155185Z","last_seen":"2026-01-30T12:11:56.155185Z","times_seen":1,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"metamaskwallet-restore.com/wp-content/themes/astra/assets/js/minified/flexibility.min.js?ver=4.12.1","fqdn":"metamaskwallet-restore.com","domain":"metamaskwallet-restore.com","tld":"com"},"ip":{"addr":"195.250.27.134","port":443,"asn":211126,"as":"WHG Hosting Services Ltd","country":"United Kingdom","country_code":"GB"},"introduction_type":"scriptElement","is_inline":false,"md5":"f3f609a6ebd5b8fede4abc63e105a7b7","sha1":"6cf96160fa67d56a7be3c68b1941d3af0061a69d","sha256":"cb7b88e5a91d97805b4efcbb6d4076cf93a62fcee29a5a363ed66dafca0dec09","sha512":"afd5aca3d8468c121b02d8b93f219bf9157c36f94a1df1511c3803ea70671d872bdb2ff6a04bcaf1110355a10ec5f9f2b2e28f9d50cb3447ee845d6ea00303a4","ssdeep":"384:uOgKnOUyVosSYlDjp1CAWa54XoO4qd7auYk4FozQ5rY3cYaTtlUBETID9g4ST6C7:Ng0OlVosHlDjp1CAWa54XoO4qd7auYkA","tlshash":"07620dc73a4c342246028e88fdab9a1578a60f6e0b2c4758d157b97400b6d571debbff","size":15525,"data":"","first_seen":"2025-10-07T17:03:00.325877Z","last_seen":"2026-05-31T10:56:46.284716Z","times_seen":16775,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"metamaskwallet-restore.com/starter-templates-zip-preview-js-extra","fqdn":"metamaskwallet-restore.com","domain":"metamaskwallet-restore.com","tld":"com"},"ip":{"addr":"0.0.0.0","port":0,"asn":0,"as":"","country":"","country_code":"ZZ"},"introduction_type":"scriptElement","is_inline":false,"md5":"e2a7431e7a145714c4f2f41895ca4220","sha1":"2ac0dd6be204b5915929f730a4dc44008f86f943","sha256":"897c27d1a02e33649c26e16e27ecbe5077af41ef94ff224be02e914397dbcf71","sha512":"38b38c2a045e3ed8823926159ccc6b59c90343fedb0a745dd77235a5366f322da6bf2cc5c082a94a8de4258c8eb1a2c46041ad444feb417d67b7fb20782c0a81","ssdeep":"","tlshash":"15219224f27419b2057389bdc51fc2a8949d6a43cd2ed709bd5dd96c21e675f0914703","size":1122,"data":"","first_seen":"2026-01-30T11:46:59.139768Z","last_seen":"2026-05-07T02:39:10.154892Z","times_seen":5,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"metamaskwallet-restore.com/wp-includes/js/dist/hooks.min.js?ver=dd5603f07f9220ed27f1","fqdn":"metamaskwallet-restore.com","domain":"metamaskwallet-restore.com","tld":"com"},"ip":{"addr":"195.250.27.134","port":443,"asn":211126,"as":"WHG Hosting Services Ltd","country":"United Kingdom","country_code":"GB"},"introduction_type":"scriptElement","is_inline":false,"md5":"90e932bd9e62583fc494c00498cfe7f5","sha1":"4f57e11bff609f90f49174187a0b5a6ba847ad28","sha256":"87cee5f49ba0d3017efc409579fc58b91a717f8f14751f7d804447ac9bcbaf4b","sha512":"ed9c129faf972ddfa705f05c3207884e5e9cd175baa45d49ce9d42bc0d01e4e8f36e627731bdd97214b1e2400fdd5012262a42f9800cd4f5565dbf183ba58507","ssdeep":"96:wXDE/3s/0EBM6ZUUCRTH+zl4NsBjcEmDtrGV2C2yics6w1RfGdzsvqZTq:wzg3kBFZYH+zhjngRw2cLzw1RfGdzsvx","tlshash":"56c153847983b970b2337057f0ff48d561baeba575298081964ec4a05d7388ee0a7abd","size":5661,"data":"","first_seen":"2025-10-27T08:47:54.273294Z","last_seen":"2026-05-31T11:21:06.76344Z","times_seen":190468,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"metamaskwallet-restore.com/wp-i18n-js-after","fqdn":"metamaskwallet-restore.com","domain":"metamaskwallet-restore.com","tld":"com"},"ip":{"addr":"0.0.0.0","port":0,"asn":0,"as":"","country":"","country_code":"ZZ"},"introduction_type":"scriptElement","is_inline":false,"md5":"e2a321807bd4709611c803ffd0d8e940","sha1":"8acc77024f49e13ed73b340b589916a35b3e8ae5","sha256":"916ac2b380af2ff640645d95934ffaada1d37d6f27e50d0be2e846bbb2a472c4","sha512":"04d9d6b55f9ceececc39261a2fa3fc17bd2442ceff6f44d5f7f7470b89ca368643eb756ed21d9025b5d36ae16f0ae672be1ae475121b1ec618165dbfc3a56314","ssdeep":"","tlshash":"4f1112cbf4ab3d50828fc7b48d23be0145502487c2afd50875e59d3496718c0b4c362f","size":880,"data":"","first_seen":"2025-12-06T01:17:52.910225Z","last_seen":"2026-05-24T11:05:44.200842Z","times_seen":43,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"metamaskwallet-restore.com/wp-includes/js/dist/i18n.min.js?ver=c26c3dc7bed366793375","fqdn":"metamaskwallet-restore.com","domain":"metamaskwallet-restore.com","tld":"com"},"ip":{"addr":"195.250.27.134","port":443,"asn":211126,"as":"WHG Hosting Services Ltd","country":"United Kingdom","country_code":"GB"},"introduction_type":"scriptElement","is_inline":false,"md5":"3a5838d1182eb0b11f5a58bfe26e2529","sha1":"920b2291e65d62eb55c1958911768540abaff5cf","sha256":"d4efe709c65438ae90dff385486421fea45762880f21fc4e0dca3fa96210f428","sha512":"bc41d50cd2e5c17c75ba737c303f2f498cc94e2c3fe402b2f15c5f10531e53633598093da98579b2dee65733dce0f763d77380ae35a9591d8bf91f975b7c6845","ssdeep":"96:L9emIWL7lnv93ssmAeGejQVnmggoC7arVCG0GXF730IQRDdlZq+SxSD3LmD:8mIWZVszMuinmg3rQ8Xd30DDdlZq+Sx3","tlshash":"2bb157dcb9d57022235121a0597fb409f3357d6470ebb8006ba9c4a47eb15cfb1a2fad","size":5314,"data":"","first_seen":"2025-10-27T08:47:54.280246Z","last_seen":"2026-05-31T11:21:06.747913Z","times_seen":187682,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"metamaskwallet-restore.com/wp-content/plugins/elementor-pro/assets/js/elements-handlers.min.js?ver=3.34.1","fqdn":"metamaskwallet-restore.com","domain":"metamaskwallet-restore.com","tld":"com"},"ip":{"addr":"195.250.27.134","port":443,"asn":211126,"as":"WHG Hosting Services Ltd","country":"United Kingdom","country_code":"GB"},"introduction_type":"scriptElement","is_inline":false,"md5":"75335041fd6f5d627ddc3475811aea8c","sha1":"8c3199226b96d5889bd4398d46ac209eb1d0ddef","sha256":"31b996586b2f1ca12e0aa6f59393364c7ba328449643d621a91fbd742aeccaf3","sha512":"0838bd06fc600eee50bf09a3bac2cc4815aab592ef0a913e4a2d83d7b3dd27bfad8591ee0113895609e49074562ad54a2b30708150c9b1551e88a60d32f1b1e2","ssdeep":"768:3/Xt95D1+WE9A5yLce/J9d0dbdTdGdadWdDdILdUd1dvd6dfdMdxdndTdiePm7La:ftDD1+WE9A5yLcWJ9mBtIoERuWfRMBK7","tlshash":"9413955171aaca2941cf84abf463164fb7225c9cf413f0e67afc8d82b564e87a390731","size":44259,"data":"","first_seen":"2026-01-21T13:53:51.822148Z","last_seen":"2026-05-27T00:25:20.739813Z","times_seen":111,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"metamaskwallet-restore.com/wp-content/plugins/elementor/assets/js/shared-frontend-handlers.03caa53373b56d3bab67.bundle.min.js","fqdn":"metamaskwallet-restore.com","domain":"metamaskwallet-restore.com","tld":"com"},"ip":{"addr":"195.250.27.134","port":443,"asn":211126,"as":"WHG Hosting Services Ltd","country":"United Kingdom","country_code":"GB"},"introduction_type":"scriptElement","is_inline":false,"md5":"a4df0433011e4a5ca770a6b46d01ab7d","sha1":"ced6acab63205209ef5db818700ba7e7f9277044","sha256":"77c0a6d635dad44b53a9eb9f0f367a1bd3bf3620c0e41d3a4c15d1313f2553f0","sha512":"d9059dc3da43bd052276c6544b81db20e438378541274eb2da852b7c535bc1738eac7c902a4c7c0913f1cef7f76a51bfd0d55e23dd659b4ed6c858141b0e1272","ssdeep":"192:IwfFpzqxODCWV5lxZmdXLf+UvDZ5CMtakRhPZT8cMkCw+v10QITpRHvcwxDnPoG0:rHzqxOPV5lxodXLfpvD/NtakRhPZT8cw","tlshash":"3802310a74c1982db58b58ba3532432866a8014de1018f6db1bf79fbc5a5d82277b7f1","size":8481,"data":"","first_seen":"2025-10-21T21:24:49.172997Z","last_seen":"2026-05-31T11:23:51.498928Z","times_seen":119725,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"metamaskwallet-restore.com/wp-content/plugins/elementor/assets/js/text-editor.45609661e409413f1cef.bundle.min.js","fqdn":"metamaskwallet-restore.com","domain":"metamaskwallet-restore.com","tld":"com"},"ip":{"addr":"195.250.27.134","port":443,"asn":211126,"as":"WHG Hosting Services Ltd","country":"United Kingdom","country_code":"GB"},"introduction_type":"scriptElement","is_inline":false,"md5":"b272ececde530e5621637a7e529abc8b","sha1":"a3fedafc836049d71aa3b1d9ddc1debcd6f73dd2","sha256":"4543f55b0b8bc8fe912da8ddd1da7b07d0e8d3e77a824295a6bccd90d4f8aa13","sha512":"d2efaf6be07605e855c348a6fd5aad58520f20912188578a3711de8840a9cd29e41860b49b36d3d7a72082077c9dcdfe8571e0279985a771cac102a520f7b020","ssdeep":"","tlshash":"f62112b371a2dded48df148a34522d16f2574d5db8caa01ef5aa08df24b2e843362634","size":1348,"data":"","first_seen":"2025-10-22T21:27:55.827503Z","last_seen":"2026-05-31T11:23:51.622139Z","times_seen":102258,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"metamaskwallet-restore.com/wp-content/plugins/elementor/assets/js/frontend-modules.min.js?ver=3.34.4","fqdn":"metamaskwallet-restore.com","domain":"metamaskwallet-restore.com","tld":"com"},"ip":{"addr":"195.250.27.134","port":443,"asn":211126,"as":"WHG Hosting Services Ltd","country":"United Kingdom","country_code":"GB"},"introduction_type":"scriptElement","is_inline":false,"md5":"73c07e9630db2adbba0c6bc0bf568719","sha1":"dbeb1065ce0ea1fc9fa6b9df9e5e1700a8dee09e","sha256":"f4bdadf362076967230901fdfc69c8df84957f6615dec226b99ad2abb64c2c76","sha512":"d48774149b65604aeee68cf2936bfe5c84714bab61a46a190952b595ee79ce8aa2c0549a3755768b3a3615c2b6abe0cfdc69c398a77296b8ceebc69bfea8f8dd","ssdeep":"1536:yuyQ5RSSYeAjA6c9CST+I83Fy0K4cR8+yhiA2pXSz2faNQAzeLHeBHmjkVziNT:C+uhIAu","tlshash":"cf33d9853652f4b70beb45da902f440af25718a8a40df4d5bfe9dce194b0d8e133ab78","size":50503,"data":"","first_seen":"2026-01-29T11:04:52.803648Z","last_seen":"2026-05-31T11:07:36.428387Z","times_seen":27976,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"metamaskwallet-restore.com/wp-content/uploads/astra-addon/astra-addon-697c98f1d6e3f8-29402264.js?ver=4.12.0","fqdn":"metamaskwallet-restore.com","domain":"metamaskwallet-restore.com","tld":"com"},"ip":{"addr":"195.250.27.134","port":443,"asn":211126,"as":"WHG Hosting Services Ltd","country":"United Kingdom","country_code":"GB"},"introduction_type":"scriptElement","is_inline":false,"md5":"ecfe37e0b696a440b61d1d5f533d5e7b","sha1":"59396f8c29afd35be67acbaffd2557b2d1d1e503","sha256":"8f0e6fe1c26bacabee3b460a3c819f73cd04254c0954ceed14c175105f57b1cb","sha512":"5a888c2fdeeaa681b9c59dc7cd4a54d865871ab2b622804a1a0f73bba893367178f4fa50911dc82f96bb0372a05fc10b37883ad6b65d521955e314ebbb280065","ssdeep":"384:taJI2Ic4uAuripyE5V3yCrtmlOPD7G7VRPV89LLE3XxAEx5WiTEDjtcg/eWhcDEF:t0I2Ic4uowE5Vi8mIPORPV89LLE3XxAx","tlshash":"9f72e8683314727b00bb07d2f4ab6b88b2728a3ee65d0051755dc8af18d4f9265e2f7d","size":17509,"data":"","first_seen":"2026-01-07T00:55:52.36487Z","last_seen":"2026-05-24T14:58:54.080342Z","times_seen":93,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"metamaskwallet-restore.com/","fqdn":"metamaskwallet-restore.com","domain":"metamaskwallet-restore.com","tld":"com"},"ip":{"addr":"195.250.27.134","port":443,"asn":211126,"as":"WHG Hosting Services Ltd","country":"United Kingdom","country_code":"GB"},"introduction_type":"scriptElement","is_inline":true,"md5":"b1e61eabb0c508a4034e9463f5c21415","sha1":"447d61fbd289f19c196dca6db57fdabf396f37ec","sha256":"14a0347940d8cd4bb00302adc1f0e7a52331a4e1453dbca140e5064622f4d1ce","sha512":"f0d5eb7750e9bd24c160562d63b62a3e8fa761d0e9e9dbdc522c1ea848868eb301bccad139ac58e713a32abe4c899064b7c179ac43ccf87eee0d9a1b23322426","ssdeep":"","tlshash":"1bb092b502e0952705ba055ba8a7e609646098216ab7b168811cc32c8872ac01da1bcd","size":119,"data":"","first_seen":"2026-01-06T15:13:01.552784Z","last_seen":"2026-05-31T10:56:46.323535Z","times_seen":10388,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"metamaskwallet-restore.com/wp-content/plugins/elementor-pro/assets/js/webpack-pro.runtime.min.js?ver=3.34.1","fqdn":"metamaskwallet-restore.com","domain":"metamaskwallet-restore.com","tld":"com"},"ip":{"addr":"195.250.27.134","port":443,"asn":211126,"as":"WHG Hosting Services Ltd","country":"United Kingdom","country_code":"GB"},"introduction_type":"scriptElement","is_inline":false,"md5":"4d3a5f7cb0809cede1c16e13d27ceba5","sha1":"381597908f8cf6f35b05e0d646c3e1c16779de81","sha256":"c33acfeb0b2e31664b9964092e512495dfabbc729fce2eee12c38ac42459f8b3","sha512":"2b38bc1a2bfcf12f0253e90b9e72fcdc3f836124225e8d3cdd773764226fbb3bcf502a96c3d96a0eebd24120f0cc8066b273c1ab06a00356aa278f6154dbb663","ssdeep":"96:BNfNg2SXdvjUq7VbocvCHHAiam4NBEPnh3CDjl2D/VTKV47YQGLo7cu8k2:3VNSXdvZVbocakNOPEDe/QOkQQbk2","tlshash":"1dd154980a589e2f26e13ad8b0976b701a3dd0723c19e991e651eddc18f8fd143da932","size":6249,"data":"","first_seen":"2026-01-21T13:53:51.770306Z","last_seen":"2026-05-27T00:25:20.702341Z","times_seen":111,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"metamaskwallet-restore.com/wp-includes/js/wp-emoji-loader.min.js","fqdn":"metamaskwallet-restore.com","domain":"metamaskwallet-restore.com","tld":"com"},"ip":{"addr":"0.0.0.0","port":0,"asn":0,"as":"","country":"","country_code":"ZZ"},"introduction_type":"scriptElement","is_inline":false,"md5":"a26cd4f52567e6ffc901949e01c441d6","sha1":"e32a0b4309c14a2029861f4c3f7162cba3bf932f","sha256":"edb49c3deb80d1b6d0f122d8264d60cfa7232bf216d6b78d191bfd5ed54fe3a4","sha512":"4853a51747d921625177edd373c09a7fd764cbcb2afd49424dcb0e3937ff920335d81974e2595f2ac132a356ff770f65c1bee488d8d3f311aa8676f4f6ac22eb","ssdeep":"","tlshash":"1c71969ae7763cdbb2f900f2697a0d47eb614435d6c8d038c9bea3141cb5893c274b46","size":3787,"data":"","first_seen":"2026-01-30T11:46:59.131432Z","last_seen":"2026-02-03T19:53:00.631368Z","times_seen":3,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"metamaskwallet-restore.com/wp-includes/js/underscore.min.js?ver=1.13.7","fqdn":"metamaskwallet-restore.com","domain":"metamaskwallet-restore.com","tld":"com"},"ip":{"addr":"195.250.27.134","port":443,"asn":211126,"as":"WHG Hosting Services Ltd","country":"United Kingdom","country_code":"GB"},"introduction_type":"scriptElement","is_inline":false,"md5":"dadb3f410026822807858737cbc7b64c","sha1":"477bafdb06d8dc0c22ada8d30067b5a0af2d79b4","sha256":"2f61c0b3d5a147bae06a4f6fd7d90031ddf39cba37e17926999b2645ac746a14","sha512":"1f6cfaf7978f2bd30503abaed49c193625e9a204ce359806449558d0caf09cae7dd10d2156e25f61b8f49efc3b7420b1332a480990da94f5a2ea3d30c262e8bf","ssdeep":"384:u2Rq5yjN1V02mEHrJDzWpl0bMpOt3PPD71ijeE9OWj:LqIbV0sHGl0dD71Uj","tlshash":"288281c83ac2f05aa76330b5406f508bf23a3ea16cada840c265e4f8bd7445d9137d6d","size":18905,"data":"","first_seen":"2025-04-01T10:25:57.91067Z","last_seen":"2026-05-31T10:34:44.402599Z","times_seen":113040,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"metamaskwallet-restore.com/astra-addon-js-js-extra","fqdn":"metamaskwallet-restore.com","domain":"metamaskwallet-restore.com","tld":"com"},"ip":{"addr":"0.0.0.0","port":0,"asn":0,"as":"","country":"","country_code":"ZZ"},"introduction_type":"scriptElement","is_inline":false,"md5":"2b7a42cac047cb79d0207cb6ff025a66","sha1":"fae15f9c27c435205d70a36cf6599c3d1bc3f58c","sha256":"36d631e9bfcbe3a8b7c64a5ef7c075f696586c14f4736c6930bd8db12ea89aa4","sha512":"a362fbd9f54c9249f81e0fa02dbcde819e8f174bbda34fe86c7f0738222247c21b4c49cc9e97add7ff5e7f96df11c52b1ac5569b5166bea0d5825c8ab1e7055a","ssdeep":"","tlshash":"e2315b0cc2f6eb9a199293b7df60894f65277d9ce9f68034fe5d8a15432e2e134400a8","size":1767,"data":"","first_seen":"2026-01-30T11:46:59.128833Z","last_seen":"2026-02-03T19:53:00.667111Z","times_seen":3,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"metamaskwallet-restore.com/wpforms-elementor-js-extra","fqdn":"metamaskwallet-restore.com","domain":"metamaskwallet-restore.com","tld":"com"},"ip":{"addr":"0.0.0.0","port":0,"asn":0,"as":"","country":"","country_code":"ZZ"},"introduction_type":"scriptElement","is_inline":false,"md5":"a289bfe20ab5069e918bda401bb553c0","sha1":"1005f4d6fb10e85e597c68fa074fbcd6222393e2","sha256":"ab83e00d2344531fc4b2dd1c0c72e9a93c51de267b064377a538dfa64a3a7993","sha512":"9a1c98d1a24e089bec0a242153b785f48344720ebf662b8d8e13da0c11fb26facedb25c395d70591319b651ab63518d1d05f9c27d3b7fb9e039863132a8b67dd","ssdeep":"","tlshash":"8011923afc776ef49e8b0c3a289b02a792594480f29158085a4902a20739cc3a389e86","size":922,"data":"","first_seen":"2026-01-30T11:46:59.134758Z","last_seen":"2026-02-03T19:53:00.653942Z","times_seen":3,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"metamaskwallet-restore.com/wp-content/themes/astra/assets/js/minified/frontend.min.js?ver=4.12.1","fqdn":"metamaskwallet-restore.com","domain":"metamaskwallet-restore.com","tld":"com"},"ip":{"addr":"195.250.27.134","port":443,"asn":211126,"as":"WHG Hosting Services Ltd","country":"United Kingdom","country_code":"GB"},"introduction_type":"scriptElement","is_inline":false,"md5":"424d1bd49a0f7bf705d9342a91c0089b","sha1":"94166e2c3fb906fcdacd8976d14638201d0a7bb9","sha256":"66b713cb51fe6103cd8729bc0c245c9497295b6873bdb9be7e8196caf5e5326e","sha512":"1694d2c8689eb7fb9e580bbe8184a6636cf6d05619ed16edb914155bf8f4488921d99ebfcbe5d1f5b3504435f13e2050934ae8d1eefdc432a4a98560180cb52f","ssdeep":"768:uYEPx6KoYcFDTHjCqoKoCo9or6jCRcjC5LltbmxPE22Ve8KTX6VzSD0tIzQ6IFNH:uYEPx6VGe6jCRcj6lBmxPErhdSLWNdio","tlshash":"12c272a66300293604fe17e7f5daabc5767114affa0944111838cc2e19a8fd352f5afd","size":25965,"data":"","first_seen":"2025-10-07T10:54:39.300678Z","last_seen":"2026-05-31T10:34:44.562053Z","times_seen":20194,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"metamaskwallet-restore.com/wp-includes/js/jquery/ui/core.min.js?ver=1.13.3","fqdn":"metamaskwallet-restore.com","domain":"metamaskwallet-restore.com","tld":"com"},"ip":{"addr":"195.250.27.134","port":443,"asn":211126,"as":"WHG Hosting Services Ltd","country":"United Kingdom","country_code":"GB"},"introduction_type":"scriptElement","is_inline":false,"md5":"da215ae12b95b3aeeb2047667016c7f8","sha1":"480a7087aa74b5b47c47f05a11670e823a3ae4c0","sha256":"699210a5ed06e497b4730ec83bb65ac4c2269ae4a0ee8af3f24aae7ee5b66b76","sha512":"d256ddc828c06f7b84f7df706a4481928a186ea6d3e1358254a1ec02f403d72d2f3aecd682a93aad61b8f236f17dbcf7e6ca100f78c30a348682bf8ee125d8ff","ssdeep":"384:G/rsrDr8LVyraS3dtrqorqr8hrpCip8fuxNhlGX0CiS9rH/OrLrErJ29FkFvd:iS33ZdvK47kv","tlshash":"06a2d94eb246380586f7a2a5402f521fb132e25cb105c8ddf468d8da3c7eea95173f79","size":21464,"data":"","first_seen":"2025-04-15T23:53:17.313193Z","last_seen":"2026-05-31T11:23:51.52364Z","times_seen":291545,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"metamaskwallet-restore.com/wp-includes/js/dist/dom-ready.min.js?ver=f77871ff7694fffea381","fqdn":"metamaskwallet-restore.com","domain":"metamaskwallet-restore.com","tld":"com"},"ip":{"addr":"195.250.27.134","port":443,"asn":211126,"as":"WHG Hosting Services Ltd","country":"United Kingdom","country_code":"GB"},"introduction_type":"scriptElement","is_inline":false,"md5":"e4bc17cc45ca91ab0f09dea134975c51","sha1":"3c03312717fb495c051d02a3d27ec0d8abc2557d","sha256":"5a43a22e48f94b7a45a9a9b1a107f197213b73307fdfa2e6b2daadab264f94d2","sha512":"f8e537a2168b94875bb7ddb9a20037c5bc79831c8b4e726f224f8d7c723c5c4b4512551697cf7bfb6ce4b5f8365dc1c027107ffe3435ea27c686f5ae96d921e7","ssdeep":"","tlshash":"bbf0d4705445edf071bc80e6442d53c1b5219039372270f14b8cdcb569e0f96127ede7","size":457,"data":"","first_seen":"2024-04-03T10:12:48Z","last_seen":"2026-05-31T11:23:45.509908Z","times_seen":103456,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"metamaskwallet-restore.com/elementor-pro-frontend-js-before","fqdn":"metamaskwallet-restore.com","domain":"metamaskwallet-restore.com","tld":"com"},"ip":{"addr":"0.0.0.0","port":0,"asn":0,"as":"","country":"","country_code":"ZZ"},"introduction_type":"scriptElement","is_inline":false,"md5":"de6408a9aca60ddf1335ed7dc6fb7309","sha1":"c57c715a448d7951bafe1f81d649f1bf11909ea1","sha256":"acf8ebe6ccc0426126943062b41801ec5581343dd51c93713508b1fb257bbae2","sha512":"9eef0e84a8e3071b7445b3024f0960582e1a1ca28162c66a7a5ff75e46d80a1ac260e90f59c2a75b0fd7aa034e2b259f24ed74d7e2285f10b194859fb387c4a4","ssdeep":"","tlshash":"e241aa16df211ea497aba7f831ca3aaf48c40332d6c4b54d22d9e06500fbcdde1152e3","size":2169,"data":"","first_seen":"2026-01-30T12:11:56.159632Z","last_seen":"2026-01-30T12:11:56.159632Z","times_seen":1,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"metamaskwallet-restore.com/wp-includes/js/wp-emoji-release.min.js?ver=6.9","fqdn":"metamaskwallet-restore.com","domain":"metamaskwallet-restore.com","tld":"com"},"ip":{"addr":"195.250.27.134","port":443,"asn":211126,"as":"WHG Hosting Services Ltd","country":"United Kingdom","country_code":"GB"},"introduction_type":"scriptElement","is_inline":false,"md5":"f0cc9ba5cf46af0cd73d521803e3b07e","sha1":"7d2a74f87dc70a39eccce3bae1d4cc404cb134f4","sha256":"fd59b0ebf6282ed71647bf2f6e0d1925bbfd1f270865a832079ebb60259aabca","sha512":"7ec44f08676c195547a623504c7105ef3d0acea5839675599598043f3e0b5a3386452e3db6fbea90722f7be9e6effdae1b89c49e2b05b22b8c415616e07d471d","ssdeep":"384:WzevzApRZTbXU/3o//bEPhXgA5POkpJTX:Wsk9XU/3o//YpXgAs+hX","tlshash":"7fa2959ba33a4e8f343e3bd78d968f4dc9da555321c0e079dbefb6c169a00568274c80","size":22762,"data":"","first_seen":"2025-11-10T19:52:32.864936Z","last_seen":"2026-05-31T11:23:51.552892Z","times_seen":250849,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"metamaskwallet-restore.com/wp-content/plugins/astra-sites/inc/lib/onboarding/assets/dist/template-preview/main.js?ver=09382f635556bec359b3","fqdn":"metamaskwallet-restore.com","domain":"metamaskwallet-restore.com","tld":"com"},"ip":{"addr":"195.250.27.134","port":443,"asn":211126,"as":"WHG Hosting Services Ltd","country":"United Kingdom","country_code":"GB"},"introduction_type":"scriptElement","is_inline":false,"md5":"a6e64218d897c667223b9729d964464f","sha1":"298e350fbb69196edb071a2023e2a045c8528253","sha256":"a78ffc057526aa84675d2eb5519424156f7d9ba3b601704f606b2e676b5615e7","sha512":"519f27265b2f723b0acf9e7cf6682b73f0ecaeded75562d7d9b1f185f2331ff7a7bbbe2c11f9093ab1e38b16d1a78b77bafc677569f061f906380cb459e923d5","ssdeep":"192:tXCj6CnyYlqqOre482UO7N1gqts1SIVje5L1Cd+eLXPMo56MxdC:u6CyYlq/i482UO7NW1vV65AxrUowMxdC","tlshash":"5ed1b63a3224d9340bba4aefb978e3d4f424b519b90792e4c99ccf0924b5d43139876a","size":6587,"data":"","first_seen":"2025-12-08T16:51:03.59113Z","last_seen":"2026-05-31T10:34:44.492996Z","times_seen":6951,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"metamaskwallet-restore.com/wp-util-js-extra","fqdn":"metamaskwallet-restore.com","domain":"metamaskwallet-restore.com","tld":"com"},"ip":{"addr":"0.0.0.0","port":0,"asn":0,"as":"","country":"","country_code":"ZZ"},"introduction_type":"scriptElement","is_inline":false,"md5":"b82c33d451342987c5a7df867e7afa0d","sha1":"3ca29c4e83fd224cff08cd87df59c2f102424921","sha256":"39015ede8a3ec7f12a4f69f90d44305e5902397b0f202d8d1b1fc4a92da0cc52","sha512":"cd15477ef2d0e0dd02bd64ff537b60e9d801a5e1755e61ea7f4880f479ebbd146e3cc7ded88505f65ef435c4b4a6ebe63555fa9593ef0ed11862c72542253ad1","ssdeep":"","tlshash":"d91112ddf8aa2f5ba3ce5df6541ea37b2460f551d0554c0527c691610120c85df48401","size":891,"data":"","first_seen":"2025-12-19T14:14:53.463819Z","last_seen":"2026-05-04T21:27:59.892901Z","times_seen":6,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"metamaskwallet-restore.com/wp-content/plugins/astra-addon/assets/js/minified/purify.min.js?ver=4.12.0","fqdn":"metamaskwallet-restore.com","domain":"metamaskwallet-restore.com","tld":"com"},"ip":{"addr":"195.250.27.134","port":443,"asn":211126,"as":"WHG Hosting Services Ltd","country":"United Kingdom","country_code":"GB"},"introduction_type":"scriptElement","is_inline":false,"md5":"fd87e766b51ac40500bc6a7ab45fdbf5","sha1":"7a110e184d0306b1e8dbdef44398a47be54effc5","sha256":"f8e4d7b0f1c613e9e79f2dd8d37c8b30e021d06d300684b29750c7f02e53e5fb","sha512":"37fd87762923312f9db9f4a40aafcad980150ec4f0d54e859bf2f6dacb5f1f5b1a0e512e3d32033e088bf98228a5a18b3951c5d885a1ed7d8f7bfe999b7fa379","ssdeep":"384:1yG3zyDNiBJRMmv8bUMFAmXlV1O4v5DE912nkk+i7wCWgXcFJBtcTukR9EL20mOq:FOYNlv8IMFZXlVU4xYH2nkk+i7wCWgXV","tlshash":"a1a2495e6d2079765fee41d820bb590ea1bc101f700c84b0e7ceecb554baa95606bf2f","size":22215,"data":"","first_seen":"2025-04-19T04:49:15.134746Z","last_seen":"2026-05-31T09:55:21.020609Z","times_seen":7927,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"metamaskwallet-restore.com/wp-content/plugins/elementor-pro/assets/js/frontend.min.js?ver=3.34.1","fqdn":"metamaskwallet-restore.com","domain":"metamaskwallet-restore.com","tld":"com"},"ip":{"addr":"195.250.27.134","port":443,"asn":211126,"as":"WHG Hosting Services Ltd","country":"United Kingdom","country_code":"GB"},"introduction_type":"scriptElement","is_inline":false,"md5":"5888f03128a623fb08d9653d68f99419","sha1":"ff37011866a3800c26ada8eaf23e9ceb3f182903","sha256":"03f0b089cb9d247bd10c8efd03e9a3e4ab69dea20e1ee90d370776b18cfbae68","sha512":"ba4e544530365db79df20e327b0a2cbf951e319d8ce8f0e0bfc60b426b1f8b32db43ee7bfb7124df38a583c9bfcf95627dddb10d2932e88c4f17352d1b387c72","ssdeep":"384:1dGy+EVxFm6cKJskdHd7glQtHuGJswg/i+TSQDTWmMo7YtDT5HJiIqkoh+vFWN74:vR+EVxFm6cKikdHd7glQtHuGJswg/DT6","tlshash":"60b2d9063163ac3a50cf815be067420e7b374995b40570ed7abc6cdba5b8d9a33ea335","size":24048,"data":"","first_seen":"2026-01-21T13:53:51.827531Z","last_seen":"2026-05-27T00:25:20.796374Z","times_seen":111,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"metamaskwallet-restore.com/wp-includes/js/jquery/jquery.min.js?ver=3.7.1","fqdn":"metamaskwallet-restore.com","domain":"metamaskwallet-restore.com","tld":"com"},"ip":{"addr":"195.250.27.134","port":443,"asn":211126,"as":"WHG Hosting Services Ltd","country":"United Kingdom","country_code":"GB"},"introduction_type":"scriptElement","is_inline":false,"md5":"826eb77e86b02ab7724fe3d0141ff87c","sha1":"79cd3587d565afe290076a8d36c31c305a573d18","sha256":"cb6f2d32c49d1c2b25e9ffc9aaafa3f83075346c01bcd4ae6eb187392a4292cf","sha512":"fc79fdb76763025dc39fac045a215ff155ef2f492a0e9640079d6f089fa6218af2b3ab7c6eaf636827dee9294e6939a95ab24554e870c976679c25567ad6374c","ssdeep":"1536:0RUX9uDgwxcy2KVBNwchN6SLaHEk2BSrBESp+a/IEk4aAocVi8SMBQ47GKO:sHNwcv9VBQpLl88SMBQ47GKO","tlshash":"7483f8df77ca702247ab30b9006f550bf276199d684d4400f159d8e9bcb8a4a827bf7e","size":87553,"data":"","first_seen":"2023-11-03T09:26:43Z","last_seen":"2026-05-31T11:22:27.447024Z","times_seen":876269,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"metamaskwallet-restore.com/wp-includes/js/wp-util.min.js?ver=6.9","fqdn":"metamaskwallet-restore.com","domain":"metamaskwallet-restore.com","tld":"com"},"ip":{"addr":"195.250.27.134","port":443,"asn":211126,"as":"WHG Hosting Services Ltd","country":"United Kingdom","country_code":"GB"},"introduction_type":"scriptElement","is_inline":false,"md5":"19d386c9004e54941c1cc61d357efa5d","sha1":"0a77594006c8d86fdcc0adbc2b9aecaef3869586","sha256":"3bc6467a95cec8fa516c6f5f69e1301e37e16f9bb1046fe7756729249f901b95","sha512":"7811cf6babb4df41707f97d1bd65337b5ad7aaedff301fcedb90fb7773fa9876f52458aa03a576910f6126384599ef25f8de76ee309c22e1914d9cf444aefb6f","ssdeep":"","tlshash":"ed21795a7175a9f311333479c23f0207f332e4145a168951e489c4f19d70d8be5b7a19","size":1426,"data":"","first_seen":"2023-03-08T14:26:29Z","last_seen":"2026-05-31T11:32:12.105272Z","times_seen":99717,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"metamaskwallet-restore.com/wp-content/plugins/elementor/assets/js/frontend.min.js?ver=3.34.4","fqdn":"metamaskwallet-restore.com","domain":"metamaskwallet-restore.com","tld":"com"},"ip":{"addr":"195.250.27.134","port":443,"asn":211126,"as":"WHG Hosting Services Ltd","country":"United Kingdom","country_code":"GB"},"introduction_type":"scriptElement","is_inline":false,"md5":"ceb183b138eac316a5cb0741ec23696a","sha1":"c9fcfc71c8f7229d96289ba702eeffc7827bd7e9","sha256":"2464e81935f8e354704bfd7c9dc5b722b7c2c3456f325be881556bf351f762e0","sha512":"7fc177991c5640b9b0113881747c7af234e6c7cfdcd5ef6d4cb4e3e9b6823499183071a398c7e505b8796028200107ec83fe3194512cd6ba1809d4fa33ec7cfd","ssdeep":"768:D1c+6idHZRdPM4ZBOB/hduNFXaz1kGtJR8RjDKv//Dk3iHVgbpM+MLKEnzBc5Glr:ZcURdPMMBOBjmFatJR8RjD8/xHVlEEnV","tlshash":"61e208523296e866069f48a3f0231119f3765dd9b80bf0d5b2bcdce6a471e877362b34","size":31880,"data":"","first_seen":"2025-10-21T21:24:49.242369Z","last_seen":"2026-05-31T11:07:36.419387Z","times_seen":67628,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"metamaskwallet-restore.com/","fqdn":"metamaskwallet-restore.com","domain":"metamaskwallet-restore.com","tld":"com"},"ip":{"addr":"195.250.27.134","port":443,"asn":211126,"as":"WHG Hosting Services Ltd","country":"United Kingdom","country_code":"GB"},"introduction_type":"scriptElement","is_inline":true,"md5":"75810f544b2ee064bf93a0a002fc4aaa","sha1":"57f544719ad2c5fce856e26872f25e24a2ed59cd","sha256":"152620764cd2f93e069abe9e7333ad846b32a877354b4e659b0187c96fd0aa69","sha512":"a5877801d94ee1ecb8b9d8e43f5678e577ebe84dac9e254b4fa4886144feb48fbf332b0fe7b949ab08886c5c1f9eb308f9c6088cd05641bf23ee4d8f5f37f46a","ssdeep":"","tlshash":"6701c01cf044101445f77039d0bf7757b6137c76662b00c7428c88b82e2cb388d639c5","size":705,"data":"","first_seen":"2025-12-02T23:16:37.220963Z","last_seen":"2026-05-31T10:38:26.793078Z","times_seen":9673,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"metamaskwallet-restore.com/wp-content/plugins/wpforms/assets/js/integrations/elementor/frontend.min.js?ver=1.8.7.2","fqdn":"metamaskwallet-restore.com","domain":"metamaskwallet-restore.com","tld":"com"},"ip":{"addr":"195.250.27.134","port":443,"asn":211126,"as":"WHG Hosting Services Ltd","country":"United Kingdom","country_code":"GB"},"introduction_type":"scriptElement","is_inline":false,"md5":"2399ef783701f73c399589ae95298b0f","sha1":"3e1f2a7ac9dcb2b50b1f1cf768441e46fd9f62ee","sha256":"2dea57483641f8762937dfd9b09126a9b21c88bd3d7486186003e0bbb9043145","sha512":"50f1c2b16c8c2fc62c504a33529dcef3fdbdd1533206c8779772cbba1a336c7c5bbb533a35f99e559aded3d1bf0c858c10a04ec083969f47a29deac92e366fa1","ssdeep":"","tlshash":"3901bd34b437beda1c6f122414af138fb266d4b3b2069c91972095b41e71dca634bf88","size":771,"data":"","first_seen":"2023-03-12T15:10:15Z","last_seen":"2026-05-31T07:10:13.988999Z","times_seen":9852,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"metamaskwallet-restore.com/astra-flexibility-js-after","fqdn":"metamaskwallet-restore.com","domain":"metamaskwallet-restore.com","tld":"com"},"ip":{"addr":"0.0.0.0","port":0,"asn":0,"as":"","country":"","country_code":"ZZ"},"introduction_type":"scriptElement","is_inline":false,"md5":"6a355b5588269cdf7a67ce53ec84e057","sha1":"13e6dd0b87349c161d5802b058db6ba36e312a0f","sha256":"e016a30f57438a39223b91fbeba4b702aed9591f433eaa18b90f91bbf060c275","sha512":"289d5b705c4cf6541f9750c5525a46f68aa5d9c82fc1a57faef0c100f38eb73235a7409751bdf9eda3e3c39429d8ff874e447dff418e8fb303c5cb775e94c1ad","ssdeep":"","tlshash":"1bd092b5c2e0a52705bb097ba8e7e60964609821eab7b168811cc32c8872ac01da1bcd","size":209,"data":"","first_seen":"2026-01-10T10:39:32.465149Z","last_seen":"2026-05-22T13:13:09.712821Z","times_seen":69,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"metamaskwallet-restore.com/wp-content/plugins/elementor/assets/lib/font-awesome/js/v4-shims.min.js?ver=3.34.4","fqdn":"metamaskwallet-restore.com","domain":"metamaskwallet-restore.com","tld":"com"},"ip":{"addr":"195.250.27.134","port":443,"asn":211126,"as":"WHG Hosting Services Ltd","country":"United Kingdom","country_code":"GB"},"introduction_type":"scriptElement","is_inline":false,"md5":"ef17c8ffc514d7418b4bec001b8473fb","sha1":"9d406018e5be8d46b89809d38eb6cea4f8bf62a2","sha256":"6f35273b8502706ee06854d797337ab40bc1b3a7421960a2ceb5392ac85a0f54","sha512":"6a3288f610d5f70344a48f885ea5a1877bd869035fb50f6e5159ddc09c67c7ffcc6d9aac4cc537800f3e84349aa26345d42134f305b41bdd5004e71b2160cbf1","ssdeep":"192:bP6lw28fajqZFSJtd4fxVOT2iQsVJqYqV5PnX9dUWFjWqh2P9e93f7POD3g:On8fajqZFwtdykZwRXcoWI2P9o7S3g","tlshash":"0262337bbd000da93cac595852a27d046d0eb32fbb430c6bbdc59de623a23f5719e006","size":15073,"data":"","first_seen":"2024-03-11T13:11:57Z","last_seen":"2026-05-31T11:00:39.103527Z","times_seen":62850,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"metamaskwallet-restore.com/jquery-js-after","fqdn":"metamaskwallet-restore.com","domain":"metamaskwallet-restore.com","tld":"com"},"ip":{"addr":"0.0.0.0","port":0,"asn":0,"as":"","country":"","country_code":"ZZ"},"introduction_type":"scriptElement","is_inline":false,"md5":"e652f22a2d85530341447537187e7522","sha1":"a52448bb6e6eff8471389d6ec7299f915a75de31","sha256":"7960133da42a7a1ae0b6a0d2c8f7eae0a5b4c473e22bddc10450751c79a789e3","sha512":"bbc38def4588aaf3675edc1ecd79515e1f160adbb2f6f6eb5da931ad66e454c5e7bbc552c9404fc53593b1be3d38aec4858f7ed94e829da822b1641035e69c9a","ssdeep":"","tlshash":"c7019c1cf044101445f7703990bf7756b6137876e62b0086428c88b82e2cb388d63985","size":802,"data":"","first_seen":"2025-12-03T18:17:37.999407Z","last_seen":"2026-05-30T20:44:49.625615Z","times_seen":91,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"metamaskwallet-restore.com/astra-theme-js-js-extra","fqdn":"metamaskwallet-restore.com","domain":"metamaskwallet-restore.com","tld":"com"},"ip":{"addr":"0.0.0.0","port":0,"asn":0,"as":"","country":"","country_code":"ZZ"},"introduction_type":"scriptElement","is_inline":false,"md5":"2106f6730a30245d2aa6d418c8fd627f","sha1":"c97f5d2ae9f6cc01b222d4f69b2f2760ddbcccf0","sha256":"51952dc545eab8c5cb8bd8decf258c02e25011d89d43e7baf41c24cddba46cbe","sha512":"9e171073429477384cad93b124a44c48416af3b939d9fccfbb267a8cd36b21f06e4be48160673aeccb9046e915488c0d3ab559c67afb2b904353791a888bd837","ssdeep":"","tlshash":"0011a914c2d22e01b6db4cb290218fa8b0fd9080d1d8f0ddea7c8e4862e6a1a1b68209","size":973,"data":"","first_seen":"2026-01-30T11:46:59.124812Z","last_seen":"2026-04-29T10:26:25.579046Z","times_seen":7,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"metamaskwallet-restore.com/wp-includes/js/jquery/jquery-migrate.min.js?ver=3.4.1","fqdn":"metamaskwallet-restore.com","domain":"metamaskwallet-restore.com","tld":"com"},"ip":{"addr":"195.250.27.134","port":443,"asn":211126,"as":"WHG Hosting Services Ltd","country":"United Kingdom","country_code":"GB"},"introduction_type":"scriptElement","is_inline":false,"md5":"9ffeb32e2d9efbf8f70caabded242267","sha1":"3ad0c10e501ac2a9bfa18f9cd7e700219b378738","sha256":"5274f11e6fb32ae0cf2dfb9f8043272865c397a7c4223b4cfa7d50ea52fbde89","sha512":"8d6be545508a1c38278b8ad780c3758ae48a25e4e12eee443375aa56031d9b356f8c90f22d4f251140fa3f65603af40523165e33cae2e2d62fc78ec106e3d731","ssdeep":"192:5rprDN+sag6ifKIUpQI99P1tLm9kdgyq1+J3aCJQ+h4MPLORq:5rprxaefKI0LP19m4q1WW+h4Mjp","tlshash":"9952c8adb56679724eb721b8f03bd24f71b205de560d8940d19cc4f6282dc6e812bf78","size":13577,"data":"","first_seen":"2023-05-09T19:21:05Z","last_seen":"2026-05-31T11:22:27.461808Z","times_seen":808581,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"metamaskwallet-restore.com/wp-content/plugins/elementor/assets/js/webpack.runtime.min.js?ver=3.34.4","fqdn":"metamaskwallet-restore.com","domain":"metamaskwallet-restore.com","tld":"com"},"ip":{"addr":"195.250.27.134","port":443,"asn":211126,"as":"WHG Hosting Services Ltd","country":"United Kingdom","country_code":"GB"},"introduction_type":"scriptElement","is_inline":false,"md5":"8677d8dfcc987f7d42b832b5ec35587d","sha1":"471ad10036d5aac3064d12441eeaffa05340e4b5","sha256":"b4bbbeb410140adf0ad76bf74e2a6525427e7fd867020599bcce5ce6c724646e","sha512":"ff8c780d9d829ce12e12f10f88fa2b4d970416aea6474c0465e184d78d19e2bbe450869004403e5bf958b394834998ac4d7ee037fed8a2425a92b994581997fa","ssdeep":"96:+6sN0Z9Z4JfrjqyWiNDgUl8OWZp5p0m4leNzwVeLyVU2j2KBKGarNcl8/2:JsNGyrjiiNg5WmH0IW9v7G/2","tlshash":"68c152941694fd2b21e139d8e01b9735252ec1373c1af981fa32eced54e4ed183aa532","size":5677,"data":"","first_seen":"2025-12-12T23:30:14.897515Z","last_seen":"2026-05-31T07:30:05.891103Z","times_seen":23676,"alerts":{"ids":null,"analyzer":null,"urlquery":null}}],"eval":null,"write":null,"console":null},"http":[{"url":{"schema":"https","addr":"metamaskwallet-restore.com/wp-content/plugins/elementor/assets/js/frontend.min.js?ver=3.34.4","fqdn":"metamaskwallet-restore.com","domain":"metamaskwallet-restore.com","tld":"com"},"ip":{"addr":"195.250.27.134","port":443,"asn":211126,"as":"WHG Hosting Services Ltd","country":"United Kingdom","country_code":"GB"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://metamaskwallet-restore.com/","date":"2026-01-30T12:11:28.370Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"www.metamaskwallet-restore.com","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Fri, 30 Jan 2026 02:04:32 GMT","end":"Thu, 30 Apr 2026 02:04:31 GMT"},"fingerprint":{"sha1":"82:70:2B:32:D3:3A:36:34:29:37:93:7F:98:95:47:45:77:5C:49:22","sha256":"84:75:E1:22:8E:81:BC:CD:DC:4D:E3:95:6A:07:41:CC:2A:4F:26:1C:75:58:8A:67:A1:7C:7E:BD:FB:8C:19:B0"}}},"request":{"raw":"GET /wp-content/plugins/elementor/assets/js/frontend.min.js?ver=3.34.4 HTTP/1.1\r\nHost: metamaskwallet-restore.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://metamaskwallet-restore.com/\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\ncontent-type: text/javascript\r\nlast-modified: Fri, 30 Jan 2026 02:18:56 GMT\r\naccept-ranges: bytes\r\ncontent-encoding: br\r\nvary: Accept-Encoding,User-Agent\r\ncontent-length: 10035\r\ndate: Fri, 30 Jan 2026 12:11:28 GMT\r\nserver: LiteSpeed\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"LiteSpeed","description":"LiteSpeed is a high-scalability web server.","website":"https://litespeedtech.com","common_platform_enumeration":"cpe:2.3:a:litespeedtech:litespeed_web_server:*:*:*:*:*:*:*:*","icon":"LiteSpeed.svg","categories":["Web servers"]}],"data":{"size":31880,"size_decoded":0,"mime_type":"text/javascript","magic":"JavaScript source, ASCII text, with very long lines (31880), with no line terminators","md5":"ceb183b138eac316a5cb0741ec23696a","sha1":"c9fcfc71c8f7229d96289ba702eeffc7827bd7e9","sha256":"2464e81935f8e354704bfd7c9dc5b722b7c2c3456f325be881556bf351f762e0","sha512":"7fc177991c5640b9b0113881747c7af234e6c7cfdcd5ef6d4cb4e3e9b6823499183071a398c7e505b8796028200107ec83fe3194512cd6ba1809d4fa33ec7cfd","ssdeep":"768:D1c+6idHZRdPM4ZBOB/hduNFXaz1kGtJR8RjDKv//Dk3iHVgbpM+MLKEnzBc5Glr:ZcURdPMMBOBjmFatJR8RjD8/xHVlEEnV","tlshash":"61e208523296e866069f48a3f0231119f3765dd9b80bf0d5b2bcdce6a471e877362b34","first_seen":"2025-10-21T21:24:49.242369Z","last_seen":"2026-05-31T11:07:36.419387Z","times_seen":67628,"resource_available":true,"data":null}},"time_used":449,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":438,"receive":11,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-01-30","alert":"Sinkholed","trigger":"metamaskwallet-restore.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"metamaskwallet-restore.com/wp-content/plugins/elementor-pro/assets/js/webpack-pro.runtime.min.js?ver=3.34.1","fqdn":"metamaskwallet-restore.com","domain":"metamaskwallet-restore.com","tld":"com"},"ip":{"addr":"195.250.27.134","port":443,"asn":211126,"as":"WHG Hosting Services Ltd","country":"United Kingdom","country_code":"GB"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://metamaskwallet-restore.com/","date":"2026-01-30T12:11:28.372Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"www.metamaskwallet-restore.com","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Fri, 30 Jan 2026 02:04:32 GMT","end":"Thu, 30 Apr 2026 02:04:31 GMT"},"fingerprint":{"sha1":"82:70:2B:32:D3:3A:36:34:29:37:93:7F:98:95:47:45:77:5C:49:22","sha256":"84:75:E1:22:8E:81:BC:CD:DC:4D:E3:95:6A:07:41:CC:2A:4F:26:1C:75:58:8A:67:A1:7C:7E:BD:FB:8C:19:B0"}}},"request":{"raw":"GET /wp-content/plugins/elementor-pro/assets/js/webpack-pro.runtime.min.js?ver=3.34.1 HTTP/1.1\r\nHost: metamaskwallet-restore.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://metamaskwallet-restore.com/\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\ncontent-type: text/javascript\r\nlast-modified: Fri, 30 Jan 2026 03:08:11 GMT\r\naccept-ranges: bytes\r\ncontent-encoding: br\r\nvary: Accept-Encoding,User-Agent\r\ncontent-length: 2620\r\ndate: Fri, 30 Jan 2026 12:11:28 GMT\r\nserver: LiteSpeed\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"LiteSpeed","description":"LiteSpeed is a high-scalability web server.","website":"https://litespeedtech.com","common_platform_enumeration":"cpe:2.3:a:litespeedtech:litespeed_web_server:*:*:*:*:*:*:*:*","icon":"LiteSpeed.svg","categories":["Web servers"]}],"data":{"size":6249,"size_decoded":0,"mime_type":"text/javascript","magic":"JavaScript source, ASCII text, with very long lines (6204), with CRLF line terminators","md5":"4d3a5f7cb0809cede1c16e13d27ceba5","sha1":"381597908f8cf6f35b05e0d646c3e1c16779de81","sha256":"c33acfeb0b2e31664b9964092e512495dfabbc729fce2eee12c38ac42459f8b3","sha512":"2b38bc1a2bfcf12f0253e90b9e72fcdc3f836124225e8d3cdd773764226fbb3bcf502a96c3d96a0eebd24120f0cc8066b273c1ab06a00356aa278f6154dbb663","ssdeep":"96:BNfNg2SXdvjUq7VbocvCHHAiam4NBEPnh3CDjl2D/VTKV47YQGLo7cu8k2:3VNSXdvZVbocakNOPEDe/QOkQQbk2","tlshash":"1dd154980a589e2f26e13ad8b0976b701a3dd0723c19e991e651eddc18f8fd143da932","first_seen":"2026-01-21T13:53:51.770306Z","last_seen":"2026-05-27T00:25:20.702341Z","times_seen":111,"resource_available":true,"data":null}},"time_used":458,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":456,"receive":2,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-01-30","alert":"Sinkholed","trigger":"metamaskwallet-restore.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"metamaskwallet-restore.com/wp-includes/js/wp-util.min.js?ver=6.9","fqdn":"metamaskwallet-restore.com","domain":"metamaskwallet-restore.com","tld":"com"},"ip":{"addr":"195.250.27.134","port":443,"asn":211126,"as":"WHG Hosting Services Ltd","country":"United Kingdom","country_code":"GB"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://metamaskwallet-restore.com/","date":"2026-01-30T12:11:28.379Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"www.metamaskwallet-restore.com","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Fri, 30 Jan 2026 02:04:32 GMT","end":"Thu, 30 Apr 2026 02:04:31 GMT"},"fingerprint":{"sha1":"82:70:2B:32:D3:3A:36:34:29:37:93:7F:98:95:47:45:77:5C:49:22","sha256":"84:75:E1:22:8E:81:BC:CD:DC:4D:E3:95:6A:07:41:CC:2A:4F:26:1C:75:58:8A:67:A1:7C:7E:BD:FB:8C:19:B0"}}},"request":{"raw":"GET /wp-includes/js/wp-util.min.js?ver=6.9 HTTP/1.1\r\nHost: metamaskwallet-restore.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://metamaskwallet-restore.com/\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\ncontent-type: text/javascript\r\nlast-modified: Thu, 06 Feb 2025 17:27:26 GMT\r\naccept-ranges: bytes\r\ncontent-encoding: br\r\nvary: Accept-Encoding,User-Agent\r\ncontent-length: 690\r\ndate: Fri, 30 Jan 2026 12:11:28 GMT\r\nserver: LiteSpeed\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"LiteSpeed","description":"LiteSpeed is a high-scalability web server.","website":"https://litespeedtech.com","common_platform_enumeration":"cpe:2.3:a:litespeedtech:litespeed_web_server:*:*:*:*:*:*:*:*","icon":"LiteSpeed.svg","categories":["Web servers"]}],"data":{"size":1426,"size_decoded":0,"mime_type":"text/javascript","magic":"JavaScript source, ASCII text, with very long lines (1391)","md5":"19d386c9004e54941c1cc61d357efa5d","sha1":"0a77594006c8d86fdcc0adbc2b9aecaef3869586","sha256":"3bc6467a95cec8fa516c6f5f69e1301e37e16f9bb1046fe7756729249f901b95","sha512":"7811cf6babb4df41707f97d1bd65337b5ad7aaedff301fcedb90fb7773fa9876f52458aa03a576910f6126384599ef25f8de76ee309c22e1914d9cf444aefb6f","ssdeep":"","tlshash":"ed21795a7175a9f311333479c23f0207f332e4145a168951e489c4f19d70d8be5b7a19","first_seen":"2023-03-08T14:26:29Z","last_seen":"2026-05-31T11:32:12.105272Z","times_seen":99717,"resource_available":true,"data":null}},"time_used":473,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":472,"receive":1,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-01-30","alert":"Sinkholed","trigger":"metamaskwallet-restore.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"metamaskwallet-restore.com/wp-content/uploads/2026/01/cropped-images-removebg-preview-300x300.png","fqdn":"metamaskwallet-restore.com","domain":"metamaskwallet-restore.com","tld":"com"},"ip":{"addr":"195.250.27.134","port":443,"asn":211126,"as":"WHG Hosting Services Ltd","country":"United Kingdom","country_code":"GB"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://metamaskwallet-restore.com/","date":"2026-01-30T12:11:29.056Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"www.metamaskwallet-restore.com","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Fri, 30 Jan 2026 02:04:32 GMT","end":"Thu, 30 Apr 2026 02:04:31 GMT"},"fingerprint":{"sha1":"82:70:2B:32:D3:3A:36:34:29:37:93:7F:98:95:47:45:77:5C:49:22","sha256":"84:75:E1:22:8E:81:BC:CD:DC:4D:E3:95:6A:07:41:CC:2A:4F:26:1C:75:58:8A:67:A1:7C:7E:BD:FB:8C:19:B0"}}},"request":{"raw":"GET /wp-content/uploads/2026/01/cropped-images-removebg-preview-300x300.png HTTP/1.1\r\nHost: metamaskwallet-restore.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://metamaskwallet-restore.com/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\ncache-control: public, max-age=604800\r\nexpires: Fri, 06 Feb 2026 12:11:29 GMT\r\ncontent-type: image/png\r\nlast-modified: Fri, 30 Jan 2026 11:41:37 GMT\r\naccept-ranges: bytes\r\ncontent-length: 73874\r\ndate: Fri, 30 Jan 2026 12:11:29 GMT\r\nserver: LiteSpeed\r\nvary: User-Agent\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"LiteSpeed","description":"LiteSpeed is a high-scalability web server.","website":"https://litespeedtech.com","common_platform_enumeration":"cpe:2.3:a:litespeedtech:litespeed_web_server:*:*:*:*:*:*:*:*","icon":"LiteSpeed.svg","categories":["Web servers"]}],"data":{"size":73874,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 300 x 300, 8-bit/color RGBA, non-interlaced","md5":"a2af6bf800dcc837034fd086ffe84301","sha1":"5acd1c375a7589b3d5886c2e40ac9ede4ebcb14b","sha256":"8db43ee918a6deb881ab5aa3a701536bd11e42b5451bbbe8503e41624968f14f","sha512":"bc0f7bd16486ba385337ab128a5be39526d838cddcc8f1cc1307078433dd4b838419a7363869d31b0c096621488c31761cb39dcfcd97c6ff4c192063cf66ebae","ssdeep":"1536:4kJyTc+m/hFPAPhSzlmso1BQI3y9BPE56gQeTEHI7tSxw8CCP9VMb:4kucPJLCa20ETiI7t6w8xVO","tlshash":"ea7302b8b74c67e1790ebadb44e8cefc8790f83956353cce617a1742d7a621925f0208","first_seen":"2026-01-30T11:46:59.051183Z","last_seen":"2026-02-03T19:53:00.624684Z","times_seen":3,"resource_available":false,"data":null}},"time_used":180,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":142,"receive":38,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-01-30","alert":"Sinkholed","trigger":"metamaskwallet-restore.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"metamaskwallet-restore.com/wp-content/uploads/elementor/css/post-13.css?ver=1769770107","fqdn":"metamaskwallet-restore.com","domain":"metamaskwallet-restore.com","tld":"com"},"ip":{"addr":"195.250.27.134","port":443,"asn":211126,"as":"WHG Hosting Services Ltd","country":"United Kingdom","country_code":"GB"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://metamaskwallet-restore.com/","date":"2026-01-30T12:11:28.336Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"www.metamaskwallet-restore.com","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Fri, 30 Jan 2026 02:04:32 GMT","end":"Thu, 30 Apr 2026 02:04:31 GMT"},"fingerprint":{"sha1":"82:70:2B:32:D3:3A:36:34:29:37:93:7F:98:95:47:45:77:5C:49:22","sha256":"84:75:E1:22:8E:81:BC:CD:DC:4D:E3:95:6A:07:41:CC:2A:4F:26:1C:75:58:8A:67:A1:7C:7E:BD:FB:8C:19:B0"}}},"request":{"raw":"GET /wp-content/uploads/elementor/css/post-13.css?ver=1769770107 HTTP/1.1\r\nHost: metamaskwallet-restore.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://metamaskwallet-restore.com/\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\ncache-control: public, max-age=604800\r\nexpires: Fri, 06 Feb 2026 12:11:28 GMT\r\ncontent-type: text/css\r\nlast-modified: Fri, 30 Jan 2026 10:48:27 GMT\r\naccept-ranges: bytes\r\ncontent-encoding: br\r\nvary: Accept-Encoding,User-Agent\r\ncontent-length: 343\r\ndate: Fri, 30 Jan 2026 12:11:28 GMT\r\nserver: LiteSpeed\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"LiteSpeed","description":"LiteSpeed is a high-scalability web server.","website":"https://litespeedtech.com","common_platform_enumeration":"cpe:2.3:a:litespeedtech:litespeed_web_server:*:*:*:*:*:*:*:*","icon":"LiteSpeed.svg","categories":["Web servers"]}],"data":{"size":1227,"size_decoded":0,"mime_type":"text/css","magic":"ASCII text, with very long lines (1227), with no line terminators","md5":"42076036cc12a25519df9cb0bd8175ed","sha1":"f047a1694acbfd74b22de241077bd978f8c19527","sha256":"992278103232e1a1880a0daa248d7fb21954d52aba8a0ea69d41d134e15d1668","sha512":"1e4085f1840d476447e1c7647611793ad6755fdd2af0d4d2acfa42cf8eea7d5308115e9411cae412b4b8af8502bf24e8de43c9e9f864b9f5be4e4abca7cff28b","ssdeep":"","tlshash":"c02124457a23e422e07b053f91c3b42c112cd45fa25fcedff81d9249f9bea4a2228643","first_seen":"2026-01-30T11:46:59.092085Z","last_seen":"2026-02-03T19:53:00.586591Z","times_seen":3,"resource_available":false,"data":null}},"time_used":176,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":176,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-01-30","alert":"Sinkholed","trigger":"metamaskwallet-restore.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"metamaskwallet-restore.com/wp-content/plugins/elementor/assets/css/widget-image.min.css?ver=3.34.4","fqdn":"metamaskwallet-restore.com","domain":"metamaskwallet-restore.com","tld":"com"},"ip":{"addr":"195.250.27.134","port":443,"asn":211126,"as":"WHG Hosting Services Ltd","country":"United Kingdom","country_code":"GB"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://metamaskwallet-restore.com/","date":"2026-01-30T12:11:28.344Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"www.metamaskwallet-restore.com","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Fri, 30 Jan 2026 02:04:32 GMT","end":"Thu, 30 Apr 2026 02:04:31 GMT"},"fingerprint":{"sha1":"82:70:2B:32:D3:3A:36:34:29:37:93:7F:98:95:47:45:77:5C:49:22","sha256":"84:75:E1:22:8E:81:BC:CD:DC:4D:E3:95:6A:07:41:CC:2A:4F:26:1C:75:58:8A:67:A1:7C:7E:BD:FB:8C:19:B0"}}},"request":{"raw":"GET /wp-content/plugins/elementor/assets/css/widget-image.min.css?ver=3.34.4 HTTP/1.1\r\nHost: metamaskwallet-restore.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://metamaskwallet-restore.com/\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\ncache-control: public, max-age=604800\r\nexpires: Fri, 06 Feb 2026 12:11:28 GMT\r\ncontent-type: text/css\r\nlast-modified: Fri, 30 Jan 2026 02:18:56 GMT\r\naccept-ranges: bytes\r\ncontent-encoding: br\r\nvary: Accept-Encoding,User-Agent\r\ncontent-length: 96\r\ndate: Fri, 30 Jan 2026 12:11:28 GMT\r\nserver: LiteSpeed\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"LiteSpeed","description":"LiteSpeed is a high-scalability web server.","website":"https://litespeedtech.com","common_platform_enumeration":"cpe:2.3:a:litespeedtech:litespeed_web_server:*:*:*:*:*:*:*:*","icon":"LiteSpeed.svg","categories":["Web servers"]}],"data":{"size":214,"size_decoded":0,"mime_type":"text/css","magic":"ASCII text, with no line terminators","md5":"12045858d487a8ae56337b554a5ee03c","sha1":"f002d465c77cc210b1a049da21d2d8dfb4bba080","sha256":"fb8690e594b2f9b841585895d811e8cb839667a1a63963d1a1cdea11e2aa2abb","sha512":"2d50371adad63f2b9b384b10b87546b85344fe46560b65f9321100515c257e6a147e1353946f8ef5c4300827a41ce6641c3cedc82c9f63847874c3aae39485ac","ssdeep":"","tlshash":"b2d0c901792783c6302f896926ab669e39d01dddf246db90aca166165abecc82772160","first_seen":"2025-01-03T10:53:39.937643Z","last_seen":"2026-05-31T11:23:51.513601Z","times_seen":92746,"resource_available":false,"data":null}},"time_used":162,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":162,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-01-30","alert":"Sinkholed","trigger":"metamaskwallet-restore.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"metamaskwallet-restore.com/wp-content/uploads/elementor/css/post-6.css?ver=1769772750","fqdn":"metamaskwallet-restore.com","domain":"metamaskwallet-restore.com","tld":"com"},"ip":{"addr":"195.250.27.134","port":443,"asn":211126,"as":"WHG Hosting Services Ltd","country":"United Kingdom","country_code":"GB"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://metamaskwallet-restore.com/","date":"2026-01-30T12:11:28.345Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"www.metamaskwallet-restore.com","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Fri, 30 Jan 2026 02:04:32 GMT","end":"Thu, 30 Apr 2026 02:04:31 GMT"},"fingerprint":{"sha1":"82:70:2B:32:D3:3A:36:34:29:37:93:7F:98:95:47:45:77:5C:49:22","sha256":"84:75:E1:22:8E:81:BC:CD:DC:4D:E3:95:6A:07:41:CC:2A:4F:26:1C:75:58:8A:67:A1:7C:7E:BD:FB:8C:19:B0"}}},"request":{"raw":"GET /wp-content/uploads/elementor/css/post-6.css?ver=1769772750 HTTP/1.1\r\nHost: metamaskwallet-restore.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://metamaskwallet-restore.com/\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\ncache-control: public, max-age=604800\r\nexpires: Fri, 06 Feb 2026 12:11:28 GMT\r\ncontent-type: text/css\r\nlast-modified: Fri, 30 Jan 2026 11:32:30 GMT\r\naccept-ranges: bytes\r\ncontent-encoding: br\r\nvary: Accept-Encoding,User-Agent\r\ncontent-length: 3595\r\ndate: Fri, 30 Jan 2026 12:11:28 GMT\r\nserver: LiteSpeed\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"LiteSpeed","description":"LiteSpeed is a high-scalability web server.","website":"https://litespeedtech.com","common_platform_enumeration":"cpe:2.3:a:litespeedtech:litespeed_web_server:*:*:*:*:*:*:*:*","icon":"LiteSpeed.svg","categories":["Web servers"]}],"data":{"size":64427,"size_decoded":0,"mime_type":"text/css","magic":"ASCII text, with very long lines (64427), with no line terminators","md5":"c1c4861fe9a56bf5b1690453755c97b5","sha1":"6bfc99c9dab9df6752de50c477c1c0c551dbb91f","sha256":"4965b18ac24420835b711a266edf252d261fd035d18fb9f716ca785483b00e24","sha512":"80bc5519ddac38c20841016922cad2e3741beed5cccf6b996312061157ffad3cc5ed82717bfe336818fe1f78908193a9d830df997d30b4516a28a312b9b233af","ssdeep":"768:gHgISN2UavUXUUkUi0UZY2Gqs8YgUrMUWUIUr2U/QHIUgrULUqxYUWUV3CHXvUa2:u","tlshash":"7a5349543d43176c722f502fc513ba9c62355ccad3ae67ebe8251527f87ac81b390b8a","first_seen":"2026-01-30T11:46:59.061176Z","last_seen":"2026-02-03T19:53:00.560798Z","times_seen":3,"resource_available":false,"data":null}},"time_used":146,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":142,"receive":4,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-01-30","alert":"Sinkholed","trigger":"metamaskwallet-restore.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"metamaskwallet-restore.com/wp-content/plugins/elementor/assets/js/frontend-modules.min.js?ver=3.34.4","fqdn":"metamaskwallet-restore.com","domain":"metamaskwallet-restore.com","tld":"com"},"ip":{"addr":"195.250.27.134","port":443,"asn":211126,"as":"WHG Hosting Services Ltd","country":"United Kingdom","country_code":"GB"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://metamaskwallet-restore.com/","date":"2026-01-30T12:11:28.368Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"www.metamaskwallet-restore.com","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Fri, 30 Jan 2026 02:04:32 GMT","end":"Thu, 30 Apr 2026 02:04:31 GMT"},"fingerprint":{"sha1":"82:70:2B:32:D3:3A:36:34:29:37:93:7F:98:95:47:45:77:5C:49:22","sha256":"84:75:E1:22:8E:81:BC:CD:DC:4D:E3:95:6A:07:41:CC:2A:4F:26:1C:75:58:8A:67:A1:7C:7E:BD:FB:8C:19:B0"}}},"request":{"raw":"GET /wp-content/plugins/elementor/assets/js/frontend-modules.min.js?ver=3.34.4 HTTP/1.1\r\nHost: metamaskwallet-restore.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://metamaskwallet-restore.com/\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\ncontent-type: text/javascript\r\nlast-modified: Fri, 30 Jan 2026 02:18:56 GMT\r\naccept-ranges: bytes\r\ncontent-encoding: br\r\nvary: Accept-Encoding,User-Agent\r\ncontent-length: 15420\r\ndate: Fri, 30 Jan 2026 12:11:28 GMT\r\nserver: LiteSpeed\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"LiteSpeed","description":"LiteSpeed is a high-scalability web server.","website":"https://litespeedtech.com","common_platform_enumeration":"cpe:2.3:a:litespeedtech:litespeed_web_server:*:*:*:*:*:*:*:*","icon":"LiteSpeed.svg","categories":["Web servers"]}],"data":{"size":50503,"size_decoded":0,"mime_type":"text/javascript","magic":"JavaScript source, Unicode text, UTF-8 text, with very long lines (50502), with no line terminators","md5":"73c07e9630db2adbba0c6bc0bf568719","sha1":"dbeb1065ce0ea1fc9fa6b9df9e5e1700a8dee09e","sha256":"f4bdadf362076967230901fdfc69c8df84957f6615dec226b99ad2abb64c2c76","sha512":"d48774149b65604aeee68cf2936bfe5c84714bab61a46a190952b595ee79ce8aa2c0549a3755768b3a3615c2b6abe0cfdc69c398a77296b8ceebc69bfea8f8dd","ssdeep":"1536:yuyQ5RSSYeAjA6c9CST+I83Fy0K4cR8+yhiA2pXSz2faNQAzeLHeBHmjkVziNT:C+uhIAu","tlshash":"cf33d9853652f4b70beb45da902f440af25718a8a40df4d5bfe9dce194b0d8e133ab78","first_seen":"2026-01-29T11:04:52.803648Z","last_seen":"2026-05-31T11:07:36.428387Z","times_seen":27976,"resource_available":true,"data":null}},"time_used":432,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":416,"receive":16,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-01-30","alert":"Sinkholed","trigger":"metamaskwallet-restore.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"metamaskwallet-restore.com/wp-content/uploads/2020/11/bg-003-free-img.png","fqdn":"metamaskwallet-restore.com","domain":"metamaskwallet-restore.com","tld":"com"},"ip":{"addr":"195.250.27.134","port":443,"asn":211126,"as":"WHG Hosting Services Ltd","country":"United Kingdom","country_code":"GB"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://metamaskwallet-restore.com/","date":"2026-01-30T12:11:28.781Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"www.metamaskwallet-restore.com","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Fri, 30 Jan 2026 02:04:32 GMT","end":"Thu, 30 Apr 2026 02:04:31 GMT"},"fingerprint":{"sha1":"82:70:2B:32:D3:3A:36:34:29:37:93:7F:98:95:47:45:77:5C:49:22","sha256":"84:75:E1:22:8E:81:BC:CD:DC:4D:E3:95:6A:07:41:CC:2A:4F:26:1C:75:58:8A:67:A1:7C:7E:BD:FB:8C:19:B0"}}},"request":{"raw":"GET /wp-content/uploads/2020/11/bg-003-free-img.png HTTP/1.1\r\nHost: metamaskwallet-restore.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://metamaskwallet-restore.com/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\ncache-control: public, max-age=604800\r\nexpires: Fri, 06 Feb 2026 12:11:28 GMT\r\ncontent-type: image/png\r\nlast-modified: Fri, 30 Jan 2026 10:07:37 GMT\r\naccept-ranges: bytes\r\ncontent-length: 468\r\ndate: Fri, 30 Jan 2026 12:11:28 GMT\r\nserver: LiteSpeed\r\nvary: User-Agent\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"LiteSpeed","description":"LiteSpeed is a high-scalability web server.","website":"https://litespeedtech.com","common_platform_enumeration":"cpe:2.3:a:litespeedtech:litespeed_web_server:*:*:*:*:*:*:*:*","icon":"LiteSpeed.svg","categories":["Web servers"]}],"data":{"size":468,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 768 x 1024, 1-bit colormap, non-interlaced","md5":"1a6a7d083d5a7b65585dffd00a4be6e8","sha1":"3bc8432be920fc2b8bff5dffcccf3202d816c2de","sha256":"a91ce1fa008e987e5bf6b412d672571407fce67a5876da45b26433b05d131ee8","sha512":"5225c97f28d822ffb29d441321560840f9ffb7cb9425af2cdba6f5bb954acf9e72d3cb2db8ac26c24572ba7908fa6c079e1e7f4e7ad0ec0e9fe145f33c7c855a","ssdeep":"","tlshash":"29f08c8d5290c678cb24023597c220a8bf3d40003924518e21f6d0ab26220bccd58fd9","first_seen":"2023-05-10T07:30:16Z","last_seen":"2026-05-30T06:33:08.263043Z","times_seen":38,"resource_available":false,"data":null}},"time_used":159,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":159,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-01-30","alert":"Sinkholed","trigger":"metamaskwallet-restore.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"fonts.gstatic.com/s/roboto/v50/KFO7CnqEu92Fr1ME7kSn66aGLdTylUAMa3yUBA.woff2","fqdn":"fonts.gstatic.com","domain":"gstatic.com","tld":"com"},"ip":{"addr":"142.250.74.3","port":443,"asn":15169,"as":"GOOGLE","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"font","requested_by":"https://metamaskwallet-restore.com/","date":"2026-01-30T12:11:28.812Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.gstatic.com","organization":""},"issuer":{"commonName":"WR2","organization":"Google Trust Services"},"validity":{"start":"Mon, 29 Dec 2025 19:52:23 GMT","end":"Mon, 23 Mar 2026 19:52:22 GMT"},"fingerprint":{"sha1":"5A:74:FC:38:D2:7B:9B:E5:E5:0D:67:25:F4:73:BC:BA:2E:12:A7:FD","sha256":"3B:19:CD:BE:44:E6:EE:DC:8D:33:2B:A2:1C:E4:13:F8:6F:7E:2E:52:5D:0E:75:F3:1A:ED:21:1B:7A:B7:2E:BA"}}},"request":{"raw":"GET /s/roboto/v50/KFO7CnqEu92Fr1ME7kSn66aGLdTylUAMa3yUBA.woff2 HTTP/1.1\r\nHost: fonts.gstatic.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: identity\r\nOrigin: https://metamaskwallet-restore.com\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://fonts.googleapis.com/\r\nSec-Fetch-Dest: font\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\naccept-ranges: bytes\r\naccess-control-allow-origin: *\r\ncontent-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes\r\ncross-origin-resource-policy: cross-origin\r\ncross-origin-opener-policy: same-origin; report-to=\"apps-themes\"\r\nreport-to: {\"group\":\"apps-themes\",\"max_age\":2592000,\"endpoints\":[{\"url\":\"https://csp.withgoogle.com/csp/report-to/apps-themes\"}]}\r\ntiming-allow-origin: *\r\ncontent-length: 40128\r\nx-content-type-options: nosniff\r\nserver: sffe\r\nx-xss-protection: 0\r\ndate: Sat, 24 Jan 2026 18:37:38 GMT\r\nexpires: Sun, 24 Jan 2027 18:37:38 GMT\r\ncache-control: public, max-age=31536000\r\nage: 495230\r\nlast-modified: Tue, 18 Nov 2025 19:00:07 GMT\r\ncontent-type: font/woff2\r\nalt-svc: h3=\":443\"; ma=2592000,h3-29=\":443\"; ma=2592000\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":null,"data":{"size":40128,"size_decoded":0,"mime_type":"font/woff2","magic":"Web Open Font Format (Version 2), TrueType, length 40128, version 1.0","md5":"9a01b69183a9604ab3a439e388b30501","sha1":"8ed1d59003d0dbe6360481017b44665153665fbe","sha256":"20b535fa80c8189e3b87d1803038389960203a886d502bc2ef1857affc2f38d2","sha512":"0e6795255b6eea00b5403fd7e3b904d52776d49ac63a31c2778361262883697943aedcb29feee85694ba6f19eaa34dddb9a5bfe7118f4a25b4757e92c331feca","ssdeep":"768:Vce3jkow68wmT4IBX0tXdlSirS61gSjcz0GPwHbP+w2jec56O:VcI/iEEEtXdFJj+0GPwHbP+w5rO","tlshash":"3703023a5e3ccf1a84157a703950f6d9a8481e548e9d143b4f1ac7bf085dde2209b6d4","first_seen":"2025-01-08T22:59:02.845106Z","last_seen":"2026-05-31T11:22:56.44886Z","times_seen":858185,"resource_available":false,"data":null}},"time_used":143,"timings":{"blocked":64,"dns":1,"connect":8,"send":0,"wait":9,"receive":3,"ssl":53},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"metamaskwallet-restore.com/wp-content/plugins/elementor-pro/assets/css/widget-blockquote.min.css?ver=3.25.0","fqdn":"metamaskwallet-restore.com","domain":"metamaskwallet-restore.com","tld":"com"},"ip":{"addr":"195.250.27.134","port":443,"asn":211126,"as":"WHG Hosting Services Ltd","country":"United Kingdom","country_code":"GB"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://metamaskwallet-restore.com/","date":"2026-01-30T12:11:28.354Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"www.metamaskwallet-restore.com","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Fri, 30 Jan 2026 02:04:32 GMT","end":"Thu, 30 Apr 2026 02:04:31 GMT"},"fingerprint":{"sha1":"82:70:2B:32:D3:3A:36:34:29:37:93:7F:98:95:47:45:77:5C:49:22","sha256":"84:75:E1:22:8E:81:BC:CD:DC:4D:E3:95:6A:07:41:CC:2A:4F:26:1C:75:58:8A:67:A1:7C:7E:BD:FB:8C:19:B0"}}},"request":{"raw":"GET /wp-content/plugins/elementor-pro/assets/css/widget-blockquote.min.css?ver=3.25.0 HTTP/1.1\r\nHost: metamaskwallet-restore.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://metamaskwallet-restore.com/\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\ncache-control: public, max-age=604800\r\nexpires: Fri, 06 Feb 2026 12:11:28 GMT\r\ncontent-type: text/css\r\nlast-modified: Fri, 30 Jan 2026 03:08:11 GMT\r\naccept-ranges: bytes\r\ncontent-encoding: br\r\nvary: Accept-Encoding,User-Agent\r\ncontent-length: 962\r\ndate: Fri, 30 Jan 2026 12:11:28 GMT\r\nserver: LiteSpeed\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"LiteSpeed","description":"LiteSpeed is a high-scalability web server.","website":"https://litespeedtech.com","common_platform_enumeration":"cpe:2.3:a:litespeedtech:litespeed_web_server:*:*:*:*:*:*:*:*","icon":"LiteSpeed.svg","categories":["Web servers"]}],"data":{"size":5238,"size_decoded":0,"mime_type":"text/css","magic":"Unicode text, UTF-8 text, with very long lines (5191), with CRLF line terminators","md5":"c2a011f76930a6595d8f48fcee29077d","sha1":"1e00b9e3fc5359713e1a2097f0cf51a2c2b9211e","sha256":"7d4dc55fda477f5d6bc8a25e3ec601f306bcc0e921092fdf8737a916737d0918","sha512":"26fd49c440d9e4a07700e89e50fd3cc1fa522d07609ef89cbaee62db2c06c8aaea905e7a0f4c748d5f4aa9f03ea88dc82d1e4cad3f595520525bfabcbd34a4a4","ssdeep":"96:BMTOXwYzqOcHH+VF0LXNhvcxiMChtGt0hlNhjUM:rwecn+3KXNhvcxiMChtGt0hlZ","tlshash":"35b1bd9e786362a9036f820a6d43e1b8615054d4d88233d0ed76d187f5ed9f833e63ab","first_seen":"2026-01-30T11:46:59.071491Z","last_seen":"2026-03-02T13:45:29.602127Z","times_seen":6,"resource_available":false,"data":null}},"time_used":296,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":295,"receive":1,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-01-30","alert":"Sinkholed","trigger":"metamaskwallet-restore.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"metamaskwallet-restore.com/wp-content/plugins/elementor-pro/assets/css/widget-mega-menu.min.css?ver=3.26.2","fqdn":"metamaskwallet-restore.com","domain":"metamaskwallet-restore.com","tld":"com"},"ip":{"addr":"195.250.27.134","port":443,"asn":211126,"as":"WHG Hosting Services Ltd","country":"United Kingdom","country_code":"GB"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://metamaskwallet-restore.com/","date":"2026-01-30T12:11:28.355Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"www.metamaskwallet-restore.com","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Fri, 30 Jan 2026 02:04:32 GMT","end":"Thu, 30 Apr 2026 02:04:31 GMT"},"fingerprint":{"sha1":"82:70:2B:32:D3:3A:36:34:29:37:93:7F:98:95:47:45:77:5C:49:22","sha256":"84:75:E1:22:8E:81:BC:CD:DC:4D:E3:95:6A:07:41:CC:2A:4F:26:1C:75:58:8A:67:A1:7C:7E:BD:FB:8C:19:B0"}}},"request":{"raw":"GET /wp-content/plugins/elementor-pro/assets/css/widget-mega-menu.min.css?ver=3.26.2 HTTP/1.1\r\nHost: metamaskwallet-restore.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://metamaskwallet-restore.com/\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\ncache-control: public, max-age=604800\r\nexpires: Fri, 06 Feb 2026 12:11:28 GMT\r\ncontent-type: text/css\r\nlast-modified: Fri, 30 Jan 2026 03:08:11 GMT\r\naccept-ranges: bytes\r\ncontent-encoding: br\r\nvary: Accept-Encoding,User-Agent\r\ncontent-length: 2689\r\ndate: Fri, 30 Jan 2026 12:11:28 GMT\r\nserver: LiteSpeed\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"LiteSpeed","description":"LiteSpeed is a high-scalability web server.","website":"https://litespeedtech.com","common_platform_enumeration":"cpe:2.3:a:litespeedtech:litespeed_web_server:*:*:*:*:*:*:*:*","icon":"LiteSpeed.svg","categories":["Web servers"]}],"data":{"size":19788,"size_decoded":0,"mime_type":"text/css","magic":"ASCII text, with very long lines (19743), with CRLF line terminators","md5":"d1a3614301c196929a919d4d04c642d2","sha1":"c065d581a66dec163455325789c5e9aa08d39507","sha256":"7c45740559999af547ba641cf724a2e9d97beb54f5f5d342950bc183e415ee53","sha512":"6c3d99f7b9354f19505dd19f8e068cd1761d7b6cd5f717be09ba87f206eccaf4c4b1c890c899743fb9f8116f1107340b65c8a0102b48c35ed80a9cce62725f28","ssdeep":"192:9MW1QG+jfq/QSha6Jb5mLY+D5tMh1Zbtb6zkQBKVkyd43g:9dQGKfq/5w6oYJh1FN6gAKVk4Z","tlshash":"4b92dbc0b8d3c022161faa5903daed2d97b97890dbc548d0a875c5061edffe3a2d0a37","first_seen":"2026-01-30T11:46:59.106643Z","last_seen":"2026-05-15T06:38:43.146515Z","times_seen":9,"resource_available":false,"data":null}},"time_used":299,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":296,"receive":3,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-01-30","alert":"Sinkholed","trigger":"metamaskwallet-restore.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"metamaskwallet-restore.com/wp-content/uploads/2020/11/bg-05-free-img.png","fqdn":"metamaskwallet-restore.com","domain":"metamaskwallet-restore.com","tld":"com"},"ip":{"addr":"195.250.27.134","port":443,"asn":211126,"as":"WHG Hosting Services Ltd","country":"United Kingdom","country_code":"GB"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://metamaskwallet-restore.com/","date":"2026-01-30T12:11:28.778Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"www.metamaskwallet-restore.com","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Fri, 30 Jan 2026 02:04:32 GMT","end":"Thu, 30 Apr 2026 02:04:31 GMT"},"fingerprint":{"sha1":"82:70:2B:32:D3:3A:36:34:29:37:93:7F:98:95:47:45:77:5C:49:22","sha256":"84:75:E1:22:8E:81:BC:CD:DC:4D:E3:95:6A:07:41:CC:2A:4F:26:1C:75:58:8A:67:A1:7C:7E:BD:FB:8C:19:B0"}}},"request":{"raw":"GET /wp-content/uploads/2020/11/bg-05-free-img.png HTTP/1.1\r\nHost: metamaskwallet-restore.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://metamaskwallet-restore.com/wp-content/uploads/elementor/css/post-6.css?ver=1769772750\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\ncache-control: public, max-age=604800\r\nexpires: Fri, 06 Feb 2026 12:11:28 GMT\r\ncontent-type: image/png\r\nlast-modified: Fri, 30 Jan 2026 10:07:37 GMT\r\naccept-ranges: bytes\r\ncontent-length: 17427\r\ndate: Fri, 30 Jan 2026 12:11:28 GMT\r\nserver: LiteSpeed\r\nvary: User-Agent\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"LiteSpeed","description":"LiteSpeed is a high-scalability web server.","website":"https://litespeedtech.com","common_platform_enumeration":"cpe:2.3:a:litespeedtech:litespeed_web_server:*:*:*:*:*:*:*:*","icon":"LiteSpeed.svg","categories":["Web servers"]}],"data":{"size":17427,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 319 x 396, 8-bit colormap, non-interlaced","md5":"518d1eba1220b23fe6bf2d8cadf0c7c1","sha1":"23f8dd1fd889b942130d561eeb4e1ea7e9a20d59","sha256":"a8c9f4165970793e753ab70b71d77e8828f252cea8484747e9314042f1383f99","sha512":"855ba4f9107585b802c1baf4694217683b584f93507d8813d983e767025d011c429863b6cda74dadc6415f3299a67014b98424c1b9c1244e0473da2b000d843c","ssdeep":"384:0JGEgqJRps8yimSUT2PgkF2B4ehFsIYjgP:0bT283qT2PgkF2DhCjO","tlshash":"c172d0e43535678606ce3ab035ba1aaccfd60d2265e205129ed31e1686037b59cf1d7f","first_seen":"2023-05-10T07:30:16Z","last_seen":"2026-05-30T06:33:08.163998Z","times_seen":18,"resource_available":false,"data":null}},"time_used":164,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":154,"receive":10,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-01-30","alert":"Sinkholed","trigger":"metamaskwallet-restore.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"metamaskwallet-restore.com/","fqdn":"metamaskwallet-restore.com","domain":"metamaskwallet-restore.com","tld":"com"},"ip":{"addr":"195.250.27.134","port":443,"asn":211126,"as":"WHG Hosting Services Ltd","country":"United Kingdom","country_code":"GB"},"is_navigation_request":true,"resource_type":"document","requested_by":"","date":"2026-01-30T12:11:27.344Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"www.metamaskwallet-restore.com","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Fri, 30 Jan 2026 02:04:32 GMT","end":"Thu, 30 Apr 2026 02:04:31 GMT"},"fingerprint":{"sha1":"82:70:2B:32:D3:3A:36:34:29:37:93:7F:98:95:47:45:77:5C:49:22","sha256":"84:75:E1:22:8E:81:BC:CD:DC:4D:E3:95:6A:07:41:CC:2A:4F:26:1C:75:58:8A:67:A1:7C:7E:BD:FB:8C:19:B0"}}},"request":{"raw":"GET / HTTP/1.1\r\nHost: metamaskwallet-restore.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nUpgrade-Insecure-Requests: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: document\r\nSec-Fetch-Mode: navigate\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ncontent-type: text/html; charset=UTF-8\r\nlink: \u003chttps://metamaskwallet-restore.com/wp-json/\u003e; rel=\"https://api.w.org/\", \u003chttps://metamaskwallet-restore.com/wp-json/wp/v2/pages/6\u003e; rel=\"alternate\"; title=\"JSON\"; type=\"application/json\", \u003chttps://metamaskwallet-restore.com/\u003e; rel=shortlink\r\ncontent-encoding: br\r\nvary: Accept-Encoding,User-Agent\r\ndate: Fri, 30 Jan 2026 12:11:27 GMT\r\nserver: LiteSpeed\r\nalt-svc: h3=\":443\"; ma=2592000, h3-29=\":443\"; ma=2592000, h3-Q050=\":443\"; ma=2592000, h3-Q046=\":443\"; ma=2592000, h3-Q043=\":443\"; ma=2592000, quic=\":443\"; ma=2592000; v=\"43,46\"\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"MySQL","description":"MySQL is an open-source relational database management system.","website":"https://mysql.com","common_platform_enumeration":"cpe:2.3:a:mysql:mysql:*:*:*:*:*:*:*:*","icon":"MySQL.svg","categories":["Databases"]},{"name":"LiteSpeed","description":"LiteSpeed is a high-scalability web server.","website":"https://litespeedtech.com","common_platform_enumeration":"cpe:2.3:a:litespeedtech:litespeed_web_server:*:*:*:*:*:*:*:*","icon":"LiteSpeed.svg","categories":["Web servers"]},{"name":"Font Awesome","description":"Font Awesome is a font and icon toolkit based on CSS and Less.","website":"https://fontawesome.com/","common_platform_enumeration":"","icon":"Font Awesome.svg","categories":["Font scripts"]},{"name":"jQuery Migrate:3.4.1","description":"Query Migrate is a javascript library that allows you to preserve the compatibility of your jQuery code developed for versions of jQuery older than 1.9.","website":"https://github.com/jquery/jquery-migrate","common_platform_enumeration":"","icon":"jQuery.svg","categories":["JavaScript libraries"]},{"name":"jQuery","description":"jQuery is a JavaScript library which is a free, open-source software designed to simplify HTML DOM tree traversal and manipulation, as well as event handling, CSS animation, and Ajax.","website":"https://jquery.com","common_platform_enumeration":"cpe:2.3:a:jquery:jquery:*:*:*:*:*:*:*:*","icon":"jQuery.svg","categories":["JavaScript libraries"]},{"name":"Elementor:3.34.4","description":"Elementor is a website builder platform for professionals on WordPress.","website":"https://elementor.com","common_platform_enumeration":"","icon":"Elementor.svg","categories":["Page builders","WordPress plugins"]},{"name":"WPForms:1.8.7.2","description":"WPForms is a drag and drop WordPress form builder.","website":"https://wpforms.com","common_platform_enumeration":"","icon":"WPForms.svg","categories":["WordPress plugins","Form builders"]},{"name":"PHP","description":"PHP is a general-purpose scripting language used for web development.","website":"https://php.net","common_platform_enumeration":"cpe:2.3:a:php:php:*:*:*:*:*:*:*:*","icon":"PHP.svg","categories":["Programming languages"]},{"name":"WordPress:6.9","description":"WordPress is a free and open-source content management system written in PHP and paired with a MySQL or MariaDB database. Features include a plugin architecture and a template system.","website":"https://wordpress.org","common_platform_enumeration":"cpe:2.3:a:wordpress:wordpress:*:*:*:*:*:*:*:*","icon":"WordPress.svg","categories":["CMS","Blogs"]},{"name":"Underscore.js:1.13.7","description":"Underscore.js is a JavaScript library which provides utility functions for common programming tasks. It is comparable to features provided by Prototype.js and the Ruby language, but opts for a functional programming design instead of extending object prototypes.","website":"https://underscorejs.org","common_platform_enumeration":"","icon":"Underscore.js.png","categories":["JavaScript libraries"]}],"data":{"size":173356,"size_decoded":0,"mime_type":"text/html; charset=UTF-8","magic":"HTML document, ASCII text, with very long lines (60816)","md5":"4ae13e0152880b8f4b0c9e6e8bc5ef74","sha1":"235424b277671f4167052d1bf51d7227d47b62da","sha256":"20bdeaaf9d6f1e57c0d79bd365d5f307b05b0ce0a0f4f548fd667eba52e91a76","sha512":"cf2fecd52fccc9002fdb8503458f9b32579463659b42778eb523c2f87e8f178af4eb56a1adb9a0755d851f8581559ea5334c8141b51b7838f46464e50537a701","ssdeep":"3072:KU2g7slLgJo5k94JwT2TDGAQFA11G0hpLMMPMa:Z2N5t","tlshash":"5604e660bb502979312b036ff057b61c51aaee97d74d66f5f4fe801885e9fc230b221a","first_seen":"2026-01-30T12:11:56.129954Z","last_seen":"2026-01-30T12:11:56.129954Z","times_seen":1,"resource_available":false,"data":null}},"time_used":1073,"timings":{"blocked":299,"dns":1,"connect":146,"send":0,"wait":474,"receive":0,"ssl":151},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-01-30","alert":"Sinkholed","trigger":"metamaskwallet-restore.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"metamaskwallet-restore.com/wp-content/uploads/astra-addon/astra-addon-697c98f1d6e3f8-29402264.js?ver=4.12.0","fqdn":"metamaskwallet-restore.com","domain":"metamaskwallet-restore.com","tld":"com"},"ip":{"addr":"195.250.27.134","port":443,"asn":211126,"as":"WHG Hosting Services Ltd","country":"United Kingdom","country_code":"GB"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://metamaskwallet-restore.com/","date":"2026-01-30T12:11:28.370Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"www.metamaskwallet-restore.com","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Fri, 30 Jan 2026 02:04:32 GMT","end":"Thu, 30 Apr 2026 02:04:31 GMT"},"fingerprint":{"sha1":"82:70:2B:32:D3:3A:36:34:29:37:93:7F:98:95:47:45:77:5C:49:22","sha256":"84:75:E1:22:8E:81:BC:CD:DC:4D:E3:95:6A:07:41:CC:2A:4F:26:1C:75:58:8A:67:A1:7C:7E:BD:FB:8C:19:B0"}}},"request":{"raw":"GET /wp-content/uploads/astra-addon/astra-addon-697c98f1d6e3f8-29402264.js?ver=4.12.0 HTTP/1.1\r\nHost: metamaskwallet-restore.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://metamaskwallet-restore.com/\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\ncontent-type: text/javascript\r\nlast-modified: Fri, 30 Jan 2026 11:41:37 GMT\r\naccept-ranges: bytes\r\ncontent-encoding: br\r\nvary: Accept-Encoding,User-Agent\r\ncontent-length: 4504\r\ndate: Fri, 30 Jan 2026 12:11:28 GMT\r\nserver: LiteSpeed\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"LiteSpeed","description":"LiteSpeed is a high-scalability web server.","website":"https://litespeedtech.com","common_platform_enumeration":"cpe:2.3:a:litespeedtech:litespeed_web_server:*:*:*:*:*:*:*:*","icon":"LiteSpeed.svg","categories":["Web servers"]}],"data":{"size":17509,"size_decoded":0,"mime_type":"text/javascript","magic":"JavaScript source, ASCII text, with very long lines (17509), with no line terminators","md5":"ecfe37e0b696a440b61d1d5f533d5e7b","sha1":"59396f8c29afd35be67acbaffd2557b2d1d1e503","sha256":"8f0e6fe1c26bacabee3b460a3c819f73cd04254c0954ceed14c175105f57b1cb","sha512":"5a888c2fdeeaa681b9c59dc7cd4a54d865871ab2b622804a1a0f73bba893367178f4fa50911dc82f96bb0372a05fc10b37883ad6b65d521955e314ebbb280065","ssdeep":"384:taJI2Ic4uAuripyE5V3yCrtmlOPD7G7VRPV89LLE3XxAEx5WiTEDjtcg/eWhcDEF:t0I2Ic4uowE5Vi8mIPORPV89LLE3XxAx","tlshash":"9f72e8683314727b00bb07d2f4ab6b88b2728a3ee65d0051755dc8af18d4f9265e2f7d","first_seen":"2026-01-07T00:55:52.36487Z","last_seen":"2026-05-24T14:58:54.080342Z","times_seen":93,"resource_available":true,"data":null}},"time_used":452,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":449,"receive":3,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-01-30","alert":"Sinkholed","trigger":"metamaskwallet-restore.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"metamaskwallet-restore.com/wp-content/plugins/elementor-pro/assets/js/elements-handlers.min.js?ver=3.34.1","fqdn":"metamaskwallet-restore.com","domain":"metamaskwallet-restore.com","tld":"com"},"ip":{"addr":"195.250.27.134","port":443,"asn":211126,"as":"WHG Hosting Services Ltd","country":"United Kingdom","country_code":"GB"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://metamaskwallet-restore.com/","date":"2026-01-30T12:11:28.375Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"www.metamaskwallet-restore.com","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Fri, 30 Jan 2026 02:04:32 GMT","end":"Thu, 30 Apr 2026 02:04:31 GMT"},"fingerprint":{"sha1":"82:70:2B:32:D3:3A:36:34:29:37:93:7F:98:95:47:45:77:5C:49:22","sha256":"84:75:E1:22:8E:81:BC:CD:DC:4D:E3:95:6A:07:41:CC:2A:4F:26:1C:75:58:8A:67:A1:7C:7E:BD:FB:8C:19:B0"}}},"request":{"raw":"GET /wp-content/plugins/elementor-pro/assets/js/elements-handlers.min.js?ver=3.34.1 HTTP/1.1\r\nHost: metamaskwallet-restore.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://metamaskwallet-restore.com/\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\ncontent-type: text/javascript\r\nlast-modified: Fri, 30 Jan 2026 03:08:11 GMT\r\naccept-ranges: bytes\r\ncontent-encoding: br\r\nvary: Accept-Encoding,User-Agent\r\ncontent-length: 10097\r\ndate: Fri, 30 Jan 2026 12:11:28 GMT\r\nserver: LiteSpeed\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"LiteSpeed","description":"LiteSpeed is a high-scalability web server.","website":"https://litespeedtech.com","common_platform_enumeration":"cpe:2.3:a:litespeedtech:litespeed_web_server:*:*:*:*:*:*:*:*","icon":"LiteSpeed.svg","categories":["Web servers"]}],"data":{"size":44259,"size_decoded":0,"mime_type":"text/javascript","magic":"JavaScript source, ASCII text, with very long lines (44214), with CRLF line terminators","md5":"75335041fd6f5d627ddc3475811aea8c","sha1":"8c3199226b96d5889bd4398d46ac209eb1d0ddef","sha256":"31b996586b2f1ca12e0aa6f59393364c7ba328449643d621a91fbd742aeccaf3","sha512":"0838bd06fc600eee50bf09a3bac2cc4815aab592ef0a913e4a2d83d7b3dd27bfad8591ee0113895609e49074562ad54a2b30708150c9b1551e88a60d32f1b1e2","ssdeep":"768:3/Xt95D1+WE9A5yLce/J9d0dbdTdGdadWdDdILdUd1dvd6dfdMdxdndTdiePm7La:ftDD1+WE9A5yLcWJ9mBtIoERuWfRMBK7","tlshash":"9413955171aaca2941cf84abf463164fb7225c9cf413f0e67afc8d82b564e87a390731","first_seen":"2026-01-21T13:53:51.822148Z","last_seen":"2026-05-27T00:25:20.739813Z","times_seen":111,"resource_available":true,"data":null}},"time_used":472,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":464,"receive":8,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-01-30","alert":"Sinkholed","trigger":"metamaskwallet-restore.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"metamaskwallet-restore.com/wp-includes/js/underscore.min.js?ver=1.13.7","fqdn":"metamaskwallet-restore.com","domain":"metamaskwallet-restore.com","tld":"com"},"ip":{"addr":"195.250.27.134","port":443,"asn":211126,"as":"WHG Hosting Services Ltd","country":"United Kingdom","country_code":"GB"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://metamaskwallet-restore.com/","date":"2026-01-30T12:11:28.376Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"www.metamaskwallet-restore.com","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Fri, 30 Jan 2026 02:04:32 GMT","end":"Thu, 30 Apr 2026 02:04:31 GMT"},"fingerprint":{"sha1":"82:70:2B:32:D3:3A:36:34:29:37:93:7F:98:95:47:45:77:5C:49:22","sha256":"84:75:E1:22:8E:81:BC:CD:DC:4D:E3:95:6A:07:41:CC:2A:4F:26:1C:75:58:8A:67:A1:7C:7E:BD:FB:8C:19:B0"}}},"request":{"raw":"GET /wp-includes/js/underscore.min.js?ver=1.13.7 HTTP/1.1\r\nHost: metamaskwallet-restore.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://metamaskwallet-restore.com/\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\ncontent-type: text/javascript\r\nlast-modified: Thu, 06 Feb 2025 17:27:26 GMT\r\naccept-ranges: bytes\r\ncontent-encoding: br\r\nvary: Accept-Encoding,User-Agent\r\ncontent-length: 7185\r\ndate: Fri, 30 Jan 2026 12:11:28 GMT\r\nserver: LiteSpeed\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"LiteSpeed","description":"LiteSpeed is a high-scalability web server.","website":"https://litespeedtech.com","common_platform_enumeration":"cpe:2.3:a:litespeedtech:litespeed_web_server:*:*:*:*:*:*:*:*","icon":"LiteSpeed.svg","categories":["Web servers"]}],"data":{"size":18905,"size_decoded":0,"mime_type":"text/javascript","magic":"JavaScript source, ASCII text, with very long lines (18870)","md5":"dadb3f410026822807858737cbc7b64c","sha1":"477bafdb06d8dc0c22ada8d30067b5a0af2d79b4","sha256":"2f61c0b3d5a147bae06a4f6fd7d90031ddf39cba37e17926999b2645ac746a14","sha512":"1f6cfaf7978f2bd30503abaed49c193625e9a204ce359806449558d0caf09cae7dd10d2156e25f61b8f49efc3b7420b1332a480990da94f5a2ea3d30c262e8bf","ssdeep":"384:u2Rq5yjN1V02mEHrJDzWpl0bMpOt3PPD71ijeE9OWj:LqIbV0sHGl0dD71Uj","tlshash":"288281c83ac2f05aa76330b5406f508bf23a3ea16cada840c265e4f8bd7445d9137d6d","first_seen":"2025-04-01T10:25:57.91067Z","last_seen":"2026-05-31T10:34:44.402599Z","times_seen":113040,"resource_available":true,"data":null}},"time_used":473,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":254,"receive":219,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-01-30","alert":"Sinkholed","trigger":"metamaskwallet-restore.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"fonts.googleapis.com/css?family=Roboto%3A400%2C%7CNoto+Sans%3A700%2C\u0026display=fallback\u0026ver=4.12.1","fqdn":"fonts.googleapis.com","domain":"fonts.googleapis.com","tld":"googleapis.com"},"ip":{"addr":"216.58.211.10","port":443,"asn":15169,"as":"GOOGLE","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://metamaskwallet-restore.com/","date":"2026-01-30T12:11:28.322Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"upload.video.google.com","organization":""},"issuer":{"commonName":"WR2","organization":"Google Trust Services"},"validity":{"start":"Mon, 29 Dec 2025 19:52:24 GMT","end":"Mon, 23 Mar 2026 19:52:23 GMT"},"fingerprint":{"sha1":"43:39:AF:0A:74:F9:2F:1B:C0:1E:4E:89:21:30:C2:28:EC:9F:6C:67","sha256":"EA:F1:0E:C7:36:18:F3:9D:D1:D5:34:23:44:7D:6F:9D:2F:61:C7:81:09:9E:E9:C8:02:C8:F2:2C:0A:83:B3:A5"}}},"request":{"raw":"GET /css?family=Roboto%3A400%2C%7CNoto+Sans%3A700%2C\u0026display=fallback\u0026ver=4.12.1 HTTP/1.1\r\nHost: fonts.googleapis.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://metamaskwallet-restore.com/\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ncontent-type: text/css; charset=utf-8\r\nvary: Sec-Fetch-Dest, Sec-Fetch-Mode, Sec-Fetch-Site\r\naccess-control-allow-origin: *\r\ntiming-allow-origin: *\r\nlink: \u003chttps://fonts.gstatic.com\u003e; rel=preconnect; crossorigin\r\nstrict-transport-security: max-age=31536000\r\nexpires: Fri, 30 Jan 2026 12:11:28 GMT\r\ndate: Fri, 30 Jan 2026 12:11:28 GMT\r\ncache-control: private, max-age=86400\r\ncross-origin-resource-policy: cross-origin\r\ncross-origin-opener-policy: same-origin-allow-popups\r\ncontent-encoding: gzip\r\nserver: ESF\r\nx-xss-protection: 0\r\nx-frame-options: SAMEORIGIN\r\nx-content-type-options: nosniff\r\nalt-svc: h3=\":443\"; ma=2592000,h3-29=\":443\"; ma=2592000\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":9063,"size_decoded":0,"mime_type":"text/css; charset=utf-8","magic":"ASCII text, with very long lines (1572)","md5":"a517ea17478d10c9ca10a0da0b96fa4b","sha1":"69b20953e0500014680c59f67eb19d68fcce5c7c","sha256":"498a4cf89b07fcd667041d97602f973afba7fcf993491e74bd790448441404fa","sha512":"a037300667665656a0970efec958f2cb94e4eb6f84674611ab09f039a0b1673c76b1ec9610d8edec09b69b9156ed18439c77346a95333e1386a6aead3cc139a9","ssdeep":"192:ky0RbMu3J0SiRNjbN7NKNXhNbqWNtbqGIwV4ENWNZdNS:POEjhBwHecJqY4CchS","tlshash":"d6122f61041b80449b839cd627cfbf32fe2e92116054d1b9abfc9a5a9ce7c6a437075d","first_seen":"2025-11-24T03:42:42.454983Z","last_seen":"2026-02-14T04:55:02.273169Z","times_seen":13,"resource_available":false,"data":null}},"time_used":237,"timings":{"blocked":86,"dns":0,"connect":20,"send":0,"wait":33,"receive":0,"ssl":96},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"metamaskwallet-restore.com/wp-content/plugins/elementor/assets/lib/eicons/css/elementor-icons.min.css?ver=5.46.0","fqdn":"metamaskwallet-restore.com","domain":"metamaskwallet-restore.com","tld":"com"},"ip":{"addr":"195.250.27.134","port":443,"asn":211126,"as":"WHG Hosting Services Ltd","country":"United Kingdom","country_code":"GB"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://metamaskwallet-restore.com/","date":"2026-01-30T12:11:28.329Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"www.metamaskwallet-restore.com","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Fri, 30 Jan 2026 02:04:32 GMT","end":"Thu, 30 Apr 2026 02:04:31 GMT"},"fingerprint":{"sha1":"82:70:2B:32:D3:3A:36:34:29:37:93:7F:98:95:47:45:77:5C:49:22","sha256":"84:75:E1:22:8E:81:BC:CD:DC:4D:E3:95:6A:07:41:CC:2A:4F:26:1C:75:58:8A:67:A1:7C:7E:BD:FB:8C:19:B0"}}},"request":{"raw":"GET /wp-content/plugins/elementor/assets/lib/eicons/css/elementor-icons.min.css?ver=5.46.0 HTTP/1.1\r\nHost: metamaskwallet-restore.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://metamaskwallet-restore.com/\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\ncache-control: public, max-age=604800\r\nexpires: Fri, 06 Feb 2026 12:11:28 GMT\r\ncontent-type: text/css\r\nlast-modified: Fri, 30 Jan 2026 02:18:56 GMT\r\naccept-ranges: bytes\r\ncontent-encoding: br\r\nvary: Accept-Encoding,User-Agent\r\ncontent-length: 4025\r\ndate: Fri, 30 Jan 2026 12:11:28 GMT\r\nserver: LiteSpeed\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"LiteSpeed","description":"LiteSpeed is a high-scalability web server.","website":"https://litespeedtech.com","common_platform_enumeration":"cpe:2.3:a:litespeedtech:litespeed_web_server:*:*:*:*:*:*:*:*","icon":"LiteSpeed.svg","categories":["Web servers"]}],"data":{"size":21415,"size_decoded":0,"mime_type":"text/css","magic":"ASCII text, with very long lines (21369)","md5":"69dd84723487578f6384ca0dc8d544ba","sha1":"04277324e3f894405a0d1a7811a1351851b0db01","sha256":"67d1925322c1310e56caddc29b343d39eddec15b4a5df5151717a3d495daf171","sha512":"39b23086bd8b06f343d7944beba1897d91d2c862f4fe9951d9371a88a8e99c276cf3b6468a9212512513e1b5926a10879b4411e0e76d067ec5f693026698fb91","ssdeep":"192:BR877iN3iCOy2bvGIdpJkhugk8/H6qiMs7HqnFTSZq7RXDlCdkgIYSN:g7iNyqEpSk8/aq8uFucbrgIYY","tlshash":"bda2d9e5e46923c87b32c413e744b64c64daf920cec99d19fa6f850c1de16a31686fb8","first_seen":"2026-01-20T09:57:08.303066Z","last_seen":"2026-05-30T22:29:38.24909Z","times_seen":4015,"resource_available":false,"data":null}},"time_used":171,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":161,"receive":10,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-01-30","alert":"Sinkholed","trigger":"metamaskwallet-restore.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"fonts.googleapis.com/css?family=Roboto+Slab:100,100italic,200,200italic,300,300italic,400,400italic,500,500italic,600,600italic,700,700italic,800,800italic,900,900italic\u0026display=swap","fqdn":"fonts.googleapis.com","domain":"fonts.googleapis.com","tld":"googleapis.com"},"ip":{"addr":"216.58.211.10","port":443,"asn":15169,"as":"GOOGLE","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://metamaskwallet-restore.com/","date":"2026-01-30T12:11:28.357Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"upload.video.google.com","organization":""},"issuer":{"commonName":"WR2","organization":"Google Trust Services"},"validity":{"start":"Mon, 29 Dec 2025 19:52:24 GMT","end":"Mon, 23 Mar 2026 19:52:23 GMT"},"fingerprint":{"sha1":"43:39:AF:0A:74:F9:2F:1B:C0:1E:4E:89:21:30:C2:28:EC:9F:6C:67","sha256":"EA:F1:0E:C7:36:18:F3:9D:D1:D5:34:23:44:7D:6F:9D:2F:61:C7:81:09:9E:E9:C8:02:C8:F2:2C:0A:83:B3:A5"}}},"request":{"raw":"GET /css?family=Roboto+Slab:100,100italic,200,200italic,300,300italic,400,400italic,500,500italic,600,600italic,700,700italic,800,800italic,900,900italic\u0026display=swap HTTP/1.1\r\nHost: fonts.googleapis.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://metamaskwallet-restore.com/\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ncontent-type: text/css; charset=utf-8\r\nvary: Sec-Fetch-Dest, Sec-Fetch-Mode, Sec-Fetch-Site\r\naccess-control-allow-origin: *\r\ntiming-allow-origin: *\r\nlink: \u003chttps://fonts.gstatic.com\u003e; rel=preconnect; crossorigin\r\nstrict-transport-security: max-age=31536000\r\nexpires: Fri, 30 Jan 2026 12:11:28 GMT\r\ndate: Fri, 30 Jan 2026 12:11:28 GMT\r\ncache-control: private, max-age=86400\r\ncross-origin-opener-policy: same-origin-allow-popups\r\ncross-origin-resource-policy: cross-origin\r\ncontent-encoding: gzip\r\nserver: ESF\r\nx-xss-protection: 0\r\nx-frame-options: SAMEORIGIN\r\nx-content-type-options: nosniff\r\nalt-svc: h3=\":443\"; ma=2592000,h3-29=\":443\"; ma=2592000\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":22365,"size_decoded":0,"mime_type":"text/css; charset=utf-8","magic":"ASCII text","md5":"63c1df95a2b11b7542db5b48c56125f1","sha1":"b4116959b5ecbc00779addd320d98d8863692210","sha256":"7ead28f8032c788137532c3a88e9a7bda1411143e54ed4c066271c29f90340b7","sha512":"a5e42a035be607f6a98d7f73a26c37ad2e03a81dd0b54f2cc7bc5dc94a41b3b80af855ce9604e2b2283a7936df9008f068a8285c4cd8e4e960ab411c9c687d4f","ssdeep":"384:bvWLvKvXvUwvzv+vLWaZOUPSVsWJqtUghWVWInkUBALWWXYjUyvsHWm1iUz+54WD:bv0vKvXv3vzv+vLrZOuSVsMqtNhWV1nR","tlshash":"66a2bdd6486ba405ab870cc163dfbfa2ad9e5151a081c4becbfd2cb86cd6d32136075d","first_seen":"2025-09-17T18:46:03.2743Z","last_seen":"2026-05-31T11:00:03.230876Z","times_seen":16096,"resource_available":false,"data":null}},"time_used":188,"timings":{"blocked":56,"dns":1,"connect":9,"send":0,"wait":34,"receive":0,"ssl":85},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"metamaskwallet-restore.com/wp-includes/js/dist/hooks.min.js?ver=dd5603f07f9220ed27f1","fqdn":"metamaskwallet-restore.com","domain":"metamaskwallet-restore.com","tld":"com"},"ip":{"addr":"195.250.27.134","port":443,"asn":211126,"as":"WHG Hosting Services Ltd","country":"United Kingdom","country_code":"GB"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://metamaskwallet-restore.com/","date":"2026-01-30T12:11:28.373Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"www.metamaskwallet-restore.com","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Fri, 30 Jan 2026 02:04:32 GMT","end":"Thu, 30 Apr 2026 02:04:31 GMT"},"fingerprint":{"sha1":"82:70:2B:32:D3:3A:36:34:29:37:93:7F:98:95:47:45:77:5C:49:22","sha256":"84:75:E1:22:8E:81:BC:CD:DC:4D:E3:95:6A:07:41:CC:2A:4F:26:1C:75:58:8A:67:A1:7C:7E:BD:FB:8C:19:B0"}}},"request":{"raw":"GET /wp-includes/js/dist/hooks.min.js?ver=dd5603f07f9220ed27f1 HTTP/1.1\r\nHost: metamaskwallet-restore.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://metamaskwallet-restore.com/\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\ncontent-type: text/javascript\r\nlast-modified: Tue, 21 Oct 2025 07:14:02 GMT\r\naccept-ranges: bytes\r\ncontent-encoding: br\r\nvary: Accept-Encoding,User-Agent\r\ncontent-length: 1852\r\ndate: Fri, 30 Jan 2026 12:11:28 GMT\r\nserver: LiteSpeed\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"LiteSpeed","description":"LiteSpeed is a high-scalability web server.","website":"https://litespeedtech.com","common_platform_enumeration":"cpe:2.3:a:litespeedtech:litespeed_web_server:*:*:*:*:*:*:*:*","icon":"LiteSpeed.svg","categories":["Web servers"]}],"data":{"size":5661,"size_decoded":0,"mime_type":"text/javascript","magic":"JavaScript source, ASCII text, with very long lines (5626)","md5":"90e932bd9e62583fc494c00498cfe7f5","sha1":"4f57e11bff609f90f49174187a0b5a6ba847ad28","sha256":"87cee5f49ba0d3017efc409579fc58b91a717f8f14751f7d804447ac9bcbaf4b","sha512":"ed9c129faf972ddfa705f05c3207884e5e9cd175baa45d49ce9d42bc0d01e4e8f36e627731bdd97214b1e2400fdd5012262a42f9800cd4f5565dbf183ba58507","ssdeep":"96:wXDE/3s/0EBM6ZUUCRTH+zl4NsBjcEmDtrGV2C2yics6w1RfGdzsvqZTq:wzg3kBFZYH+zhjngRw2cLzw1RfGdzsvx","tlshash":"56c153847983b970b2337057f0ff48d561baeba575298081964ec4a05d7388ee0a7abd","first_seen":"2025-10-27T08:47:54.273294Z","last_seen":"2026-05-31T11:21:06.76344Z","times_seen":190468,"resource_available":true,"data":null}},"time_used":461,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":459,"receive":2,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-01-30","alert":"Sinkholed","trigger":"metamaskwallet-restore.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"metamaskwallet-restore.com/wp-content/plugins/elementor/assets/lib/font-awesome/webfonts/fa-solid-900.woff2","fqdn":"metamaskwallet-restore.com","domain":"metamaskwallet-restore.com","tld":"com"},"ip":{"addr":"195.250.27.134","port":443,"asn":211126,"as":"WHG Hosting Services Ltd","country":"United Kingdom","country_code":"GB"},"is_navigation_request":false,"resource_type":"font","requested_by":"https://metamaskwallet-restore.com/","date":"2026-01-30T12:11:28.794Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"www.metamaskwallet-restore.com","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Fri, 30 Jan 2026 02:04:32 GMT","end":"Thu, 30 Apr 2026 02:04:31 GMT"},"fingerprint":{"sha1":"82:70:2B:32:D3:3A:36:34:29:37:93:7F:98:95:47:45:77:5C:49:22","sha256":"84:75:E1:22:8E:81:BC:CD:DC:4D:E3:95:6A:07:41:CC:2A:4F:26:1C:75:58:8A:67:A1:7C:7E:BD:FB:8C:19:B0"}}},"request":{"raw":"GET /wp-content/plugins/elementor/assets/lib/font-awesome/webfonts/fa-solid-900.woff2 HTTP/1.1\r\nHost: metamaskwallet-restore.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: identity\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://metamaskwallet-restore.com/wp-content/plugins/elementor/assets/lib/font-awesome/css/solid.min.css?ver=5.15.3\r\nSec-Fetch-Dest: font\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\ncache-control: public, max-age=604800\r\nexpires: Fri, 06 Feb 2026 12:11:28 GMT\r\ncontent-type: font/woff2\r\nlast-modified: Fri, 30 Jan 2026 02:18:56 GMT\r\naccept-ranges: bytes\r\ncontent-length: 78196\r\ndate: Fri, 30 Jan 2026 12:11:28 GMT\r\nserver: LiteSpeed\r\nvary: User-Agent\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"LiteSpeed","description":"LiteSpeed is a high-scalability web server.","website":"https://litespeedtech.com","common_platform_enumeration":"cpe:2.3:a:litespeedtech:litespeed_web_server:*:*:*:*:*:*:*:*","icon":"LiteSpeed.svg","categories":["Web servers"]}],"data":{"size":78196,"size_decoded":0,"mime_type":"font/woff2","magic":"Web Open Font Format (Version 2), TrueType, length 78196, version 331.-31261","md5":"e8a427e15cc502bef99cfd722b37ea98","sha1":"a9922842a120a7f1eaced667480c5e185a106d69","sha256":"d0b4256abed72481585662971262eabee345c19f837af00d7ce24239d3b40eef","sha512":"113775748a4166c07e58c26cf6db7fed473732dc6124b8ee0f0dcc0d6439eb2ab2c5d9e01c67324fdf9de4105349cf30cc5796a0b0e0ce9a08f337b9d4e10b7b","ssdeep":"1536:1iGQV8Q8UOUMUd5UY3qyCkHQCCz2LL1F+u3MHLGxe3U:QVWuF33qy7HQchFz8HnU","tlshash":"3273121cf567643ef6a8e05f3c38256d4fd5c724e2e68a06748db808c4ce71d90879b6","first_seen":"2023-04-05T08:37:56Z","last_seen":"2026-05-31T11:08:34.125257Z","times_seen":148367,"resource_available":false,"data":null}},"time_used":192,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":151,"receive":41,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-01-30","alert":"Sinkholed","trigger":"metamaskwallet-restore.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"fonts.gstatic.com/s/roboto/v50/KFO7CnqEu92Fr1ME7kSn66aGLdTylUAMa3yUBA.woff2","fqdn":"fonts.gstatic.com","domain":"gstatic.com","tld":"com"},"ip":{"addr":"142.250.74.3","port":443,"asn":15169,"as":"GOOGLE","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"font","requested_by":"https://metamaskwallet-restore.com/","date":"2026-01-30T12:11:28.820Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.gstatic.com","organization":""},"issuer":{"commonName":"WR2","organization":"Google Trust Services"},"validity":{"start":"Mon, 29 Dec 2025 19:52:23 GMT","end":"Mon, 23 Mar 2026 19:52:22 GMT"},"fingerprint":{"sha1":"5A:74:FC:38:D2:7B:9B:E5:E5:0D:67:25:F4:73:BC:BA:2E:12:A7:FD","sha256":"3B:19:CD:BE:44:E6:EE:DC:8D:33:2B:A2:1C:E4:13:F8:6F:7E:2E:52:5D:0E:75:F3:1A:ED:21:1B:7A:B7:2E:BA"}}},"request":{"raw":"GET /s/roboto/v50/KFO7CnqEu92Fr1ME7kSn66aGLdTylUAMa3yUBA.woff2 HTTP/1.1\r\nHost: fonts.gstatic.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: identity\r\nOrigin: https://metamaskwallet-restore.com\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://fonts.googleapis.com/\r\nSec-Fetch-Dest: font\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\naccept-ranges: bytes\r\naccess-control-allow-origin: *\r\ncontent-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes\r\ncross-origin-resource-policy: cross-origin\r\ncross-origin-opener-policy: same-origin; report-to=\"apps-themes\"\r\nreport-to: {\"group\":\"apps-themes\",\"max_age\":2592000,\"endpoints\":[{\"url\":\"https://csp.withgoogle.com/csp/report-to/apps-themes\"}]}\r\ntiming-allow-origin: *\r\ncontent-length: 40128\r\nx-content-type-options: nosniff\r\nserver: sffe\r\nx-xss-protection: 0\r\ndate: Sat, 24 Jan 2026 18:37:38 GMT\r\nexpires: Sun, 24 Jan 2027 18:37:38 GMT\r\ncache-control: public, max-age=31536000\r\nage: 495230\r\nlast-modified: Tue, 18 Nov 2025 19:00:07 GMT\r\ncontent-type: font/woff2\r\nalt-svc: h3=\":443\"; ma=2592000,h3-29=\":443\"; ma=2592000\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":null,"data":{"size":40128,"size_decoded":0,"mime_type":"font/woff2","magic":"Web Open Font Format (Version 2), TrueType, length 40128, version 1.0","md5":"9a01b69183a9604ab3a439e388b30501","sha1":"8ed1d59003d0dbe6360481017b44665153665fbe","sha256":"20b535fa80c8189e3b87d1803038389960203a886d502bc2ef1857affc2f38d2","sha512":"0e6795255b6eea00b5403fd7e3b904d52776d49ac63a31c2778361262883697943aedcb29feee85694ba6f19eaa34dddb9a5bfe7118f4a25b4757e92c331feca","ssdeep":"768:Vce3jkow68wmT4IBX0tXdlSirS61gSjcz0GPwHbP+w2jec56O:VcI/iEEEtXdFJj+0GPwHbP+w5rO","tlshash":"3703023a5e3ccf1a84157a703950f6d9a8481e548e9d143b4f1ac7bf085dde2209b6d4","first_seen":"2025-01-08T22:59:02.845106Z","last_seen":"2026-05-31T11:22:56.44886Z","times_seen":858185,"resource_available":false,"data":null}},"time_used":99,"timings":{"blocked":37,"dns":8,"connect":7,"send":0,"wait":12,"receive":10,"ssl":21},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"metamaskwallet-restore.com/wp-includes/js/wp-emoji-release.min.js?ver=6.9","fqdn":"metamaskwallet-restore.com","domain":"metamaskwallet-restore.com","tld":"com"},"ip":{"addr":"195.250.27.134","port":443,"asn":211126,"as":"WHG Hosting Services Ltd","country":"United Kingdom","country_code":"GB"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://metamaskwallet-restore.com/","date":"2026-01-30T12:11:29.145Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"www.metamaskwallet-restore.com","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Fri, 30 Jan 2026 02:04:32 GMT","end":"Thu, 30 Apr 2026 02:04:31 GMT"},"fingerprint":{"sha1":"82:70:2B:32:D3:3A:36:34:29:37:93:7F:98:95:47:45:77:5C:49:22","sha256":"84:75:E1:22:8E:81:BC:CD:DC:4D:E3:95:6A:07:41:CC:2A:4F:26:1C:75:58:8A:67:A1:7C:7E:BD:FB:8C:19:B0"}}},"request":{"raw":"GET /wp-includes/js/wp-emoji-release.min.js?ver=6.9 HTTP/1.1\r\nHost: metamaskwallet-restore.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://metamaskwallet-restore.com/\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\ncontent-type: text/javascript\r\nlast-modified: Fri, 07 Nov 2025 14:44:34 GMT\r\naccept-ranges: bytes\r\ncontent-encoding: br\r\nvary: Accept-Encoding,User-Agent\r\ncontent-length: 4949\r\ndate: Fri, 30 Jan 2026 12:11:29 GMT\r\nserver: LiteSpeed\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"LiteSpeed","description":"LiteSpeed is a high-scalability web server.","website":"https://litespeedtech.com","common_platform_enumeration":"cpe:2.3:a:litespeedtech:litespeed_web_server:*:*:*:*:*:*:*:*","icon":"LiteSpeed.svg","categories":["Web servers"]}],"data":{"size":22762,"size_decoded":0,"mime_type":"text/javascript","magic":"JavaScript source, ASCII text, with very long lines (19823)","md5":"f0cc9ba5cf46af0cd73d521803e3b07e","sha1":"7d2a74f87dc70a39eccce3bae1d4cc404cb134f4","sha256":"fd59b0ebf6282ed71647bf2f6e0d1925bbfd1f270865a832079ebb60259aabca","sha512":"7ec44f08676c195547a623504c7105ef3d0acea5839675599598043f3e0b5a3386452e3db6fbea90722f7be9e6effdae1b89c49e2b05b22b8c415616e07d471d","ssdeep":"384:WzevzApRZTbXU/3o//bEPhXgA5POkpJTX:Wsk9XU/3o//YpXgAs+hX","tlshash":"7fa2959ba33a4e8f343e3bd78d968f4dc9da555321c0e079dbefb6c169a00568274c80","first_seen":"2025-11-10T19:52:32.864936Z","last_seen":"2026-05-31T11:23:51.552892Z","times_seen":250849,"resource_available":true,"data":null}},"time_used":143,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":143,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-01-30","alert":"Sinkholed","trigger":"metamaskwallet-restore.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"metamaskwallet-restore.com/wp-content/plugins/elementor/assets/css/widget-spacer.min.css?ver=3.34.4","fqdn":"metamaskwallet-restore.com","domain":"metamaskwallet-restore.com","tld":"com"},"ip":{"addr":"195.250.27.134","port":443,"asn":211126,"as":"WHG Hosting Services Ltd","country":"United Kingdom","country_code":"GB"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://metamaskwallet-restore.com/","date":"2026-01-30T12:11:28.343Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"www.metamaskwallet-restore.com","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Fri, 30 Jan 2026 02:04:32 GMT","end":"Thu, 30 Apr 2026 02:04:31 GMT"},"fingerprint":{"sha1":"82:70:2B:32:D3:3A:36:34:29:37:93:7F:98:95:47:45:77:5C:49:22","sha256":"84:75:E1:22:8E:81:BC:CD:DC:4D:E3:95:6A:07:41:CC:2A:4F:26:1C:75:58:8A:67:A1:7C:7E:BD:FB:8C:19:B0"}}},"request":{"raw":"GET /wp-content/plugins/elementor/assets/css/widget-spacer.min.css?ver=3.34.4 HTTP/1.1\r\nHost: metamaskwallet-restore.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://metamaskwallet-restore.com/\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\ncache-control: public, max-age=604800\r\nexpires: Fri, 06 Feb 2026 12:11:28 GMT\r\ncontent-type: text/css\r\nlast-modified: Fri, 30 Jan 2026 02:18:56 GMT\r\naccept-ranges: bytes\r\ncontent-encoding: br\r\nvary: Accept-Encoding,User-Agent\r\ncontent-length: 287\r\ndate: Fri, 30 Jan 2026 12:11:28 GMT\r\nserver: LiteSpeed\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"LiteSpeed","description":"LiteSpeed is a high-scalability web server.","website":"https://litespeedtech.com","common_platform_enumeration":"cpe:2.3:a:litespeedtech:litespeed_web_server:*:*:*:*:*:*:*:*","icon":"LiteSpeed.svg","categories":["Web servers"]}],"data":{"size":1793,"size_decoded":0,"mime_type":"text/css","magic":"ASCII text, with very long lines (1793), with no line terminators","md5":"c329a1f8486b82d9b9c7cb4d7060f346","sha1":"85b874b1c09c4f163738d439cacd53e6141f4f2b","sha256":"808a659eb4e85607c6efe022bff149c3076853c5570a322bd35e5e8cb9458904","sha512":"414974a35c9d401df85422ca92e886a3e0b57c6cd071023dd97d2987157fc9976d777d7b44c0c8d4a8caac81b0c1b862828bdaa67e5b05345894964a1dbe81a4","ssdeep":"","tlshash":"3731f650bd07662c787fa60f8413129c658494dee581ccc6dba1f60aa2fcde33336935","first_seen":"2025-04-08T12:29:44.439106Z","last_seen":"2026-05-31T11:07:56.283087Z","times_seen":31499,"resource_available":false,"data":null}},"time_used":163,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":163,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-01-30","alert":"Sinkholed","trigger":"metamaskwallet-restore.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"metamaskwallet-restore.com/wp-includes/js/dist/dom-ready.min.js?ver=f77871ff7694fffea381","fqdn":"metamaskwallet-restore.com","domain":"metamaskwallet-restore.com","tld":"com"},"ip":{"addr":"195.250.27.134","port":443,"asn":211126,"as":"WHG Hosting Services Ltd","country":"United Kingdom","country_code":"GB"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://metamaskwallet-restore.com/","date":"2026-01-30T12:11:28.366Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"www.metamaskwallet-restore.com","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Fri, 30 Jan 2026 02:04:32 GMT","end":"Thu, 30 Apr 2026 02:04:31 GMT"},"fingerprint":{"sha1":"82:70:2B:32:D3:3A:36:34:29:37:93:7F:98:95:47:45:77:5C:49:22","sha256":"84:75:E1:22:8E:81:BC:CD:DC:4D:E3:95:6A:07:41:CC:2A:4F:26:1C:75:58:8A:67:A1:7C:7E:BD:FB:8C:19:B0"}}},"request":{"raw":"GET /wp-includes/js/dist/dom-ready.min.js?ver=f77871ff7694fffea381 HTTP/1.1\r\nHost: metamaskwallet-restore.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://metamaskwallet-restore.com/\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\ncontent-type: text/javascript\r\nlast-modified: Wed, 31 Jan 2024 12:59:56 GMT\r\naccept-ranges: bytes\r\ncontent-encoding: br\r\nvary: Accept-Encoding,User-Agent\r\ncontent-length: 275\r\ndate: Fri, 30 Jan 2026 12:11:28 GMT\r\nserver: LiteSpeed\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"LiteSpeed","description":"LiteSpeed is a high-scalability web server.","website":"https://litespeedtech.com","common_platform_enumeration":"cpe:2.3:a:litespeedtech:litespeed_web_server:*:*:*:*:*:*:*:*","icon":"LiteSpeed.svg","categories":["Web servers"]}],"data":{"size":457,"size_decoded":0,"mime_type":"text/javascript","magic":"JavaScript source, ASCII text, with very long lines (422)","md5":"e4bc17cc45ca91ab0f09dea134975c51","sha1":"3c03312717fb495c051d02a3d27ec0d8abc2557d","sha256":"5a43a22e48f94b7a45a9a9b1a107f197213b73307fdfa2e6b2daadab264f94d2","sha512":"f8e537a2168b94875bb7ddb9a20037c5bc79831c8b4e726f224f8d7c723c5c4b4512551697cf7bfb6ce4b5f8365dc1c027107ffe3435ea27c686f5ae96d921e7","ssdeep":"","tlshash":"bbf0d4705445edf071bc80e6442d53c1b5219039372270f14b8cdcb569e0f96127ede7","first_seen":"2024-04-03T10:12:48Z","last_seen":"2026-05-31T11:23:45.509908Z","times_seen":103456,"resource_available":true,"data":null}},"time_used":416,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":416,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-01-30","alert":"Sinkholed","trigger":"metamaskwallet-restore.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"metamaskwallet-restore.com/wp-content/plugins/header-footer-elementor/inc/widgets-css/frontend.css?ver=2.8.2","fqdn":"metamaskwallet-restore.com","domain":"metamaskwallet-restore.com","tld":"com"},"ip":{"addr":"195.250.27.134","port":443,"asn":211126,"as":"WHG Hosting Services Ltd","country":"United Kingdom","country_code":"GB"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://metamaskwallet-restore.com/","date":"2026-01-30T12:11:28.325Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"www.metamaskwallet-restore.com","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Fri, 30 Jan 2026 02:04:32 GMT","end":"Thu, 30 Apr 2026 02:04:31 GMT"},"fingerprint":{"sha1":"82:70:2B:32:D3:3A:36:34:29:37:93:7F:98:95:47:45:77:5C:49:22","sha256":"84:75:E1:22:8E:81:BC:CD:DC:4D:E3:95:6A:07:41:CC:2A:4F:26:1C:75:58:8A:67:A1:7C:7E:BD:FB:8C:19:B0"}}},"request":{"raw":"GET /wp-content/plugins/header-footer-elementor/inc/widgets-css/frontend.css?ver=2.8.2 HTTP/1.1\r\nHost: metamaskwallet-restore.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://metamaskwallet-restore.com/\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\ncache-control: public, max-age=604800\r\nexpires: Fri, 06 Feb 2026 12:11:28 GMT\r\ncontent-type: text/css\r\nlast-modified: Fri, 30 Jan 2026 04:11:44 GMT\r\naccept-ranges: bytes\r\ncontent-encoding: br\r\nvary: Accept-Encoding,User-Agent\r\ncontent-length: 8756\r\ndate: Fri, 30 Jan 2026 12:11:28 GMT\r\nserver: LiteSpeed\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"LiteSpeed","description":"LiteSpeed is a high-scalability web server.","website":"https://litespeedtech.com","common_platform_enumeration":"cpe:2.3:a:litespeedtech:litespeed_web_server:*:*:*:*:*:*:*:*","icon":"LiteSpeed.svg","categories":["Web servers"]}],"data":{"size":83015,"size_decoded":0,"mime_type":"text/css","magic":"Unicode text, UTF-8 text, with very long lines (1646)","md5":"993387aae0b00dd250f8c6bacb602bb4","sha1":"c2ee953f8cbcfc03cb53fbb0375bef674ae52e1c","sha256":"47c7bdd897d958f095447c03e1752dc3c746563dc4507f7babd083348bd1ead5","sha512":"59c1a8d34241eb3d4c8993d3b9d755af35c5662a5b7f3ec85829ea63b34b44c7665c6f96099d920784d40b5065f0e9b5ca6434b03c762d353d7f7fcc713e3627","ssdeep":"768:uGU2+Rm5ukW6EdVBSs+QXLjBnTGpIq5pbTpqzGI5eFV/ftc/yorXzFSSBlzfSKVt:uGU2+Rm5ufoqDr1GLvm","tlshash":"5c83d8861dc329749a16681da3ee936457b60043cf35a9ac36ed821ccf82342b7f6f57","first_seen":"2025-11-18T16:28:00.164576Z","last_seen":"2026-05-31T10:38:26.707894Z","times_seen":11559,"resource_available":false,"data":null}},"time_used":163,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":142,"receive":21,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-01-30","alert":"Sinkholed","trigger":"metamaskwallet-restore.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"metamaskwallet-restore.com/wp-content/plugins/elementor/assets/lib/font-awesome/css/all.min.css?ver=3.34.4","fqdn":"metamaskwallet-restore.com","domain":"metamaskwallet-restore.com","tld":"com"},"ip":{"addr":"195.250.27.134","port":443,"asn":211126,"as":"WHG Hosting Services Ltd","country":"United Kingdom","country_code":"GB"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://metamaskwallet-restore.com/","date":"2026-01-30T12:11:28.338Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"www.metamaskwallet-restore.com","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Fri, 30 Jan 2026 02:04:32 GMT","end":"Thu, 30 Apr 2026 02:04:31 GMT"},"fingerprint":{"sha1":"82:70:2B:32:D3:3A:36:34:29:37:93:7F:98:95:47:45:77:5C:49:22","sha256":"84:75:E1:22:8E:81:BC:CD:DC:4D:E3:95:6A:07:41:CC:2A:4F:26:1C:75:58:8A:67:A1:7C:7E:BD:FB:8C:19:B0"}}},"request":{"raw":"GET /wp-content/plugins/elementor/assets/lib/font-awesome/css/all.min.css?ver=3.34.4 HTTP/1.1\r\nHost: metamaskwallet-restore.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://metamaskwallet-restore.com/\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\ncache-control: public, max-age=604800\r\nexpires: Fri, 06 Feb 2026 12:11:28 GMT\r\ncontent-type: text/css\r\nlast-modified: Fri, 30 Jan 2026 02:18:56 GMT\r\naccept-ranges: bytes\r\ncontent-encoding: br\r\nvary: Accept-Encoding,User-Agent\r\ncontent-length: 12380\r\ndate: Fri, 30 Jan 2026 12:11:28 GMT\r\nserver: LiteSpeed\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"LiteSpeed","description":"LiteSpeed is a high-scalability web server.","website":"https://litespeedtech.com","common_platform_enumeration":"cpe:2.3:a:litespeedtech:litespeed_web_server:*:*:*:*:*:*:*:*","icon":"LiteSpeed.svg","categories":["Web servers"]}],"data":{"size":59344,"size_decoded":0,"mime_type":"text/css","magic":"ASCII text, with very long lines (59158)","md5":"74bab4578692993514e7f882cc15c218","sha1":"b6293bcfd851f963edbe859498570c4c0c7eaae4","sha256":"d87ddf917b7a1449ab45e2b8e3c98354629bdd65b6659c37e6023bbea1ce1386","sha512":"8810579bc7d6f74fa7b8b7122a56e6acf70b6b4393f76c4ed4122c67ecb00d6642beab1681c715de0168441bf4cfef1d2c9832007221477e5565cda833f808d7","ssdeep":"768:0Eh31IPiyXNq4YxBowbgJlkwF//zMQyYJYX9Bft6VSzl:0E0PxXE4YXJgndFTfy9lt5B","tlshash":"0a43fbb8e54c01c9b731c44bef82b2bc61b6f73de5914d95f00e691c2ad26a811c5fba","first_seen":"2023-04-05T04:00:29Z","last_seen":"2026-05-31T11:00:39.053169Z","times_seen":99187,"resource_available":false,"data":null}},"time_used":287,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":175,"receive":112,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-01-30","alert":"Sinkholed","trigger":"metamaskwallet-restore.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"metamaskwallet-restore.com/wp-includes/js/jquery/jquery-migrate.min.js?ver=3.4.1","fqdn":"metamaskwallet-restore.com","domain":"metamaskwallet-restore.com","tld":"com"},"ip":{"addr":"195.250.27.134","port":443,"asn":211126,"as":"WHG Hosting Services Ltd","country":"United Kingdom","country_code":"GB"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://metamaskwallet-restore.com/","date":"2026-01-30T12:11:28.363Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"www.metamaskwallet-restore.com","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Fri, 30 Jan 2026 02:04:32 GMT","end":"Thu, 30 Apr 2026 02:04:31 GMT"},"fingerprint":{"sha1":"82:70:2B:32:D3:3A:36:34:29:37:93:7F:98:95:47:45:77:5C:49:22","sha256":"84:75:E1:22:8E:81:BC:CD:DC:4D:E3:95:6A:07:41:CC:2A:4F:26:1C:75:58:8A:67:A1:7C:7E:BD:FB:8C:19:B0"}}},"request":{"raw":"GET /wp-includes/js/jquery/jquery-migrate.min.js?ver=3.4.1 HTTP/1.1\r\nHost: metamaskwallet-restore.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://metamaskwallet-restore.com/\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\ncontent-type: text/javascript\r\nlast-modified: Fri, 09 Jun 2023 05:49:24 GMT\r\naccept-ranges: bytes\r\ncontent-encoding: br\r\nvary: Accept-Encoding,User-Agent\r\ncontent-length: 4678\r\ndate: Fri, 30 Jan 2026 12:11:28 GMT\r\nserver: LiteSpeed\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"LiteSpeed","description":"LiteSpeed is a high-scalability web server.","website":"https://litespeedtech.com","common_platform_enumeration":"cpe:2.3:a:litespeedtech:litespeed_web_server:*:*:*:*:*:*:*:*","icon":"LiteSpeed.svg","categories":["Web servers"]}],"data":{"size":13577,"size_decoded":0,"mime_type":"text/javascript","magic":"JavaScript source, ASCII text, with very long lines (13479)","md5":"9ffeb32e2d9efbf8f70caabded242267","sha1":"3ad0c10e501ac2a9bfa18f9cd7e700219b378738","sha256":"5274f11e6fb32ae0cf2dfb9f8043272865c397a7c4223b4cfa7d50ea52fbde89","sha512":"8d6be545508a1c38278b8ad780c3758ae48a25e4e12eee443375aa56031d9b356f8c90f22d4f251140fa3f65603af40523165e33cae2e2d62fc78ec106e3d731","ssdeep":"192:5rprDN+sag6ifKIUpQI99P1tLm9kdgyq1+J3aCJQ+h4MPLORq:5rprxaefKI0LP19m4q1WW+h4Mjp","tlshash":"9952c8adb56679724eb721b8f03bd24f71b205de560d8940d19cc4f6282dc6e812bf78","first_seen":"2023-05-09T19:21:05Z","last_seen":"2026-05-31T11:22:27.461808Z","times_seen":808581,"resource_available":true,"data":null}},"time_used":401,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":350,"receive":51,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-01-30","alert":"Sinkholed","trigger":"metamaskwallet-restore.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"metamaskwallet-restore.com/wp-content/uploads/2020/11/bg-0002-free-img.jpg","fqdn":"metamaskwallet-restore.com","domain":"metamaskwallet-restore.com","tld":"com"},"ip":{"addr":"195.250.27.134","port":443,"asn":211126,"as":"WHG Hosting Services Ltd","country":"United Kingdom","country_code":"GB"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://metamaskwallet-restore.com/","date":"2026-01-30T12:11:28.772Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"www.metamaskwallet-restore.com","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Fri, 30 Jan 2026 02:04:32 GMT","end":"Thu, 30 Apr 2026 02:04:31 GMT"},"fingerprint":{"sha1":"82:70:2B:32:D3:3A:36:34:29:37:93:7F:98:95:47:45:77:5C:49:22","sha256":"84:75:E1:22:8E:81:BC:CD:DC:4D:E3:95:6A:07:41:CC:2A:4F:26:1C:75:58:8A:67:A1:7C:7E:BD:FB:8C:19:B0"}}},"request":{"raw":"GET /wp-content/uploads/2020/11/bg-0002-free-img.jpg HTTP/1.1\r\nHost: metamaskwallet-restore.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://metamaskwallet-restore.com/wp-content/uploads/elementor/css/post-6.css?ver=1769772750\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\ncache-control: public, max-age=604800\r\nexpires: Fri, 06 Feb 2026 12:11:28 GMT\r\ncontent-type: image/jpeg\r\nlast-modified: Fri, 30 Jan 2026 10:07:37 GMT\r\naccept-ranges: bytes\r\ncontent-length: 31687\r\ndate: Fri, 30 Jan 2026 12:11:28 GMT\r\nserver: LiteSpeed\r\nvary: User-Agent\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"LiteSpeed","description":"LiteSpeed is a high-scalability web server.","website":"https://litespeedtech.com","common_platform_enumeration":"cpe:2.3:a:litespeedtech:litespeed_web_server:*:*:*:*:*:*:*:*","icon":"LiteSpeed.svg","categories":["Web servers"]}],"data":{"size":31687,"size_decoded":0,"mime_type":"image/jpeg","magic":"JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 1920x1079, components 3","md5":"cd1db2c83be3a5cfdd0e19272ceb16ab","sha1":"5fb3f33c912b2ef9b331d044da0f60fd97040267","sha256":"6bd5cec9cf2d9412edbab13f63098bccf50c63121392ad0eaeabb1a2b0970b14","sha512":"de8d8fad4b2d93abe4b1c30b0da0a2c6294e37a169c3d2471296c50c1f6201f61fa3ca436459ce761abb24f9f3d5803c851d1e59a246abe6d751d2530877be22","ssdeep":"768:brCE2WBsfhCY635sGsELFmMKnQgYBy6a5yS6vTJO:bGE34hU35s2LoM8QaoSz","tlshash":"ece29e17eba6a829c4105370d9f72b313761c978b2e6990757890c21bcd6388fcb7b67","first_seen":"2023-05-10T07:30:16Z","last_seen":"2026-05-10T11:32:56.05276Z","times_seen":27,"resource_available":false,"data":null}},"time_used":161,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":142,"receive":19,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-01-30","alert":"Sinkholed","trigger":"metamaskwallet-restore.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"metamaskwallet-restore.com/wp-content/plugins/elementor/assets/js/text-editor.45609661e409413f1cef.bundle.min.js","fqdn":"metamaskwallet-restore.com","domain":"metamaskwallet-restore.com","tld":"com"},"ip":{"addr":"195.250.27.134","port":443,"asn":211126,"as":"WHG Hosting Services Ltd","country":"United Kingdom","country_code":"GB"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://metamaskwallet-restore.com/","date":"2026-01-30T12:11:29.151Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"www.metamaskwallet-restore.com","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Fri, 30 Jan 2026 02:04:32 GMT","end":"Thu, 30 Apr 2026 02:04:31 GMT"},"fingerprint":{"sha1":"82:70:2B:32:D3:3A:36:34:29:37:93:7F:98:95:47:45:77:5C:49:22","sha256":"84:75:E1:22:8E:81:BC:CD:DC:4D:E3:95:6A:07:41:CC:2A:4F:26:1C:75:58:8A:67:A1:7C:7E:BD:FB:8C:19:B0"}}},"request":{"raw":"GET /wp-content/plugins/elementor/assets/js/text-editor.45609661e409413f1cef.bundle.min.js HTTP/1.1\r\nHost: metamaskwallet-restore.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://metamaskwallet-restore.com/\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\ncontent-type: text/javascript\r\nlast-modified: Fri, 30 Jan 2026 02:18:56 GMT\r\naccept-ranges: bytes\r\ncontent-encoding: br\r\nvary: Accept-Encoding,User-Agent\r\ncontent-length: 592\r\ndate: Fri, 30 Jan 2026 12:11:29 GMT\r\nserver: LiteSpeed\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"LiteSpeed","description":"LiteSpeed is a high-scalability web server.","website":"https://litespeedtech.com","common_platform_enumeration":"cpe:2.3:a:litespeedtech:litespeed_web_server:*:*:*:*:*:*:*:*","icon":"LiteSpeed.svg","categories":["Web servers"]}],"data":{"size":1348,"size_decoded":0,"mime_type":"text/javascript","magic":"JavaScript source, ASCII text, with very long lines (1348), with no line terminators","md5":"b272ececde530e5621637a7e529abc8b","sha1":"a3fedafc836049d71aa3b1d9ddc1debcd6f73dd2","sha256":"4543f55b0b8bc8fe912da8ddd1da7b07d0e8d3e77a824295a6bccd90d4f8aa13","sha512":"d2efaf6be07605e855c348a6fd5aad58520f20912188578a3711de8840a9cd29e41860b49b36d3d7a72082077c9dcdfe8571e0279985a771cac102a520f7b020","ssdeep":"","tlshash":"f62112b371a2dded48df148a34522d16f2574d5db8caa01ef5aa08df24b2e843362634","first_seen":"2025-10-22T21:27:55.827503Z","last_seen":"2026-05-31T11:23:51.622139Z","times_seen":102258,"resource_available":true,"data":null}},"time_used":142,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":142,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-01-30","alert":"Sinkholed","trigger":"metamaskwallet-restore.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"metamaskwallet-restore.com/wp-content/themes/astra/assets/css/minified/main.min.css?ver=4.12.1","fqdn":"metamaskwallet-restore.com","domain":"metamaskwallet-restore.com","tld":"com"},"ip":{"addr":"195.250.27.134","port":443,"asn":211126,"as":"WHG Hosting Services Ltd","country":"United Kingdom","country_code":"GB"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://metamaskwallet-restore.com/","date":"2026-01-30T12:11:28.319Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"www.metamaskwallet-restore.com","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Fri, 30 Jan 2026 02:04:32 GMT","end":"Thu, 30 Apr 2026 02:04:31 GMT"},"fingerprint":{"sha1":"82:70:2B:32:D3:3A:36:34:29:37:93:7F:98:95:47:45:77:5C:49:22","sha256":"84:75:E1:22:8E:81:BC:CD:DC:4D:E3:95:6A:07:41:CC:2A:4F:26:1C:75:58:8A:67:A1:7C:7E:BD:FB:8C:19:B0"}}},"request":{"raw":"GET /wp-content/themes/astra/assets/css/minified/main.min.css?ver=4.12.1 HTTP/1.1\r\nHost: metamaskwallet-restore.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://metamaskwallet-restore.com/\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\ncache-control: public, max-age=604800\r\nexpires: Fri, 06 Feb 2026 12:11:28 GMT\r\ncontent-type: text/css\r\nlast-modified: Fri, 30 Jan 2026 02:21:18 GMT\r\naccept-ranges: bytes\r\ncontent-encoding: br\r\nvary: Accept-Encoding,User-Agent\r\ncontent-length: 8493\r\ndate: Fri, 30 Jan 2026 12:11:28 GMT\r\nserver: LiteSpeed\r\nalt-svc: h3=\":443\"; ma=2592000, h3-29=\":443\"; ma=2592000, h3-Q050=\":443\"; ma=2592000, h3-Q046=\":443\"; ma=2592000, h3-Q043=\":443\"; ma=2592000, quic=\":443\"; ma=2592000; v=\"43,46\"\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"LiteSpeed","description":"LiteSpeed is a high-scalability web server.","website":"https://litespeedtech.com","common_platform_enumeration":"cpe:2.3:a:litespeedtech:litespeed_web_server:*:*:*:*:*:*:*:*","icon":"LiteSpeed.svg","categories":["Web servers"]}],"data":{"size":45749,"size_decoded":0,"mime_type":"text/css","magic":"ASCII text, with very long lines (43567)","md5":"42496634dc1c555e846841a0080ada59","sha1":"9e2de8d81b0caa2745f374746c60a223c1ba27d7","sha256":"a8ff2f0b3249b1dbadfe779835a4b29346af2941144d12d2f95c2a6e505f4088","sha512":"68529399c5c478f9d4a9ce838ee0bc39e4a36e0f89e88633e4840795957f3146da15d8b6bc81e308f464dffb6bfe080bc42797fd4c3939f05259a99a562dbf8f","ssdeep":"768:mPcOrP1rhDYollnk+FHk3YCzxdvN3JR2/WLmiyCFS7OHQtBU5PT1enhm2a7ZAR2s:AnYY+tHQtBU5PTwDuaP","tlshash":"6823f96043d035391233873efad6b9082b694313d74f26e6f8ab8668c9c57d71a72e4c","first_seen":"2026-01-21T20:47:01.725402Z","last_seen":"2026-05-31T09:30:26.938372Z","times_seen":6100,"resource_available":false,"data":null}},"time_used":145,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":143,"receive":2,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-01-30","alert":"Sinkholed","trigger":"metamaskwallet-restore.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"metamaskwallet-restore.com/wp-content/plugins/elementor/assets/css/widget-icon-list.min.css?ver=3.24.3","fqdn":"metamaskwallet-restore.com","domain":"metamaskwallet-restore.com","tld":"com"},"ip":{"addr":"195.250.27.134","port":443,"asn":211126,"as":"WHG Hosting Services Ltd","country":"United Kingdom","country_code":"GB"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://metamaskwallet-restore.com/","date":"2026-01-30T12:11:28.348Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"www.metamaskwallet-restore.com","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Fri, 30 Jan 2026 02:04:32 GMT","end":"Thu, 30 Apr 2026 02:04:31 GMT"},"fingerprint":{"sha1":"82:70:2B:32:D3:3A:36:34:29:37:93:7F:98:95:47:45:77:5C:49:22","sha256":"84:75:E1:22:8E:81:BC:CD:DC:4D:E3:95:6A:07:41:CC:2A:4F:26:1C:75:58:8A:67:A1:7C:7E:BD:FB:8C:19:B0"}}},"request":{"raw":"GET /wp-content/plugins/elementor/assets/css/widget-icon-list.min.css?ver=3.24.3 HTTP/1.1\r\nHost: metamaskwallet-restore.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://metamaskwallet-restore.com/\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\ncache-control: public, max-age=604800\r\nexpires: Fri, 06 Feb 2026 12:11:28 GMT\r\ncontent-type: text/css\r\nlast-modified: Fri, 30 Jan 2026 02:18:56 GMT\r\naccept-ranges: bytes\r\ncontent-encoding: br\r\nvary: Accept-Encoding,User-Agent\r\ncontent-length: 928\r\ndate: Fri, 30 Jan 2026 12:11:28 GMT\r\nserver: LiteSpeed\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"LiteSpeed","description":"LiteSpeed is a high-scalability web server.","website":"https://litespeedtech.com","common_platform_enumeration":"cpe:2.3:a:litespeedtech:litespeed_web_server:*:*:*:*:*:*:*:*","icon":"LiteSpeed.svg","categories":["Web servers"]}],"data":{"size":10255,"size_decoded":0,"mime_type":"text/css","magic":"ASCII text, with very long lines (10255), with no line terminators","md5":"1c6df716953f870be76c3e88a69a326f","sha1":"55001bbb898eb7636eabd0418275a9f5aa96ac51","sha256":"1b34d4c7324321e36db5d35f05bb011238a1326f89058a4399d028d1f6c47dd5","sha512":"d2cb3f58b7f5b83fac1744e81367e6ef4e350a073aee634b85a2ad87b4676cb78561db329bb4c9da20617a1be770b0d399ca731d0dc6792fd1f37e2ca116432d","ssdeep":"192:eKTrGZCLG+tlR3080ur1R6gxrcazf7fneLG6AHRJSJ/JwJp+XuknI0:eyv0","tlshash":"a52283917d83814e1aff651b141b2a4ca1c9c4dee8b6ecd6e866130782ffec53772528","first_seen":"2025-12-13T14:03:51.781572Z","last_seen":"2026-05-31T11:08:34.113946Z","times_seen":38705,"resource_available":false,"data":null}},"time_used":283,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":270,"receive":13,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-01-30","alert":"Sinkholed","trigger":"metamaskwallet-restore.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"metamaskwallet-restore.com/wp-content/plugins/elementor/assets/lib/font-awesome/js/v4-shims.min.js?ver=3.34.4","fqdn":"metamaskwallet-restore.com","domain":"metamaskwallet-restore.com","tld":"com"},"ip":{"addr":"195.250.27.134","port":443,"asn":211126,"as":"WHG Hosting Services Ltd","country":"United Kingdom","country_code":"GB"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://metamaskwallet-restore.com/","date":"2026-01-30T12:11:28.362Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"www.metamaskwallet-restore.com","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Fri, 30 Jan 2026 02:04:32 GMT","end":"Thu, 30 Apr 2026 02:04:31 GMT"},"fingerprint":{"sha1":"82:70:2B:32:D3:3A:36:34:29:37:93:7F:98:95:47:45:77:5C:49:22","sha256":"84:75:E1:22:8E:81:BC:CD:DC:4D:E3:95:6A:07:41:CC:2A:4F:26:1C:75:58:8A:67:A1:7C:7E:BD:FB:8C:19:B0"}}},"request":{"raw":"GET /wp-content/plugins/elementor/assets/lib/font-awesome/js/v4-shims.min.js?ver=3.34.4 HTTP/1.1\r\nHost: metamaskwallet-restore.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://metamaskwallet-restore.com/\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\ncontent-type: text/javascript\r\nlast-modified: Fri, 30 Jan 2026 02:18:56 GMT\r\naccept-ranges: bytes\r\ncontent-encoding: br\r\nvary: Accept-Encoding,User-Agent\r\ncontent-length: 4042\r\ndate: Fri, 30 Jan 2026 12:11:28 GMT\r\nserver: LiteSpeed\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"LiteSpeed","description":"LiteSpeed is a high-scalability web server.","website":"https://litespeedtech.com","common_platform_enumeration":"cpe:2.3:a:litespeedtech:litespeed_web_server:*:*:*:*:*:*:*:*","icon":"LiteSpeed.svg","categories":["Web servers"]}],"data":{"size":15073,"size_decoded":0,"mime_type":"text/javascript","magic":"JavaScript source, ASCII text, with very long lines (14886)","md5":"ef17c8ffc514d7418b4bec001b8473fb","sha1":"9d406018e5be8d46b89809d38eb6cea4f8bf62a2","sha256":"6f35273b8502706ee06854d797337ab40bc1b3a7421960a2ceb5392ac85a0f54","sha512":"6a3288f610d5f70344a48f885ea5a1877bd869035fb50f6e5159ddc09c67c7ffcc6d9aac4cc537800f3e84349aa26345d42134f305b41bdd5004e71b2160cbf1","ssdeep":"192:bP6lw28fajqZFSJtd4fxVOT2iQsVJqYqV5PnX9dUWFjWqh2P9e93f7POD3g:On8fajqZFwtdykZwRXcoWI2P9o7S3g","tlshash":"0262337bbd000da93cac595852a27d046d0eb32fbb430c6bbdc59de623a23f5719e006","first_seen":"2024-03-11T13:11:57Z","last_seen":"2026-05-31T11:00:39.103527Z","times_seen":62850,"resource_available":true,"data":null}},"time_used":320,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":317,"receive":3,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-01-30","alert":"Sinkholed","trigger":"metamaskwallet-restore.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"metamaskwallet-restore.com/wp-content/plugins/elementor-pro/assets/js/frontend.min.js?ver=3.34.1","fqdn":"metamaskwallet-restore.com","domain":"metamaskwallet-restore.com","tld":"com"},"ip":{"addr":"195.250.27.134","port":443,"asn":211126,"as":"WHG Hosting Services Ltd","country":"United Kingdom","country_code":"GB"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://metamaskwallet-restore.com/","date":"2026-01-30T12:11:28.374Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"www.metamaskwallet-restore.com","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Fri, 30 Jan 2026 02:04:32 GMT","end":"Thu, 30 Apr 2026 02:04:31 GMT"},"fingerprint":{"sha1":"82:70:2B:32:D3:3A:36:34:29:37:93:7F:98:95:47:45:77:5C:49:22","sha256":"84:75:E1:22:8E:81:BC:CD:DC:4D:E3:95:6A:07:41:CC:2A:4F:26:1C:75:58:8A:67:A1:7C:7E:BD:FB:8C:19:B0"}}},"request":{"raw":"GET /wp-content/plugins/elementor-pro/assets/js/frontend.min.js?ver=3.34.1 HTTP/1.1\r\nHost: metamaskwallet-restore.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://metamaskwallet-restore.com/\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\ncontent-type: text/javascript\r\nlast-modified: Fri, 30 Jan 2026 03:08:11 GMT\r\naccept-ranges: bytes\r\ncontent-encoding: br\r\nvary: Accept-Encoding,User-Agent\r\ncontent-length: 6199\r\ndate: Fri, 30 Jan 2026 12:11:28 GMT\r\nserver: LiteSpeed\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"LiteSpeed","description":"LiteSpeed is a high-scalability web server.","website":"https://litespeedtech.com","common_platform_enumeration":"cpe:2.3:a:litespeedtech:litespeed_web_server:*:*:*:*:*:*:*:*","icon":"LiteSpeed.svg","categories":["Web servers"]}],"data":{"size":24048,"size_decoded":0,"mime_type":"text/javascript","magic":"JavaScript source, ASCII text, with very long lines (24003), with CRLF line terminators","md5":"5888f03128a623fb08d9653d68f99419","sha1":"ff37011866a3800c26ada8eaf23e9ceb3f182903","sha256":"03f0b089cb9d247bd10c8efd03e9a3e4ab69dea20e1ee90d370776b18cfbae68","sha512":"ba4e544530365db79df20e327b0a2cbf951e319d8ce8f0e0bfc60b426b1f8b32db43ee7bfb7124df38a583c9bfcf95627dddb10d2932e88c4f17352d1b387c72","ssdeep":"384:1dGy+EVxFm6cKJskdHd7glQtHuGJswg/i+TSQDTWmMo7YtDT5HJiIqkoh+vFWN74:vR+EVxFm6cKikdHd7glQtHuGJswg/DT6","tlshash":"60b2d9063163ac3a50cf815be067420e7b374995b40570ed7abc6cdba5b8d9a33ea335","first_seen":"2026-01-21T13:53:51.827531Z","last_seen":"2026-05-27T00:25:20.796374Z","times_seen":111,"resource_available":true,"data":null}},"time_used":465,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":459,"receive":6,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-01-30","alert":"Sinkholed","trigger":"metamaskwallet-restore.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"metamaskwallet-restore.com/wp-content/plugins/header-footer-elementor/assets/css/header-footer-elementor.css?ver=2.8.2","fqdn":"metamaskwallet-restore.com","domain":"metamaskwallet-restore.com","tld":"com"},"ip":{"addr":"195.250.27.134","port":443,"asn":211126,"as":"WHG Hosting Services Ltd","country":"United Kingdom","country_code":"GB"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://metamaskwallet-restore.com/","date":"2026-01-30T12:11:28.326Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"www.metamaskwallet-restore.com","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Fri, 30 Jan 2026 02:04:32 GMT","end":"Thu, 30 Apr 2026 02:04:31 GMT"},"fingerprint":{"sha1":"82:70:2B:32:D3:3A:36:34:29:37:93:7F:98:95:47:45:77:5C:49:22","sha256":"84:75:E1:22:8E:81:BC:CD:DC:4D:E3:95:6A:07:41:CC:2A:4F:26:1C:75:58:8A:67:A1:7C:7E:BD:FB:8C:19:B0"}}},"request":{"raw":"GET /wp-content/plugins/header-footer-elementor/assets/css/header-footer-elementor.css?ver=2.8.2 HTTP/1.1\r\nHost: metamaskwallet-restore.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://metamaskwallet-restore.com/\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\ncache-control: public, max-age=604800\r\nexpires: Fri, 06 Feb 2026 12:11:28 GMT\r\ncontent-type: text/css\r\nlast-modified: Fri, 30 Jan 2026 04:11:44 GMT\r\naccept-ranges: bytes\r\ncontent-encoding: br\r\nvary: Accept-Encoding,User-Agent\r\ncontent-length: 259\r\ndate: Fri, 30 Jan 2026 12:11:28 GMT\r\nserver: LiteSpeed\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"LiteSpeed","description":"LiteSpeed is a high-scalability web server.","website":"https://litespeedtech.com","common_platform_enumeration":"cpe:2.3:a:litespeedtech:litespeed_web_server:*:*:*:*:*:*:*:*","icon":"LiteSpeed.svg","categories":["Web servers"]}],"data":{"size":776,"size_decoded":0,"mime_type":"text/css","magic":"ASCII text","md5":"a5bf64d5859ee94a3e8e93d592d6d2a0","sha1":"049eb63b42dbb820b06870a430f523bf06880721","sha256":"25825611ade7ceaed7df3862ec56dc91ad1d2be539966ef7bbe84306e51cfb08","sha512":"22c9c7ad86ad2b45124c5ff6b0a41e271ee176cfe0249c973877e51a1895f6d25c8f69b1c4eb565f5fe5e2befe2f4b80d4a89dcea57eeac43b3ae8e020469809","ssdeep":"","tlshash":"fe019024b14eb96412318c28f561857cb1be81075b05997275ecd19bfbde740c02e2c4","first_seen":"2023-04-05T05:47:47Z","last_seen":"2026-05-31T10:38:26.780547Z","times_seen":34726,"resource_available":false,"data":null}},"time_used":162,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":162,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-01-30","alert":"Sinkholed","trigger":"metamaskwallet-restore.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"metamaskwallet-restore.com/wp-content/plugins/elementor/assets/css/frontend.min.css?ver=3.34.4","fqdn":"metamaskwallet-restore.com","domain":"metamaskwallet-restore.com","tld":"com"},"ip":{"addr":"195.250.27.134","port":443,"asn":211126,"as":"WHG Hosting Services Ltd","country":"United Kingdom","country_code":"GB"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://metamaskwallet-restore.com/","date":"2026-01-30T12:11:28.333Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"www.metamaskwallet-restore.com","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Fri, 30 Jan 2026 02:04:32 GMT","end":"Thu, 30 Apr 2026 02:04:31 GMT"},"fingerprint":{"sha1":"82:70:2B:32:D3:3A:36:34:29:37:93:7F:98:95:47:45:77:5C:49:22","sha256":"84:75:E1:22:8E:81:BC:CD:DC:4D:E3:95:6A:07:41:CC:2A:4F:26:1C:75:58:8A:67:A1:7C:7E:BD:FB:8C:19:B0"}}},"request":{"raw":"GET /wp-content/plugins/elementor/assets/css/frontend.min.css?ver=3.34.4 HTTP/1.1\r\nHost: metamaskwallet-restore.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://metamaskwallet-restore.com/\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\ncache-control: public, max-age=604800\r\nexpires: Fri, 06 Feb 2026 12:11:28 GMT\r\ncontent-type: text/css\r\nlast-modified: Fri, 30 Jan 2026 02:18:56 GMT\r\naccept-ranges: bytes\r\ncontent-encoding: br\r\nvary: Accept-Encoding,User-Agent\r\ncontent-length: 6575\r\ndate: Fri, 30 Jan 2026 12:11:28 GMT\r\nserver: LiteSpeed\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"LiteSpeed","description":"LiteSpeed is a high-scalability web server.","website":"https://litespeedtech.com","common_platform_enumeration":"cpe:2.3:a:litespeedtech:litespeed_web_server:*:*:*:*:*:*:*:*","icon":"LiteSpeed.svg","categories":["Web servers"]}],"data":{"size":54511,"size_decoded":0,"mime_type":"text/css","magic":"ASCII text, with very long lines (54511), with no line terminators","md5":"56191e9cf78477719ca66780e8d3cbfd","sha1":"8473aed27502d32928dcad273a9ce446238a6502","sha256":"2c5e4ed6659c6383d6a27d079848670d4d6cc6f6ee27d8021d2eab2bb8a0038a","sha512":"107c9b1b9f52cb4ce29752e541f76dfd3c97083960da1997921e4fcbac33900a547aac2631733069765809d004a565fa23282734a08736a028b81a1f05d1c44a","ssdeep":"384:Ws4J/8DEksCoI+SBQYO22/RmRs5Cz9TQikvmGkvmCFldtraiIks05ArOk:dFLh5mP3RwlDdps05Xk","tlshash":"9a330da23d13b269226f442b82c7364c536495c1ee1375d9f944c5239afece63b36c2b","first_seen":"2026-01-20T09:57:08.400248Z","last_seen":"2026-05-30T22:29:38.318558Z","times_seen":4758,"resource_available":false,"data":null}},"time_used":177,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":170,"receive":7,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-01-30","alert":"Sinkholed","trigger":"metamaskwallet-restore.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"metamaskwallet-restore.com/wp-content/plugins/elementor/assets/lib/font-awesome/css/brands.css?ver=5.15.3","fqdn":"metamaskwallet-restore.com","domain":"metamaskwallet-restore.com","tld":"com"},"ip":{"addr":"195.250.27.134","port":443,"asn":211126,"as":"WHG Hosting Services Ltd","country":"United Kingdom","country_code":"GB"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://metamaskwallet-restore.com/","date":"2026-01-30T12:11:28.350Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"www.metamaskwallet-restore.com","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Fri, 30 Jan 2026 02:04:32 GMT","end":"Thu, 30 Apr 2026 02:04:31 GMT"},"fingerprint":{"sha1":"82:70:2B:32:D3:3A:36:34:29:37:93:7F:98:95:47:45:77:5C:49:22","sha256":"84:75:E1:22:8E:81:BC:CD:DC:4D:E3:95:6A:07:41:CC:2A:4F:26:1C:75:58:8A:67:A1:7C:7E:BD:FB:8C:19:B0"}}},"request":{"raw":"GET /wp-content/plugins/elementor/assets/lib/font-awesome/css/brands.css?ver=5.15.3 HTTP/1.1\r\nHost: metamaskwallet-restore.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://metamaskwallet-restore.com/\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\ncache-control: public, max-age=604800\r\nexpires: Fri, 06 Feb 2026 12:11:28 GMT\r\ncontent-type: text/css\r\nlast-modified: Fri, 30 Jan 2026 02:18:56 GMT\r\naccept-ranges: bytes\r\ncontent-encoding: br\r\nvary: Accept-Encoding,User-Agent\r\ncontent-length: 296\r\ndate: Fri, 30 Jan 2026 12:11:28 GMT\r\nserver: LiteSpeed\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"LiteSpeed","description":"LiteSpeed is a high-scalability web server.","website":"https://litespeedtech.com","common_platform_enumeration":"cpe:2.3:a:litespeedtech:litespeed_web_server:*:*:*:*:*:*:*:*","icon":"LiteSpeed.svg","categories":["Web servers"]}],"data":{"size":732,"size_decoded":0,"mime_type":"text/css","magic":"ASCII text, with very long lines (312)","md5":"1f1c6abbb54c6d189b7263e0861fae8a","sha1":"6bc092e1e58b2fa6364bc17b02443ade0c6d32f1","sha256":"5009a34e30063ffb89185274681b359ae8c7dac19a606d5b1456ee3524cbc9b0","sha512":"7dd9accf0a69d2a89009443de17d6f09c3ca55e62fe9c7c4d3f12f89354b11559d83436fbc4befc8618ccbe0fe46fea657743d758e543b79a3d039ce36852b33","ssdeep":"","tlshash":"8f0164b0810510048a40091a2bdfbf28ae09a245781daea572239c1edcf4e4d61faf0d","first_seen":"2023-04-10T17:28:04Z","last_seen":"2026-05-31T10:19:30.797414Z","times_seen":30975,"resource_available":false,"data":null}},"time_used":287,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":287,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-01-30","alert":"Sinkholed","trigger":"metamaskwallet-restore.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"metamaskwallet-restore.com/wp-includes/js/jquery/jquery.min.js?ver=3.7.1","fqdn":"metamaskwallet-restore.com","domain":"metamaskwallet-restore.com","tld":"com"},"ip":{"addr":"195.250.27.134","port":443,"asn":211126,"as":"WHG Hosting Services Ltd","country":"United Kingdom","country_code":"GB"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://metamaskwallet-restore.com/","date":"2026-01-30T12:11:28.363Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"www.metamaskwallet-restore.com","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Fri, 30 Jan 2026 02:04:32 GMT","end":"Thu, 30 Apr 2026 02:04:31 GMT"},"fingerprint":{"sha1":"82:70:2B:32:D3:3A:36:34:29:37:93:7F:98:95:47:45:77:5C:49:22","sha256":"84:75:E1:22:8E:81:BC:CD:DC:4D:E3:95:6A:07:41:CC:2A:4F:26:1C:75:58:8A:67:A1:7C:7E:BD:FB:8C:19:B0"}}},"request":{"raw":"GET /wp-includes/js/jquery/jquery.min.js?ver=3.7.1 HTTP/1.1\r\nHost: metamaskwallet-restore.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://metamaskwallet-restore.com/\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\ncontent-type: text/javascript\r\nlast-modified: Mon, 28 Aug 2023 17:14:24 GMT\r\naccept-ranges: bytes\r\ncontent-encoding: br\r\nvary: Accept-Encoding,User-Agent\r\ncontent-length: 29744\r\ndate: Fri, 30 Jan 2026 12:11:28 GMT\r\nserver: LiteSpeed\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"LiteSpeed","description":"LiteSpeed is a high-scalability web server.","website":"https://litespeedtech.com","common_platform_enumeration":"cpe:2.3:a:litespeedtech:litespeed_web_server:*:*:*:*:*:*:*:*","icon":"LiteSpeed.svg","categories":["Web servers"]}],"data":{"size":87553,"size_decoded":0,"mime_type":"text/javascript","magic":"JavaScript source, ASCII text, with very long lines (65447)","md5":"826eb77e86b02ab7724fe3d0141ff87c","sha1":"79cd3587d565afe290076a8d36c31c305a573d18","sha256":"cb6f2d32c49d1c2b25e9ffc9aaafa3f83075346c01bcd4ae6eb187392a4292cf","sha512":"fc79fdb76763025dc39fac045a215ff155ef2f492a0e9640079d6f089fa6218af2b3ab7c6eaf636827dee9294e6939a95ab24554e870c976679c25567ad6374c","ssdeep":"1536:0RUX9uDgwxcy2KVBNwchN6SLaHEk2BSrBESp+a/IEk4aAocVi8SMBQ47GKO:sHNwcv9VBQpLl88SMBQ47GKO","tlshash":"7483f8df77ca702247ab30b9006f550bf276199d684d4400f159d8e9bcb8a4a827bf7e","first_seen":"2023-11-03T09:26:43Z","last_seen":"2026-05-31T11:22:27.447024Z","times_seen":876269,"resource_available":true,"data":null}},"time_used":353,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":320,"receive":33,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-01-30","alert":"Sinkholed","trigger":"metamaskwallet-restore.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"metamaskwallet-restore.com/wp-content/plugins/elementor/assets/js/webpack.runtime.min.js?ver=3.34.4","fqdn":"metamaskwallet-restore.com","domain":"metamaskwallet-restore.com","tld":"com"},"ip":{"addr":"195.250.27.134","port":443,"asn":211126,"as":"WHG Hosting Services Ltd","country":"United Kingdom","country_code":"GB"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://metamaskwallet-restore.com/","date":"2026-01-30T12:11:28.367Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"www.metamaskwallet-restore.com","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Fri, 30 Jan 2026 02:04:32 GMT","end":"Thu, 30 Apr 2026 02:04:31 GMT"},"fingerprint":{"sha1":"82:70:2B:32:D3:3A:36:34:29:37:93:7F:98:95:47:45:77:5C:49:22","sha256":"84:75:E1:22:8E:81:BC:CD:DC:4D:E3:95:6A:07:41:CC:2A:4F:26:1C:75:58:8A:67:A1:7C:7E:BD:FB:8C:19:B0"}}},"request":{"raw":"GET /wp-content/plugins/elementor/assets/js/webpack.runtime.min.js?ver=3.34.4 HTTP/1.1\r\nHost: metamaskwallet-restore.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://metamaskwallet-restore.com/\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\ncontent-type: text/javascript\r\nlast-modified: Fri, 30 Jan 2026 02:18:56 GMT\r\naccept-ranges: bytes\r\ncontent-encoding: br\r\nvary: Accept-Encoding,User-Agent\r\ncontent-length: 2255\r\ndate: Fri, 30 Jan 2026 12:11:28 GMT\r\nserver: LiteSpeed\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"LiteSpeed","description":"LiteSpeed is a high-scalability web server.","website":"https://litespeedtech.com","common_platform_enumeration":"cpe:2.3:a:litespeedtech:litespeed_web_server:*:*:*:*:*:*:*:*","icon":"LiteSpeed.svg","categories":["Web servers"]}],"data":{"size":5677,"size_decoded":0,"mime_type":"text/javascript","magic":"JavaScript source, ASCII text, with very long lines (5677), with no line terminators","md5":"8677d8dfcc987f7d42b832b5ec35587d","sha1":"471ad10036d5aac3064d12441eeaffa05340e4b5","sha256":"b4bbbeb410140adf0ad76bf74e2a6525427e7fd867020599bcce5ce6c724646e","sha512":"ff8c780d9d829ce12e12f10f88fa2b4d970416aea6474c0465e184d78d19e2bbe450869004403e5bf958b394834998ac4d7ee037fed8a2425a92b994581997fa","ssdeep":"96:+6sN0Z9Z4JfrjqyWiNDgUl8OWZp5p0m4leNzwVeLyVU2j2KBKGarNcl8/2:JsNGyrjiiNg5WmH0IW9v7G/2","tlshash":"68c152941694fd2b21e139d8e01b9735252ec1373c1af981fa32eced54e4ed183aa532","first_seen":"2025-12-12T23:30:14.897515Z","last_seen":"2026-05-31T07:30:05.891103Z","times_seen":23676,"resource_available":true,"data":null}},"time_used":416,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":259,"receive":157,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-01-30","alert":"Sinkholed","trigger":"metamaskwallet-restore.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"metamaskwallet-restore.com/wp-content/plugins/elementor/assets/lib/font-awesome/css/solid.min.css?ver=5.15.3","fqdn":"metamaskwallet-restore.com","domain":"metamaskwallet-restore.com","tld":"com"},"ip":{"addr":"195.250.27.134","port":443,"asn":211126,"as":"WHG Hosting Services Ltd","country":"United Kingdom","country_code":"GB"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://metamaskwallet-restore.com/","date":"2026-01-30T12:11:28.359Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"www.metamaskwallet-restore.com","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Fri, 30 Jan 2026 02:04:32 GMT","end":"Thu, 30 Apr 2026 02:04:31 GMT"},"fingerprint":{"sha1":"82:70:2B:32:D3:3A:36:34:29:37:93:7F:98:95:47:45:77:5C:49:22","sha256":"84:75:E1:22:8E:81:BC:CD:DC:4D:E3:95:6A:07:41:CC:2A:4F:26:1C:75:58:8A:67:A1:7C:7E:BD:FB:8C:19:B0"}}},"request":{"raw":"GET /wp-content/plugins/elementor/assets/lib/font-awesome/css/solid.min.css?ver=5.15.3 HTTP/1.1\r\nHost: metamaskwallet-restore.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://metamaskwallet-restore.com/\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\ncache-control: public, max-age=604800\r\nexpires: Fri, 06 Feb 2026 12:11:28 GMT\r\ncontent-type: text/css\r\nlast-modified: Fri, 30 Jan 2026 02:18:56 GMT\r\naccept-ranges: bytes\r\ncontent-encoding: br\r\nvary: Accept-Encoding,User-Agent\r\ncontent-length: 286\r\ndate: Fri, 30 Jan 2026 12:11:28 GMT\r\nserver: LiteSpeed\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"LiteSpeed","description":"LiteSpeed is a high-scalability web server.","website":"https://litespeedtech.com","common_platform_enumeration":"cpe:2.3:a:litespeedtech:litespeed_web_server:*:*:*:*:*:*:*:*","icon":"LiteSpeed.svg","categories":["Web servers"]}],"data":{"size":669,"size_decoded":0,"mime_type":"text/css","magic":"ASCII text, with very long lines (483)","md5":"9eb2d3c87feb6bb2ffa63b70532b1477","sha1":"38f226335a05ab0e30497bc7419eb5e243a9e26c","sha256":"37bab6cd583982e8eff58501a99d7c5c4d63664c1ca34f9e3b7cf526c5b73ae2","sha512":"8d0ab38f6bc757103fc82a234fca5566328639ef549a862f9ceb8cff6b10d75d2fc626a3054fb85a4c91b3538332677801f9edc14115e09f957cce8391f8cb46","ssdeep":"","tlshash":"ce01f96e4646194141c10f1138d9fa5ded46f0a97c582f33a12adc2d8cf9e5f21b9f19","first_seen":"2023-04-05T04:00:29Z","last_seen":"2026-05-31T11:08:34.134722Z","times_seen":95543,"resource_available":false,"data":null}},"time_used":312,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":312,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-01-30","alert":"Sinkholed","trigger":"metamaskwallet-restore.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"metamaskwallet-restore.com/wp-content/plugins/elementor/assets/lib/font-awesome/css/fontawesome.css?ver=5.15.3","fqdn":"metamaskwallet-restore.com","domain":"metamaskwallet-restore.com","tld":"com"},"ip":{"addr":"195.250.27.134","port":443,"asn":211126,"as":"WHG Hosting Services Ltd","country":"United Kingdom","country_code":"GB"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://metamaskwallet-restore.com/","date":"2026-01-30T12:11:28.350Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"www.metamaskwallet-restore.com","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Fri, 30 Jan 2026 02:04:32 GMT","end":"Thu, 30 Apr 2026 02:04:31 GMT"},"fingerprint":{"sha1":"82:70:2B:32:D3:3A:36:34:29:37:93:7F:98:95:47:45:77:5C:49:22","sha256":"84:75:E1:22:8E:81:BC:CD:DC:4D:E3:95:6A:07:41:CC:2A:4F:26:1C:75:58:8A:67:A1:7C:7E:BD:FB:8C:19:B0"}}},"request":{"raw":"GET /wp-content/plugins/elementor/assets/lib/font-awesome/css/fontawesome.css?ver=5.15.3 HTTP/1.1\r\nHost: metamaskwallet-restore.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://metamaskwallet-restore.com/\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\ncache-control: public, max-age=604800\r\nexpires: Fri, 06 Feb 2026 12:11:28 GMT\r\ncontent-type: text/css\r\nlast-modified: Fri, 30 Jan 2026 02:18:56 GMT\r\naccept-ranges: bytes\r\ncontent-encoding: br\r\nvary: Accept-Encoding,User-Agent\r\ncontent-length: 12526\r\ndate: Fri, 30 Jan 2026 12:11:28 GMT\r\nserver: LiteSpeed\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"LiteSpeed","description":"LiteSpeed is a high-scalability web server.","website":"https://litespeedtech.com","common_platform_enumeration":"cpe:2.3:a:litespeedtech:litespeed_web_server:*:*:*:*:*:*:*:*","icon":"LiteSpeed.svg","categories":["Web servers"]}],"data":{"size":72184,"size_decoded":0,"mime_type":"text/css","magic":"ASCII text","md5":"aae648ec410260f859ac89e58a8372c1","sha1":"f7320458aadcbaa2ed94c43c8d7ddb9361d0b106","sha256":"d417b6ed49cb6ae3dfe2b0bab5d865472052cd0286a9478c74cbb09a02a56d0d","sha512":"88c7cfdc35aa5e4ecbd8023b966758f30aa7d1f5367820a1443922988c06a4a5a96fc500fab19985a090cbc85c9e2e5db63470e50fbc93f5596fee59346c3b73","ssdeep":"768:0bUiiiukQWIsjoQCSsncTpsTO3DNnYGmLN0yPburmvXnH4:0giii1IohCSicdsa3DNnYGeZPK4XY","tlshash":"d963dcfee1ff10944311e4812643e2e4f329b66cec8a4c98d2a67d9df1c165ca186bdd","first_seen":"2024-05-17T06:44:22Z","last_seen":"2026-05-31T10:19:30.798275Z","times_seen":31245,"resource_available":false,"data":null}},"time_used":299,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":286,"receive":13,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-01-30","alert":"Sinkholed","trigger":"metamaskwallet-restore.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"fonts.googleapis.com/css?family=Roboto:100,100italic,200,200italic,300,300italic,400,400italic,500,500italic,600,600italic,700,700italic,800,800italic,900,900italic\u0026display=swap","fqdn":"fonts.googleapis.com","domain":"fonts.googleapis.com","tld":"googleapis.com"},"ip":{"addr":"216.58.211.10","port":443,"asn":15169,"as":"GOOGLE","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://metamaskwallet-restore.com/","date":"2026-01-30T12:11:28.357Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"upload.video.google.com","organization":""},"issuer":{"commonName":"WR2","organization":"Google Trust Services"},"validity":{"start":"Mon, 29 Dec 2025 19:52:24 GMT","end":"Mon, 23 Mar 2026 19:52:23 GMT"},"fingerprint":{"sha1":"43:39:AF:0A:74:F9:2F:1B:C0:1E:4E:89:21:30:C2:28:EC:9F:6C:67","sha256":"EA:F1:0E:C7:36:18:F3:9D:D1:D5:34:23:44:7D:6F:9D:2F:61:C7:81:09:9E:E9:C8:02:C8:F2:2C:0A:83:B3:A5"}}},"request":{"raw":"GET /css?family=Roboto:100,100italic,200,200italic,300,300italic,400,400italic,500,500italic,600,600italic,700,700italic,800,800italic,900,900italic\u0026display=swap HTTP/1.1\r\nHost: fonts.googleapis.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://metamaskwallet-restore.com/\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ncontent-type: text/css; charset=utf-8\r\nvary: Sec-Fetch-Dest, Sec-Fetch-Mode, Sec-Fetch-Site\r\naccess-control-allow-origin: *\r\ntiming-allow-origin: *\r\nlink: \u003chttps://fonts.gstatic.com\u003e; rel=preconnect; crossorigin\r\nstrict-transport-security: max-age=31536000\r\nexpires: Fri, 30 Jan 2026 12:11:28 GMT\r\ndate: Fri, 30 Jan 2026 12:11:28 GMT\r\ncache-control: private, max-age=86400\r\ncross-origin-resource-policy: cross-origin\r\ncross-origin-opener-policy: same-origin-allow-popups\r\ncontent-encoding: gzip\r\nserver: ESF\r\nx-xss-protection: 0\r\nx-frame-options: SAMEORIGIN\r\nx-content-type-options: nosniff\r\nalt-svc: h3=\":443\"; ma=2592000,h3-29=\":443\"; ma=2592000\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":100764,"size_decoded":0,"mime_type":"text/css; charset=utf-8","magic":"ASCII text, with very long lines (1572)","md5":"c1a689e52451e6a409deb9d792dbac30","sha1":"d51f6f8ea1dfdf5fb4c0dcaf3c7978ce4d8eed75","sha256":"55960525d6ce04943c6bde176b9ab7c92f4a27666c7105e5b0d32a336ab1c0b2","sha512":"5839e22aaa92cf2407b1717f337de537822b89e5745d60a1db18ba779cbe19fbdc4266d89a73adba84f7005bc176eaa0d9294903992cf04e1be63072b6f7e675","ssdeep":"768:yDcDaDvDcDzBDFKDeDODO/Re/zUFhl114KF4zLFa+OgN7wNzaFLXnnGE3GzhFUQS:zO3YRSrslIxerANy3El","tlshash":"efa3eda1041b5040ab834ce223cfbe34fe1f92507151d0b9abfd9b6baddbd66526835c","first_seen":"2025-11-19T00:01:22.142754Z","last_seen":"2026-05-31T09:48:00.748269Z","times_seen":5838,"resource_available":false,"data":null}},"time_used":249,"timings":{"blocked":85,"dns":1,"connect":7,"send":0,"wait":37,"receive":0,"ssl":116},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"metamaskwallet-restore.com/wp-content/uploads/astra-addon/astra-addon-697c98f1d6a790-78841188.css?ver=4.12.0","fqdn":"metamaskwallet-restore.com","domain":"metamaskwallet-restore.com","tld":"com"},"ip":{"addr":"195.250.27.134","port":443,"asn":211126,"as":"WHG Hosting Services Ltd","country":"United Kingdom","country_code":"GB"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://metamaskwallet-restore.com/","date":"2026-01-30T12:11:28.346Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"www.metamaskwallet-restore.com","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Fri, 30 Jan 2026 02:04:32 GMT","end":"Thu, 30 Apr 2026 02:04:31 GMT"},"fingerprint":{"sha1":"82:70:2B:32:D3:3A:36:34:29:37:93:7F:98:95:47:45:77:5C:49:22","sha256":"84:75:E1:22:8E:81:BC:CD:DC:4D:E3:95:6A:07:41:CC:2A:4F:26:1C:75:58:8A:67:A1:7C:7E:BD:FB:8C:19:B0"}}},"request":{"raw":"GET /wp-content/uploads/astra-addon/astra-addon-697c98f1d6a790-78841188.css?ver=4.12.0 HTTP/1.1\r\nHost: metamaskwallet-restore.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://metamaskwallet-restore.com/\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\ncache-control: public, max-age=604800\r\nexpires: Fri, 06 Feb 2026 12:11:28 GMT\r\ncontent-type: text/css\r\nlast-modified: Fri, 30 Jan 2026 11:41:37 GMT\r\naccept-ranges: bytes\r\ncontent-encoding: br\r\nvary: Accept-Encoding,User-Agent\r\ncontent-length: 2773\r\ndate: Fri, 30 Jan 2026 12:11:28 GMT\r\nserver: LiteSpeed\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"LiteSpeed","description":"LiteSpeed is a high-scalability web server.","website":"https://litespeedtech.com","common_platform_enumeration":"cpe:2.3:a:litespeedtech:litespeed_web_server:*:*:*:*:*:*:*:*","icon":"LiteSpeed.svg","categories":["Web servers"]}],"data":{"size":16972,"size_decoded":0,"mime_type":"text/css","magic":"ASCII text, with very long lines (16972), with no line terminators","md5":"bb6ba4e8a738221abc51bb28cdbbf7f3","sha1":"6d6f189128b32465b41947a9bbc4310bff51870b","sha256":"3bbecd7bec5162916a363fd7a11ee7150a1ad2a36df1852b2a1494d2ec162be2","sha512":"6e620b7c25900e9593dffbdaa7f6282887b7fecbf2fea7f8434dd564e4859882b67f43b6e660ff1facf192a243ce35a92823e6b35cbcc0df9336c29b1217441d","ssdeep":"192:9I8ImI+sEACq4IJI7RjA1Pc4U5+xwiVIE0glh6I06PGNE3H393rtl3T3Xtl3w3IR:0dKQrXhT","tlshash":"04723252578535153037a733f087bf1877758763be2e238bf2a9811b8aebf5840a1949","first_seen":"2024-12-30T13:16:30.511747Z","last_seen":"2026-05-31T09:01:29.975586Z","times_seen":1269,"resource_available":false,"data":null}},"time_used":166,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":145,"receive":21,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-01-30","alert":"Sinkholed","trigger":"metamaskwallet-restore.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"metamaskwallet-restore.com/wp-content/themes/astra/assets/js/minified/flexibility.min.js?ver=4.12.1","fqdn":"metamaskwallet-restore.com","domain":"metamaskwallet-restore.com","tld":"com"},"ip":{"addr":"195.250.27.134","port":443,"asn":211126,"as":"WHG Hosting Services Ltd","country":"United Kingdom","country_code":"GB"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://metamaskwallet-restore.com/","date":"2026-01-30T12:11:28.361Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"www.metamaskwallet-restore.com","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Fri, 30 Jan 2026 02:04:32 GMT","end":"Thu, 30 Apr 2026 02:04:31 GMT"},"fingerprint":{"sha1":"82:70:2B:32:D3:3A:36:34:29:37:93:7F:98:95:47:45:77:5C:49:22","sha256":"84:75:E1:22:8E:81:BC:CD:DC:4D:E3:95:6A:07:41:CC:2A:4F:26:1C:75:58:8A:67:A1:7C:7E:BD:FB:8C:19:B0"}}},"request":{"raw":"GET /wp-content/themes/astra/assets/js/minified/flexibility.min.js?ver=4.12.1 HTTP/1.1\r\nHost: metamaskwallet-restore.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://metamaskwallet-restore.com/\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\ncontent-type: text/javascript\r\nlast-modified: Fri, 30 Jan 2026 02:21:18 GMT\r\naccept-ranges: bytes\r\ncontent-encoding: br\r\nvary: Accept-Encoding,User-Agent\r\ncontent-length: 3759\r\ndate: Fri, 30 Jan 2026 12:11:28 GMT\r\nserver: LiteSpeed\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"LiteSpeed","description":"LiteSpeed is a high-scalability web server.","website":"https://litespeedtech.com","common_platform_enumeration":"cpe:2.3:a:litespeedtech:litespeed_web_server:*:*:*:*:*:*:*:*","icon":"LiteSpeed.svg","categories":["Web servers"]}],"data":{"size":15525,"size_decoded":0,"mime_type":"text/javascript","magic":"JavaScript source, ASCII text, with very long lines (15525), with no line terminators","md5":"f3f609a6ebd5b8fede4abc63e105a7b7","sha1":"6cf96160fa67d56a7be3c68b1941d3af0061a69d","sha256":"cb7b88e5a91d97805b4efcbb6d4076cf93a62fcee29a5a363ed66dafca0dec09","sha512":"afd5aca3d8468c121b02d8b93f219bf9157c36f94a1df1511c3803ea70671d872bdb2ff6a04bcaf1110355a10ec5f9f2b2e28f9d50cb3447ee845d6ea00303a4","ssdeep":"384:uOgKnOUyVosSYlDjp1CAWa54XoO4qd7auYk4FozQ5rY3cYaTtlUBETID9g4ST6C7:Ng0OlVosHlDjp1CAWa54XoO4qd7auYkA","tlshash":"07620dc73a4c342246028e88fdab9a1578a60f6e0b2c4758d157b97400b6d571debbff","first_seen":"2025-10-07T17:03:00.325877Z","last_seen":"2026-05-31T10:56:46.284716Z","times_seen":16775,"resource_available":true,"data":null}},"time_used":318,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":312,"receive":6,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-01-30","alert":"Sinkholed","trigger":"metamaskwallet-restore.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"metamaskwallet-restore.com/wp-content/plugins/wpforms/assets/js/integrations/elementor/frontend.min.js?ver=1.8.7.2","fqdn":"metamaskwallet-restore.com","domain":"metamaskwallet-restore.com","tld":"com"},"ip":{"addr":"195.250.27.134","port":443,"asn":211126,"as":"WHG Hosting Services Ltd","country":"United Kingdom","country_code":"GB"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://metamaskwallet-restore.com/","date":"2026-01-30T12:11:28.380Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"www.metamaskwallet-restore.com","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Fri, 30 Jan 2026 02:04:32 GMT","end":"Thu, 30 Apr 2026 02:04:31 GMT"},"fingerprint":{"sha1":"82:70:2B:32:D3:3A:36:34:29:37:93:7F:98:95:47:45:77:5C:49:22","sha256":"84:75:E1:22:8E:81:BC:CD:DC:4D:E3:95:6A:07:41:CC:2A:4F:26:1C:75:58:8A:67:A1:7C:7E:BD:FB:8C:19:B0"}}},"request":{"raw":"GET /wp-content/plugins/wpforms/assets/js/integrations/elementor/frontend.min.js?ver=1.8.7.2 HTTP/1.1\r\nHost: metamaskwallet-restore.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://metamaskwallet-restore.com/\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\ncontent-type: text/javascript\r\nlast-modified: Fri, 30 Jan 2026 03:07:10 GMT\r\naccept-ranges: bytes\r\ncontent-encoding: br\r\nvary: Accept-Encoding,User-Agent\r\ncontent-length: 342\r\ndate: Fri, 30 Jan 2026 12:11:28 GMT\r\nserver: LiteSpeed\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"LiteSpeed","description":"LiteSpeed is a high-scalability web server.","website":"https://litespeedtech.com","common_platform_enumeration":"cpe:2.3:a:litespeedtech:litespeed_web_server:*:*:*:*:*:*:*:*","icon":"LiteSpeed.svg","categories":["Web servers"]}],"data":{"size":771,"size_decoded":0,"mime_type":"text/javascript","magic":"JavaScript source, ASCII text, with very long lines (771), with no line terminators","md5":"2399ef783701f73c399589ae95298b0f","sha1":"3e1f2a7ac9dcb2b50b1f1cf768441e46fd9f62ee","sha256":"2dea57483641f8762937dfd9b09126a9b21c88bd3d7486186003e0bbb9043145","sha512":"50f1c2b16c8c2fc62c504a33529dcef3fdbdd1533206c8779772cbba1a336c7c5bbb533a35f99e559aded3d1bf0c858c10a04ec083969f47a29deac92e366fa1","ssdeep":"","tlshash":"3901bd34b437beda1c6f122414af138fb266d4b3b2069c91972095b41e71dca634bf88","first_seen":"2023-03-12T15:10:15Z","last_seen":"2026-05-31T07:10:13.988999Z","times_seen":9852,"resource_available":true,"data":null}},"time_used":472,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":472,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-01-30","alert":"Sinkholed","trigger":"metamaskwallet-restore.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"metamaskwallet-restore.com/wp-content/plugins/elementor/assets/lib/font-awesome/css/solid.css?ver=5.15.3","fqdn":"metamaskwallet-restore.com","domain":"metamaskwallet-restore.com","tld":"com"},"ip":{"addr":"195.250.27.134","port":443,"asn":211126,"as":"WHG Hosting Services Ltd","country":"United Kingdom","country_code":"GB"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://metamaskwallet-restore.com/","date":"2026-01-30T12:11:28.351Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"www.metamaskwallet-restore.com","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Fri, 30 Jan 2026 02:04:32 GMT","end":"Thu, 30 Apr 2026 02:04:31 GMT"},"fingerprint":{"sha1":"82:70:2B:32:D3:3A:36:34:29:37:93:7F:98:95:47:45:77:5C:49:22","sha256":"84:75:E1:22:8E:81:BC:CD:DC:4D:E3:95:6A:07:41:CC:2A:4F:26:1C:75:58:8A:67:A1:7C:7E:BD:FB:8C:19:B0"}}},"request":{"raw":"GET /wp-content/plugins/elementor/assets/lib/font-awesome/css/solid.css?ver=5.15.3 HTTP/1.1\r\nHost: metamaskwallet-restore.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://metamaskwallet-restore.com/\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\ncache-control: public, max-age=604800\r\nexpires: Fri, 06 Feb 2026 12:11:28 GMT\r\ncontent-type: text/css\r\nlast-modified: Fri, 30 Jan 2026 02:18:56 GMT\r\naccept-ranges: bytes\r\ncontent-encoding: br\r\nvary: Accept-Encoding,User-Agent\r\ncontent-length: 296\r\ndate: Fri, 30 Jan 2026 12:11:28 GMT\r\nserver: LiteSpeed\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"LiteSpeed","description":"LiteSpeed is a high-scalability web server.","website":"https://litespeedtech.com","common_platform_enumeration":"cpe:2.3:a:litespeedtech:litespeed_web_server:*:*:*:*:*:*:*:*","icon":"LiteSpeed.svg","categories":["Web servers"]}],"data":{"size":727,"size_decoded":0,"mime_type":"text/css","magic":"ASCII text, with very long lines (307)","md5":"8d37441d69ebc9b55dff2c7c214ef997","sha1":"9a292c8559131ea8838899863987ffdcfb4005ea","sha256":"93cf6e96459e42f9f656e03ec4800578dc2c021dcde475c9e5e891a7780b0866","sha512":"25e4e29eadc6a9c8b81b8e000726d8a9eea9d3378ca6faa641d5b9dcb64039ba97904fd0b2bf50a8303b7cd1194d08c80641025a635f8c3fd2ebd9217f824704","ssdeep":"","tlshash":"a201247d81022a504a8008152adabf689e99b0a6785c6f7572329c2eccf4e5961a9f0d","first_seen":"2023-04-09T05:14:34Z","last_seen":"2026-05-31T10:38:26.732434Z","times_seen":31094,"resource_available":false,"data":null}},"time_used":298,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":298,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-01-30","alert":"Sinkholed","trigger":"metamaskwallet-restore.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"metamaskwallet-restore.com/wp-content/uploads/2026/01/cropped-images-removebg-preview-80x80.png","fqdn":"metamaskwallet-restore.com","domain":"metamaskwallet-restore.com","tld":"com"},"ip":{"addr":"195.250.27.134","port":443,"asn":211126,"as":"WHG Hosting Services Ltd","country":"United Kingdom","country_code":"GB"},"is_navigation_request":false,"resource_type":"imageset","requested_by":"https://metamaskwallet-restore.com/","date":"2026-01-30T12:11:28.364Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"www.metamaskwallet-restore.com","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Fri, 30 Jan 2026 02:04:32 GMT","end":"Thu, 30 Apr 2026 02:04:31 GMT"},"fingerprint":{"sha1":"82:70:2B:32:D3:3A:36:34:29:37:93:7F:98:95:47:45:77:5C:49:22","sha256":"84:75:E1:22:8E:81:BC:CD:DC:4D:E3:95:6A:07:41:CC:2A:4F:26:1C:75:58:8A:67:A1:7C:7E:BD:FB:8C:19:B0"}}},"request":{"raw":"GET /wp-content/uploads/2026/01/cropped-images-removebg-preview-80x80.png HTTP/1.1\r\nHost: metamaskwallet-restore.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://metamaskwallet-restore.com/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\ncache-control: public, max-age=604800\r\nexpires: Fri, 06 Feb 2026 12:11:28 GMT\r\ncontent-type: image/png\r\nlast-modified: Fri, 30 Jan 2026 11:41:37 GMT\r\naccept-ranges: bytes\r\ncontent-length: 8761\r\ndate: Fri, 30 Jan 2026 12:11:28 GMT\r\nserver: LiteSpeed\r\nvary: User-Agent\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"LiteSpeed","description":"LiteSpeed is a high-scalability web server.","website":"https://litespeedtech.com","common_platform_enumeration":"cpe:2.3:a:litespeedtech:litespeed_web_server:*:*:*:*:*:*:*:*","icon":"LiteSpeed.svg","categories":["Web servers"]}],"data":{"size":8761,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 80 x 80, 8-bit/color RGBA, non-interlaced","md5":"d4354625f85449ef7f5c7d8f1ba4f97e","sha1":"8fd70dca810167e94715dc272d0cda8c6944cc00","sha256":"52a43614eea810a771bd1852f4afd1355dce686c053a45d47249bc31b95f5d9f","sha512":"6a2717216e2ee7dae8c616d61bb4d1336c2a646de83fe3fc35412c96c75fb631de1e371383865fccb93fc71f2956f84929f2b2c0c5978b2cfcb13adf224fa580","ssdeep":"192:M3Y7gvM+rGmJy9UNZ00hLVUPdYoCmqRKZJ/KSR:M3bvcmECJhZMdYBmuKLd","tlshash":"f602af76bb1f2bc8adc564cf7f23639d686e345d961e02601ef28c22f146d4accb2841","first_seen":"2026-01-30T11:46:59.057384Z","last_seen":"2026-02-03T19:53:00.581029Z","times_seen":3,"resource_available":false,"data":null}},"time_used":412,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":401,"receive":11,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-01-30","alert":"Sinkholed","trigger":"metamaskwallet-restore.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"metamaskwallet-restore.com/wp-includes/js/dist/i18n.min.js?ver=c26c3dc7bed366793375","fqdn":"metamaskwallet-restore.com","domain":"metamaskwallet-restore.com","tld":"com"},"ip":{"addr":"195.250.27.134","port":443,"asn":211126,"as":"WHG Hosting Services Ltd","country":"United Kingdom","country_code":"GB"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://metamaskwallet-restore.com/","date":"2026-01-30T12:11:28.374Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"www.metamaskwallet-restore.com","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Fri, 30 Jan 2026 02:04:32 GMT","end":"Thu, 30 Apr 2026 02:04:31 GMT"},"fingerprint":{"sha1":"82:70:2B:32:D3:3A:36:34:29:37:93:7F:98:95:47:45:77:5C:49:22","sha256":"84:75:E1:22:8E:81:BC:CD:DC:4D:E3:95:6A:07:41:CC:2A:4F:26:1C:75:58:8A:67:A1:7C:7E:BD:FB:8C:19:B0"}}},"request":{"raw":"GET /wp-includes/js/dist/i18n.min.js?ver=c26c3dc7bed366793375 HTTP/1.1\r\nHost: metamaskwallet-restore.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://metamaskwallet-restore.com/\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\ncontent-type: text/javascript\r\nlast-modified: Tue, 21 Oct 2025 07:14:02 GMT\r\naccept-ranges: bytes\r\ncontent-encoding: br\r\nvary: Accept-Encoding,User-Agent\r\ncontent-length: 2119\r\ndate: Fri, 30 Jan 2026 12:11:28 GMT\r\nserver: LiteSpeed\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"LiteSpeed","description":"LiteSpeed is a high-scalability web server.","website":"https://litespeedtech.com","common_platform_enumeration":"cpe:2.3:a:litespeedtech:litespeed_web_server:*:*:*:*:*:*:*:*","icon":"LiteSpeed.svg","categories":["Web servers"]}],"data":{"size":5314,"size_decoded":0,"mime_type":"text/javascript","magic":"data","md5":"3a5838d1182eb0b11f5a58bfe26e2529","sha1":"920b2291e65d62eb55c1958911768540abaff5cf","sha256":"d4efe709c65438ae90dff385486421fea45762880f21fc4e0dca3fa96210f428","sha512":"bc41d50cd2e5c17c75ba737c303f2f498cc94e2c3fe402b2f15c5f10531e53633598093da98579b2dee65733dce0f763d77380ae35a9591d8bf91f975b7c6845","ssdeep":"96:L9emIWL7lnv93ssmAeGejQVnmggoC7arVCG0GXF730IQRDdlZq+SxSD3LmD:8mIWZVszMuinmg3rQ8Xd30DDdlZq+Sx3","tlshash":"2bb157dcb9d57022235121a0597fb409f3357d6470ebb8006ba9c4a47eb15cfb1a2fad","first_seen":"2025-10-27T08:47:54.280246Z","last_seen":"2026-05-31T11:21:06.747913Z","times_seen":187682,"resource_available":true,"data":null}},"time_used":460,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":460,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-01-30","alert":"Sinkholed","trigger":"metamaskwallet-restore.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"metamaskwallet-restore.com/wp-content/plugins/elementor/assets/css/widget-social-icons.min.css?ver=3.24.0","fqdn":"metamaskwallet-restore.com","domain":"metamaskwallet-restore.com","tld":"com"},"ip":{"addr":"195.250.27.134","port":443,"asn":211126,"as":"WHG Hosting Services Ltd","country":"United Kingdom","country_code":"GB"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://metamaskwallet-restore.com/","date":"2026-01-30T12:11:28.348Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"www.metamaskwallet-restore.com","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Fri, 30 Jan 2026 02:04:32 GMT","end":"Thu, 30 Apr 2026 02:04:31 GMT"},"fingerprint":{"sha1":"82:70:2B:32:D3:3A:36:34:29:37:93:7F:98:95:47:45:77:5C:49:22","sha256":"84:75:E1:22:8E:81:BC:CD:DC:4D:E3:95:6A:07:41:CC:2A:4F:26:1C:75:58:8A:67:A1:7C:7E:BD:FB:8C:19:B0"}}},"request":{"raw":"GET /wp-content/plugins/elementor/assets/css/widget-social-icons.min.css?ver=3.24.0 HTTP/1.1\r\nHost: metamaskwallet-restore.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://metamaskwallet-restore.com/\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\ncache-control: public, max-age=604800\r\nexpires: Fri, 06 Feb 2026 12:11:28 GMT\r\ncontent-type: text/css\r\nlast-modified: Fri, 30 Jan 2026 02:18:56 GMT\r\naccept-ranges: bytes\r\ncontent-encoding: br\r\nvary: Accept-Encoding,User-Agent\r\ncontent-length: 1039\r\ndate: Fri, 30 Jan 2026 12:11:28 GMT\r\nserver: LiteSpeed\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"LiteSpeed","description":"LiteSpeed is a high-scalability web server.","website":"https://litespeedtech.com","common_platform_enumeration":"cpe:2.3:a:litespeedtech:litespeed_web_server:*:*:*:*:*:*:*:*","icon":"LiteSpeed.svg","categories":["Web servers"]}],"data":{"size":5110,"size_decoded":0,"mime_type":"text/css","magic":"ASCII text, with very long lines (5110), with no line terminators","md5":"d026a17938c5380cc610572fdda43f40","sha1":"2b5df61e56b7fe1dfb88f1707d4b017909b02a75","sha256":"91079644ee1e76145b30c207470b56866770b0564f0fbf1373ab8b11d94f8c9f","sha512":"00dd387f3726c15e71f2f7379c4fd3bdef41c2d81d73f22f3212991b4d18d4b663ae89906722fd9e188606c1061f3f8b5472deee2cd514680e64a29f8193cd66","ssdeep":"48:FDoWozmcbWsiYPt3U/vjfQIeyiZ8Fu2ifnFNZP1NsXUyG9eoL:5oz/WkBUHjfQL7aFu2if3Jf9HL","tlshash":"e5b17651be4f9586321f002a0993f309d05a12c5dc8c6f78f856b16e59b6fe43a73eb2","first_seen":"2025-02-28T14:24:31.329664Z","last_seen":"2026-05-31T11:23:51.521229Z","times_seen":61324,"resource_available":false,"data":null}},"time_used":287,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":282,"receive":5,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-01-30","alert":"Sinkholed","trigger":"metamaskwallet-restore.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"metamaskwallet-restore.com/wp-content/plugins/elementor-pro/assets/css/widget-nav-menu.min.css?ver=3.26.0","fqdn":"metamaskwallet-restore.com","domain":"metamaskwallet-restore.com","tld":"com"},"ip":{"addr":"195.250.27.134","port":443,"asn":211126,"as":"WHG Hosting Services Ltd","country":"United Kingdom","country_code":"GB"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://metamaskwallet-restore.com/","date":"2026-01-30T12:11:28.356Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"www.metamaskwallet-restore.com","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Fri, 30 Jan 2026 02:04:32 GMT","end":"Thu, 30 Apr 2026 02:04:31 GMT"},"fingerprint":{"sha1":"82:70:2B:32:D3:3A:36:34:29:37:93:7F:98:95:47:45:77:5C:49:22","sha256":"84:75:E1:22:8E:81:BC:CD:DC:4D:E3:95:6A:07:41:CC:2A:4F:26:1C:75:58:8A:67:A1:7C:7E:BD:FB:8C:19:B0"}}},"request":{"raw":"GET /wp-content/plugins/elementor-pro/assets/css/widget-nav-menu.min.css?ver=3.26.0 HTTP/1.1\r\nHost: metamaskwallet-restore.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://metamaskwallet-restore.com/\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\ncache-control: public, max-age=604800\r\nexpires: Fri, 06 Feb 2026 12:11:28 GMT\r\ncontent-type: text/css\r\nlast-modified: Fri, 30 Jan 2026 03:08:11 GMT\r\naccept-ranges: bytes\r\ncontent-encoding: br\r\nvary: Accept-Encoding,User-Agent\r\ncontent-length: 3242\r\ndate: Fri, 30 Jan 2026 12:11:28 GMT\r\nserver: LiteSpeed\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"LiteSpeed","description":"LiteSpeed is a high-scalability web server.","website":"https://litespeedtech.com","common_platform_enumeration":"cpe:2.3:a:litespeedtech:litespeed_web_server:*:*:*:*:*:*:*:*","icon":"LiteSpeed.svg","categories":["Web servers"]}],"data":{"size":27365,"size_decoded":0,"mime_type":"text/css","magic":"Unicode text, UTF-8 text, with very long lines (27319), with CRLF line terminators","md5":"36013bdadbd59957e985635f26f69174","sha1":"892423e06647c9b37fb1c45bb7ce1b0f9727076b","sha256":"495316ffe538b8c4fdeaab600be19fad7be2b4b2dad2afba38627fc933b55130","sha512":"826f08b72859683394cad6821fdcf8458d408805221434489ce79fdea14e813e0a3f20197be60f2b03ef74ac55e6335dcdca4192e20f73638888526916b7bad1","ssdeep":"768:BrPoScoKjcUlwvGQzKVwGz42lvQz0ABI5PmBMqRIEEtCelEqJUrY+jz:B","tlshash":"c7c27a81be93592f032f613b91e2c60c4f9519c8b2a176a9f0f5910f41d7d5c6bb7b22","first_seen":"2026-01-21T13:53:51.856019Z","last_seen":"2026-05-27T00:25:20.754303Z","times_seen":54,"resource_available":false,"data":null}},"time_used":300,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":298,"receive":2,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-01-30","alert":"Sinkholed","trigger":"metamaskwallet-restore.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"metamaskwallet-restore.com/wp-content/plugins/elementor/assets/lib/font-awesome/css/fontawesome.min.css?ver=5.15.3","fqdn":"metamaskwallet-restore.com","domain":"metamaskwallet-restore.com","tld":"com"},"ip":{"addr":"195.250.27.134","port":443,"asn":211126,"as":"WHG Hosting Services Ltd","country":"United Kingdom","country_code":"GB"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://metamaskwallet-restore.com/","date":"2026-01-30T12:11:28.358Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"www.metamaskwallet-restore.com","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Fri, 30 Jan 2026 02:04:32 GMT","end":"Thu, 30 Apr 2026 02:04:31 GMT"},"fingerprint":{"sha1":"82:70:2B:32:D3:3A:36:34:29:37:93:7F:98:95:47:45:77:5C:49:22","sha256":"84:75:E1:22:8E:81:BC:CD:DC:4D:E3:95:6A:07:41:CC:2A:4F:26:1C:75:58:8A:67:A1:7C:7E:BD:FB:8C:19:B0"}}},"request":{"raw":"GET /wp-content/plugins/elementor/assets/lib/font-awesome/css/fontawesome.min.css?ver=5.15.3 HTTP/1.1\r\nHost: metamaskwallet-restore.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://metamaskwallet-restore.com/\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\ncache-control: public, max-age=604800\r\nexpires: Fri, 06 Feb 2026 12:11:28 GMT\r\ncontent-type: text/css\r\nlast-modified: Fri, 30 Jan 2026 02:18:56 GMT\r\naccept-ranges: bytes\r\ncontent-encoding: br\r\nvary: Accept-Encoding,User-Agent\r\ncontent-length: 12164\r\ndate: Fri, 30 Jan 2026 12:11:28 GMT\r\nserver: LiteSpeed\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"LiteSpeed","description":"LiteSpeed is a high-scalability web server.","website":"https://litespeedtech.com","common_platform_enumeration":"cpe:2.3:a:litespeedtech:litespeed_web_server:*:*:*:*:*:*:*:*","icon":"LiteSpeed.svg","categories":["Web servers"]}],"data":{"size":58071,"size_decoded":0,"mime_type":"text/css","magic":"ASCII text, with very long lines (57884)","md5":"f4af7e5ec05ebb0f08d43e2384266abc","sha1":"a1869e155e92fa178b9c3ae6dff787df57f195c6","sha256":"fafc4160788beca657ec3e3041976281fb6d54a0e82bb4d22a433f7c6bb8b1d6","sha512":"8352ad9a565e0092429759d29e9384f9c4a5df874fdc448a247080993a3ac99961f13737d57cc4b26ba7107a4bf20718d92429626e175cd46dbbaca2790ebe03","ssdeep":"768:0Eh31IPiyXNq4YxBowbgJlkwF//zMQyYJYX9Bst6VSzO:0E0PxXE4YXJgndFTfy9et5q","tlshash":"6943f9b8e54c01cab731c44bef42b2bc61b6f73de5914d95f00e691c2ad26a81185fba","first_seen":"2024-03-11T23:30:43Z","last_seen":"2026-05-31T11:08:34.125767Z","times_seen":95775,"resource_available":false,"data":null}},"time_used":313,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":301,"receive":12,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-01-30","alert":"Sinkholed","trigger":"metamaskwallet-restore.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"metamaskwallet-restore.com/wp-content/themes/astra/assets/js/minified/frontend.min.js?ver=4.12.1","fqdn":"metamaskwallet-restore.com","domain":"metamaskwallet-restore.com","tld":"com"},"ip":{"addr":"195.250.27.134","port":443,"asn":211126,"as":"WHG Hosting Services Ltd","country":"United Kingdom","country_code":"GB"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://metamaskwallet-restore.com/","date":"2026-01-30T12:11:28.365Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"www.metamaskwallet-restore.com","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Fri, 30 Jan 2026 02:04:32 GMT","end":"Thu, 30 Apr 2026 02:04:31 GMT"},"fingerprint":{"sha1":"82:70:2B:32:D3:3A:36:34:29:37:93:7F:98:95:47:45:77:5C:49:22","sha256":"84:75:E1:22:8E:81:BC:CD:DC:4D:E3:95:6A:07:41:CC:2A:4F:26:1C:75:58:8A:67:A1:7C:7E:BD:FB:8C:19:B0"}}},"request":{"raw":"GET /wp-content/themes/astra/assets/js/minified/frontend.min.js?ver=4.12.1 HTTP/1.1\r\nHost: metamaskwallet-restore.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://metamaskwallet-restore.com/\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\ncontent-type: text/javascript\r\nlast-modified: Fri, 30 Jan 2026 02:21:18 GMT\r\naccept-ranges: bytes\r\ncontent-encoding: br\r\nvary: Accept-Encoding,User-Agent\r\ncontent-length: 5927\r\ndate: Fri, 30 Jan 2026 12:11:28 GMT\r\nserver: LiteSpeed\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"LiteSpeed","description":"LiteSpeed is a high-scalability web server.","website":"https://litespeedtech.com","common_platform_enumeration":"cpe:2.3:a:litespeedtech:litespeed_web_server:*:*:*:*:*:*:*:*","icon":"LiteSpeed.svg","categories":["Web servers"]}],"data":{"size":25965,"size_decoded":0,"mime_type":"text/javascript","magic":"JavaScript source, ASCII text, with very long lines (25965), with no line terminators","md5":"424d1bd49a0f7bf705d9342a91c0089b","sha1":"94166e2c3fb906fcdacd8976d14638201d0a7bb9","sha256":"66b713cb51fe6103cd8729bc0c245c9497295b6873bdb9be7e8196caf5e5326e","sha512":"1694d2c8689eb7fb9e580bbe8184a6636cf6d05619ed16edb914155bf8f4488921d99ebfcbe5d1f5b3504435f13e2050934ae8d1eefdc432a4a98560180cb52f","ssdeep":"768:uYEPx6KoYcFDTHjCqoKoCo9or6jCRcjC5LltbmxPE22Ve8KTX6VzSD0tIzQ6IFNH:uYEPx6VGe6jCRcj6lBmxPErhdSLWNdio","tlshash":"12c272a66300293604fe17e7f5daabc5767114affa0944111838cc2e19a8fd352f5afd","first_seen":"2025-10-07T10:54:39.300678Z","last_seen":"2026-05-31T10:34:44.562053Z","times_seen":20194,"resource_available":true,"data":null}},"time_used":419,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":411,"receive":8,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-01-30","alert":"Sinkholed","trigger":"metamaskwallet-restore.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"metamaskwallet-restore.com/wp-content/plugins/astra-sites/inc/lib/onboarding/assets/dist/template-preview/main.js?ver=09382f635556bec359b3","fqdn":"metamaskwallet-restore.com","domain":"metamaskwallet-restore.com","tld":"com"},"ip":{"addr":"195.250.27.134","port":443,"asn":211126,"as":"WHG Hosting Services Ltd","country":"United Kingdom","country_code":"GB"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://metamaskwallet-restore.com/","date":"2026-01-30T12:11:28.366Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"www.metamaskwallet-restore.com","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Fri, 30 Jan 2026 02:04:32 GMT","end":"Thu, 30 Apr 2026 02:04:31 GMT"},"fingerprint":{"sha1":"82:70:2B:32:D3:3A:36:34:29:37:93:7F:98:95:47:45:77:5C:49:22","sha256":"84:75:E1:22:8E:81:BC:CD:DC:4D:E3:95:6A:07:41:CC:2A:4F:26:1C:75:58:8A:67:A1:7C:7E:BD:FB:8C:19:B0"}}},"request":{"raw":"GET /wp-content/plugins/astra-sites/inc/lib/onboarding/assets/dist/template-preview/main.js?ver=09382f635556bec359b3 HTTP/1.1\r\nHost: metamaskwallet-restore.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://metamaskwallet-restore.com/\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\ncontent-type: text/javascript\r\nlast-modified: Fri, 30 Jan 2026 04:04:17 GMT\r\naccept-ranges: bytes\r\ncontent-encoding: br\r\nvary: Accept-Encoding,User-Agent\r\ncontent-length: 2096\r\ndate: Fri, 30 Jan 2026 12:11:28 GMT\r\nserver: LiteSpeed\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"LiteSpeed","description":"LiteSpeed is a high-scalability web server.","website":"https://litespeedtech.com","common_platform_enumeration":"cpe:2.3:a:litespeedtech:litespeed_web_server:*:*:*:*:*:*:*:*","icon":"LiteSpeed.svg","categories":["Web servers"]}],"data":{"size":6587,"size_decoded":0,"mime_type":"text/javascript","magic":"JavaScript source, ASCII text, with very long lines (6587), with no line terminators","md5":"a6e64218d897c667223b9729d964464f","sha1":"298e350fbb69196edb071a2023e2a045c8528253","sha256":"a78ffc057526aa84675d2eb5519424156f7d9ba3b601704f606b2e676b5615e7","sha512":"519f27265b2f723b0acf9e7cf6682b73f0ecaeded75562d7d9b1f185f2331ff7a7bbbe2c11f9093ab1e38b16d1a78b77bafc677569f061f906380cb459e923d5","ssdeep":"192:tXCj6CnyYlqqOre482UO7N1gqts1SIVje5L1Cd+eLXPMo56MxdC:u6CyYlq/i482UO7NW1vV65AxrUowMxdC","tlshash":"5ed1b63a3224d9340bba4aefb978e3d4f424b519b90792e4c99ccf0924b5d43139876a","first_seen":"2025-12-08T16:51:03.59113Z","last_seen":"2026-05-31T10:34:44.492996Z","times_seen":6951,"resource_available":true,"data":null}},"time_used":262,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":262,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-01-30","alert":"Sinkholed","trigger":"metamaskwallet-restore.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"fonts.gstatic.com/s/notosans/v42/o-0mIpQlx3QUlC5A4PNB6Ryti20_6n1iPHjcz6L1SoM-jCpoiyAaBO9a6VI.woff2","fqdn":"fonts.gstatic.com","domain":"gstatic.com","tld":"com"},"ip":{"addr":"142.250.74.3","port":443,"asn":15169,"as":"GOOGLE","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"font","requested_by":"https://metamaskwallet-restore.com/","date":"2026-01-30T12:11:28.793Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.gstatic.com","organization":""},"issuer":{"commonName":"WR2","organization":"Google Trust Services"},"validity":{"start":"Mon, 29 Dec 2025 19:52:23 GMT","end":"Mon, 23 Mar 2026 19:52:22 GMT"},"fingerprint":{"sha1":"5A:74:FC:38:D2:7B:9B:E5:E5:0D:67:25:F4:73:BC:BA:2E:12:A7:FD","sha256":"3B:19:CD:BE:44:E6:EE:DC:8D:33:2B:A2:1C:E4:13:F8:6F:7E:2E:52:5D:0E:75:F3:1A:ED:21:1B:7A:B7:2E:BA"}}},"request":{"raw":"GET /s/notosans/v42/o-0mIpQlx3QUlC5A4PNB6Ryti20_6n1iPHjcz6L1SoM-jCpoiyAaBO9a6VI.woff2 HTTP/1.1\r\nHost: fonts.gstatic.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: identity\r\nOrigin: https://metamaskwallet-restore.com\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://fonts.googleapis.com/\r\nSec-Fetch-Dest: font\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\naccept-ranges: bytes\r\naccess-control-allow-origin: *\r\ncontent-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes\r\ncross-origin-resource-policy: cross-origin\r\ncross-origin-opener-policy: same-origin; report-to=\"apps-themes\"\r\nreport-to: {\"group\":\"apps-themes\",\"max_age\":2592000,\"endpoints\":[{\"url\":\"https://csp.withgoogle.com/csp/report-to/apps-themes\"}]}\r\ntiming-allow-origin: *\r\ncontent-length: 13464\r\nx-content-type-options: nosniff\r\nserver: sffe\r\nx-xss-protection: 0\r\ndate: Sat, 24 Jan 2026 18:24:37 GMT\r\nexpires: Sun, 24 Jan 2027 18:24:37 GMT\r\ncache-control: public, max-age=31536000\r\nage: 496011\r\nlast-modified: Wed, 10 Sep 2025 16:23:41 GMT\r\ncontent-type: font/woff2\r\nalt-svc: h3=\":443\"; ma=2592000,h3-29=\":443\"; ma=2592000\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":null,"data":{"size":13464,"size_decoded":0,"mime_type":"font/woff2","magic":"Web Open Font Format (Version 2), TrueType, length 13464, version 1.0","md5":"8a4f634102a03f0e0e0a16ff1a3cc010","sha1":"8f38d0cbd869c187af3d01d5830a3f8ee1c7995d","sha256":"e77bfe1db912f687b0319b60de158cfada67f89c8ee4f8e2bd6020f970accbfb","sha512":"1ca042c39468e459b0ace845e7c80d718787dcc559d0480a3dc94ce68867e2eac46a09ddd147cb88f5567de5acc228398a2bbb0adab993985258f1cda0faf6dc","ssdeep":"384:HHNxU3urkSGsMzkE76+PZLydWi8Dkkvg9:NxrrkoMwE76+PZLydaIka","tlshash":"b652d08fa11598cbcce245fc398f188acd16b8ce1cb5a114b1f5a7cbc0ecaa591102d3","first_seen":"2025-09-16T02:00:42.708523Z","last_seen":"2026-05-30T06:33:08.18076Z","times_seen":320,"resource_available":false,"data":null}},"time_used":133,"timings":{"blocked":54,"dns":0,"connect":7,"send":0,"wait":21,"receive":1,"ssl":47},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"fonts.gstatic.com/s/roboto/v50/KFO7CnqEu92Fr1ME7kSn66aGLdTylUAMa3yUBA.woff2","fqdn":"fonts.gstatic.com","domain":"gstatic.com","tld":"com"},"ip":{"addr":"142.250.74.3","port":443,"asn":15169,"as":"GOOGLE","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"font","requested_by":"https://metamaskwallet-restore.com/","date":"2026-01-30T12:11:28.827Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.gstatic.com","organization":""},"issuer":{"commonName":"WR2","organization":"Google Trust Services"},"validity":{"start":"Mon, 29 Dec 2025 19:52:23 GMT","end":"Mon, 23 Mar 2026 19:52:22 GMT"},"fingerprint":{"sha1":"5A:74:FC:38:D2:7B:9B:E5:E5:0D:67:25:F4:73:BC:BA:2E:12:A7:FD","sha256":"3B:19:CD:BE:44:E6:EE:DC:8D:33:2B:A2:1C:E4:13:F8:6F:7E:2E:52:5D:0E:75:F3:1A:ED:21:1B:7A:B7:2E:BA"}}},"request":{"raw":"GET /s/roboto/v50/KFO7CnqEu92Fr1ME7kSn66aGLdTylUAMa3yUBA.woff2 HTTP/1.1\r\nHost: fonts.gstatic.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: identity\r\nOrigin: https://metamaskwallet-restore.com\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://fonts.googleapis.com/\r\nSec-Fetch-Dest: font\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\naccept-ranges: bytes\r\naccess-control-allow-origin: *\r\ncontent-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes\r\ncross-origin-resource-policy: cross-origin\r\ncross-origin-opener-policy: same-origin; report-to=\"apps-themes\"\r\nreport-to: {\"group\":\"apps-themes\",\"max_age\":2592000,\"endpoints\":[{\"url\":\"https://csp.withgoogle.com/csp/report-to/apps-themes\"}]}\r\ntiming-allow-origin: *\r\ncontent-length: 40128\r\nx-content-type-options: nosniff\r\nserver: sffe\r\nx-xss-protection: 0\r\ndate: Sat, 24 Jan 2026 18:37:38 GMT\r\nexpires: Sun, 24 Jan 2027 18:37:38 GMT\r\ncache-control: public, max-age=31536000\r\nage: 495230\r\nlast-modified: Tue, 18 Nov 2025 19:00:07 GMT\r\ncontent-type: font/woff2\r\nalt-svc: h3=\":443\"; ma=2592000,h3-29=\":443\"; ma=2592000\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":null,"data":{"size":40128,"size_decoded":0,"mime_type":"font/woff2","magic":"Web Open Font Format (Version 2), TrueType, length 40128, version 1.0","md5":"9a01b69183a9604ab3a439e388b30501","sha1":"8ed1d59003d0dbe6360481017b44665153665fbe","sha256":"20b535fa80c8189e3b87d1803038389960203a886d502bc2ef1857affc2f38d2","sha512":"0e6795255b6eea00b5403fd7e3b904d52776d49ac63a31c2778361262883697943aedcb29feee85694ba6f19eaa34dddb9a5bfe7118f4a25b4757e92c331feca","ssdeep":"768:Vce3jkow68wmT4IBX0tXdlSirS61gSjcz0GPwHbP+w2jec56O:VcI/iEEEtXdFJj+0GPwHbP+w5rO","tlshash":"3703023a5e3ccf1a84157a703950f6d9a8481e548e9d143b4f1ac7bf085dde2209b6d4","first_seen":"2025-01-08T22:59:02.845106Z","last_seen":"2026-05-31T11:22:56.44886Z","times_seen":858185,"resource_available":false,"data":null}},"time_used":108,"timings":{"blocked":54,"dns":0,"connect":0,"send":0,"wait":8,"receive":4,"ssl":42},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"metamaskwallet-restore.com/wp-content/uploads/2026/01/cropped-images-removebg-preview-80x80.png","fqdn":"metamaskwallet-restore.com","domain":"metamaskwallet-restore.com","tld":"com"},"ip":{"addr":"195.250.27.134","port":443,"asn":211126,"as":"WHG Hosting Services Ltd","country":"United Kingdom","country_code":"GB"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://metamaskwallet-restore.com/","date":"2026-01-30T12:11:29.057Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"www.metamaskwallet-restore.com","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Fri, 30 Jan 2026 02:04:32 GMT","end":"Thu, 30 Apr 2026 02:04:31 GMT"},"fingerprint":{"sha1":"82:70:2B:32:D3:3A:36:34:29:37:93:7F:98:95:47:45:77:5C:49:22","sha256":"84:75:E1:22:8E:81:BC:CD:DC:4D:E3:95:6A:07:41:CC:2A:4F:26:1C:75:58:8A:67:A1:7C:7E:BD:FB:8C:19:B0"}}},"request":{"raw":"GET /wp-content/uploads/2026/01/cropped-images-removebg-preview-80x80.png HTTP/1.1\r\nHost: metamaskwallet-restore.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://metamaskwallet-restore.com/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\ncache-control: public, max-age=604800\r\nexpires: Fri, 06 Feb 2026 12:11:29 GMT\r\ncontent-type: image/png\r\nlast-modified: Fri, 30 Jan 2026 11:41:37 GMT\r\naccept-ranges: bytes\r\ncontent-length: 8761\r\ndate: Fri, 30 Jan 2026 12:11:29 GMT\r\nserver: LiteSpeed\r\nvary: User-Agent\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"LiteSpeed","description":"LiteSpeed is a high-scalability web server.","website":"https://litespeedtech.com","common_platform_enumeration":"cpe:2.3:a:litespeedtech:litespeed_web_server:*:*:*:*:*:*:*:*","icon":"LiteSpeed.svg","categories":["Web servers"]}],"data":{"size":8761,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 80 x 80, 8-bit/color RGBA, non-interlaced","md5":"d4354625f85449ef7f5c7d8f1ba4f97e","sha1":"8fd70dca810167e94715dc272d0cda8c6944cc00","sha256":"52a43614eea810a771bd1852f4afd1355dce686c053a45d47249bc31b95f5d9f","sha512":"6a2717216e2ee7dae8c616d61bb4d1336c2a646de83fe3fc35412c96c75fb631de1e371383865fccb93fc71f2956f84929f2b2c0c5978b2cfcb13adf224fa580","ssdeep":"192:M3Y7gvM+rGmJy9UNZ00hLVUPdYoCmqRKZJ/KSR:M3bvcmECJhZMdYBmuKLd","tlshash":"f602af76bb1f2bc8adc564cf7f23639d686e345d961e02601ef28c22f146d4accb2841","first_seen":"2026-01-30T11:46:59.057384Z","last_seen":"2026-02-03T19:53:00.581029Z","times_seen":3,"resource_available":false,"data":null}},"time_used":182,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":179,"receive":3,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-01-30","alert":"Sinkholed","trigger":"metamaskwallet-restore.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"metamaskwallet-restore.com/wp-content/plugins/elementor/assets/css/widget-heading.min.css?ver=3.34.4","fqdn":"metamaskwallet-restore.com","domain":"metamaskwallet-restore.com","tld":"com"},"ip":{"addr":"195.250.27.134","port":443,"asn":211126,"as":"WHG Hosting Services Ltd","country":"United Kingdom","country_code":"GB"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://metamaskwallet-restore.com/","date":"2026-01-30T12:11:28.342Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"www.metamaskwallet-restore.com","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Fri, 30 Jan 2026 02:04:32 GMT","end":"Thu, 30 Apr 2026 02:04:31 GMT"},"fingerprint":{"sha1":"82:70:2B:32:D3:3A:36:34:29:37:93:7F:98:95:47:45:77:5C:49:22","sha256":"84:75:E1:22:8E:81:BC:CD:DC:4D:E3:95:6A:07:41:CC:2A:4F:26:1C:75:58:8A:67:A1:7C:7E:BD:FB:8C:19:B0"}}},"request":{"raw":"GET /wp-content/plugins/elementor/assets/css/widget-heading.min.css?ver=3.34.4 HTTP/1.1\r\nHost: metamaskwallet-restore.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://metamaskwallet-restore.com/\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\ncache-control: public, max-age=604800\r\nexpires: Fri, 06 Feb 2026 12:11:28 GMT\r\ncontent-type: text/css\r\nlast-modified: Fri, 30 Jan 2026 02:18:56 GMT\r\naccept-ranges: bytes\r\ncontent-encoding: br\r\nvary: Accept-Encoding,User-Agent\r\ncontent-length: 126\r\ndate: Fri, 30 Jan 2026 12:11:28 GMT\r\nserver: LiteSpeed\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"LiteSpeed","description":"LiteSpeed is a high-scalability web server.","website":"https://litespeedtech.com","common_platform_enumeration":"cpe:2.3:a:litespeedtech:litespeed_web_server:*:*:*:*:*:*:*:*","icon":"LiteSpeed.svg","categories":["Web servers"]}],"data":{"size":560,"size_decoded":0,"mime_type":"text/css","magic":"ASCII text, with very long lines (560), with no line terminators","md5":"c3be9e612baf8fc4af612de8af4c0864","sha1":"f6b1366e30a459deefca035c5563f1c929c8ed10","sha256":"f68e889145cb0e47b7b190b2fdf087a9213a264ad33951512880c9f8bb6d0cd8","sha512":"aee455fe10d8126deb4d1015b6b4450ace4851e5b32890505af619f7863469c56b788b5d822849986759aa85efde260da77ed12bbb236ce2bf6629bf6759f4ca","ssdeep":"","tlshash":"f2f0c0237e4b94aa383f1d571083337c74944ec893a0a8d8e9fa91435cf4cb27330622","first_seen":"2023-10-14T23:00:09Z","last_seen":"2026-05-31T11:23:51.46698Z","times_seen":96094,"resource_available":false,"data":null}},"time_used":163,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":163,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-01-30","alert":"Sinkholed","trigger":"metamaskwallet-restore.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"metamaskwallet-restore.com/wp-includes/js/jquery/ui/core.min.js?ver=1.13.3","fqdn":"metamaskwallet-restore.com","domain":"metamaskwallet-restore.com","tld":"com"},"ip":{"addr":"195.250.27.134","port":443,"asn":211126,"as":"WHG Hosting Services Ltd","country":"United Kingdom","country_code":"GB"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://metamaskwallet-restore.com/","date":"2026-01-30T12:11:28.369Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"www.metamaskwallet-restore.com","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Fri, 30 Jan 2026 02:04:32 GMT","end":"Thu, 30 Apr 2026 02:04:31 GMT"},"fingerprint":{"sha1":"82:70:2B:32:D3:3A:36:34:29:37:93:7F:98:95:47:45:77:5C:49:22","sha256":"84:75:E1:22:8E:81:BC:CD:DC:4D:E3:95:6A:07:41:CC:2A:4F:26:1C:75:58:8A:67:A1:7C:7E:BD:FB:8C:19:B0"}}},"request":{"raw":"GET /wp-includes/js/jquery/ui/core.min.js?ver=1.13.3 HTTP/1.1\r\nHost: metamaskwallet-restore.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://metamaskwallet-restore.com/\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\ncontent-type: text/javascript\r\nlast-modified: Thu, 06 Feb 2025 17:27:26 GMT\r\naccept-ranges: bytes\r\ncontent-encoding: br\r\nvary: Accept-Encoding,User-Agent\r\ncontent-length: 6812\r\ndate: Fri, 30 Jan 2026 12:11:28 GMT\r\nserver: LiteSpeed\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"LiteSpeed","description":"LiteSpeed is a high-scalability web server.","website":"https://litespeedtech.com","common_platform_enumeration":"cpe:2.3:a:litespeedtech:litespeed_web_server:*:*:*:*:*:*:*:*","icon":"LiteSpeed.svg","categories":["Web servers"]}],"data":{"size":21464,"size_decoded":0,"mime_type":"text/javascript","magic":"JavaScript source, Unicode text, UTF-8 text, with very long lines (8189)","md5":"da215ae12b95b3aeeb2047667016c7f8","sha1":"480a7087aa74b5b47c47f05a11670e823a3ae4c0","sha256":"699210a5ed06e497b4730ec83bb65ac4c2269ae4a0ee8af3f24aae7ee5b66b76","sha512":"d256ddc828c06f7b84f7df706a4481928a186ea6d3e1358254a1ec02f403d72d2f3aecd682a93aad61b8f236f17dbcf7e6ca100f78c30a348682bf8ee125d8ff","ssdeep":"384:G/rsrDr8LVyraS3dtrqorqr8hrpCip8fuxNhlGX0CiS9rH/OrLrErJ29FkFvd:iS33ZdvK47kv","tlshash":"06a2d94eb246380586f7a2a5402f521fb132e25cb105c8ddf468d8da3c7eea95173f79","first_seen":"2025-04-15T23:53:17.313193Z","last_seen":"2026-05-31T11:23:51.52364Z","times_seen":291545,"resource_available":true,"data":null}},"time_used":439,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":431,"receive":8,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-01-30","alert":"Sinkholed","trigger":"metamaskwallet-restore.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"metamaskwallet-restore.com/wp-content/uploads/2020/10/bg-001-free-img.png","fqdn":"metamaskwallet-restore.com","domain":"metamaskwallet-restore.com","tld":"com"},"ip":{"addr":"195.250.27.134","port":443,"asn":211126,"as":"WHG Hosting Services Ltd","country":"United Kingdom","country_code":"GB"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://metamaskwallet-restore.com/","date":"2026-01-30T12:11:28.782Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"www.metamaskwallet-restore.com","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Fri, 30 Jan 2026 02:04:32 GMT","end":"Thu, 30 Apr 2026 02:04:31 GMT"},"fingerprint":{"sha1":"82:70:2B:32:D3:3A:36:34:29:37:93:7F:98:95:47:45:77:5C:49:22","sha256":"84:75:E1:22:8E:81:BC:CD:DC:4D:E3:95:6A:07:41:CC:2A:4F:26:1C:75:58:8A:67:A1:7C:7E:BD:FB:8C:19:B0"}}},"request":{"raw":"GET /wp-content/uploads/2020/10/bg-001-free-img.png HTTP/1.1\r\nHost: metamaskwallet-restore.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://metamaskwallet-restore.com/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\ncache-control: public, max-age=604800\r\nexpires: Fri, 06 Feb 2026 12:11:28 GMT\r\ncontent-type: image/png\r\nlast-modified: Fri, 30 Jan 2026 10:07:36 GMT\r\naccept-ranges: bytes\r\ncontent-length: 1216\r\ndate: Fri, 30 Jan 2026 12:11:28 GMT\r\nserver: LiteSpeed\r\nvary: User-Agent\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"LiteSpeed","description":"LiteSpeed is a high-scalability web server.","website":"https://litespeedtech.com","common_platform_enumeration":"cpe:2.3:a:litespeedtech:litespeed_web_server:*:*:*:*:*:*:*:*","icon":"LiteSpeed.svg","categories":["Web servers"]}],"data":{"size":1216,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 1920 x 1080, 1-bit colormap, non-interlaced","md5":"bc0b835d3a10e89d6986c4cdce0f771d","sha1":"c9eebdcb42ab4e95d7bf0f814a20a0a9da356e48","sha256":"081c3254693a117c9d25d675d8b2c43759f6fdea0b16d5faba241da82e2320a5","sha512":"43d0fd47679d0eb69be1e179de3198391ab579d3817754d96fb7128f40cb3365e657543384e73c8812c938238848a18902f726c34f68dfcc06a5b52f8dbe999e","ssdeep":"","tlshash":"da21d2ab622ff327f1d46eb42a7c787445a1b76e47c31944ed6d800c67c323e44d2499","first_seen":"2023-05-10T07:30:16Z","last_seen":"2026-05-30T06:33:08.191093Z","times_seen":60,"resource_available":false,"data":null}},"time_used":161,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":160,"receive":1,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-01-30","alert":"Sinkholed","trigger":"metamaskwallet-restore.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"metamaskwallet-restore.com/wp-content/plugins/elementor/assets/js/shared-frontend-handlers.03caa53373b56d3bab67.bundle.min.js","fqdn":"metamaskwallet-restore.com","domain":"metamaskwallet-restore.com","tld":"com"},"ip":{"addr":"195.250.27.134","port":443,"asn":211126,"as":"WHG Hosting Services Ltd","country":"United Kingdom","country_code":"GB"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://metamaskwallet-restore.com/","date":"2026-01-30T12:11:29.120Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"www.metamaskwallet-restore.com","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Fri, 30 Jan 2026 02:04:32 GMT","end":"Thu, 30 Apr 2026 02:04:31 GMT"},"fingerprint":{"sha1":"82:70:2B:32:D3:3A:36:34:29:37:93:7F:98:95:47:45:77:5C:49:22","sha256":"84:75:E1:22:8E:81:BC:CD:DC:4D:E3:95:6A:07:41:CC:2A:4F:26:1C:75:58:8A:67:A1:7C:7E:BD:FB:8C:19:B0"}}},"request":{"raw":"GET /wp-content/plugins/elementor/assets/js/shared-frontend-handlers.03caa53373b56d3bab67.bundle.min.js HTTP/1.1\r\nHost: metamaskwallet-restore.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://metamaskwallet-restore.com/\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\ncontent-type: text/javascript\r\nlast-modified: Fri, 30 Jan 2026 02:18:56 GMT\r\naccept-ranges: bytes\r\ncontent-encoding: br\r\nvary: Accept-Encoding,User-Agent\r\ncontent-length: 2511\r\ndate: Fri, 30 Jan 2026 12:11:29 GMT\r\nserver: LiteSpeed\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"LiteSpeed","description":"LiteSpeed is a high-scalability web server.","website":"https://litespeedtech.com","common_platform_enumeration":"cpe:2.3:a:litespeedtech:litespeed_web_server:*:*:*:*:*:*:*:*","icon":"LiteSpeed.svg","categories":["Web servers"]}],"data":{"size":8481,"size_decoded":0,"mime_type":"text/javascript","magic":"JavaScript source, ASCII text, with very long lines (8481), with no line terminators","md5":"a4df0433011e4a5ca770a6b46d01ab7d","sha1":"ced6acab63205209ef5db818700ba7e7f9277044","sha256":"77c0a6d635dad44b53a9eb9f0f367a1bd3bf3620c0e41d3a4c15d1313f2553f0","sha512":"d9059dc3da43bd052276c6544b81db20e438378541274eb2da852b7c535bc1738eac7c902a4c7c0913f1cef7f76a51bfd0d55e23dd659b4ed6c858141b0e1272","ssdeep":"192:IwfFpzqxODCWV5lxZmdXLf+UvDZ5CMtakRhPZT8cMkCw+v10QITpRHvcwxDnPoG0:rHzqxOPV5lxodXLfpvD/NtakRhPZT8cw","tlshash":"3802310a74c1982db58b58ba3532432866a8014de1018f6db1bf79fbc5a5d82277b7f1","first_seen":"2025-10-21T21:24:49.172997Z","last_seen":"2026-05-31T11:23:51.498928Z","times_seen":119725,"resource_available":true,"data":null}},"time_used":142,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":142,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-01-30","alert":"Sinkholed","trigger":"metamaskwallet-restore.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"metamaskwallet-restore.com/wp-content/plugins/elementor/assets/lib/font-awesome/css/v4-shims.min.css?ver=3.34.4","fqdn":"metamaskwallet-restore.com","domain":"metamaskwallet-restore.com","tld":"com"},"ip":{"addr":"195.250.27.134","port":443,"asn":211126,"as":"WHG Hosting Services Ltd","country":"United Kingdom","country_code":"GB"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://metamaskwallet-restore.com/","date":"2026-01-30T12:11:28.339Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"www.metamaskwallet-restore.com","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Fri, 30 Jan 2026 02:04:32 GMT","end":"Thu, 30 Apr 2026 02:04:31 GMT"},"fingerprint":{"sha1":"82:70:2B:32:D3:3A:36:34:29:37:93:7F:98:95:47:45:77:5C:49:22","sha256":"84:75:E1:22:8E:81:BC:CD:DC:4D:E3:95:6A:07:41:CC:2A:4F:26:1C:75:58:8A:67:A1:7C:7E:BD:FB:8C:19:B0"}}},"request":{"raw":"GET /wp-content/plugins/elementor/assets/lib/font-awesome/css/v4-shims.min.css?ver=3.34.4 HTTP/1.1\r\nHost: metamaskwallet-restore.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://metamaskwallet-restore.com/\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\ncache-control: public, max-age=604800\r\nexpires: Fri, 06 Feb 2026 12:11:28 GMT\r\ncontent-type: text/css\r\nlast-modified: Fri, 30 Jan 2026 02:18:56 GMT\r\naccept-ranges: bytes\r\ncontent-encoding: br\r\nvary: Accept-Encoding,User-Agent\r\ncontent-length: 3987\r\ndate: Fri, 30 Jan 2026 12:11:28 GMT\r\nserver: LiteSpeed\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"LiteSpeed","description":"LiteSpeed is a high-scalability web server.","website":"https://litespeedtech.com","common_platform_enumeration":"cpe:2.3:a:litespeedtech:litespeed_web_server:*:*:*:*:*:*:*:*","icon":"LiteSpeed.svg","categories":["Web servers"]}],"data":{"size":26702,"size_decoded":0,"mime_type":"text/css","magic":"ASCII text, with very long lines (26516)","md5":"c55205bce667f5d812354fd1353e7389","sha1":"f22de0af271eba636a022c873c94fbcd81b4c89a","sha256":"c55902832fb84522d02ea1a60a30747403a140d8651fa748f13ba398b0c0df3a","sha512":"89a2e11075b7a7e64d8240ca062e3311f1fe69600c189ec8ee78ea0f78ca9db374bb1e0692e9aedaf8ee23bd58528bf6d0e20f977477daff073be57ee8e81bbd","ssdeep":"192:dP6RT1bIl4w0QUmQ10PwKLaAu5CwWavpHo4O6wgLPbJVR8XD7mycP:0Ral4w0QK+PwK05eavpmgPPeXD7mycP","tlshash":"1ec20665930c60d3a3eef847ba0172a8277577999a864c54f30b7c9c8dc3a5772e8f18","first_seen":"2023-04-05T04:00:29Z","last_seen":"2026-05-31T11:00:39.120069Z","times_seen":76873,"resource_available":false,"data":null}},"time_used":287,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":287,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-01-30","alert":"Sinkholed","trigger":"metamaskwallet-restore.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"metamaskwallet-restore.com/wp-content/plugins/elementor/assets/css/widget-divider.min.css?ver=3.34.4","fqdn":"metamaskwallet-restore.com","domain":"metamaskwallet-restore.com","tld":"com"},"ip":{"addr":"195.250.27.134","port":443,"asn":211126,"as":"WHG Hosting Services Ltd","country":"United Kingdom","country_code":"GB"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://metamaskwallet-restore.com/","date":"2026-01-30T12:11:28.340Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"www.metamaskwallet-restore.com","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Fri, 30 Jan 2026 02:04:32 GMT","end":"Thu, 30 Apr 2026 02:04:31 GMT"},"fingerprint":{"sha1":"82:70:2B:32:D3:3A:36:34:29:37:93:7F:98:95:47:45:77:5C:49:22","sha256":"84:75:E1:22:8E:81:BC:CD:DC:4D:E3:95:6A:07:41:CC:2A:4F:26:1C:75:58:8A:67:A1:7C:7E:BD:FB:8C:19:B0"}}},"request":{"raw":"GET /wp-content/plugins/elementor/assets/css/widget-divider.min.css?ver=3.34.4 HTTP/1.1\r\nHost: metamaskwallet-restore.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://metamaskwallet-restore.com/\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\ncache-control: public, max-age=604800\r\nexpires: Fri, 06 Feb 2026 12:11:28 GMT\r\ncontent-type: text/css\r\nlast-modified: Fri, 30 Jan 2026 02:18:56 GMT\r\naccept-ranges: bytes\r\ncontent-encoding: br\r\nvary: Accept-Encoding,User-Agent\r\ncontent-length: 678\r\ndate: Fri, 30 Jan 2026 12:11:28 GMT\r\nserver: LiteSpeed\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"LiteSpeed","description":"LiteSpeed is a high-scalability web server.","website":"https://litespeedtech.com","common_platform_enumeration":"cpe:2.3:a:litespeedtech:litespeed_web_server:*:*:*:*:*:*:*:*","icon":"LiteSpeed.svg","categories":["Web servers"]}],"data":{"size":4258,"size_decoded":0,"mime_type":"text/css","magic":"ASCII text, with very long lines (4258), with no line terminators","md5":"3d78dc83d20515d554c4a45df3500bb0","sha1":"36fe7b5ebfeb079e9e20b12222766b1922382586","sha256":"f042f3243af9c3e339447b3aa8acf5776c9c12bf03b67e87013750ca5ad7fb0a","sha512":"c61feebb9eeb0cc5ef3029e7c6e94797face0f9bfb4905a51e96d2e59c63978688aff83fddea3326cc5d197e3cace6cf42c94f6cfb98ff7c6c16da61e7a28f32","ssdeep":"96:voAhZrOq52pydTYk0+5FD1852KELxrFrRevYJocO:voIOq5a75slUmor","tlshash":"a5918555b94f8218b79f141b8e173e4cf04467c9fa618a81d9f37252f0aed842f209e9","first_seen":"2025-05-04T13:14:28.472981Z","last_seen":"2026-05-31T11:23:51.535527Z","times_seen":33524,"resource_available":false,"data":null}},"time_used":165,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":165,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-01-30","alert":"Sinkholed","trigger":"metamaskwallet-restore.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"metamaskwallet-restore.com/wp-content/plugins/elementor/assets/lib/eicons/css/elementor-icons.min.css?ver=5.34.0","fqdn":"metamaskwallet-restore.com","domain":"metamaskwallet-restore.com","tld":"com"},"ip":{"addr":"195.250.27.134","port":443,"asn":211126,"as":"WHG Hosting Services Ltd","country":"United Kingdom","country_code":"GB"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://metamaskwallet-restore.com/","date":"2026-01-30T12:11:28.347Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"www.metamaskwallet-restore.com","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Fri, 30 Jan 2026 02:04:32 GMT","end":"Thu, 30 Apr 2026 02:04:31 GMT"},"fingerprint":{"sha1":"82:70:2B:32:D3:3A:36:34:29:37:93:7F:98:95:47:45:77:5C:49:22","sha256":"84:75:E1:22:8E:81:BC:CD:DC:4D:E3:95:6A:07:41:CC:2A:4F:26:1C:75:58:8A:67:A1:7C:7E:BD:FB:8C:19:B0"}}},"request":{"raw":"GET /wp-content/plugins/elementor/assets/lib/eicons/css/elementor-icons.min.css?ver=5.34.0 HTTP/1.1\r\nHost: metamaskwallet-restore.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://metamaskwallet-restore.com/\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\ncache-control: public, max-age=604800\r\nexpires: Fri, 06 Feb 2026 12:11:28 GMT\r\ncontent-type: text/css\r\nlast-modified: Fri, 30 Jan 2026 02:18:56 GMT\r\naccept-ranges: bytes\r\ncontent-encoding: br\r\nvary: Accept-Encoding,User-Agent\r\ncontent-length: 4025\r\ndate: Fri, 30 Jan 2026 12:11:28 GMT\r\nserver: LiteSpeed\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"LiteSpeed","description":"LiteSpeed is a high-scalability web server.","website":"https://litespeedtech.com","common_platform_enumeration":"cpe:2.3:a:litespeedtech:litespeed_web_server:*:*:*:*:*:*:*:*","icon":"LiteSpeed.svg","categories":["Web servers"]}],"data":{"size":21415,"size_decoded":0,"mime_type":"text/css","magic":"ASCII text, with very long lines (21369)","md5":"69dd84723487578f6384ca0dc8d544ba","sha1":"04277324e3f894405a0d1a7811a1351851b0db01","sha256":"67d1925322c1310e56caddc29b343d39eddec15b4a5df5151717a3d495daf171","sha512":"39b23086bd8b06f343d7944beba1897d91d2c862f4fe9951d9371a88a8e99c276cf3b6468a9212512513e1b5926a10879b4411e0e76d067ec5f693026698fb91","ssdeep":"192:BR877iN3iCOy2bvGIdpJkhugk8/H6qiMs7HqnFTSZq7RXDlCdkgIYSN:g7iNyqEpSk8/aq8uFucbrgIYY","tlshash":"bda2d9e5e46923c87b32c413e744b64c64daf920cec99d19fa6f850c1de16a31686fb8","first_seen":"2026-01-20T09:57:08.303066Z","last_seen":"2026-05-30T22:29:38.24909Z","times_seen":4015,"resource_available":false,"data":null}},"time_used":270,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":165,"receive":105,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-01-30","alert":"Sinkholed","trigger":"metamaskwallet-restore.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"metamaskwallet-restore.com/wp-content/plugins/astra-addon/assets/js/minified/purify.min.js?ver=4.12.0","fqdn":"metamaskwallet-restore.com","domain":"metamaskwallet-restore.com","tld":"com"},"ip":{"addr":"195.250.27.134","port":443,"asn":211126,"as":"WHG Hosting Services Ltd","country":"United Kingdom","country_code":"GB"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://metamaskwallet-restore.com/","date":"2026-01-30T12:11:28.371Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"www.metamaskwallet-restore.com","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Fri, 30 Jan 2026 02:04:32 GMT","end":"Thu, 30 Apr 2026 02:04:31 GMT"},"fingerprint":{"sha1":"82:70:2B:32:D3:3A:36:34:29:37:93:7F:98:95:47:45:77:5C:49:22","sha256":"84:75:E1:22:8E:81:BC:CD:DC:4D:E3:95:6A:07:41:CC:2A:4F:26:1C:75:58:8A:67:A1:7C:7E:BD:FB:8C:19:B0"}}},"request":{"raw":"GET /wp-content/plugins/astra-addon/assets/js/minified/purify.min.js?ver=4.12.0 HTTP/1.1\r\nHost: metamaskwallet-restore.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://metamaskwallet-restore.com/\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\ncontent-type: text/javascript\r\nlast-modified: Fri, 30 Jan 2026 03:09:06 GMT\r\naccept-ranges: bytes\r\ncontent-encoding: br\r\nvary: Accept-Encoding,User-Agent\r\ncontent-length: 8193\r\ndate: Fri, 30 Jan 2026 12:11:28 GMT\r\nserver: LiteSpeed\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"LiteSpeed","description":"LiteSpeed is a high-scalability web server.","website":"https://litespeedtech.com","common_platform_enumeration":"cpe:2.3:a:litespeedtech:litespeed_web_server:*:*:*:*:*:*:*:*","icon":"LiteSpeed.svg","categories":["Web servers"]}],"data":{"size":22215,"size_decoded":0,"mime_type":"text/javascript","magic":"JavaScript source, ASCII text, with very long lines (22027)","md5":"fd87e766b51ac40500bc6a7ab45fdbf5","sha1":"7a110e184d0306b1e8dbdef44398a47be54effc5","sha256":"f8e4d7b0f1c613e9e79f2dd8d37c8b30e021d06d300684b29750c7f02e53e5fb","sha512":"37fd87762923312f9db9f4a40aafcad980150ec4f0d54e859bf2f6dacb5f1f5b1a0e512e3d32033e088bf98228a5a18b3951c5d885a1ed7d8f7bfe999b7fa379","ssdeep":"384:1yG3zyDNiBJRMmv8bUMFAmXlV1O4v5DE912nkk+i7wCWgXcFJBtcTukR9EL20mOq:FOYNlv8IMFZXlVU4xYH2nkk+i7wCWgXV","tlshash":"a1a2495e6d2079765fee41d820bb590ea1bc101f700c84b0e7ceecb554baa95606bf2f","first_seen":"2025-04-19T04:49:15.134746Z","last_seen":"2026-05-31T09:55:21.020609Z","times_seen":7927,"resource_available":true,"data":null}},"time_used":457,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":451,"receive":6,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-01-30","alert":"Sinkholed","trigger":"metamaskwallet-restore.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}}]}