{"report_id":"05606e80-3ed2-4e41-96f1-37fd2ddce687","version":6,"status":"done","tags":[],"date":"2025-10-17T02:20:56Z","url":{"schema":"https","addr":"coinbaseow.com/","fqdn":"coinbaseow.com","domain":"coinbaseow.com","tld":"com"},"ip":{"addr":"202.79.173.8","port":0,"asn":152194,"as":"CTG Server Limited","country":"Singapore","country_code":"SG"},"final":{"url":{"schema":"https","addr":"coinbaseow.com/h5/#/","fqdn":"coinbaseow.com","domain":"coinbaseow.com","tld":"com"},"title":"coinbaseow.com/h5/#/"},"submit":{"url":{"schema":"https","addr":"coinbaseow.com/","fqdn":"coinbaseow.com","domain":"coinbaseow.com","tld":"com"},"ip":{"addr":"202.79.173.8","port":0,"asn":152194,"as":"CTG Server Limited","country":"Singapore","country_code":"SG"},"tags":null,"meta":null,"user":{"user_id":"akbkyowd9geqr98"}},"settings":{"access":"public","device_type":"desktop","expires_at":"2026-11-21T02:20:56Z","useragent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0","referer":"","cookies":null,"exit_node":"z0yflva4pidy47h"},"stats":{"alert_count":{"ids":1,"urlquery":0,"analyzer":7}},"detection":{"ids":[{"sensor_name":"suricata","title":"Suricata IDS","description":"Suricata /w Emerging Threats Pro","date":"2025-10-17T02:20:34Z","timestamp":1760667634,"ip_dst":{"addr":"172.18.0.2","port":46622,"asn":0,"as":"","country":"","country_code":"zz"},"ip_src":{"addr":"202.79.173.8","port":443,"asn":152194,"as":"CTG Server Limited","country":"Singapore","country_code":"SG"},"severity":"medium","alert":"ET DROP Spamhaus DROP Listed Traffic Inbound group 52","source":"{\"timestamp\":\"2025-10-17T02:20:34.714995+0000\",\"flow_id\":2104163130580258,\"in_iface\":\"br-31613a7ed13b\",\"event_type\":\"alert\",\"src_ip\":\"202.79.173.8\",\"src_port\":443,\"dest_ip\":\"172.18.0.2\",\"dest_port\":46622,\"proto\":\"TCP\",\"metadata\":{\"flowbits\":[\"ET.Evil\",\"ET.DROPIP\"]},\"alert\":{\"action\":\"allowed\",\"gid\":1,\"signature_id\":2400051,\"rev\":4421,\"signature\":\"ET DROP Spamhaus DROP Listed Traffic Inbound group 52\",\"category\":\"Misc Attack\",\"severity\":2,\"metadata\":{\"affected_product\":[\"Any\"],\"attack_target\":[\"Any\"],\"created_at\":[\"2010_12_30\"],\"deployment\":[\"Perimeter\"],\"signature_severity\":[\"Minor\"],\"tag\":[\"Dshield\"],\"updated_at\":[\"2025_08_01\"]}},\"flow\":{\"pkts_toserver\":1,\"pkts_toclient\":1,\"bytes_toserver\":74,\"bytes_toclient\":74,\"start\":\"2025-10-17T02:20:34.367906+0000\"}}"}],"analyzer":[{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-10-17","alert":"Sinkholed","trigger":"coinbaseow.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2025-10-17","alert":"Sinkholed","trigger":"coinbaseow.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2025-10-17","alert":"Sinkholed","trigger":"coinbaseow.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2025-10-17","alert":"Sinkholed","trigger":"www.coinbaseok.com","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2025-10-17","alert":"Sinkholed","trigger":"www.coinbaseok.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-10-17","alert":"Sinkholed","trigger":"www.coinbaseok.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2025-10-17","alert":"Sinkholed","trigger":"www.coinbaseok.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null},"summary":[{"fqdn":"coinbaseow.com","ip":{"addr":"202.79.173.8","port":443,"asn":152194,"as":"CTG Server Limited","country":"Singapore","country_code":"SG"},"domain_registered":"unknown","domain_rank":0,"first_seen":"2025-10-17T02:20:58.562607Z","last_seen":"2025-10-17T02:20:58.562607Z","alert_count":149,"request_count":50,"received_data":3227204,"sent_data":44186,"comment":"","tags":null,"fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}]},{"fqdn":"cdn.dcloud.net.cn","ip":{"addr":"124.220.203.60","port":443,"asn":45090,"as":"Shenzhen Tencent Computer Systems Company Limited","country":"China","country_code":"CN"},"domain_registered":"2013-07-17","domain_rank":296858,"first_seen":"2018-09-15T09:18:08Z","last_seen":"2025-10-13T01:05:48.754216Z","alert_count":0,"request_count":1,"received_data":579,"sent_data":445,"comment":"","tags":null,"fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}]},{"fqdn":"www.coinbaseok.com","ip":{"addr":"0.0.0.0","port":0,"asn":0,"as":"","country":"","country_code":"zz"},"domain_registered":"unknown","domain_rank":0,"first_seen":"2025-09-15T12:54:55.89982Z","last_seen":"2025-10-02T19:02:04.935928Z","alert_count":4,"request_count":1,"received_data":0,"sent_data":441,"comment":"","tags":null,"fingerprints":null}],"files":null,"artifacts":{"windows_shortcuts":null,"files":null,"telegram":null,"pdfs":null,"clipboard":null},"sensors":{"ids":[{"sensor_name":"suricata","description":"Suricata /w Emerging Threats Pro","alerts":[{"sensor_name":"suricata","title":"Suricata IDS","description":"Suricata /w Emerging Threats Pro","date":"2025-10-17T02:20:34Z","timestamp":1760667634,"ip_dst":{"addr":"172.18.0.2","port":46622,"asn":0,"as":"","country":"","country_code":"zz"},"ip_src":{"addr":"202.79.173.8","port":443,"asn":152194,"as":"CTG Server Limited","country":"Singapore","country_code":"SG"},"severity":"medium","alert":"ET DROP Spamhaus DROP Listed Traffic Inbound group 52","source":"{\"timestamp\":\"2025-10-17T02:20:34.714995+0000\",\"flow_id\":2104163130580258,\"in_iface\":\"br-31613a7ed13b\",\"event_type\":\"alert\",\"src_ip\":\"202.79.173.8\",\"src_port\":443,\"dest_ip\":\"172.18.0.2\",\"dest_port\":46622,\"proto\":\"TCP\",\"metadata\":{\"flowbits\":[\"ET.Evil\",\"ET.DROPIP\"]},\"alert\":{\"action\":\"allowed\",\"gid\":1,\"signature_id\":2400051,\"rev\":4421,\"signature\":\"ET DROP Spamhaus DROP Listed Traffic Inbound group 52\",\"category\":\"Misc Attack\",\"severity\":2,\"metadata\":{\"affected_product\":[\"Any\"],\"attack_target\":[\"Any\"],\"created_at\":[\"2010_12_30\"],\"deployment\":[\"Perimeter\"],\"signature_severity\":[\"Minor\"],\"tag\":[\"Dshield\"],\"updated_at\":[\"2025_08_01\"]}},\"flow\":{\"pkts_toserver\":1,\"pkts_toclient\":1,\"bytes_toserver\":74,\"bytes_toclient\":74,\"start\":\"2025-10-17T02:20:34.367906+0000\"}}"}]}],"analyzer":null,"urlquery":null},"javascript":{"script":[{"url":{"schema":"https","addr":"coinbaseow.com/h5/static/js/pages-financial-index~pages-ieo-ieo~pages-index-index~pages-invest-invest.3fdde360.js","fqdn":"coinbaseow.com","domain":"coinbaseow.com","tld":"com"},"ip":{"addr":"202.79.173.8","port":443,"asn":152194,"as":"CTG Server Limited","country":"Singapore","country_code":"SG"},"introduction_type":"scriptElement","is_inline":false,"md5":"65ba185691bde46dc75d51b55f223152","sha1":"b87dddcc01d7352f17ea443d1a23dd7aaff4da1d","sha256":"1b9b7ef4445c98267bbcbfea2dcfa12d9743bbf15a177138f8b400eacd7f6d0a","sha512":"f56ddb848f1c2650284f56daf080f083eb2fccc7c37dc5c5dcca383fe7433b5641a3428a6640c25c457b72511e9ace4eb8bbf11ceac088c7840b4b9f6739aea7","ssdeep":"384:RawqrOs0y6CF9pnRj4p+ZGUQxSXbLlKm3HKSUYCXeWZVdmo:RaB0avpnF4p+ZGUQxSXbLg7S2XeWZyo","tlshash":"6743b292f5db220c4577cb46d94136fc9f7aaba36b017c52e8836f348e266c63b0459c","size":58392,"data":"","first_seen":"2025-09-15T12:55:02.710618Z","last_seen":"2025-10-17T02:21:05.116116Z","times_seen":6,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"coinbaseow.com/h5/","fqdn":"coinbaseow.com","domain":"coinbaseow.com","tld":"com"},"ip":{"addr":"202.79.173.8","port":443,"asn":152194,"as":"CTG Server Limited","country":"Singapore","country_code":"SG"},"introduction_type":"scriptElement","is_inline":true,"md5":"3d6b954dc2d01b7f947ffbdbc08419c4","sha1":"91b4d1da374271f3f7a26ace5bb5d9a18cc7833d","sha256":"33452930b33391ee5b905f55ea3d83da98c22f96e001002468f1230369567e4e","sha512":"0edd93b88ed4f3b4e519ecaf80b84a9226198637f31e617f182614a579969c77e65863f98bda78349defd5054b0de9daff0d03b9299fdf432a72ca1b28191074","ssdeep":"","tlshash":"bb6000c3c03303000c0033ff00c300f00000c0000000f3003cc3000330000c003c00cc","size":16,"data":"","first_seen":"2023-03-07T14:41:52Z","last_seen":"2026-07-23T15:53:23.504144Z","times_seen":973,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"coinbaseow.com/h5/static/js/index.260e7e25.js","fqdn":"coinbaseow.com","domain":"coinbaseow.com","tld":"com"},"ip":{"addr":"202.79.173.8","port":443,"asn":152194,"as":"CTG Server Limited","country":"Singapore","country_code":"SG"},"introduction_type":"scriptElement","is_inline":false,"md5":"a0c74bb7ac83255bd0ab7d4bdf70ba76","sha1":"bddc915cf3ab2050b932c579cc4e50e7c3305325","sha256":"eb0bf4a2d5f27868f59adf5ba456a2447a36f0418003800de68dd7128983c96d","sha512":"4492baa6cd0a827e8b4ac33c93b34afe99280a6690f0f9780f4c3e8bbe2d9c5fe574368cd633e9b463955ffb14bcbd07b66e55f7101deb3de8ae9064ac2050d9","ssdeep":"12288:3zf2zYBy2G2pTmZemVycSyKVIqD3MDc8S1O5kCnl2Sxx8H5ZdwG1ZAIkKDJ3bysp:GzxIZdwG1ZAIkKDJ3bys5XrHeg05TFiF","tlshash":"eaf45ba7f4c0696852d31501909f72a8637add352445b8cdb3ca7b54cbd6bce2222b3f","size":729292,"data":"","first_seen":"2025-09-15T12:55:02.786993Z","last_seen":"2025-10-17T02:21:05.262641Z","times_seen":6,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"coinbaseow.com/h5/static/js/pages-common-aboutus~pages-common-area~pages-common-article~pages-common-borrowing~pages-common-cont~2242e1f3.1fbed555.js","fqdn":"coinbaseow.com","domain":"coinbaseow.com","tld":"com"},"ip":{"addr":"202.79.173.8","port":443,"asn":152194,"as":"CTG Server Limited","country":"Singapore","country_code":"SG"},"introduction_type":"scriptElement","is_inline":false,"md5":"5e0f776248d9468b53baa194b4573e76","sha1":"de473483992465866c439b0292c8908982d0e1f9","sha256":"2a1c6b54d00bb64b4f43f10937dd093b770bf2d7aab21418e33041f067676038","sha512":"88ca4fe4dc0a36388a37e2900b70192d89e34d6f61e55af52f4020ed8dc5e1773939a0530d351eb49d855d01deb0c2fd280b4f2ff9b0c63b6266601389694e83","ssdeep":"768:c6jgQnKb6QWm4AmCd0tG8e+W1MAbu7N8ChEAh8sd0Q2Z7wXH90tWNjZNztpptzkX:cYsYId0FHoMqu7NdEAaM2O3O7cbWrDWM","tlshash":"01b3cdd2f6cc2840566fcf4e9341a3fcbbbaba2342697867e4622f244f772d62504558","size":109160,"data":"","first_seen":"2025-09-15T12:55:02.71984Z","last_seen":"2025-10-17T02:21:05.10032Z","times_seen":6,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"coinbaseow.com/h5/static/js/pages-common-login~pages-common-register~pages-copytrade-copy~pages-follow-index~pages-fund-fundTran~dfbeb8f8.8ebaa9ae.js","fqdn":"coinbaseow.com","domain":"coinbaseow.com","tld":"com"},"ip":{"addr":"202.79.173.8","port":443,"asn":152194,"as":"CTG Server Limited","country":"Singapore","country_code":"SG"},"introduction_type":"scriptElement","is_inline":false,"md5":"e8a88259226221d031ccd8862197acdb","sha1":"ba970c15fff2596ab9460fe32449f87d7da966f1","sha256":"5fd29fb031d6c6e8dea561925e2aacbf2969c3dbd4d15361981569b65afd9df0","sha512":"ce843bfe8efb1866f4cbc09b1256e57bd46cebea0ba118f8356be7d9e5f98cc9f430d3dd30506879c0d68c1939be684fe3f84076222ac5fd458fbe1041b15eab","ssdeep":"768:UW18W9M9p71EuVOdvFJUzFxthjVvUgy+X0a:N+b72DvTUzpZ","tlshash":"f0c33bc2fdc860048d6bd705954636fd9e2ffb630255acdafe812f384e2a1d726095ac","size":121713,"data":"","first_seen":"2025-09-15T12:55:02.771312Z","last_seen":"2025-10-17T02:21:05.132093Z","times_seen":6,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"coinbaseow.com/h5/static/js/pages-index-index~pages-transaction-index.ab68c10e.js","fqdn":"coinbaseow.com","domain":"coinbaseow.com","tld":"com"},"ip":{"addr":"202.79.173.8","port":443,"asn":152194,"as":"CTG Server Limited","country":"Singapore","country_code":"SG"},"introduction_type":"scriptElement","is_inline":false,"md5":"801131277d46f3f5075723633217fc9d","sha1":"12a339498fa8e6c0f31d695881f3ee5e6bdb2e23","sha256":"de7b1e5eee5c7ca514a7161cea7e88e587ec6b163c75acc7a8431da3637fb90b","sha512":"309edd3c4ca714f4446cb6b15eb0d40e136ac865d53ce4e6786f08e622d5388894d3f2b4c5ecf81d99849e9830d8c4698f0abd7058778ba3cbaacf18278176b6","ssdeep":"384:w+xQiE2j8FT+TwVccWi1jQfaIHE+W/34Mb3:Rxh8ogQf2r3","tlshash":"cb530aa2f7ec2006c567f743a16332f89a3bad7303016852da5d7f744e166ce2d865ac","size":63467,"data":"","first_seen":"2025-09-15T12:55:02.775076Z","last_seen":"2025-10-17T02:21:05.141151Z","times_seen":6,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"coinbaseow.com/h5/static/js/pages-index-index.499a4f2e.js","fqdn":"coinbaseow.com","domain":"coinbaseow.com","tld":"com"},"ip":{"addr":"202.79.173.8","port":443,"asn":152194,"as":"CTG Server Limited","country":"Singapore","country_code":"SG"},"introduction_type":"scriptElement","is_inline":false,"md5":"c0da19be41b4ad0e27d008b2e5ab4590","sha1":"42fbf754c630d69cbcf5dca72c3f1cfe8754a3a2","sha256":"54566864d396ab9711d037fc73509e5c530d02bd6006c41e0511fb9b49ed98f1","sha512":"2bd4427632eeacfca70fd2e3c1a966056215db02c686877d02472ed5044e99906b6b54db007deea224e2fcd889eb0a7f597ad154b0c1fee70320c72b1aa4c02a","ssdeep":"6144:4Rpj4Cva8FDVY0JlSanfrckyuGiaoPRKcGFS1t5LeZ:4vj4ChDVY0fSanjckyuRhRKhZ","tlshash":"32d4c9d6f6cd30054173c711944f72fc9a3bbd23a606a852f965ffb04e169ca361aa2c","size":637337,"data":"","first_seen":"2025-09-15T12:55:02.706216Z","last_seen":"2025-10-17T02:21:05.14571Z","times_seen":6,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"coinbaseow.com/h5/","fqdn":"coinbaseow.com","domain":"coinbaseow.com","tld":"com"},"ip":{"addr":"202.79.173.8","port":443,"asn":152194,"as":"CTG Server Limited","country":"Singapore","country_code":"SG"},"introduction_type":"scriptElement","is_inline":true,"md5":"c7c2044589cd6c4afb8f708d8f4929ce","sha1":"0a1a91f258a6b31b5f24008bde88fe949fd00317","sha256":"20217fc70ebe327eee12ece90b2c8ad0e6f760234c316849f05b7e2a7d0ee931","sha512":"50894a9f5d6c19842e74141d8b09cfc2ed951ee4d75dd45343c8c9156064fabc2129acf0c4635cfba00be760064af9293e826d7df958097177d67e364bb11248","ssdeep":"","tlshash":"25c04cb4761959305659a22d7239e7d83dbb501130437547901c158d0cf4e945671ea9","size":159,"data":"","first_seen":"2023-03-07T12:06:42Z","last_seen":"2026-07-24T17:25:15.914352Z","times_seen":1408,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"coinbaseow.com/h5/","fqdn":"coinbaseow.com","domain":"coinbaseow.com","tld":"com"},"ip":{"addr":"202.79.173.8","port":443,"asn":152194,"as":"CTG Server Limited","country":"Singapore","country_code":"SG"},"introduction_type":"scriptElement","is_inline":true,"md5":"d9e35f3565e98641c0174d284e8ddd26","sha1":"967e8443ce108fe2742f3ec46237a40560c67c35","sha256":"6fc1c4ed09be48bc1d695bba608ad0c9ff9a525edd88b1819bdf413e88960e82","sha512":"7b6ca8aea3dd9c4b83fda1914179c9957606363ee546540bdaa87d0ed099362681da51036c06bb3a8c6641946b69621d72154075f78b02b770ab1bddb3ac8a23","ssdeep":"","tlshash":"576000000000f00c00c0000c003000c000c0f00f000c0c303c0fcc00300000c0f3000c","size":14,"data":"","first_seen":"2023-03-07T14:41:52Z","last_seen":"2026-07-23T17:19:49.172588Z","times_seen":1535,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"coinbaseow.com/h5/static/common/js/touch-emulator.js","fqdn":"coinbaseow.com","domain":"coinbaseow.com","tld":"com"},"ip":{"addr":"202.79.173.8","port":443,"asn":152194,"as":"CTG Server Limited","country":"Singapore","country_code":"SG"},"introduction_type":"scriptElement","is_inline":false,"md5":"178ba7db6232252a555ba6ff953756a8","sha1":"31129606e2c7e395a73184f30e81e835a424cdf5","sha256":"2968f310031c7a0c1d271836caa44aedaa28794289d14c577f0b17033e8c036d","sha512":"dea2f867ed3e1774320ea9494c9fd6fa24a7c7eeba27e50099530d3eabe196b6a34f70cfb7d0ac87aa5c70dcb5172d149de92da8af78725b6090952588041dbd","ssdeep":"96:L+vx+c5tJzNjX/wGiZ27oA2qMrttS7KDWom4RhvYahnT/TCKkTIT1/CoShwqhzcs:yvx+chzxItcKs+LmKk8TqhzwoEPq","tlshash":"1a32314f098a226204bb7329fb9e904af67e85a311012056fcbc5f653f72a758694ecd","size":11668,"data":"","first_seen":"2023-03-07T14:41:52Z","last_seen":"2026-07-23T15:53:23.455004Z","times_seen":719,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"coinbaseow.com/h5/static/js/chunk-vendors.689a8234.js","fqdn":"coinbaseow.com","domain":"coinbaseow.com","tld":"com"},"ip":{"addr":"202.79.173.8","port":443,"asn":152194,"as":"CTG Server Limited","country":"Singapore","country_code":"SG"},"introduction_type":"scriptElement","is_inline":false,"md5":"7b1016723cd2ded736f3f4c743430f52","sha1":"b67ffd249d9effc765cd09c99a128a0cf10928d6","sha256":"184fb1947cb55b7b543b30c0ee5ae06ec31dcdfbc76976d596723de740c2d41d","sha512":"3335c7fd675556b77dd288a81697fba8f8f54c5dd5778e02f6ddf215f2a9c431a739c402af2e7307e4732997fbcdedcd91e8d4495b20ec86ca14fd9226e96331","ssdeep":"6144:mXBx0zCGAG5zcVyPL3nlhhZwa+WfZ5JQpjhKxnZY4sqvZ3bdw:ixHezO8E2/Jsj8Zp3bm","tlshash":"55e4089cb281b0ba07e761f5003f220ba13b6968b40ad4d5f279e5d4ad78d8e5127f7c","size":695613,"data":"","first_seen":"2025-09-15T12:55:02.72189Z","last_seen":"2025-10-17T02:21:05.091849Z","times_seen":6,"alerts":{"ids":null,"analyzer":null,"urlquery":null}}],"eval":null,"write":null,"console":null},"http":[{"url":{"schema":"https","addr":"coinbaseow.com/h5/static/image/nav/nav-1-active.png","fqdn":"coinbaseow.com","domain":"coinbaseow.com","tld":"com"},"ip":{"addr":"202.79.173.8","port":443,"asn":152194,"as":"CTG Server Limited","country":"Singapore","country_code":"SG"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://coinbaseow.com/h5/","date":"2025-10-17T02:20:40.230Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"www.coinbaseoq.shop","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Thu, 09 Oct 2025 07:16:50 GMT","end":"Wed, 07 Jan 2026 07:16:49 GMT"},"fingerprint":{"sha1":"71:AC:C8:1A:43:33:1E:D9:F5:BE:92:DB:27:46:FC:E2:F0:DA:07:A7","sha256":"59:AC:48:87:76:46:B0:7F:ED:AA:98:8C:AD:DD:7C:40:7E:52:F9:11:1D:71:85:35:F8:29:5D:27:D6:19:43:90"}}},"request":{"raw":"GET /h5/static/image/nav/nav-1-active.png HTTP/1.1\r\nHost: coinbaseow.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://coinbaseow.com/h5/\r\nCookie: angela_session=eyJpdiI6Ik41Zk9jTkxrNjI4NndXNXFSMjN5aWc9PSIsInZhbHVlIjoiaDhmYVljVDVCQTJFeVZnYzNkWndpbEYyNm1wR1RoMm1sWWxTTzRQb1B6eWREd2ZyZjBcL1RKa2lmVldKdUxCK3JPZ1d0NXcyVVM3WVQrZTFuSlpMNFhWYzZ1RVhvTTZCYlV1cXZHd3ZBSGdhaEVxN0J4OWxMVXlcL21XbHFPZnkwYyIsIm1hYyI6IjAwNGU0NDVkZGRiMDQwN2MyOTNlYjJkNTRmMDNmYzQ0YzFkYzFjNDFhY2Y5Yzg0MWQzY2JjNjAzZjUxZjMyZDYifQ%3D%3D; SITE_TOTAL_ID=3c6c7b94394b9ebde77373f18a7ee7b7\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Fri, 17 Oct 2025 02:20:40 GMT\r\ncontent-type: image/png\r\nlast-modified: Thu, 11 Sep 2025 06:31:12 GMT\r\nvary: Accept-Encoding\r\netag: W/\"68c26cb0-700\"\r\nexpires: Sun, 16 Nov 2025 02:20:40 GMT\r\ncache-control: max-age=2592000\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: quic=\":443\"; h3=\":443\"; h3-29=\":443\"; h3-27=\":443\";h3-25=\":443\"; h3-T050=\":443\"; h3-Q050=\":443\";h3-Q049=\":443\";h3-Q048=\":443\"; h3-Q046=\":443\"; h3-Q043=\":443\"\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":1792,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 39 x 43, 8-bit/color RGBA, non-interlaced","md5":"6e2baf8ad92bb13eccce1b784be6f4de","sha1":"56195bc729f562359e7a5de5d0db813017971b68","sha256":"155295d2342170ff1b32d8bf029e9b1cd79ab884b6014fef2bc2990bf57cb44d","sha512":"ec2ecc8a420b474996700a8f7177985e1d512ede1d5fda6285ac995175c51899c90014654e5b440cfe83006d87d087f4783a729bf462be683b2936ec3ee504a5","ssdeep":"","tlshash":"39312bdb974664088db27c5113441d4c1f290b666ef7ae0c14c4f8cf31be0ca5624a38","first_seen":"2023-05-20T12:09:29Z","last_seen":"2026-07-23T15:53:23.490174Z","times_seen":242,"resource_available":false,"data":null}},"time_used":682,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":682,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-10-17","alert":"Sinkholed","trigger":"coinbaseow.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2025-10-17","alert":"Sinkholed","trigger":"coinbaseow.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2025-10-17","alert":"Sinkholed","trigger":"coinbaseow.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"coinbaseow.com/api/news/index_pop?lang=zh","fqdn":"coinbaseow.com","domain":"coinbaseow.com","tld":"com"},"ip":{"addr":"202.79.173.8","port":443,"asn":152194,"as":"CTG Server Limited","country":"Singapore","country_code":"SG"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"https://coinbaseow.com/h5/","date":"2025-10-17T02:20:41.232Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"www.coinbaseoq.shop","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Thu, 09 Oct 2025 07:16:50 GMT","end":"Wed, 07 Jan 2026 07:16:49 GMT"},"fingerprint":{"sha1":"71:AC:C8:1A:43:33:1E:D9:F5:BE:92:DB:27:46:FC:E2:F0:DA:07:A7","sha256":"59:AC:48:87:76:46:B0:7F:ED:AA:98:8C:AD:DD:7C:40:7E:52:F9:11:1D:71:85:35:F8:29:5D:27:D6:19:43:90"}}},"request":{"raw":"GET /api/news/index_pop?lang=zh HTTP/1.1\r\nHost: coinbaseow.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nAuthorization: \r\nContent-Type: application/x-www-form-urlencoded\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://coinbaseow.com/h5/\r\nCookie: angela_session=eyJpdiI6IkU5NTd0Yk1pQVhSTUVheklOYU1CNmc9PSIsInZhbHVlIjoiK0RtZCszOFpTMURXV2lcL0p0QjZ4V3N4UmJuZnJDYVZpclkzWDFTZ201TFRuVmJxRVBBR0NnUGI5b0U4UTlNa3BXRHEreFU1VXF3OXNGaDFNdVwvb3RcLzRYRG1YQWlyNUk1cUs4VHE4NmMzOVFpNWdwZ2FRbnVabWJwelBHYUVtcEciLCJtYWMiOiI2Nzk2MDAzZGM5NjIwOTI0YTAxZjczMjVkOGMwNGVlM2Y2YjlkZTQyZTlmMjBjOTUzYjYzMmI4NzlmNjQ5NWI5In0%3D; SITE_TOTAL_ID=3c6c7b94394b9ebde77373f18a7ee7b7\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ncontent-type: application/json\r\nvary: Accept-Encoding\r\naccess-control-allow-origin: *\r\naccess-control-allow-methods: POST,GET,OPTIONS,DELETE\r\naccess-control-allow-headers: x-requested-with,content-type,Authorization\r\ncache-control: no-cache, private\r\ndate: Fri, 17 Oct 2025 02:20:41 GMT\r\nset-cookie: angela_session=eyJpdiI6ImNIdE1veHFUaW42eFd1U1FYV0ZQNlE9PSIsInZhbHVlIjoiZlc3UUI5ZXljSnpvbjdDaXZcL1ZRamtwVnd5Rkh2bFpOTnlwYUlKR2phWlBYckJIb1wvMUNkSUR4bExDNldmaVArdTQyVDJ2K1wvNms2XC9zU2huV3N1Tng0MHArdVdSXC8xaWhtYk5TRlh5Q3BUTEI5dEo1bDNTRENBQ2Zqa1lYQ0h6UiIsIm1hYyI6ImM3ZWRhMWY2YjY2NzU3YTQ4Y2VmYzVkNDYwZjY3NTFiODFiM2U3ZDViZDBmZmVmZDliY2RiOWIzZGM0NmFjNWIifQ%3D%3D; expires=Fri, 17-Oct-2025 04:20:41 GMT; Max-Age=7200; path=/; httponly\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: quic=\":443\"; h3=\":443\"; h3-29=\":443\"; h3-27=\":443\";h3-25=\":443\"; h3-T050=\":443\"; h3-Q050=\":443\";h3-Q049=\":443\";h3-Q048=\":443\"; h3-Q046=\":443\"; h3-Q043=\":443\"\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":28,"size_decoded":0,"mime_type":"application/json","magic":"JSON text data","md5":"7e6fa1bf5cc93ff191f6e9d25a7b5587","sha1":"027ba2ef0614fec58e260e7a0c989c283527b30b","sha256":"4fda09bb7c83ec6f6948f56849c4f7cb727c29cdeb0b42b84bec891be728a963","sha512":"4953f0c097793c2f756ea0eb744cac4369bb3cabad68f180964c481216bd4b77a9c176b1c4c0c81caf6df74bf5c8bb91f14c7b3aa4caee30131c6811ca9a5e0d","ssdeep":"","tlshash":"4b800000a208ac28030a0a0238883800828e0083c0822a0208088e28838e8b0223232e","first_seen":"2023-11-01T08:36:58Z","last_seen":"2026-07-09T16:09:08.052213Z","times_seen":277,"resource_available":false,"data":null}},"time_used":367,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":367,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2025-10-17","alert":"Sinkholed","trigger":"coinbaseow.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2025-10-17","alert":"Sinkholed","trigger":"coinbaseow.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-10-17","alert":"Sinkholed","trigger":"coinbaseow.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"coinbaseow.com/api/news/list","fqdn":"coinbaseow.com","domain":"coinbaseow.com","tld":"com"},"ip":{"addr":"202.79.173.8","port":443,"asn":152194,"as":"CTG Server Limited","country":"Singapore","country_code":"SG"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"https://coinbaseow.com/h5/","date":"2025-10-17T02:20:41.243Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"www.coinbaseoq.shop","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Thu, 09 Oct 2025 07:16:50 GMT","end":"Wed, 07 Jan 2026 07:16:49 GMT"},"fingerprint":{"sha1":"71:AC:C8:1A:43:33:1E:D9:F5:BE:92:DB:27:46:FC:E2:F0:DA:07:A7","sha256":"59:AC:48:87:76:46:B0:7F:ED:AA:98:8C:AD:DD:7C:40:7E:52:F9:11:1D:71:85:35:F8:29:5D:27:D6:19:43:90"}}},"request":{"raw":"POST /api/news/list HTTP/1.1\r\nHost: coinbaseow.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nAuthorization: \r\nContent-Type: application/x-www-form-urlencoded\r\nContent-Length: 14\r\nOrigin: https://coinbaseow.com\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://coinbaseow.com/h5/\r\nCookie: angela_session=eyJpdiI6IkU5NTd0Yk1pQVhSTUVheklOYU1CNmc9PSIsInZhbHVlIjoiK0RtZCszOFpTMURXV2lcL0p0QjZ4V3N4UmJuZnJDYVZpclkzWDFTZ201TFRuVmJxRVBBR0NnUGI5b0U4UTlNa3BXRHEreFU1VXF3OXNGaDFNdVwvb3RcLzRYRG1YQWlyNUk1cUs4VHE4NmMzOVFpNWdwZ2FRbnVabWJwelBHYUVtcEciLCJtYWMiOiI2Nzk2MDAzZGM5NjIwOTI0YTAxZjczMjVkOGMwNGVlM2Y2YjlkZTQyZTlmMjBjOTUzYjYzMmI4NzlmNjQ5NWI5In0%3D; SITE_TOTAL_ID=3c6c7b94394b9ebde77373f18a7ee7b7\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"POST"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ncontent-type: application/json\r\nvary: Accept-Encoding\r\naccess-control-allow-origin: *\r\naccess-control-allow-methods: POST,GET,OPTIONS,DELETE\r\naccess-control-allow-headers: x-requested-with,content-type,Authorization\r\ncache-control: no-cache, private\r\ndate: Fri, 17 Oct 2025 02:20:41 GMT\r\nset-cookie: angela_session=eyJpdiI6InBNRWMrT2RReGZYSXh5UEs4R3drTXc9PSIsInZhbHVlIjoiR2xyQ1hkWnRkMVRDNjRzTmI0c01RWXljeVFBRjFxY3dlSitWT09Yalo0eTYydmFEcDQ1Q2NjZ3NMaUs2dlVzaVwvRGtneVNuQmdXdzlWWkxFNWNcLzVlc3VTV3o1bGd3TWpzNWo5VG04aFFaZlk5U1hmTFFKcmZPYTJzaHlIcjhNUSIsIm1hYyI6ImQwYzIyMDQwMzgzMjQ2MTliMzkwNjExZTZiNzI5YmM5NzE0ODZmZjIxNTViOTNiYmMwNDgyZDdjODIyM2E5MmMifQ%3D%3D; expires=Fri, 17-Oct-2025 04:20:41 GMT; Max-Age=7200; path=/; httponly\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: quic=\":443\"; h3=\":443\"; h3-29=\":443\"; h3-27=\":443\";h3-25=\":443\"; h3-T050=\":443\"; h3-Q050=\":443\";h3-Q049=\":443\";h3-Q048=\":443\"; h3-Q046=\":443\"; h3-Q043=\":443\"\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":368,"size_decoded":0,"mime_type":"application/json","magic":"JSON text data","md5":"3d56d005ca0a695cedf6dbb5edc8be15","sha1":"e1908c058fb7c7b6ee291e7b0ea9e5fa6c43fe0d","sha256":"af769ea62aecc7b7a87ef7858293e30b1d7d55278c8948a1c5ddea7b29a5a03b","sha512":"2fc7e6e92c51b0ad1b17426e8c4cf0f90d4e4cf3b9449b1ff2f2cba9e901f6dadca9ed3f7c837810e917efd9ef460bad46cef319a754860279a52b6f31303329","ssdeep":"","tlshash":"0de0c07d2600adff53d023c8648fb545d9dd2042864587ad49cc8ca8d3586f8403b427","first_seen":"2025-09-15T12:55:02.727578Z","last_seen":"2025-10-17T02:21:05.073164Z","times_seen":6,"resource_available":false,"data":null}},"time_used":367,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":367,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2025-10-17","alert":"Sinkholed","trigger":"coinbaseow.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2025-10-17","alert":"Sinkholed","trigger":"coinbaseow.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-10-17","alert":"Sinkholed","trigger":"coinbaseow.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"coinbaseow.com/h5/static/image/icon/home-icon-6.png","fqdn":"coinbaseow.com","domain":"coinbaseow.com","tld":"com"},"ip":{"addr":"202.79.173.8","port":443,"asn":152194,"as":"CTG Server Limited","country":"Singapore","country_code":"SG"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://coinbaseow.com/h5/","date":"2025-10-17T02:20:41.270Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"www.coinbaseoq.shop","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Thu, 09 Oct 2025 07:16:50 GMT","end":"Wed, 07 Jan 2026 07:16:49 GMT"},"fingerprint":{"sha1":"71:AC:C8:1A:43:33:1E:D9:F5:BE:92:DB:27:46:FC:E2:F0:DA:07:A7","sha256":"59:AC:48:87:76:46:B0:7F:ED:AA:98:8C:AD:DD:7C:40:7E:52:F9:11:1D:71:85:35:F8:29:5D:27:D6:19:43:90"}}},"request":{"raw":"GET /h5/static/image/icon/home-icon-6.png HTTP/1.1\r\nHost: coinbaseow.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://coinbaseow.com/h5/\r\nCookie: angela_session=eyJpdiI6IkU5NTd0Yk1pQVhSTUVheklOYU1CNmc9PSIsInZhbHVlIjoiK0RtZCszOFpTMURXV2lcL0p0QjZ4V3N4UmJuZnJDYVZpclkzWDFTZ201TFRuVmJxRVBBR0NnUGI5b0U4UTlNa3BXRHEreFU1VXF3OXNGaDFNdVwvb3RcLzRYRG1YQWlyNUk1cUs4VHE4NmMzOVFpNWdwZ2FRbnVabWJwelBHYUVtcEciLCJtYWMiOiI2Nzk2MDAzZGM5NjIwOTI0YTAxZjczMjVkOGMwNGVlM2Y2YjlkZTQyZTlmMjBjOTUzYjYzMmI4NzlmNjQ5NWI5In0%3D; SITE_TOTAL_ID=3c6c7b94394b9ebde77373f18a7ee7b7\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Fri, 17 Oct 2025 02:20:41 GMT\r\ncontent-type: image/png\r\nlast-modified: Thu, 11 Sep 2025 06:31:12 GMT\r\nvary: Accept-Encoding\r\netag: W/\"68c26cb0-aba\"\r\nexpires: Sun, 16 Nov 2025 02:20:41 GMT\r\ncache-control: max-age=2592000\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: quic=\":443\"; h3=\":443\"; h3-29=\":443\"; h3-27=\":443\";h3-25=\":443\"; h3-T050=\":443\"; h3-Q050=\":443\";h3-Q049=\":443\";h3-Q048=\":443\"; h3-Q046=\":443\"; h3-Q043=\":443\"\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":2746,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 81 x 59, 8-bit/color RGBA, non-interlaced","md5":"425470dd8a1e29c0f15eff66021ddb09","sha1":"6b6d04f134dbe6802d250058a232e7411b306916","sha256":"059f4c1b20b74cef836207419e99301aeedc4784a90aca388a0ee21ab5bc2a87","sha512":"31faab5ead30a5b61f9767379916f61b28ff3ad796840ec1f58894b1cad851e1121ab1b8474342b48c7ce8bfcb04fba47f84e892a4ef92709ab6252755fbcb0f","ssdeep":"","tlshash":"d2512aae32e6eb0ef2994103e4bf3143d2a34a441125ba8c84e43cee07842b3a995131","first_seen":"2023-05-20T12:09:29Z","last_seen":"2026-06-17T15:44:58.958753Z","times_seen":161,"resource_available":false,"data":null}},"time_used":347,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":347,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2025-10-17","alert":"Sinkholed","trigger":"coinbaseow.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2025-10-17","alert":"Sinkholed","trigger":"coinbaseow.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-10-17","alert":"Sinkholed","trigger":"coinbaseow.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"coinbaseow.com/h5/static/DIN-Regular.ttf","fqdn":"coinbaseow.com","domain":"coinbaseow.com","tld":"com"},"ip":{"addr":"202.79.173.8","port":443,"asn":152194,"as":"CTG Server Limited","country":"Singapore","country_code":"SG"},"is_navigation_request":false,"resource_type":"font","requested_by":"https://coinbaseow.com/h5/","date":"2025-10-17T02:20:40.244Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"www.coinbaseoq.shop","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Thu, 09 Oct 2025 07:16:50 GMT","end":"Wed, 07 Jan 2026 07:16:49 GMT"},"fingerprint":{"sha1":"71:AC:C8:1A:43:33:1E:D9:F5:BE:92:DB:27:46:FC:E2:F0:DA:07:A7","sha256":"59:AC:48:87:76:46:B0:7F:ED:AA:98:8C:AD:DD:7C:40:7E:52:F9:11:1D:71:85:35:F8:29:5D:27:D6:19:43:90"}}},"request":{"raw":"GET /h5/static/DIN-Regular.ttf HTTP/1.1\r\nHost: coinbaseow.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://coinbaseow.com/h5/\r\nCookie: angela_session=eyJpdiI6Ik41Zk9jTkxrNjI4NndXNXFSMjN5aWc9PSIsInZhbHVlIjoiaDhmYVljVDVCQTJFeVZnYzNkWndpbEYyNm1wR1RoMm1sWWxTTzRQb1B6eWREd2ZyZjBcL1RKa2lmVldKdUxCK3JPZ1d0NXcyVVM3WVQrZTFuSlpMNFhWYzZ1RVhvTTZCYlV1cXZHd3ZBSGdhaEVxN0J4OWxMVXlcL21XbHFPZnkwYyIsIm1hYyI6IjAwNGU0NDVkZGRiMDQwN2MyOTNlYjJkNTRmMDNmYzQ0YzFkYzFjNDFhY2Y5Yzg0MWQzY2JjNjAzZjUxZjMyZDYifQ%3D%3D; SITE_TOTAL_ID=3c6c7b94394b9ebde77373f18a7ee7b7\r\nSec-Fetch-Dest: font\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Fri, 17 Oct 2025 02:20:40 GMT\r\ncontent-type: application/octet-stream\r\ncontent-length: 24676\r\nlast-modified: Thu, 11 Sep 2025 06:31:12 GMT\r\netag: \"68c26cb0-6064\"\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: quic=\":443\"; h3=\":443\"; h3-29=\":443\"; h3-27=\":443\";h3-25=\":443\"; h3-T050=\":443\"; h3-Q050=\":443\";h3-Q049=\":443\";h3-Q048=\":443\"; h3-Q046=\":443\"; h3-Q043=\":443\"\r\naccept-ranges: bytes\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":24676,"size_decoded":0,"mime_type":"application/octet-stream","magic":"TrueType Font data, 15 tables, 1st \"FFTM\", 14 names, Macintosh","md5":"1e0b91dcb4ed262d0c603006919a1fd8","sha1":"aa0cecebc344f5a3bbd614ab97a42ff8f8637d46","sha256":"4749fb5068ba31c2cba31bf6c7340977fc21cf0e9339bdf155dd57457cfc9e0d","sha512":"dc5635a9a7a8f0b3b454de6c1cd56bd22d16310a18b874f153a38bdecaf41dad5eea2405f3e092d9040f9278d37cc5163dba32f3478f91d7a6a348f4ee708bd8","ssdeep":"384:9iJk3F9sakdL5E5P/y5QJ0FNpmuJqJgkJhBZ5JeJMz1vHJb90KILamCKwL/plOLz:9JmdlAn2/pm6cBpJX2sdX4","tlshash":"9db27c0957424b0fc7277e308e2642a2d725fcb427fa9bdb9d44d8f7606d2e34c68a45","first_seen":"2023-04-17T17:59:29Z","last_seen":"2026-07-23T15:53:23.470633Z","times_seen":526,"resource_available":false,"data":null}},"time_used":669,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":668,"receive":1,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2025-10-17","alert":"Sinkholed","trigger":"coinbaseow.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2025-10-17","alert":"Sinkholed","trigger":"coinbaseow.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-10-17","alert":"Sinkholed","trigger":"coinbaseow.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"coinbaseow.com/api/currency/new_timeshar?from=1760664041\u0026to=1760667641\u0026symbol=XRP%2FUSDT\u0026period=1min\u0026lang=zh","fqdn":"coinbaseow.com","domain":"coinbaseow.com","tld":"com"},"ip":{"addr":"202.79.173.8","port":443,"asn":152194,"as":"CTG Server Limited","country":"Singapore","country_code":"SG"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"https://coinbaseow.com/h5/","date":"2025-10-17T02:20:43.779Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"www.coinbaseoq.shop","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Thu, 09 Oct 2025 07:16:50 GMT","end":"Wed, 07 Jan 2026 07:16:49 GMT"},"fingerprint":{"sha1":"71:AC:C8:1A:43:33:1E:D9:F5:BE:92:DB:27:46:FC:E2:F0:DA:07:A7","sha256":"59:AC:48:87:76:46:B0:7F:ED:AA:98:8C:AD:DD:7C:40:7E:52:F9:11:1D:71:85:35:F8:29:5D:27:D6:19:43:90"}}},"request":{"raw":"GET /api/currency/new_timeshar?from=1760664041\u0026to=1760667641\u0026symbol=XRP%2FUSDT\u0026period=1min\u0026lang=zh HTTP/1.1\r\nHost: coinbaseow.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nAuthorization: \r\nContent-Type: application/x-www-form-urlencoded\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://coinbaseow.com/h5/\r\nCookie: angela_session=eyJpdiI6ImhzWmc5THIwaVoxSVVrQ3p5MEhuZXc9PSIsInZhbHVlIjoieks1MkQxSk40K3VUTU1DVFFQVXBxV213SnpLdHlVRDdwYXQwY0x0cXJ0S2dlc08xdnRDVXFxQmtQRGprVVRpY2ViWEoyMHFyaWUrMGxIZjdpOFNZbk4zNzVKamdJRW5WK1pwNkNac29scFwvRnBFczNsQ0tqMVpXcjRDSHUwXC9YcSIsIm1hYyI6ImFiMGRhZjU0OGI1YjNjNjA5OGM0ZTY5YzBhYTNiYjUxOWY3NDBmYjI5MWYwNWY1MDkwOWI4ZWNjNTQ5MTk0ZDIifQ%3D%3D; SITE_TOTAL_ID=3c6c7b94394b9ebde77373f18a7ee7b7\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ncontent-type: application/json\r\nvary: Accept-Encoding\r\ncache-control: no-cache, private\r\ndate: Fri, 17 Oct 2025 02:20:44 GMT\r\naccess-control-allow-origin: *, *\r\naccess-control-allow-headers: Content-Type, Authorization, X-Requested-With, Origin, Content-Type, Cookie, X-CSRF-TOKEN, Accept, Authorization, X-XSRF-TOKEN\r\naccess-control-expose-headers: Authorization, authenticated\r\naccess-control-allow-methods: GET, POST, PUT, DELETE, OPTIONS, GET, POST, PATCH, PUT, OPTIONS\r\naccess-control-allow-credentials: false\r\nset-cookie: angela_session=eyJpdiI6IndCM2VlNVBMYllFa1BRR0FGVnJpdEE9PSIsInZhbHVlIjoiRXh0eHNcL2lJY3JycXBtdWlMWU50b1p4U3pIZDZicUUwVUg3Y2ZFNzdtUzUyNVJLclpDZmpEcyttM2RUTTR3bVJXSERiQTdQbGp4dTlsUVdzamlJM2dlTEx0ZzFQM251Sjg0YUpSQUFBQzdOWFBQNllYU2Z5dHBCK2I0eXhlajhHIiwibWFjIjoiYjcwYTUyNWRmYTQ1ZjJmNjNmNGVhMGQ5ZDczYzdmZmMzMWIwNWM3ODY2OGY4Y2RiMTUzZmMyMzU4OTc5OTY5MyJ9; expires=Fri, 17-Oct-2025 04:20:44 GMT; Max-Age=7200; path=/; httponly\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: quic=\":443\"; h3=\":443\"; h3-29=\":443\"; h3-27=\":443\";h3-25=\":443\"; h3-T050=\":443\"; h3-Q050=\":443\";h3-Q049=\":443\";h3-Q048=\":443\"; h3-Q046=\":443\"; h3-Q043=\":443\"\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":13092,"size_decoded":0,"mime_type":"application/json","magic":"JSON text data","md5":"1bd4d12b620a0b51b95ea626e3094e89","sha1":"9e84a10c6179874bd05f51192edd63779c245871","sha256":"d147f54b06abdca49045546608281b62fbf55c758c17387ecc867d9ac10362c7","sha512":"cbd8c5ec7f64cd001ab1a717328efdfae4bb97107f5345213e8e2fa6846126a8438f3e82ca9e07ae86f813e334f8872f76e14617f8e577adbcffe8ffc1f6e998","ssdeep":"192:v02FPbCAPJbUiLNkVfS3oH6HYeAPFKt2YU7jW61Xkhq4iKPNmCiJnxoAqCPPj7wf:fnBwKgzTJtd2","tlshash":"d34258c482fa0374c07a14d83dd34f6ca77a219764938e6961be46827de1ea9f102d7f","first_seen":"2025-10-17T02:21:05.082316Z","last_seen":"2025-10-17T02:21:05.082316Z","times_seen":1,"resource_available":false,"data":null}},"time_used":388,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":388,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2025-10-17","alert":"Sinkholed","trigger":"coinbaseow.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2025-10-17","alert":"Sinkholed","trigger":"coinbaseow.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-10-17","alert":"Sinkholed","trigger":"coinbaseow.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"coinbaseow.com/h5/static/js/chunk-vendors.689a8234.js","fqdn":"coinbaseow.com","domain":"coinbaseow.com","tld":"com"},"ip":{"addr":"202.79.173.8","port":443,"asn":152194,"as":"CTG Server Limited","country":"Singapore","country_code":"SG"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://coinbaseow.com/h5/","date":"2025-10-17T02:20:38.135Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"www.coinbaseoq.shop","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Thu, 09 Oct 2025 07:16:50 GMT","end":"Wed, 07 Jan 2026 07:16:49 GMT"},"fingerprint":{"sha1":"71:AC:C8:1A:43:33:1E:D9:F5:BE:92:DB:27:46:FC:E2:F0:DA:07:A7","sha256":"59:AC:48:87:76:46:B0:7F:ED:AA:98:8C:AD:DD:7C:40:7E:52:F9:11:1D:71:85:35:F8:29:5D:27:D6:19:43:90"}}},"request":{"raw":"GET /h5/static/js/chunk-vendors.689a8234.js HTTP/1.1\r\nHost: coinbaseow.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://coinbaseow.com/h5/\r\nCookie: angela_session=eyJpdiI6Ik41Zk9jTkxrNjI4NndXNXFSMjN5aWc9PSIsInZhbHVlIjoiaDhmYVljVDVCQTJFeVZnYzNkWndpbEYyNm1wR1RoMm1sWWxTTzRQb1B6eWREd2ZyZjBcL1RKa2lmVldKdUxCK3JPZ1d0NXcyVVM3WVQrZTFuSlpMNFhWYzZ1RVhvTTZCYlV1cXZHd3ZBSGdhaEVxN0J4OWxMVXlcL21XbHFPZnkwYyIsIm1hYyI6IjAwNGU0NDVkZGRiMDQwN2MyOTNlYjJkNTRmMDNmYzQ0YzFkYzFjNDFhY2Y5Yzg0MWQzY2JjNjAzZjUxZjMyZDYifQ%3D%3D; SITE_TOTAL_ID=3c6c7b94394b9ebde77373f18a7ee7b7\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Fri, 17 Oct 2025 02:20:38 GMT\r\ncontent-type: application/javascript\r\nlast-modified: Thu, 11 Sep 2025 06:31:12 GMT\r\nvary: Accept-Encoding\r\netag: W/\"68c26cb0-a9d3d\"\r\nexpires: Fri, 17 Oct 2025 14:20:38 GMT\r\ncache-control: max-age=43200\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: quic=\":443\"; h3=\":443\"; h3-29=\":443\"; h3-27=\":443\";h3-25=\":443\"; h3-T050=\":443\"; h3-Q050=\":443\";h3-Q049=\":443\";h3-Q048=\":443\"; h3-Q046=\":443\"; h3-Q043=\":443\"\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":695613,"size_decoded":0,"mime_type":"application/javascript","magic":"JavaScript source, Unicode text, UTF-8 text, with very long lines (65527), with no line terminators","md5":"7b1016723cd2ded736f3f4c743430f52","sha1":"b67ffd249d9effc765cd09c99a128a0cf10928d6","sha256":"184fb1947cb55b7b543b30c0ee5ae06ec31dcdfbc76976d596723de740c2d41d","sha512":"3335c7fd675556b77dd288a81697fba8f8f54c5dd5778e02f6ddf215f2a9c431a739c402af2e7307e4732997fbcdedcd91e8d4495b20ec86ca14fd9226e96331","ssdeep":"6144:mXBx0zCGAG5zcVyPL3nlhhZwa+WfZ5JQpjhKxnZY4sqvZ3bdw:ixHezO8E2/Jsj8Zp3bm","tlshash":"55e4089cb281b0ba07e761f5003f220ba13b6968b40ad4d5f279e5d4ad78d8e5127f7c","first_seen":"2025-09-15T12:55:02.72189Z","last_seen":"2025-10-17T02:21:05.091849Z","times_seen":6,"resource_available":true,"data":null}},"time_used":1040,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":1040,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2025-10-17","alert":"Sinkholed","trigger":"coinbaseow.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2025-10-17","alert":"Sinkholed","trigger":"coinbaseow.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-10-17","alert":"Sinkholed","trigger":"coinbaseow.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"coinbaseow.com/h5/static/puhui.ttf","fqdn":"coinbaseow.com","domain":"coinbaseow.com","tld":"com"},"ip":{"addr":"202.79.173.8","port":443,"asn":152194,"as":"CTG Server Limited","country":"Singapore","country_code":"SG"},"is_navigation_request":false,"resource_type":"font","requested_by":"https://coinbaseow.com/h5/","date":"2025-10-17T02:20:41.631Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"www.coinbaseoq.shop","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Thu, 09 Oct 2025 07:16:50 GMT","end":"Wed, 07 Jan 2026 07:16:49 GMT"},"fingerprint":{"sha1":"71:AC:C8:1A:43:33:1E:D9:F5:BE:92:DB:27:46:FC:E2:F0:DA:07:A7","sha256":"59:AC:48:87:76:46:B0:7F:ED:AA:98:8C:AD:DD:7C:40:7E:52:F9:11:1D:71:85:35:F8:29:5D:27:D6:19:43:90"}}},"request":{"raw":"GET /h5/static/puhui.ttf HTTP/1.1\r\nHost: coinbaseow.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://coinbaseow.com/h5/\r\nCookie: angela_session=eyJpdiI6Ik9XZnRTS1psYWU3ZDFIQ3dcLzhuOU5BPT0iLCJ2YWx1ZSI6IjZ2WHYzRDU1bmtTRFFrVjMwdmt5eFJxcDRVYkhWMXdWdzNQMUVpMlZEd3dcL2JRaHQySGRWSTNrelROK0k1WDhBS1d3YVlZc2ViZVkwXC9cL2JNZmlET0tTNVVXUW1SdTNDQ0lpenZKVDA3UUR3WGFDaXVNVzdDckhtbGowbGpER1VnIiwibWFjIjoiNjM3ZWE4ZDgxODE2YjQ3NjczNDA2ZjFmZTVlYzkzZmZkN2QwOTVkNDhhYmY4YTU2Njg1YjA2MDQxNWYwOWE3OSJ9; SITE_TOTAL_ID=3c6c7b94394b9ebde77373f18a7ee7b7\r\nSec-Fetch-Dest: font\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Fri, 17 Oct 2025 02:20:41 GMT\r\ncontent-type: application/octet-stream\r\ncontent-length: 114072\r\nlast-modified: Thu, 11 Sep 2025 06:31:12 GMT\r\netag: \"68c26cb0-1bd98\"\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: quic=\":443\"; h3=\":443\"; h3-29=\":443\"; h3-27=\":443\";h3-25=\":443\"; h3-T050=\":443\"; h3-Q050=\":443\";h3-Q049=\":443\";h3-Q048=\":443\"; h3-Q046=\":443\"; h3-Q043=\":443\"\r\naccept-ranges: bytes\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":114072,"size_decoded":0,"mime_type":"application/octet-stream","magic":"TrueType Font data, 11 tables, 1st \"GSUB\", 18 names, Macintosh,            ","md5":"96669e515a783cb097faa49d1db8003c","sha1":"d8d7a2b9df8ca9b7904f90992e58d9328e2e330e","sha256":"56292fb7d6391f60ec54fdd70864cfa44c21f0227c87f190e0b1884d61006983","sha512":"926d814e95d0155e42d9857f7add5cb444d53600dbf92d8b681a0b5bec27e621b2af5411dbe0241dcfa3511bd8df7be3b3571e38204df82cbd8f5b3f79ab4e1f","ssdeep":"1536:J4NShFmEgaaQSZhwb6sdQOYyzrnTtp5Jt6jvmIN7nos+XtjriAX3s+dm:JckVCZsqOYyz/tf/EeI7oNJ3MEm","tlshash":"f0b36c939b5a7816dc32bdfc4845a34bbdc0c4a40756d2132f7a182e48d7dd80badeb8","first_seen":"2023-10-29T16:17:57Z","last_seen":"2026-07-09T16:09:08.054777Z","times_seen":150,"resource_available":false,"data":null}},"time_used":351,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":347,"receive":4,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2025-10-17","alert":"Sinkholed","trigger":"coinbaseow.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2025-10-17","alert":"Sinkholed","trigger":"coinbaseow.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-10-17","alert":"Sinkholed","trigger":"coinbaseow.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"coinbaseow.com/h5/static/image/icon/home-nav-2.png","fqdn":"coinbaseow.com","domain":"coinbaseow.com","tld":"com"},"ip":{"addr":"202.79.173.8","port":443,"asn":152194,"as":"CTG Server Limited","country":"Singapore","country_code":"SG"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://coinbaseow.com/h5/","date":"2025-10-17T02:20:41.735Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"www.coinbaseoq.shop","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Thu, 09 Oct 2025 07:16:50 GMT","end":"Wed, 07 Jan 2026 07:16:49 GMT"},"fingerprint":{"sha1":"71:AC:C8:1A:43:33:1E:D9:F5:BE:92:DB:27:46:FC:E2:F0:DA:07:A7","sha256":"59:AC:48:87:76:46:B0:7F:ED:AA:98:8C:AD:DD:7C:40:7E:52:F9:11:1D:71:85:35:F8:29:5D:27:D6:19:43:90"}}},"request":{"raw":"GET /h5/static/image/icon/home-nav-2.png HTTP/1.1\r\nHost: coinbaseow.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://coinbaseow.com/h5/\r\nCookie: angela_session=eyJpdiI6IlwveTR4N0o4QTNJTWlRdnNpSFBOUjJRPT0iLCJ2YWx1ZSI6IkRFdTRyWjBQc0xzNEsybnZwU3FJWG5sUjhWellva1RRbXhPQTlcL0FMKzJTblFlVXNqbHBOWWpPVEpnZ3l0WTlFMmtNcmp1R0JDc2c3dkVub0xOcUIzRnBUdWsrQWpxa1UrckkyXC9iMTBoMHFQUXFiWTFHd0Y0NUtqWE5nY0ppZ08iLCJtYWMiOiIyN2MwODJlOWRkOTg4MDVjZTBlMDBmOWY2NWQ0NmJkMjIwYjk4YWU4MTgwNGJmZDhmNzM0N2Y5MWM5Yjg3OGY0In0%3D; SITE_TOTAL_ID=3c6c7b94394b9ebde77373f18a7ee7b7\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Fri, 17 Oct 2025 02:20:41 GMT\r\ncontent-type: image/png\r\nlast-modified: Thu, 11 Sep 2025 06:31:12 GMT\r\nvary: Accept-Encoding\r\netag: W/\"68c26cb0-17be\"\r\nexpires: Sun, 16 Nov 2025 02:20:41 GMT\r\ncache-control: max-age=2592000\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: quic=\":443\"; h3=\":443\"; h3-29=\":443\"; h3-27=\":443\";h3-25=\":443\"; h3-T050=\":443\"; h3-Q050=\":443\";h3-Q049=\":443\";h3-Q048=\":443\"; h3-Q046=\":443\"; h3-Q043=\":443\"\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":6078,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 88 x 88, 8-bit/color RGBA, non-interlaced","md5":"8edb61a43ebbac5b1c00c183530722fe","sha1":"602712cb46dbce14c871f2ca1ebd29acf6136368","sha256":"b53157f804ec5e41faf0213dfcf9f05a00d55ec3390266848735d3e62275829c","sha512":"2edb5e4f1ac0068c4225b411d622a9c06162cfa2db87e6658df5b4cb14bc4670a6f64537d25471c27295a05549b89f9c3d5d688738591fd26989506019e6fb78","ssdeep":"96:MknmWIHF/KENGWGMHOzH5ogs4rpHggsBRC70n4wj7isQwtJDvv1Wm1VKUi8s528l:MknEj4+X2bsBsANjmsTDVnbfM5Gy3","tlshash":"cfc15c56d8b059751215e6592add30227f3603c08751ea84ecfedc7ab6600bd9dbcdc3","first_seen":"2023-05-20T12:09:29Z","last_seen":"2026-07-23T15:53:23.469972Z","times_seen":233,"resource_available":false,"data":null}},"time_used":347,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":347,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2025-10-17","alert":"Sinkholed","trigger":"coinbaseow.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2025-10-17","alert":"Sinkholed","trigger":"coinbaseow.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-10-17","alert":"Sinkholed","trigger":"coinbaseow.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"coinbaseow.com/h5/static/js/pages-common-aboutus~pages-common-area~pages-common-article~pages-common-borrowing~pages-common-cont~2242e1f3.1fbed555.js","fqdn":"coinbaseow.com","domain":"coinbaseow.com","tld":"com"},"ip":{"addr":"202.79.173.8","port":443,"asn":152194,"as":"CTG Server Limited","country":"Singapore","country_code":"SG"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://coinbaseow.com/h5/","date":"2025-10-17T02:20:40.212Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"www.coinbaseoq.shop","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Thu, 09 Oct 2025 07:16:50 GMT","end":"Wed, 07 Jan 2026 07:16:49 GMT"},"fingerprint":{"sha1":"71:AC:C8:1A:43:33:1E:D9:F5:BE:92:DB:27:46:FC:E2:F0:DA:07:A7","sha256":"59:AC:48:87:76:46:B0:7F:ED:AA:98:8C:AD:DD:7C:40:7E:52:F9:11:1D:71:85:35:F8:29:5D:27:D6:19:43:90"}}},"request":{"raw":"GET /h5/static/js/pages-common-aboutus~pages-common-area~pages-common-article~pages-common-borrowing~pages-common-cont~2242e1f3.1fbed555.js HTTP/1.1\r\nHost: coinbaseow.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://coinbaseow.com/h5/\r\nCookie: angela_session=eyJpdiI6Ik41Zk9jTkxrNjI4NndXNXFSMjN5aWc9PSIsInZhbHVlIjoiaDhmYVljVDVCQTJFeVZnYzNkWndpbEYyNm1wR1RoMm1sWWxTTzRQb1B6eWREd2ZyZjBcL1RKa2lmVldKdUxCK3JPZ1d0NXcyVVM3WVQrZTFuSlpMNFhWYzZ1RVhvTTZCYlV1cXZHd3ZBSGdhaEVxN0J4OWxMVXlcL21XbHFPZnkwYyIsIm1hYyI6IjAwNGU0NDVkZGRiMDQwN2MyOTNlYjJkNTRmMDNmYzQ0YzFkYzFjNDFhY2Y5Yzg0MWQzY2JjNjAzZjUxZjMyZDYifQ%3D%3D; SITE_TOTAL_ID=3c6c7b94394b9ebde77373f18a7ee7b7\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Fri, 17 Oct 2025 02:20:40 GMT\r\ncontent-type: application/javascript\r\nlast-modified: Thu, 11 Sep 2025 06:31:12 GMT\r\nvary: Accept-Encoding\r\netag: W/\"68c26cb0-1aabe\"\r\nexpires: Fri, 17 Oct 2025 14:20:40 GMT\r\ncache-control: max-age=43200\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: quic=\":443\"; h3=\":443\"; h3-29=\":443\"; h3-27=\":443\";h3-25=\":443\"; h3-T050=\":443\"; h3-Q050=\":443\";h3-Q049=\":443\";h3-Q048=\":443\"; h3-Q046=\":443\"; h3-Q043=\":443\"\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":109246,"size_decoded":0,"mime_type":"application/javascript","magic":"JavaScript source, Unicode text, UTF-8 text, with very long lines (65272), with no line terminators","md5":"5e0f776248d9468b53baa194b4573e76","sha1":"de473483992465866c439b0292c8908982d0e1f9","sha256":"2a1c6b54d00bb64b4f43f10937dd093b770bf2d7aab21418e33041f067676038","sha512":"88ca4fe4dc0a36388a37e2900b70192d89e34d6f61e55af52f4020ed8dc5e1773939a0530d351eb49d855d01deb0c2fd280b4f2ff9b0c63b6266601389694e83","ssdeep":"768:c6jgQnKb6QWm4AmCd0tG8e+W1MAbu7N8ChEAh8sd0Q2Z7wXH90tWNjZNztpptzkX:cYsYId0FHoMqu7NdEAaM2O3O7cbWrDWM","tlshash":"01b3cdd2f6cc2840566fcf4e9341a3fcbbbaba2342697867e4622f244f772d62504558","first_seen":"2025-09-15T12:55:02.71984Z","last_seen":"2025-10-17T02:21:05.10032Z","times_seen":6,"resource_available":true,"data":null}},"time_used":352,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":352,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2025-10-17","alert":"Sinkholed","trigger":"coinbaseow.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2025-10-17","alert":"Sinkholed","trigger":"coinbaseow.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-10-17","alert":"Sinkholed","trigger":"coinbaseow.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"coinbaseow.com/api/news/list","fqdn":"coinbaseow.com","domain":"coinbaseow.com","tld":"com"},"ip":{"addr":"202.79.173.8","port":443,"asn":152194,"as":"CTG Server Limited","country":"Singapore","country_code":"SG"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"https://coinbaseow.com/h5/","date":"2025-10-17T02:20:41.245Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"www.coinbaseoq.shop","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Thu, 09 Oct 2025 07:16:50 GMT","end":"Wed, 07 Jan 2026 07:16:49 GMT"},"fingerprint":{"sha1":"71:AC:C8:1A:43:33:1E:D9:F5:BE:92:DB:27:46:FC:E2:F0:DA:07:A7","sha256":"59:AC:48:87:76:46:B0:7F:ED:AA:98:8C:AD:DD:7C:40:7E:52:F9:11:1D:71:85:35:F8:29:5D:27:D6:19:43:90"}}},"request":{"raw":"POST /api/news/list HTTP/1.1\r\nHost: coinbaseow.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nAuthorization: \r\nContent-Type: application/x-www-form-urlencoded\r\nContent-Length: 14\r\nOrigin: https://coinbaseow.com\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://coinbaseow.com/h5/\r\nCookie: angela_session=eyJpdiI6IkU5NTd0Yk1pQVhSTUVheklOYU1CNmc9PSIsInZhbHVlIjoiK0RtZCszOFpTMURXV2lcL0p0QjZ4V3N4UmJuZnJDYVZpclkzWDFTZ201TFRuVmJxRVBBR0NnUGI5b0U4UTlNa3BXRHEreFU1VXF3OXNGaDFNdVwvb3RcLzRYRG1YQWlyNUk1cUs4VHE4NmMzOVFpNWdwZ2FRbnVabWJwelBHYUVtcEciLCJtYWMiOiI2Nzk2MDAzZGM5NjIwOTI0YTAxZjczMjVkOGMwNGVlM2Y2YjlkZTQyZTlmMjBjOTUzYjYzMmI4NzlmNjQ5NWI5In0%3D; SITE_TOTAL_ID=3c6c7b94394b9ebde77373f18a7ee7b7\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"POST"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ncontent-type: application/json\r\nvary: Accept-Encoding\r\naccess-control-allow-origin: *\r\naccess-control-allow-methods: POST,GET,OPTIONS,DELETE\r\naccess-control-allow-headers: x-requested-with,content-type,Authorization\r\ncache-control: no-cache, private\r\ndate: Fri, 17 Oct 2025 02:20:41 GMT\r\nset-cookie: angela_session=eyJpdiI6Ik9XZnRTS1psYWU3ZDFIQ3dcLzhuOU5BPT0iLCJ2YWx1ZSI6IjZ2WHYzRDU1bmtTRFFrVjMwdmt5eFJxcDRVYkhWMXdWdzNQMUVpMlZEd3dcL2JRaHQySGRWSTNrelROK0k1WDhBS1d3YVlZc2ViZVkwXC9cL2JNZmlET0tTNVVXUW1SdTNDQ0lpenZKVDA3UUR3WGFDaXVNVzdDckhtbGowbGpER1VnIiwibWFjIjoiNjM3ZWE4ZDgxODE2YjQ3NjczNDA2ZjFmZTVlYzkzZmZkN2QwOTVkNDhhYmY4YTU2Njg1YjA2MDQxNWYwOWE3OSJ9; expires=Fri, 17-Oct-2025 04:20:41 GMT; Max-Age=7200; path=/; httponly\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: quic=\":443\"; h3=\":443\"; h3-29=\":443\"; h3-27=\":443\";h3-25=\":443\"; h3-T050=\":443\"; h3-Q050=\":443\";h3-Q049=\":443\";h3-Q048=\":443\"; h3-Q046=\":443\"; h3-Q043=\":443\"\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":431,"size_decoded":0,"mime_type":"application/json","magic":"JSON text data","md5":"2e17092a1918d60c00ecbaa539fce634","sha1":"2b5a2dc0742a347eb431efbb3ba86aee85b66c24","sha256":"6dc0b8ec5d49f2a4594adcb95c7281376a7bb77ef1b18fc6b9212ecb52f77966","sha512":"8b94fe38838786b680e8fee7eb0accce9db3a643cc8c1c182d3e0a4219fb4352bee75b802f87e39a5a2366314d3f44b09b88326730779a4ef17cb2f63891d470","ssdeep":"","tlshash":"f2e02bae9d9089fbe25853c2a507f08557ce61c28b5507491bc08cd8cabc6968423483","first_seen":"2025-09-15T12:55:02.729496Z","last_seen":"2025-10-17T02:21:05.104076Z","times_seen":6,"resource_available":false,"data":null}},"time_used":367,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":367,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2025-10-17","alert":"Sinkholed","trigger":"coinbaseow.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2025-10-17","alert":"Sinkholed","trigger":"coinbaseow.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-10-17","alert":"Sinkholed","trigger":"coinbaseow.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"coinbaseow.com/api/lh/deposit/config?lang=zh","fqdn":"coinbaseow.com","domain":"coinbaseow.com","tld":"com"},"ip":{"addr":"202.79.173.8","port":443,"asn":152194,"as":"CTG Server Limited","country":"Singapore","country_code":"SG"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"https://coinbaseow.com/h5/","date":"2025-10-17T02:20:41.247Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"www.coinbaseoq.shop","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Thu, 09 Oct 2025 07:16:50 GMT","end":"Wed, 07 Jan 2026 07:16:49 GMT"},"fingerprint":{"sha1":"71:AC:C8:1A:43:33:1E:D9:F5:BE:92:DB:27:46:FC:E2:F0:DA:07:A7","sha256":"59:AC:48:87:76:46:B0:7F:ED:AA:98:8C:AD:DD:7C:40:7E:52:F9:11:1D:71:85:35:F8:29:5D:27:D6:19:43:90"}}},"request":{"raw":"GET /api/lh/deposit/config?lang=zh HTTP/1.1\r\nHost: coinbaseow.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nAuthorization: \r\nContent-Type: application/x-www-form-urlencoded\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://coinbaseow.com/h5/\r\nCookie: angela_session=eyJpdiI6IkU5NTd0Yk1pQVhSTUVheklOYU1CNmc9PSIsInZhbHVlIjoiK0RtZCszOFpTMURXV2lcL0p0QjZ4V3N4UmJuZnJDYVZpclkzWDFTZ201TFRuVmJxRVBBR0NnUGI5b0U4UTlNa3BXRHEreFU1VXF3OXNGaDFNdVwvb3RcLzRYRG1YQWlyNUk1cUs4VHE4NmMzOVFpNWdwZ2FRbnVabWJwelBHYUVtcEciLCJtYWMiOiI2Nzk2MDAzZGM5NjIwOTI0YTAxZjczMjVkOGMwNGVlM2Y2YjlkZTQyZTlmMjBjOTUzYjYzMmI4NzlmNjQ5NWI5In0%3D; SITE_TOTAL_ID=3c6c7b94394b9ebde77373f18a7ee7b7\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ncontent-type: application/json\r\nvary: Accept-Encoding\r\naccess-control-allow-methods: POST,GET,OPTIONS,DELETE\r\naccess-control-allow-headers: x-requested-with,content-type,Authorization\r\ncache-control: no-cache, private\r\ndate: Fri, 17 Oct 2025 02:20:41 GMT\r\naccess-control-allow-origin: *, *\r\naccess-control-allow-credentials: true\r\nx-ratelimit-limit: 60\r\nx-ratelimit-remaining: 59\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: quic=\":443\"; h3=\":443\"; h3-29=\":443\"; h3-27=\":443\";h3-25=\":443\"; h3-T050=\":443\"; h3-Q050=\":443\";h3-Q049=\":443\";h3-Q048=\":443\"; h3-Q046=\":443\"; h3-Q043=\":443\"\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":1122,"size_decoded":0,"mime_type":"application/json","magic":"JSON text data","md5":"7bf0ae9126fdcc078ddad7e8b622a09b","sha1":"88ea86f6aae1a6e16d0013f64a3affbeba61eeae","sha256":"43ebf578e16b839f1c5d02db3bacf501409125f0b10f89bbbc8761b87868436c","sha512":"3ddd8d56dca30fdc91a86ad676d9cd4632c7811f95b41c8cd108640a40af971c7123acafd8b9bde548012c1c64eaec8bc7e4087b826569e2647ed42f5a3bd18e","ssdeep":"","tlshash":"c221d56d739d9ae8c66515c202dab4acb05b364f3ecb49c833ceacac82d4535d019933","first_seen":"2025-09-10T12:42:35.159958Z","last_seen":"2026-04-09T01:57:39.037446Z","times_seen":13,"resource_available":false,"data":null}},"time_used":366,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":366,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2025-10-17","alert":"Sinkholed","trigger":"coinbaseow.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2025-10-17","alert":"Sinkholed","trigger":"coinbaseow.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-10-17","alert":"Sinkholed","trigger":"coinbaseow.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"coinbaseow.com/h5/static/js/index.260e7e25.js","fqdn":"coinbaseow.com","domain":"coinbaseow.com","tld":"com"},"ip":{"addr":"202.79.173.8","port":443,"asn":152194,"as":"CTG Server Limited","country":"Singapore","country_code":"SG"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://coinbaseow.com/h5/","date":"2025-10-17T02:20:38.136Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"www.coinbaseoq.shop","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Thu, 09 Oct 2025 07:16:50 GMT","end":"Wed, 07 Jan 2026 07:16:49 GMT"},"fingerprint":{"sha1":"71:AC:C8:1A:43:33:1E:D9:F5:BE:92:DB:27:46:FC:E2:F0:DA:07:A7","sha256":"59:AC:48:87:76:46:B0:7F:ED:AA:98:8C:AD:DD:7C:40:7E:52:F9:11:1D:71:85:35:F8:29:5D:27:D6:19:43:90"}}},"request":{"raw":"GET /h5/static/js/index.260e7e25.js HTTP/1.1\r\nHost: coinbaseow.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://coinbaseow.com/h5/\r\nCookie: angela_session=eyJpdiI6Ik41Zk9jTkxrNjI4NndXNXFSMjN5aWc9PSIsInZhbHVlIjoiaDhmYVljVDVCQTJFeVZnYzNkWndpbEYyNm1wR1RoMm1sWWxTTzRQb1B6eWREd2ZyZjBcL1RKa2lmVldKdUxCK3JPZ1d0NXcyVVM3WVQrZTFuSlpMNFhWYzZ1RVhvTTZCYlV1cXZHd3ZBSGdhaEVxN0J4OWxMVXlcL21XbHFPZnkwYyIsIm1hYyI6IjAwNGU0NDVkZGRiMDQwN2MyOTNlYjJkNTRmMDNmYzQ0YzFkYzFjNDFhY2Y5Yzg0MWQzY2JjNjAzZjUxZjMyZDYifQ%3D%3D; SITE_TOTAL_ID=3c6c7b94394b9ebde77373f18a7ee7b7\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Fri, 17 Oct 2025 02:20:38 GMT\r\ncontent-type: application/javascript\r\nlast-modified: Thu, 11 Sep 2025 06:31:12 GMT\r\nvary: Accept-Encoding\r\netag: W/\"68c26cb0-b20cc\"\r\nexpires: Fri, 17 Oct 2025 14:20:38 GMT\r\ncache-control: max-age=43200\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: quic=\":443\"; h3=\":443\"; h3-29=\":443\"; h3-27=\":443\";h3-25=\":443\"; h3-T050=\":443\"; h3-Q050=\":443\";h3-Q049=\":443\";h3-Q048=\":443\"; h3-Q046=\":443\"; h3-Q043=\":443\"\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":729292,"size_decoded":0,"mime_type":"application/javascript","magic":"JavaScript source, Unicode text, UTF-8 text, with very long lines (64961), with no line terminators","md5":"32907f9cf8cfefc16f50cedef58d19bb","sha1":"d11bfae130e9fad1af6d7266d94db1f2f9ad5694","sha256":"8b1de70862f36fb5d9697af9138c40d287a5ea2c28e2b18a676d20ac35291ffb","sha512":"1804805864ff2ea5a55e6bff63d7b1ce6a676d738653c180e72d88d470758e36cf923fb4f40bf4217ef3044d3ba1d55a5bd129c6f7144bd329cef2a95d2b9b61","ssdeep":"12288:3zf2zYBy2G2pTmZemVycSyKVIqD3MDc8S1O5kCnl2Sxx8H5ZdwG1ZAIkKDJ3bysO:GzxIZdwG1ZAIkKDJ3bys5XrHeg05TFiy","tlshash":"ddf45b93f0c1a76852d31511909f32686379dd762449b8cd73caab94cbd6bcd2222b3f","first_seen":"2025-10-17T02:21:05.111449Z","last_seen":"2025-10-17T02:21:05.111449Z","times_seen":1,"resource_available":false,"data":null}},"time_used":1386,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":1386,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2025-10-17","alert":"Sinkholed","trigger":"coinbaseow.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2025-10-17","alert":"Sinkholed","trigger":"coinbaseow.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-10-17","alert":"Sinkholed","trigger":"coinbaseow.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"coinbaseow.com/h5/static/js/pages-financial-index~pages-ieo-ieo~pages-index-index~pages-invest-invest.3fdde360.js","fqdn":"coinbaseow.com","domain":"coinbaseow.com","tld":"com"},"ip":{"addr":"202.79.173.8","port":443,"asn":152194,"as":"CTG Server Limited","country":"Singapore","country_code":"SG"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://coinbaseow.com/h5/","date":"2025-10-17T02:20:40.219Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"www.coinbaseoq.shop","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Thu, 09 Oct 2025 07:16:50 GMT","end":"Wed, 07 Jan 2026 07:16:49 GMT"},"fingerprint":{"sha1":"71:AC:C8:1A:43:33:1E:D9:F5:BE:92:DB:27:46:FC:E2:F0:DA:07:A7","sha256":"59:AC:48:87:76:46:B0:7F:ED:AA:98:8C:AD:DD:7C:40:7E:52:F9:11:1D:71:85:35:F8:29:5D:27:D6:19:43:90"}}},"request":{"raw":"GET /h5/static/js/pages-financial-index~pages-ieo-ieo~pages-index-index~pages-invest-invest.3fdde360.js HTTP/1.1\r\nHost: coinbaseow.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://coinbaseow.com/h5/\r\nCookie: angela_session=eyJpdiI6Ik41Zk9jTkxrNjI4NndXNXFSMjN5aWc9PSIsInZhbHVlIjoiaDhmYVljVDVCQTJFeVZnYzNkWndpbEYyNm1wR1RoMm1sWWxTTzRQb1B6eWREd2ZyZjBcL1RKa2lmVldKdUxCK3JPZ1d0NXcyVVM3WVQrZTFuSlpMNFhWYzZ1RVhvTTZCYlV1cXZHd3ZBSGdhaEVxN0J4OWxMVXlcL21XbHFPZnkwYyIsIm1hYyI6IjAwNGU0NDVkZGRiMDQwN2MyOTNlYjJkNTRmMDNmYzQ0YzFkYzFjNDFhY2Y5Yzg0MWQzY2JjNjAzZjUxZjMyZDYifQ%3D%3D; SITE_TOTAL_ID=3c6c7b94394b9ebde77373f18a7ee7b7\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Fri, 17 Oct 2025 02:20:40 GMT\r\ncontent-type: application/javascript\r\nlast-modified: Thu, 11 Sep 2025 06:31:12 GMT\r\nvary: Accept-Encoding\r\netag: W/\"68c26cb0-e418\"\r\nexpires: Fri, 17 Oct 2025 14:20:40 GMT\r\ncache-control: max-age=43200\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: quic=\":443\"; h3=\":443\"; h3-29=\":443\"; h3-27=\":443\";h3-25=\":443\"; h3-T050=\":443\"; h3-Q050=\":443\";h3-Q049=\":443\";h3-Q048=\":443\"; h3-Q046=\":443\"; h3-Q043=\":443\"\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":58392,"size_decoded":0,"mime_type":"application/javascript","magic":"JavaScript source, Unicode text, UTF-8 text, with very long lines (58214), with no line terminators","md5":"65ba185691bde46dc75d51b55f223152","sha1":"b87dddcc01d7352f17ea443d1a23dd7aaff4da1d","sha256":"1b9b7ef4445c98267bbcbfea2dcfa12d9743bbf15a177138f8b400eacd7f6d0a","sha512":"f56ddb848f1c2650284f56daf080f083eb2fccc7c37dc5c5dcca383fe7433b5641a3428a6640c25c457b72511e9ace4eb8bbf11ceac088c7840b4b9f6739aea7","ssdeep":"384:RawqrOs0y6CF9pnRj4p+ZGUQxSXbLlKm3HKSUYCXeWZVdmo:RaB0avpnF4p+ZGUQxSXbLg7S2XeWZyo","tlshash":"6743b292f5db220c4577cb46d94136fc9f7aaba36b017c52e8836f348e266c63b0459c","first_seen":"2025-09-15T12:55:02.710618Z","last_seen":"2025-10-17T02:21:05.116116Z","times_seen":6,"resource_available":true,"data":null}},"time_used":358,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":358,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2025-10-17","alert":"Sinkholed","trigger":"coinbaseow.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2025-10-17","alert":"Sinkholed","trigger":"coinbaseow.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-10-17","alert":"Sinkholed","trigger":"coinbaseow.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"coinbaseow.com/h5/static/image/icon/home-bg.png","fqdn":"coinbaseow.com","domain":"coinbaseow.com","tld":"com"},"ip":{"addr":"202.79.173.8","port":443,"asn":152194,"as":"CTG Server Limited","country":"Singapore","country_code":"SG"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://coinbaseow.com/h5/","date":"2025-10-17T02:20:41.307Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"www.coinbaseoq.shop","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Thu, 09 Oct 2025 07:16:50 GMT","end":"Wed, 07 Jan 2026 07:16:49 GMT"},"fingerprint":{"sha1":"71:AC:C8:1A:43:33:1E:D9:F5:BE:92:DB:27:46:FC:E2:F0:DA:07:A7","sha256":"59:AC:48:87:76:46:B0:7F:ED:AA:98:8C:AD:DD:7C:40:7E:52:F9:11:1D:71:85:35:F8:29:5D:27:D6:19:43:90"}}},"request":{"raw":"GET /h5/static/image/icon/home-bg.png HTTP/1.1\r\nHost: coinbaseow.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://coinbaseow.com/h5/\r\nCookie: angela_session=eyJpdiI6IkU5NTd0Yk1pQVhSTUVheklOYU1CNmc9PSIsInZhbHVlIjoiK0RtZCszOFpTMURXV2lcL0p0QjZ4V3N4UmJuZnJDYVZpclkzWDFTZ201TFRuVmJxRVBBR0NnUGI5b0U4UTlNa3BXRHEreFU1VXF3OXNGaDFNdVwvb3RcLzRYRG1YQWlyNUk1cUs4VHE4NmMzOVFpNWdwZ2FRbnVabWJwelBHYUVtcEciLCJtYWMiOiI2Nzk2MDAzZGM5NjIwOTI0YTAxZjczMjVkOGMwNGVlM2Y2YjlkZTQyZTlmMjBjOTUzYjYzMmI4NzlmNjQ5NWI5In0%3D; SITE_TOTAL_ID=3c6c7b94394b9ebde77373f18a7ee7b7\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Fri, 17 Oct 2025 02:20:41 GMT\r\ncontent-type: image/png\r\nlast-modified: Thu, 11 Sep 2025 06:31:12 GMT\r\nvary: Accept-Encoding\r\netag: W/\"68c26cb0-2dabb\"\r\nexpires: Sun, 16 Nov 2025 02:20:41 GMT\r\ncache-control: max-age=2592000\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: quic=\":443\"; h3=\":443\"; h3-29=\":443\"; h3-27=\":443\";h3-25=\":443\"; h3-T050=\":443\"; h3-Q050=\":443\";h3-Q049=\":443\";h3-Q048=\":443\"; h3-Q046=\":443\"; h3-Q043=\":443\"\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":187067,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 750 x 531, 8-bit/color RGBA, non-interlaced","md5":"cb97c37693d681a4dc8fb53d83fd0c3f","sha1":"7c7e02a326ef78773ae70ca06e428a4c1e9268da","sha256":"7db6d76800b4482bbef3ece1d2db75ea235bb799edff049635046fdfb8617ac9","sha512":"0477d0a3cdbc30bbd59bab9453ba89bcb8d9acf495f8175c35df26fd46fa3a2712bc126d481f24bd7d5f718e16126867ecd155370a02825924c59c7572db297d","ssdeep":"3072:N55TxTi4zf+oLjtpDCZ31sZ+iskI8ao668LQ0oxPL11xYWnhIipCtyuJm3ecG3q:BFe4v/tpDWsZ3aD68LtWhHCyuJmGa","tlshash":"b8042200a41aec6ead7d78b3d25501e2835624ae27f5f076c23638cddae6e01156cfe9","first_seen":"2023-05-20T12:09:29Z","last_seen":"2026-07-23T15:53:23.468179Z","times_seen":209,"resource_available":false,"data":null}},"time_used":349,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":349,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2025-10-17","alert":"Sinkholed","trigger":"coinbaseow.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2025-10-17","alert":"Sinkholed","trigger":"coinbaseow.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-10-17","alert":"Sinkholed","trigger":"coinbaseow.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"coinbaseow.com/api/currency/new_timeshar?from=1760664041\u0026to=1760667641\u0026symbol=BTC%2FUSDT\u0026period=1min\u0026lang=zh","fqdn":"coinbaseow.com","domain":"coinbaseow.com","tld":"com"},"ip":{"addr":"202.79.173.8","port":443,"asn":152194,"as":"CTG Server Limited","country":"Singapore","country_code":"SG"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"https://coinbaseow.com/h5/","date":"2025-10-17T02:20:41.831Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"www.coinbaseoq.shop","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Thu, 09 Oct 2025 07:16:50 GMT","end":"Wed, 07 Jan 2026 07:16:49 GMT"},"fingerprint":{"sha1":"71:AC:C8:1A:43:33:1E:D9:F5:BE:92:DB:27:46:FC:E2:F0:DA:07:A7","sha256":"59:AC:48:87:76:46:B0:7F:ED:AA:98:8C:AD:DD:7C:40:7E:52:F9:11:1D:71:85:35:F8:29:5D:27:D6:19:43:90"}}},"request":{"raw":"GET /api/currency/new_timeshar?from=1760664041\u0026to=1760667641\u0026symbol=BTC%2FUSDT\u0026period=1min\u0026lang=zh HTTP/1.1\r\nHost: coinbaseow.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nAuthorization: \r\nContent-Type: application/x-www-form-urlencoded\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://coinbaseow.com/h5/\r\nCookie: angela_session=eyJpdiI6IlwveTR4N0o4QTNJTWlRdnNpSFBOUjJRPT0iLCJ2YWx1ZSI6IkRFdTRyWjBQc0xzNEsybnZwU3FJWG5sUjhWellva1RRbXhPQTlcL0FMKzJTblFlVXNqbHBOWWpPVEpnZ3l0WTlFMmtNcmp1R0JDc2c3dkVub0xOcUIzRnBUdWsrQWpxa1UrckkyXC9iMTBoMHFQUXFiWTFHd0Y0NUtqWE5nY0ppZ08iLCJtYWMiOiIyN2MwODJlOWRkOTg4MDVjZTBlMDBmOWY2NWQ0NmJkMjIwYjk4YWU4MTgwNGJmZDhmNzM0N2Y5MWM5Yjg3OGY0In0%3D; SITE_TOTAL_ID=3c6c7b94394b9ebde77373f18a7ee7b7\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ncontent-type: application/json\r\nvary: Accept-Encoding\r\ncache-control: no-cache, private\r\ndate: Fri, 17 Oct 2025 02:20:43 GMT\r\naccess-control-allow-origin: *, *\r\naccess-control-allow-headers: Content-Type, Authorization, X-Requested-With, Origin, Content-Type, Cookie, X-CSRF-TOKEN, Accept, Authorization, X-XSRF-TOKEN\r\naccess-control-expose-headers: Authorization, authenticated\r\naccess-control-allow-methods: GET, POST, PUT, DELETE, OPTIONS, GET, POST, PATCH, PUT, OPTIONS\r\naccess-control-allow-credentials: false\r\nset-cookie: angela_session=eyJpdiI6IkNxNklQNE5SY0t3YVlCRXhZVXB0U1E9PSIsInZhbHVlIjoiQnhiSlN4RUdXVmFEclZVNjVlbjRwTzI0K0JhaHBUYTZLcjlkSlAySlZrOU9wSkFZT21XZUxYbnpNbXRkb0U1RjFTWUZrMGpKUVwvbjk3YTRERWhPajR0RnlIb0hMV1AraWpVZnp6ZGlcL2NLeEp5U3o2b3ErOG9wa0dyaHExdk9LdiIsIm1hYyI6Ijg0ZmM2YmE4OWZlNTIyZWRkN2I3NjBkZWY0ZDA4OGUzM2IxNjg1ZTFkMmE1YzUzY2U1NDNlZmZjMDUwZGU2MWYifQ%3D%3D; expires=Fri, 17-Oct-2025 04:20:43 GMT; Max-Age=7200; path=/; httponly\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: quic=\":443\"; h3=\":443\"; h3-29=\":443\"; h3-27=\":443\";h3-25=\":443\"; h3-T050=\":443\"; h3-Q050=\":443\";h3-Q049=\":443\";h3-Q048=\":443\"; h3-Q046=\":443\"; h3-Q043=\":443\"\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":13892,"size_decoded":0,"mime_type":"application/json","magic":"JSON text data","md5":"66d81d8a1244a6d112b682cc24c65a71","sha1":"61c02a4d3dedab16c872da25a71386147848fd65","sha256":"6317a8625e1911125350e033eb3276f8ebbe515a58c0267042359bf01519c52b","sha512":"bdd44c29b515ef89d535b7cc846abe3c190f1ec62196fbd62bcb17ae559ed978ceb00a81c3ba783dd67e7889c67bb39c0de079997313e8b4307e2dd0a28aa465","ssdeep":"192:vRU/Xc34xPlJWhQ3eTVhurm4UAoHAbN38wo8m12BIHRgxf9RwRyWmXObOkBgE8jZ:mfl0O+TbN4ugOumZUKof","tlshash":"e1528b4447fd1260c07a34c47db388e983ba23a764839f9952be4ec259e1d69f202d7f","first_seen":"2025-10-17T02:21:05.123349Z","last_seen":"2025-10-17T02:21:05.123349Z","times_seen":1,"resource_available":false,"data":null}},"time_used":1505,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":1505,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2025-10-17","alert":"Sinkholed","trigger":"coinbaseow.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2025-10-17","alert":"Sinkholed","trigger":"coinbaseow.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-10-17","alert":"Sinkholed","trigger":"coinbaseow.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"coinbaseow.com/api/currency/new_timeshar?from=1760664041\u0026to=1760667641\u0026symbol=YMT%2FUSDT\u0026period=1min\u0026lang=zh","fqdn":"coinbaseow.com","domain":"coinbaseow.com","tld":"com"},"ip":{"addr":"202.79.173.8","port":443,"asn":152194,"as":"CTG Server Limited","country":"Singapore","country_code":"SG"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"https://coinbaseow.com/h5/","date":"2025-10-17T02:20:45.054Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"www.coinbaseoq.shop","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Thu, 09 Oct 2025 07:16:50 GMT","end":"Wed, 07 Jan 2026 07:16:49 GMT"},"fingerprint":{"sha1":"71:AC:C8:1A:43:33:1E:D9:F5:BE:92:DB:27:46:FC:E2:F0:DA:07:A7","sha256":"59:AC:48:87:76:46:B0:7F:ED:AA:98:8C:AD:DD:7C:40:7E:52:F9:11:1D:71:85:35:F8:29:5D:27:D6:19:43:90"}}},"request":{"raw":"GET /api/currency/new_timeshar?from=1760664041\u0026to=1760667641\u0026symbol=YMT%2FUSDT\u0026period=1min\u0026lang=zh HTTP/1.1\r\nHost: coinbaseow.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nAuthorization: \r\nContent-Type: application/x-www-form-urlencoded\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://coinbaseow.com/h5/\r\nCookie: angela_session=eyJpdiI6ImhqTTVwZ1JhRllwbDFlVTArekExT1E9PSIsInZhbHVlIjoiZTRxeTk1SjJPRyt4Vm82Q1g0dnJIMTBYQ2hFQ2JCSFVPSjhUYTh0YnlRRE9jNDY1UStEWUppY3pneUE2ZCtuRGt0eEo4M0hra0pTZERRcjg0RUdJaUJDV2NmaGJiXC9OS3hGXC9BNnJmM3ZVbFM5RFpaMkxKWlhzdko5ZVJXSlBrSSIsIm1hYyI6ImUzMGM2Y2I1ZTRkZmEyZjcxN2Y2ZmJhOWU2MmRkZTJiZTIwZTgwMjRhZGE5OTQwM2RhNjgyMDdiMjMyNmFhNTgifQ%3D%3D; SITE_TOTAL_ID=3c6c7b94394b9ebde77373f18a7ee7b7\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ncontent-type: application/json\r\nvary: Accept-Encoding\r\ncache-control: no-cache, private\r\ndate: Fri, 17 Oct 2025 02:20:45 GMT\r\naccess-control-allow-origin: *, *\r\naccess-control-allow-headers: Content-Type, Authorization, X-Requested-With, Origin, Content-Type, Cookie, X-CSRF-TOKEN, Accept, Authorization, X-XSRF-TOKEN\r\naccess-control-expose-headers: Authorization, authenticated\r\naccess-control-allow-methods: GET, POST, PUT, DELETE, OPTIONS, GET, POST, PATCH, PUT, OPTIONS\r\naccess-control-allow-credentials: false\r\nset-cookie: angela_session=eyJpdiI6IkhmS1JzdWpwbmErSHA5R2d0VTl2MEE9PSIsInZhbHVlIjoiOTI1TnppVXJwRlVGb09RQmtcL2FpV0xDUTRQbFIzMGxNZ0taV0Nwd2JSTE5WWlQ0MUgxZStHZk1KUkZ5M2lFbmpGYnRRZUJ4XC9vb0srdGpuU05maDVocGJsV2d5SjZiVzJzT0Y4NEZuc1lXZWtWUDVMK1p6MzdCVlpMd3N3bTlvZCIsIm1hYyI6IjZmNzA1OWRlYTBhZTQ1YzBhNjA5MmRjODg3MjQ4YTRjNGYxZTk2ODE0YmQzOWNiNDczMWVkMjZlYmM0Yjg0MDgifQ%3D%3D; expires=Fri, 17-Oct-2025 04:20:45 GMT; Max-Age=7200; path=/; httponly\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: quic=\":443\"; h3=\":443\"; h3-29=\":443\"; h3-27=\":443\";h3-25=\":443\"; h3-T050=\":443\"; h3-Q050=\":443\";h3-Q049=\":443\";h3-Q048=\":443\"; h3-Q046=\":443\"; h3-Q043=\":443\"\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":36,"size_decoded":0,"mime_type":"application/json","magic":"JSON text data","md5":"136b02255a623f7c44544d5266e21ee6","sha1":"d16732370a4b4c9c029637920cd26afa2d422390","sha256":"fcca40d39e392ed1fed0515a2ed890128e3a461bc12240751cf2df7506160f86","sha512":"cc52574d8ea557037eccc98a0d0831b18956f9f6dc5d9c88dcb4b5a4a5abc88ba79470d35c772cc38bd8bc28159b911093b3375b72634bc6bea5ee8bc1c8e6c2","ssdeep":"","tlshash":"ba8000a2280e2c830c0a38cc880c8b8220e8a0808a200320ce8ea238cb080acb883830","first_seen":"2023-04-07T14:59:17Z","last_seen":"2026-07-23T15:53:23.475087Z","times_seen":219,"resource_available":false,"data":null}},"time_used":370,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":370,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2025-10-17","alert":"Sinkholed","trigger":"coinbaseow.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2025-10-17","alert":"Sinkholed","trigger":"coinbaseow.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-10-17","alert":"Sinkholed","trigger":"coinbaseow.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"coinbaseow.com/h5/static/common/js/touch-emulator.js","fqdn":"coinbaseow.com","domain":"coinbaseow.com","tld":"com"},"ip":{"addr":"202.79.173.8","port":443,"asn":152194,"as":"CTG Server Limited","country":"Singapore","country_code":"SG"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://coinbaseow.com/h5/","date":"2025-10-17T02:20:38.133Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"www.coinbaseoq.shop","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Thu, 09 Oct 2025 07:16:50 GMT","end":"Wed, 07 Jan 2026 07:16:49 GMT"},"fingerprint":{"sha1":"71:AC:C8:1A:43:33:1E:D9:F5:BE:92:DB:27:46:FC:E2:F0:DA:07:A7","sha256":"59:AC:48:87:76:46:B0:7F:ED:AA:98:8C:AD:DD:7C:40:7E:52:F9:11:1D:71:85:35:F8:29:5D:27:D6:19:43:90"}}},"request":{"raw":"GET /h5/static/common/js/touch-emulator.js HTTP/1.1\r\nHost: coinbaseow.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://coinbaseow.com/h5/\r\nCookie: angela_session=eyJpdiI6Ik41Zk9jTkxrNjI4NndXNXFSMjN5aWc9PSIsInZhbHVlIjoiaDhmYVljVDVCQTJFeVZnYzNkWndpbEYyNm1wR1RoMm1sWWxTTzRQb1B6eWREd2ZyZjBcL1RKa2lmVldKdUxCK3JPZ1d0NXcyVVM3WVQrZTFuSlpMNFhWYzZ1RVhvTTZCYlV1cXZHd3ZBSGdhaEVxN0J4OWxMVXlcL21XbHFPZnkwYyIsIm1hYyI6IjAwNGU0NDVkZGRiMDQwN2MyOTNlYjJkNTRmMDNmYzQ0YzFkYzFjNDFhY2Y5Yzg0MWQzY2JjNjAzZjUxZjMyZDYifQ%3D%3D; SITE_TOTAL_ID=3c6c7b94394b9ebde77373f18a7ee7b7\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Fri, 17 Oct 2025 02:20:38 GMT\r\ncontent-type: application/javascript\r\nlast-modified: Thu, 11 Sep 2025 06:31:12 GMT\r\nvary: Accept-Encoding\r\netag: W/\"68c26cb0-2d94\"\r\nexpires: Fri, 17 Oct 2025 14:20:38 GMT\r\ncache-control: max-age=43200\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: quic=\":443\"; h3=\":443\"; h3-29=\":443\"; h3-27=\":443\";h3-25=\":443\"; h3-T050=\":443\"; h3-Q050=\":443\";h3-Q049=\":443\";h3-Q048=\":443\"; h3-Q046=\":443\"; h3-Q043=\":443\"\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":11668,"size_decoded":0,"mime_type":"application/javascript","magic":"JavaScript source, Unicode text, UTF-8 text, with CRLF line terminators","md5":"178ba7db6232252a555ba6ff953756a8","sha1":"31129606e2c7e395a73184f30e81e835a424cdf5","sha256":"2968f310031c7a0c1d271836caa44aedaa28794289d14c577f0b17033e8c036d","sha512":"dea2f867ed3e1774320ea9494c9fd6fa24a7c7eeba27e50099530d3eabe196b6a34f70cfb7d0ac87aa5c70dcb5172d149de92da8af78725b6090952588041dbd","ssdeep":"96:L+vx+c5tJzNjX/wGiZ27oA2qMrttS7KDWom4RhvYahnT/TCKkTIT1/CoShwqhzcs:yvx+chzxItcKs+LmKk8TqhzwoEPq","tlshash":"1a32314f098a226204bb7329fb9e904af67e85a311012056fcbc5f653f72a758694ecd","first_seen":"2023-03-07T14:41:52Z","last_seen":"2026-07-23T15:53:23.455004Z","times_seen":719,"resource_available":true,"data":null}},"time_used":348,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":348,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2025-10-17","alert":"Sinkholed","trigger":"coinbaseow.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2025-10-17","alert":"Sinkholed","trigger":"coinbaseow.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-10-17","alert":"Sinkholed","trigger":"coinbaseow.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"coinbaseow.com/h5/static/js/pages-common-login~pages-common-register~pages-copytrade-copy~pages-follow-index~pages-fund-fundTran~dfbeb8f8.8ebaa9ae.js","fqdn":"coinbaseow.com","domain":"coinbaseow.com","tld":"com"},"ip":{"addr":"202.79.173.8","port":443,"asn":152194,"as":"CTG Server Limited","country":"Singapore","country_code":"SG"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://coinbaseow.com/h5/","date":"2025-10-17T02:20:40.216Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"www.coinbaseoq.shop","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Thu, 09 Oct 2025 07:16:50 GMT","end":"Wed, 07 Jan 2026 07:16:49 GMT"},"fingerprint":{"sha1":"71:AC:C8:1A:43:33:1E:D9:F5:BE:92:DB:27:46:FC:E2:F0:DA:07:A7","sha256":"59:AC:48:87:76:46:B0:7F:ED:AA:98:8C:AD:DD:7C:40:7E:52:F9:11:1D:71:85:35:F8:29:5D:27:D6:19:43:90"}}},"request":{"raw":"GET /h5/static/js/pages-common-login~pages-common-register~pages-copytrade-copy~pages-follow-index~pages-fund-fundTran~dfbeb8f8.8ebaa9ae.js HTTP/1.1\r\nHost: coinbaseow.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://coinbaseow.com/h5/\r\nCookie: angela_session=eyJpdiI6Ik41Zk9jTkxrNjI4NndXNXFSMjN5aWc9PSIsInZhbHVlIjoiaDhmYVljVDVCQTJFeVZnYzNkWndpbEYyNm1wR1RoMm1sWWxTTzRQb1B6eWREd2ZyZjBcL1RKa2lmVldKdUxCK3JPZ1d0NXcyVVM3WVQrZTFuSlpMNFhWYzZ1RVhvTTZCYlV1cXZHd3ZBSGdhaEVxN0J4OWxMVXlcL21XbHFPZnkwYyIsIm1hYyI6IjAwNGU0NDVkZGRiMDQwN2MyOTNlYjJkNTRmMDNmYzQ0YzFkYzFjNDFhY2Y5Yzg0MWQzY2JjNjAzZjUxZjMyZDYifQ%3D%3D; SITE_TOTAL_ID=3c6c7b94394b9ebde77373f18a7ee7b7\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Fri, 17 Oct 2025 02:20:40 GMT\r\ncontent-type: application/javascript\r\nlast-modified: Thu, 11 Sep 2025 06:31:12 GMT\r\nvary: Accept-Encoding\r\netag: W/\"68c26cb0-1dc23\"\r\nexpires: Fri, 17 Oct 2025 14:20:40 GMT\r\ncache-control: max-age=43200\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: quic=\":443\"; h3=\":443\"; h3-29=\":443\"; h3-27=\":443\";h3-25=\":443\"; h3-T050=\":443\"; h3-Q050=\":443\";h3-Q049=\":443\";h3-Q048=\":443\"; h3-Q046=\":443\"; h3-Q043=\":443\"\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":121891,"size_decoded":0,"mime_type":"application/javascript","magic":"JavaScript source, Unicode text, UTF-8 text, with very long lines (65180), with no line terminators","md5":"e8a88259226221d031ccd8862197acdb","sha1":"ba970c15fff2596ab9460fe32449f87d7da966f1","sha256":"5fd29fb031d6c6e8dea561925e2aacbf2969c3dbd4d15361981569b65afd9df0","sha512":"ce843bfe8efb1866f4cbc09b1256e57bd46cebea0ba118f8356be7d9e5f98cc9f430d3dd30506879c0d68c1939be684fe3f84076222ac5fd458fbe1041b15eab","ssdeep":"768:UW18W9M9p71EuVOdvFJUzFxthjVvUgy+X0a:N+b72DvTUzpZ","tlshash":"f0c33bc2fdc860048d6bd705954636fd9e2ffb630255acdafe812f384e2a1d726095ac","first_seen":"2025-09-15T12:55:02.771312Z","last_seen":"2025-10-17T02:21:05.132093Z","times_seen":6,"resource_available":true,"data":null}},"time_used":357,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":357,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2025-10-17","alert":"Sinkholed","trigger":"coinbaseow.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2025-10-17","alert":"Sinkholed","trigger":"coinbaseow.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-10-17","alert":"Sinkholed","trigger":"coinbaseow.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"coinbaseow.com/h5/static/image/icon/home-nav-1.png","fqdn":"coinbaseow.com","domain":"coinbaseow.com","tld":"com"},"ip":{"addr":"202.79.173.8","port":443,"asn":152194,"as":"CTG Server Limited","country":"Singapore","country_code":"SG"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://coinbaseow.com/h5/","date":"2025-10-17T02:20:41.722Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"www.coinbaseoq.shop","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Thu, 09 Oct 2025 07:16:50 GMT","end":"Wed, 07 Jan 2026 07:16:49 GMT"},"fingerprint":{"sha1":"71:AC:C8:1A:43:33:1E:D9:F5:BE:92:DB:27:46:FC:E2:F0:DA:07:A7","sha256":"59:AC:48:87:76:46:B0:7F:ED:AA:98:8C:AD:DD:7C:40:7E:52:F9:11:1D:71:85:35:F8:29:5D:27:D6:19:43:90"}}},"request":{"raw":"GET /h5/static/image/icon/home-nav-1.png HTTP/1.1\r\nHost: coinbaseow.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://coinbaseow.com/h5/\r\nCookie: angela_session=eyJpdiI6IlwveTR4N0o4QTNJTWlRdnNpSFBOUjJRPT0iLCJ2YWx1ZSI6IkRFdTRyWjBQc0xzNEsybnZwU3FJWG5sUjhWellva1RRbXhPQTlcL0FMKzJTblFlVXNqbHBOWWpPVEpnZ3l0WTlFMmtNcmp1R0JDc2c3dkVub0xOcUIzRnBUdWsrQWpxa1UrckkyXC9iMTBoMHFQUXFiWTFHd0Y0NUtqWE5nY0ppZ08iLCJtYWMiOiIyN2MwODJlOWRkOTg4MDVjZTBlMDBmOWY2NWQ0NmJkMjIwYjk4YWU4MTgwNGJmZDhmNzM0N2Y5MWM5Yjg3OGY0In0%3D; SITE_TOTAL_ID=3c6c7b94394b9ebde77373f18a7ee7b7\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Fri, 17 Oct 2025 02:20:41 GMT\r\ncontent-type: image/png\r\nlast-modified: Thu, 11 Sep 2025 06:31:12 GMT\r\nvary: Accept-Encoding\r\netag: W/\"68c26cb0-1b25\"\r\nexpires: Sun, 16 Nov 2025 02:20:41 GMT\r\ncache-control: max-age=2592000\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: quic=\":443\"; h3=\":443\"; h3-29=\":443\"; h3-27=\":443\";h3-25=\":443\"; h3-T050=\":443\"; h3-Q050=\":443\";h3-Q049=\":443\";h3-Q048=\":443\"; h3-Q046=\":443\"; h3-Q043=\":443\"\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":6949,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 88 x 88, 8-bit/color RGBA, non-interlaced","md5":"e42448179a7e4cfd76149fc4e340c190","sha1":"8c9bf373b329b7cbabb770586167fadc13c34fb6","sha256":"aad8f325c9108c1b4b9a5f5fd40bc6ad910e12a81b6014d4586f6f8e8131da19","sha512":"265b4ef947931ddd88d013c03c50a6546989ef54312ed83bff4dffcbf03588ac5a37ec62e2dfd38760fe8c34a911f5b14973249c06f7a1e2d06522e92b4b4e17","ssdeep":"192:MknihKLD6GjZm0AqoXmXXTEHuh3O4nG5rg2c1sQgl:fnihKtjZm0AqoX05h3O2Wg2ADgl","tlshash":"d5e18e0d78d15ca04e635781ffcd90a30b535581fee0b8427ca6ae5bae702b1ca2d9d7","first_seen":"2023-05-20T12:09:29Z","last_seen":"2026-07-23T15:53:23.478971Z","times_seen":230,"resource_available":false,"data":null}},"time_used":347,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":347,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2025-10-17","alert":"Sinkholed","trigger":"coinbaseow.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2025-10-17","alert":"Sinkholed","trigger":"coinbaseow.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-10-17","alert":"Sinkholed","trigger":"coinbaseow.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"coinbaseow.com/h5/static/image/icon/home-nav-3.png","fqdn":"coinbaseow.com","domain":"coinbaseow.com","tld":"com"},"ip":{"addr":"202.79.173.8","port":443,"asn":152194,"as":"CTG Server Limited","country":"Singapore","country_code":"SG"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://coinbaseow.com/h5/","date":"2025-10-17T02:20:41.726Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"www.coinbaseoq.shop","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Thu, 09 Oct 2025 07:16:50 GMT","end":"Wed, 07 Jan 2026 07:16:49 GMT"},"fingerprint":{"sha1":"71:AC:C8:1A:43:33:1E:D9:F5:BE:92:DB:27:46:FC:E2:F0:DA:07:A7","sha256":"59:AC:48:87:76:46:B0:7F:ED:AA:98:8C:AD:DD:7C:40:7E:52:F9:11:1D:71:85:35:F8:29:5D:27:D6:19:43:90"}}},"request":{"raw":"GET /h5/static/image/icon/home-nav-3.png HTTP/1.1\r\nHost: coinbaseow.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://coinbaseow.com/h5/\r\nCookie: angela_session=eyJpdiI6IlwveTR4N0o4QTNJTWlRdnNpSFBOUjJRPT0iLCJ2YWx1ZSI6IkRFdTRyWjBQc0xzNEsybnZwU3FJWG5sUjhWellva1RRbXhPQTlcL0FMKzJTblFlVXNqbHBOWWpPVEpnZ3l0WTlFMmtNcmp1R0JDc2c3dkVub0xOcUIzRnBUdWsrQWpxa1UrckkyXC9iMTBoMHFQUXFiWTFHd0Y0NUtqWE5nY0ppZ08iLCJtYWMiOiIyN2MwODJlOWRkOTg4MDVjZTBlMDBmOWY2NWQ0NmJkMjIwYjk4YWU4MTgwNGJmZDhmNzM0N2Y5MWM5Yjg3OGY0In0%3D; SITE_TOTAL_ID=3c6c7b94394b9ebde77373f18a7ee7b7\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Fri, 17 Oct 2025 02:20:41 GMT\r\ncontent-type: image/png\r\nlast-modified: Thu, 11 Sep 2025 06:31:12 GMT\r\nvary: Accept-Encoding\r\netag: W/\"68c26cb0-f02\"\r\nexpires: Sun, 16 Nov 2025 02:20:41 GMT\r\ncache-control: max-age=2592000\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: quic=\":443\"; h3=\":443\"; h3-29=\":443\"; h3-27=\":443\";h3-25=\":443\"; h3-T050=\":443\"; h3-Q050=\":443\";h3-Q049=\":443\";h3-Q048=\":443\"; h3-Q046=\":443\"; h3-Q043=\":443\"\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":3842,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 46 x 46, 8-bit/color RGBA, non-interlaced","md5":"af1e80bff113a7687e542d4fca416239","sha1":"83ce6e6d1881f6fa0d2a64873cde529d2fc14055","sha256":"dc41ff7881c27712a7a16d402346b6af5d3de0eda8b78b07a5a537df095393a0","sha512":"cce7ce1bf1894630112a56ba27699ea9a63c436e552cd4b5f052b7d8f40370a6833a37a4ac2ac34e776cf941d3337c831929b7c41be9fa436a1329e2858b57e2","ssdeep":"","tlshash":"29814c89f1c2a81121469c84eae6d1b72b3757e086e0e4a5dcdbc42bd8745fcc8de9d3","first_seen":"2023-05-20T12:09:29Z","last_seen":"2026-06-17T15:44:58.936662Z","times_seen":191,"resource_available":false,"data":null}},"time_used":347,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":347,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2025-10-17","alert":"Sinkholed","trigger":"coinbaseow.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2025-10-17","alert":"Sinkholed","trigger":"coinbaseow.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-10-17","alert":"Sinkholed","trigger":"coinbaseow.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"coinbaseow.com/h5/static/js/pages-index-index~pages-transaction-index.ab68c10e.js","fqdn":"coinbaseow.com","domain":"coinbaseow.com","tld":"com"},"ip":{"addr":"202.79.173.8","port":443,"asn":152194,"as":"CTG Server Limited","country":"Singapore","country_code":"SG"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://coinbaseow.com/h5/","date":"2025-10-17T02:20:40.223Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"www.coinbaseoq.shop","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Thu, 09 Oct 2025 07:16:50 GMT","end":"Wed, 07 Jan 2026 07:16:49 GMT"},"fingerprint":{"sha1":"71:AC:C8:1A:43:33:1E:D9:F5:BE:92:DB:27:46:FC:E2:F0:DA:07:A7","sha256":"59:AC:48:87:76:46:B0:7F:ED:AA:98:8C:AD:DD:7C:40:7E:52:F9:11:1D:71:85:35:F8:29:5D:27:D6:19:43:90"}}},"request":{"raw":"GET /h5/static/js/pages-index-index~pages-transaction-index.ab68c10e.js HTTP/1.1\r\nHost: coinbaseow.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://coinbaseow.com/h5/\r\nCookie: angela_session=eyJpdiI6Ik41Zk9jTkxrNjI4NndXNXFSMjN5aWc9PSIsInZhbHVlIjoiaDhmYVljVDVCQTJFeVZnYzNkWndpbEYyNm1wR1RoMm1sWWxTTzRQb1B6eWREd2ZyZjBcL1RKa2lmVldKdUxCK3JPZ1d0NXcyVVM3WVQrZTFuSlpMNFhWYzZ1RVhvTTZCYlV1cXZHd3ZBSGdhaEVxN0J4OWxMVXlcL21XbHFPZnkwYyIsIm1hYyI6IjAwNGU0NDVkZGRiMDQwN2MyOTNlYjJkNTRmMDNmYzQ0YzFkYzFjNDFhY2Y5Yzg0MWQzY2JjNjAzZjUxZjMyZDYifQ%3D%3D; SITE_TOTAL_ID=3c6c7b94394b9ebde77373f18a7ee7b7\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Fri, 17 Oct 2025 02:20:40 GMT\r\ncontent-type: application/javascript\r\nlast-modified: Thu, 11 Sep 2025 06:31:12 GMT\r\nvary: Accept-Encoding\r\netag: W/\"68c26cb0-f7eb\"\r\nexpires: Fri, 17 Oct 2025 14:20:40 GMT\r\ncache-control: max-age=43200\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: quic=\":443\"; h3=\":443\"; h3-29=\":443\"; h3-27=\":443\";h3-25=\":443\"; h3-T050=\":443\"; h3-Q050=\":443\";h3-Q049=\":443\";h3-Q048=\":443\"; h3-Q046=\":443\"; h3-Q043=\":443\"\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":63467,"size_decoded":0,"mime_type":"application/javascript","magic":"JavaScript source, Unicode text, UTF-8 text, with very long lines (63289), with no line terminators","md5":"801131277d46f3f5075723633217fc9d","sha1":"12a339498fa8e6c0f31d695881f3ee5e6bdb2e23","sha256":"de7b1e5eee5c7ca514a7161cea7e88e587ec6b163c75acc7a8431da3637fb90b","sha512":"309edd3c4ca714f4446cb6b15eb0d40e136ac865d53ce4e6786f08e622d5388894d3f2b4c5ecf81d99849e9830d8c4698f0abd7058778ba3cbaacf18278176b6","ssdeep":"384:w+xQiE2j8FT+TwVccWi1jQfaIHE+W/34Mb3:Rxh8ogQf2r3","tlshash":"cb530aa2f7ec2006c567f743a16332f89a3bad7303016852da5d7f744e166ce2d865ac","first_seen":"2025-09-15T12:55:02.775076Z","last_seen":"2025-10-17T02:21:05.141151Z","times_seen":6,"resource_available":true,"data":null}},"time_used":354,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":354,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2025-10-17","alert":"Sinkholed","trigger":"coinbaseow.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2025-10-17","alert":"Sinkholed","trigger":"coinbaseow.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-10-17","alert":"Sinkholed","trigger":"coinbaseow.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"coinbaseow.com/h5/static/js/pages-index-index.499a4f2e.js","fqdn":"coinbaseow.com","domain":"coinbaseow.com","tld":"com"},"ip":{"addr":"202.79.173.8","port":443,"asn":152194,"as":"CTG Server Limited","country":"Singapore","country_code":"SG"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://coinbaseow.com/h5/","date":"2025-10-17T02:20:40.225Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"www.coinbaseoq.shop","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Thu, 09 Oct 2025 07:16:50 GMT","end":"Wed, 07 Jan 2026 07:16:49 GMT"},"fingerprint":{"sha1":"71:AC:C8:1A:43:33:1E:D9:F5:BE:92:DB:27:46:FC:E2:F0:DA:07:A7","sha256":"59:AC:48:87:76:46:B0:7F:ED:AA:98:8C:AD:DD:7C:40:7E:52:F9:11:1D:71:85:35:F8:29:5D:27:D6:19:43:90"}}},"request":{"raw":"GET /h5/static/js/pages-index-index.499a4f2e.js HTTP/1.1\r\nHost: coinbaseow.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://coinbaseow.com/h5/\r\nCookie: angela_session=eyJpdiI6Ik41Zk9jTkxrNjI4NndXNXFSMjN5aWc9PSIsInZhbHVlIjoiaDhmYVljVDVCQTJFeVZnYzNkWndpbEYyNm1wR1RoMm1sWWxTTzRQb1B6eWREd2ZyZjBcL1RKa2lmVldKdUxCK3JPZ1d0NXcyVVM3WVQrZTFuSlpMNFhWYzZ1RVhvTTZCYlV1cXZHd3ZBSGdhaEVxN0J4OWxMVXlcL21XbHFPZnkwYyIsIm1hYyI6IjAwNGU0NDVkZGRiMDQwN2MyOTNlYjJkNTRmMDNmYzQ0YzFkYzFjNDFhY2Y5Yzg0MWQzY2JjNjAzZjUxZjMyZDYifQ%3D%3D; SITE_TOTAL_ID=3c6c7b94394b9ebde77373f18a7ee7b7\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Fri, 17 Oct 2025 02:20:40 GMT\r\ncontent-type: application/javascript\r\nlast-modified: Thu, 11 Sep 2025 06:31:12 GMT\r\nvary: Accept-Encoding\r\netag: W/\"68c26cb0-9b999\"\r\nexpires: Fri, 17 Oct 2025 14:20:40 GMT\r\ncache-control: max-age=43200\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: quic=\":443\"; h3=\":443\"; h3-29=\":443\"; h3-27=\":443\";h3-25=\":443\"; h3-T050=\":443\"; h3-Q050=\":443\";h3-Q049=\":443\";h3-Q048=\":443\"; h3-Q046=\":443\"; h3-Q043=\":443\"\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":637337,"size_decoded":0,"mime_type":"application/javascript","magic":"JavaScript source, Unicode text, UTF-8 text, with very long lines (65274), with no line terminators","md5":"c0da19be41b4ad0e27d008b2e5ab4590","sha1":"42fbf754c630d69cbcf5dca72c3f1cfe8754a3a2","sha256":"54566864d396ab9711d037fc73509e5c530d02bd6006c41e0511fb9b49ed98f1","sha512":"2bd4427632eeacfca70fd2e3c1a966056215db02c686877d02472ed5044e99906b6b54db007deea224e2fcd889eb0a7f597ad154b0c1fee70320c72b1aa4c02a","ssdeep":"6144:4Rpj4Cva8FDVY0JlSanfrckyuGiaoPRKcGFS1t5LeZ:4vj4ChDVY0fSanjckyuRhRKhZ","tlshash":"32d4c9d6f6cd30054173c711944f72fc9a3bbd23a606a852f965ffb04e169ca361aa2c","first_seen":"2025-09-15T12:55:02.706216Z","last_seen":"2025-10-17T02:21:05.14571Z","times_seen":6,"resource_available":true,"data":null}},"time_used":353,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":353,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2025-10-17","alert":"Sinkholed","trigger":"coinbaseow.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2025-10-17","alert":"Sinkholed","trigger":"coinbaseow.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-10-17","alert":"Sinkholed","trigger":"coinbaseow.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"wss","addr":"coinbaseow.com/socket.io/?EIO=3\u0026transport=websocket","fqdn":"coinbaseow.com","domain":"coinbaseow.com","tld":"com"},"ip":{"addr":"202.79.173.8","port":443,"asn":152194,"as":"CTG Server Limited","country":"Singapore","country_code":"SG"},"is_navigation_request":false,"resource_type":"websocket","requested_by":"https://coinbaseow.com/h5/","date":"2025-10-17T02:20:40.256Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"www.coinbaseoq.shop","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Thu, 09 Oct 2025 07:16:50 GMT","end":"Wed, 07 Jan 2026 07:16:49 GMT"},"fingerprint":{"sha1":"71:AC:C8:1A:43:33:1E:D9:F5:BE:92:DB:27:46:FC:E2:F0:DA:07:A7","sha256":"59:AC:48:87:76:46:B0:7F:ED:AA:98:8C:AD:DD:7C:40:7E:52:F9:11:1D:71:85:35:F8:29:5D:27:D6:19:43:90"}}},"request":{"raw":"GET /socket.io/?EIO=3\u0026transport=websocket HTTP/1.1\r\nHost: coinbaseow.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nSec-WebSocket-Version: 13\r\nOrigin: https://coinbaseow.com\r\nSec-WebSocket-Extensions: permessage-deflate\r\nSec-WebSocket-Key: 3AeMkgQCg0jWQIih37z/Bg==\r\nDNT: 1\r\nConnection: keep-alive, Upgrade\r\nCookie: angela_session=eyJpdiI6Ik41Zk9jTkxrNjI4NndXNXFSMjN5aWc9PSIsInZhbHVlIjoiaDhmYVljVDVCQTJFeVZnYzNkWndpbEYyNm1wR1RoMm1sWWxTTzRQb1B6eWREd2ZyZjBcL1RKa2lmVldKdUxCK3JPZ1d0NXcyVVM3WVQrZTFuSlpMNFhWYzZ1RVhvTTZCYlV1cXZHd3ZBSGdhaEVxN0J4OWxMVXlcL21XbHFPZnkwYyIsIm1hYyI6IjAwNGU0NDVkZGRiMDQwN2MyOTNlYjJkNTRmMDNmYzQ0YzFkYzFjNDFhY2Y5Yzg0MWQzY2JjNjAzZjUxZjMyZDYifQ%3D%3D; SITE_TOTAL_ID=3c6c7b94394b9ebde77373f18a7ee7b7\r\nSec-Fetch-Dest: websocket\r\nSec-Fetch-Mode: websocket\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\nUpgrade: websocket\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 101 Switching Protocols\r\nServer: nginx\r\nDate: Fri, 17 Oct 2025 02:20:41 GMT\r\nContent-Length: 0\r\nConnection: upgrade\r\nUpgrade: websocket\r\nSec-WebSocket-Version: 13\r\nSec-WebSocket-Accept: mYSjUtsAMMgfX5nbDuUABRowiLo=\r\n\r\n","headers":null,"cookies":null,"status_code":"101","status_text":"Switching Protocols","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":0,"size_decoded":0,"mime_type":"text/plain","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-07-25T04:51:46.086242Z","times_seen":17521484,"resource_available":true,"data":null}},"time_used":1006,"timings":{"blocked":0,"dns":1,"connect":332,"send":0,"wait":332,"receive":0,"ssl":341},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2025-10-17","alert":"Sinkholed","trigger":"coinbaseow.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2025-10-17","alert":"Sinkholed","trigger":"coinbaseow.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-10-17","alert":"Sinkholed","trigger":"coinbaseow.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"coinbaseow.com/upload/1754713672803141.jpg","fqdn":"coinbaseow.com","domain":"coinbaseow.com","tld":"com"},"ip":{"addr":"202.79.173.8","port":443,"asn":152194,"as":"CTG Server Limited","country":"Singapore","country_code":"SG"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://coinbaseow.com/h5/","date":"2025-10-17T02:20:41.668Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"www.coinbaseoq.shop","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Thu, 09 Oct 2025 07:16:50 GMT","end":"Wed, 07 Jan 2026 07:16:49 GMT"},"fingerprint":{"sha1":"71:AC:C8:1A:43:33:1E:D9:F5:BE:92:DB:27:46:FC:E2:F0:DA:07:A7","sha256":"59:AC:48:87:76:46:B0:7F:ED:AA:98:8C:AD:DD:7C:40:7E:52:F9:11:1D:71:85:35:F8:29:5D:27:D6:19:43:90"}}},"request":{"raw":"GET /upload/1754713672803141.jpg HTTP/1.1\r\nHost: coinbaseow.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://coinbaseow.com/h5/\r\nCookie: angela_session=eyJpdiI6Ik9XZnRTS1psYWU3ZDFIQ3dcLzhuOU5BPT0iLCJ2YWx1ZSI6IjZ2WHYzRDU1bmtTRFFrVjMwdmt5eFJxcDRVYkhWMXdWdzNQMUVpMlZEd3dcL2JRaHQySGRWSTNrelROK0k1WDhBS1d3YVlZc2ViZVkwXC9cL2JNZmlET0tTNVVXUW1SdTNDQ0lpenZKVDA3UUR3WGFDaXVNVzdDckhtbGowbGpER1VnIiwibWFjIjoiNjM3ZWE4ZDgxODE2YjQ3NjczNDA2ZjFmZTVlYzkzZmZkN2QwOTVkNDhhYmY4YTU2Njg1YjA2MDQxNWYwOWE3OSJ9; SITE_TOTAL_ID=3c6c7b94394b9ebde77373f18a7ee7b7\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Fri, 17 Oct 2025 02:20:41 GMT\r\ncontent-type: image/jpeg\r\nlast-modified: Sat, 09 Aug 2025 04:27:52 GMT\r\nvary: Accept-Encoding\r\netag: W/\"6896ce48-12150\"\r\nexpires: Sun, 16 Nov 2025 02:20:41 GMT\r\ncache-control: max-age=2592000\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: quic=\":443\"; h3=\":443\"; h3-29=\":443\"; h3-27=\":443\";h3-25=\":443\"; h3-T050=\":443\"; h3-Q050=\":443\";h3-Q049=\":443\";h3-Q048=\":443\"; h3-Q046=\":443\"; h3-Q043=\":443\"\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":74064,"size_decoded":0,"mime_type":"image/jpeg","magic":"JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, comment: \"CREATOR: gd-jpeg v1.0 (using IJG JPEG v62), quality = 90\", baseline, precision 8, 720x420, components 3","md5":"3d5951e9cbf3765cd3bb32dcbbb9119c","sha1":"5beb3597d22d0278ee54ee6a2f8a86119686b09d","sha256":"6658f25ebcc448b3d3a8fccd75b34444df3fcdcc04986bb0b8cdd77c48d79e37","sha512":"9406e308d681f0213de89ae20b2f68a9a981a1efe1b8970902102733ac8ba3c7d9f83ec7d53d70afef247c37da451c23d40676b76e1aeee07cd9b4e5af782668","ssdeep":"1536:TcZWGA8cRiNdjGFWkT7Rq5OsU4pPe1liPZK1/x3zxkC1w:CWTRCGFVTlQOXIQ8I1532j","tlshash":"1773d007d911af67e91c937cbfb91cd6635ca60c94d3b18a902cbea53ec52b0cd86027","first_seen":"2025-09-15T12:55:02.75073Z","last_seen":"2025-10-17T02:21:05.151904Z","times_seen":6,"resource_available":false,"data":null}},"time_used":353,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":353,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2025-10-17","alert":"Sinkholed","trigger":"coinbaseow.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2025-10-17","alert":"Sinkholed","trigger":"coinbaseow.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-10-17","alert":"Sinkholed","trigger":"coinbaseow.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"coinbaseow.com/api/news/list","fqdn":"coinbaseow.com","domain":"coinbaseow.com","tld":"com"},"ip":{"addr":"202.79.173.8","port":443,"asn":152194,"as":"CTG Server Limited","country":"Singapore","country_code":"SG"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"https://coinbaseow.com/h5/","date":"2025-10-17T02:20:41.225Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"www.coinbaseoq.shop","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Thu, 09 Oct 2025 07:16:50 GMT","end":"Wed, 07 Jan 2026 07:16:49 GMT"},"fingerprint":{"sha1":"71:AC:C8:1A:43:33:1E:D9:F5:BE:92:DB:27:46:FC:E2:F0:DA:07:A7","sha256":"59:AC:48:87:76:46:B0:7F:ED:AA:98:8C:AD:DD:7C:40:7E:52:F9:11:1D:71:85:35:F8:29:5D:27:D6:19:43:90"}}},"request":{"raw":"POST /api/news/list HTTP/1.1\r\nHost: coinbaseow.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nAuthorization: \r\nContent-Type: application/x-www-form-urlencoded\r\nContent-Length: 14\r\nOrigin: https://coinbaseow.com\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://coinbaseow.com/h5/\r\nCookie: angela_session=eyJpdiI6IkU5NTd0Yk1pQVhSTUVheklOYU1CNmc9PSIsInZhbHVlIjoiK0RtZCszOFpTMURXV2lcL0p0QjZ4V3N4UmJuZnJDYVZpclkzWDFTZ201TFRuVmJxRVBBR0NnUGI5b0U4UTlNa3BXRHEreFU1VXF3OXNGaDFNdVwvb3RcLzRYRG1YQWlyNUk1cUs4VHE4NmMzOVFpNWdwZ2FRbnVabWJwelBHYUVtcEciLCJtYWMiOiI2Nzk2MDAzZGM5NjIwOTI0YTAxZjczMjVkOGMwNGVlM2Y2YjlkZTQyZTlmMjBjOTUzYjYzMmI4NzlmNjQ5NWI5In0%3D; SITE_TOTAL_ID=3c6c7b94394b9ebde77373f18a7ee7b7\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"POST"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ncontent-type: application/json\r\nvary: Accept-Encoding\r\naccess-control-allow-origin: *\r\naccess-control-allow-methods: POST,GET,OPTIONS,DELETE\r\naccess-control-allow-headers: x-requested-with,content-type,Authorization\r\ncache-control: no-cache, private\r\ndate: Fri, 17 Oct 2025 02:20:41 GMT\r\nset-cookie: angela_session=eyJpdiI6IkF3R1wvMENQUFwvM05iRWdkUVwvVzN0b1E9PSIsInZhbHVlIjoiT1hvREsySUc4Q3RYZDZVaDF5QTlNVEQrcWh1M3NFb2VZcjVFbnN1QU03NnZBVjRaSEVEVmZJVnpcL2NVZHdHWEgzNDlwSm53M0VmRVNoOEg5RUZ0azdjN2tTcGdFRFlQa29zMndFSUE0NkY0OWIxVnJMSFgrWW9SV2xCTnpXM1hMIiwibWFjIjoiYWJmMDVmODE4MDYyNmMxYmY1NzQ0Nzc3OTAyOTExZjFmNTRhZjYzOWI1NTgzMDIxOWIzNDMzNTBiMjg5Yjk1MSJ9; expires=Fri, 17-Oct-2025 04:20:41 GMT; Max-Age=7200; path=/; httponly\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: quic=\":443\"; h3=\":443\"; h3-29=\":443\"; h3-27=\":443\";h3-25=\":443\"; h3-T050=\":443\"; h3-Q050=\":443\";h3-Q049=\":443\";h3-Q048=\":443\"; h3-Q046=\":443\"; h3-Q043=\":443\"\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":431,"size_decoded":0,"mime_type":"application/json","magic":"JSON text data","md5":"2e17092a1918d60c00ecbaa539fce634","sha1":"2b5a2dc0742a347eb431efbb3ba86aee85b66c24","sha256":"6dc0b8ec5d49f2a4594adcb95c7281376a7bb77ef1b18fc6b9212ecb52f77966","sha512":"8b94fe38838786b680e8fee7eb0accce9db3a643cc8c1c182d3e0a4219fb4352bee75b802f87e39a5a2366314d3f44b09b88326730779a4ef17cb2f63891d470","ssdeep":"","tlshash":"f2e02bae9d9089fbe25853c2a507f08557ce61c28b5507491bc08cd8cabc6968423483","first_seen":"2025-09-15T12:55:02.729496Z","last_seen":"2025-10-17T02:21:05.104076Z","times_seen":6,"resource_available":false,"data":null}},"time_used":369,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":369,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2025-10-17","alert":"Sinkholed","trigger":"coinbaseow.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2025-10-17","alert":"Sinkholed","trigger":"coinbaseow.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-10-17","alert":"Sinkholed","trigger":"coinbaseow.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"coinbaseow.com/api/menu?lang=zh","fqdn":"coinbaseow.com","domain":"coinbaseow.com","tld":"com"},"ip":{"addr":"202.79.173.8","port":443,"asn":152194,"as":"CTG Server Limited","country":"Singapore","country_code":"SG"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"https://coinbaseow.com/h5/","date":"2025-10-17T02:20:41.242Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"www.coinbaseoq.shop","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Thu, 09 Oct 2025 07:16:50 GMT","end":"Wed, 07 Jan 2026 07:16:49 GMT"},"fingerprint":{"sha1":"71:AC:C8:1A:43:33:1E:D9:F5:BE:92:DB:27:46:FC:E2:F0:DA:07:A7","sha256":"59:AC:48:87:76:46:B0:7F:ED:AA:98:8C:AD:DD:7C:40:7E:52:F9:11:1D:71:85:35:F8:29:5D:27:D6:19:43:90"}}},"request":{"raw":"GET /api/menu?lang=zh HTTP/1.1\r\nHost: coinbaseow.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nAuthorization: \r\nContent-Type: application/x-www-form-urlencoded\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://coinbaseow.com/h5/\r\nCookie: angela_session=eyJpdiI6IkU5NTd0Yk1pQVhSTUVheklOYU1CNmc9PSIsInZhbHVlIjoiK0RtZCszOFpTMURXV2lcL0p0QjZ4V3N4UmJuZnJDYVZpclkzWDFTZ201TFRuVmJxRVBBR0NnUGI5b0U4UTlNa3BXRHEreFU1VXF3OXNGaDFNdVwvb3RcLzRYRG1YQWlyNUk1cUs4VHE4NmMzOVFpNWdwZ2FRbnVabWJwelBHYUVtcEciLCJtYWMiOiI2Nzk2MDAzZGM5NjIwOTI0YTAxZjczMjVkOGMwNGVlM2Y2YjlkZTQyZTlmMjBjOTUzYjYzMmI4NzlmNjQ5NWI5In0%3D; SITE_TOTAL_ID=3c6c7b94394b9ebde77373f18a7ee7b7\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ncontent-type: application/json\r\nvary: Accept-Encoding\r\naccess-control-allow-origin: *\r\naccess-control-allow-methods: POST,GET,OPTIONS,DELETE\r\naccess-control-allow-headers: x-requested-with,content-type,Authorization\r\ncache-control: no-cache, private\r\ndate: Fri, 17 Oct 2025 02:20:41 GMT\r\nset-cookie: angela_session=eyJpdiI6IkZJY21sQStoWGdcL0krSDBucTJ4QnR3PT0iLCJ2YWx1ZSI6InlBZWJUN0hsMGYreTZpM2U0cmlFcGxOK0RRRkUwR2VCNU9LMytYYVdsSThRK1o5c2Vzd1VVM3pMVHdJWDNrNVpXTmlwMHVcL1oyM3B3cXo4RnU0bHA3Rlp2VUNQZ2FXREJcL0VUNVk2WU5rTFE4YmZFR203YTFFa1RwYkU5a29XRjUiLCJtYWMiOiJhYjYxZjQ3NmNiMjM2MWEwYjg1YTliMWUxMTI4ZjdlMWJmNTQxYTcyNWQzYzhiMzJhYWY0NjQyOGYzMmY5NjMxIn0%3D; expires=Fri, 17-Oct-2025 04:20:41 GMT; Max-Age=7200; path=/; httponly\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: quic=\":443\"; h3=\":443\"; h3-29=\":443\"; h3-27=\":443\";h3-25=\":443\"; h3-T050=\":443\"; h3-Q050=\":443\";h3-Q049=\":443\";h3-Q048=\":443\"; h3-Q046=\":443\"; h3-Q043=\":443\"\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":977,"size_decoded":0,"mime_type":"application/json","magic":"JSON text data","md5":"bb4931335eec1d0bbf0b3bb385f32135","sha1":"03646878162d2e6cdf5e01ce8e57fb8634480d69","sha256":"97ee93adc5ecc5c800d65ed811ad4ccde0ac6019bddaee4c9fefda2dc635b536","sha512":"e86c278e2a9c367a4cebfcbdb49c21df43daeb4bdafba45f13b0afd6eabd80eeddb7a9a95535ab72033892903dd1f9cfa5e8a3f395a86b9d7233b6b34e965d5e","ssdeep":"","tlshash":"cf1129ec5eb83c2dc2fb32f468e3155e249a0546dde4b9a61befad9c02e81804297481","first_seen":"2025-10-17T02:21:05.155573Z","last_seen":"2025-10-17T02:21:05.155573Z","times_seen":1,"resource_available":false,"data":null}},"time_used":366,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":366,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2025-10-17","alert":"Sinkholed","trigger":"coinbaseow.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2025-10-17","alert":"Sinkholed","trigger":"coinbaseow.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-10-17","alert":"Sinkholed","trigger":"coinbaseow.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"cdn.dcloud.net.cn/img/shadow-grey.png","fqdn":"cdn.dcloud.net.cn","domain":"dcloud.net.cn","tld":"net.cn"},"ip":{"addr":"124.220.203.60","port":443,"asn":45090,"as":"Shenzhen Tencent Computer Systems Company Limited","country":"China","country_code":"CN"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://coinbaseow.com/h5/","date":"2025-10-17T02:20:41.863Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.dcloud.net.cn","organization":""},"issuer":{"commonName":"Certum Domain Validation CA SHA2","organization":"Unizeto Technologies S.A."},"validity":{"start":"Tue, 26 Aug 2025 11:47:17 GMT","end":"Fri, 25 Sep 2026 11:47:16 GMT"},"fingerprint":{"sha1":"47:A7:6C:09:6B:1D:CA:2D:7D:39:2E:C1:7F:15:DE:5D:F2:C4:0F:77","sha256":"EA:73:37:83:D0:38:44:D9:3C:0B:26:F0:DD:D1:22:2F:36:F7:F2:86:A1:B0:58:52:DE:4E:0A:21:D6:89:E7:3E"}}},"request":{"raw":"GET /img/shadow-grey.png HTTP/1.1\r\nHost: cdn.dcloud.net.cn\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://coinbaseow.com/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Fri, 17 Oct 2025 02:20:42 GMT\r\ncontent-type: image/png\r\ncontent-length: 136\r\nlast-modified: Thu, 06 Jun 2019 06:42:07 GMT\r\netag: \"5cf8b5bf-88\"\r\nexpires: Fri, 17 Oct 2025 15:20:42 GMT\r\ncache-control: max-age=46800\r\nset-cookie: __uni__uid=rBEQiWjxp/pXXuNhA1iwAg==; expires=Thu, 31-Dec-37 23:55:55 GMT; domain=dcloud.net.cn; path=/; secure; httponly; samesite=none\r\naccept-ranges: bytes\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":136,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 1 x 6, 4-bit colormap, non-interlaced","md5":"5a962adf74d92ae702467b3f47976547","sha1":"36f74049375584e3fa69b5ef87e9572336ff9e7a","sha256":"ad4ebea1c3496dd2924789ee009174a2c6289d1200e9811f458fd46f172d1d6f","sha512":"4ace23fe7ec6c7271710030fd423aace13eafac68ac3e76366ce4ce9bdc702caf71c9bdc2fb6a32c8e9791546098617cc0259decd8bb8489afdbce43e1b53a73","ssdeep":"","tlshash":"47c09bf3a615dc754a0d153b42e98271f429511e07046d0e5a13c216741e3448d56793","first_seen":"2023-04-15T10:50:30Z","last_seen":"2026-07-25T04:13:55.593637Z","times_seen":17464,"resource_available":false,"data":null}},"time_used":1947,"timings":{"blocked":845,"dns":278,"connect":256,"send":0,"wait":256,"receive":0,"ssl":308},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"coinbaseow.com/","fqdn":"coinbaseow.com","domain":"coinbaseow.com","tld":"com"},"ip":{"addr":"202.79.173.8","port":443,"asn":152194,"as":"CTG Server Limited","country":"Singapore","country_code":"SG"},"is_navigation_request":true,"resource_type":"document","requested_by":"","date":"2025-10-17T02:20:36.172Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"www.coinbaseoq.shop","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Thu, 09 Oct 2025 07:16:50 GMT","end":"Wed, 07 Jan 2026 07:16:49 GMT"},"fingerprint":{"sha1":"71:AC:C8:1A:43:33:1E:D9:F5:BE:92:DB:27:46:FC:E2:F0:DA:07:A7","sha256":"59:AC:48:87:76:46:B0:7F:ED:AA:98:8C:AD:DD:7C:40:7E:52:F9:11:1D:71:85:35:F8:29:5D:27:D6:19:43:90"}}},"request":{"raw":"GET / HTTP/1.1\r\nHost: coinbaseow.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nUpgrade-Insecure-Requests: 1\r\nSec-Fetch-Dest: document\r\nSec-Fetch-Mode: navigate\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 302 Found\r\nserver: nginx\r\ncontent-type: text/html; charset=UTF-8\r\nlocation: https://coinbaseow.com/h5\r\naccess-control-allow-origin: *\r\naccess-control-allow-methods: GET, POST, PUT, DELETE, OPTIONS\r\naccess-control-allow-headers: Content-Type, Authorization, X-Requested-With\r\ncache-control: no-cache, private\r\ndate: Fri, 17 Oct 2025 02:20:37 GMT\r\nset-cookie: angela_session=eyJpdiI6Ik41Zk9jTkxrNjI4NndXNXFSMjN5aWc9PSIsInZhbHVlIjoiaDhmYVljVDVCQTJFeVZnYzNkWndpbEYyNm1wR1RoMm1sWWxTTzRQb1B6eWREd2ZyZjBcL1RKa2lmVldKdUxCK3JPZ1d0NXcyVVM3WVQrZTFuSlpMNFhWYzZ1RVhvTTZCYlV1cXZHd3ZBSGdhaEVxN0J4OWxMVXlcL21XbHFPZnkwYyIsIm1hYyI6IjAwNGU0NDVkZGRiMDQwN2MyOTNlYjJkNTRmMDNmYzQ0YzFkYzFjNDFhY2Y5Yzg0MWQzY2JjNjAzZjUxZjMyZDYifQ%3D%3D; expires=Fri, 17-Oct-2025 04:20:37 GMT; Max-Age=7200; path=/; httponly\nSITE_TOTAL_ID=3c6c7b94394b9ebde77373f18a7ee7b7; Path=/; Max-Age=259200000; HttpOnly\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: quic=\":443\"; h3=\":443\"; h3-29=\":443\"; h3-27=\":443\";h3-25=\":443\"; h3-T050=\":443\"; h3-Q050=\":443\";h3-Q049=\":443\";h3-Q048=\":443\"; h3-Q046=\":443\"; h3-Q043=\":443\"\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"302","status_text":"Found","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":1001,"size_decoded":0,"mime_type":"text/html","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-07-25T04:51:46.086242Z","times_seen":17521484,"resource_available":true,"data":null}},"time_used":1775,"timings":{"blocked":705,"dns":1,"connect":347,"send":0,"wait":365,"receive":0,"ssl":353},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2025-10-17","alert":"Sinkholed","trigger":"coinbaseow.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2025-10-17","alert":"Sinkholed","trigger":"coinbaseow.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-10-17","alert":"Sinkholed","trigger":"coinbaseow.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"coinbaseow.com/h5/static/image/nav/nav-5.png","fqdn":"coinbaseow.com","domain":"coinbaseow.com","tld":"com"},"ip":{"addr":"202.79.173.8","port":443,"asn":152194,"as":"CTG Server Limited","country":"Singapore","country_code":"SG"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://coinbaseow.com/h5/","date":"2025-10-17T02:20:40.240Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"www.coinbaseoq.shop","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Thu, 09 Oct 2025 07:16:50 GMT","end":"Wed, 07 Jan 2026 07:16:49 GMT"},"fingerprint":{"sha1":"71:AC:C8:1A:43:33:1E:D9:F5:BE:92:DB:27:46:FC:E2:F0:DA:07:A7","sha256":"59:AC:48:87:76:46:B0:7F:ED:AA:98:8C:AD:DD:7C:40:7E:52:F9:11:1D:71:85:35:F8:29:5D:27:D6:19:43:90"}}},"request":{"raw":"GET /h5/static/image/nav/nav-5.png HTTP/1.1\r\nHost: coinbaseow.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://coinbaseow.com/h5/\r\nCookie: angela_session=eyJpdiI6Ik41Zk9jTkxrNjI4NndXNXFSMjN5aWc9PSIsInZhbHVlIjoiaDhmYVljVDVCQTJFeVZnYzNkWndpbEYyNm1wR1RoMm1sWWxTTzRQb1B6eWREd2ZyZjBcL1RKa2lmVldKdUxCK3JPZ1d0NXcyVVM3WVQrZTFuSlpMNFhWYzZ1RVhvTTZCYlV1cXZHd3ZBSGdhaEVxN0J4OWxMVXlcL21XbHFPZnkwYyIsIm1hYyI6IjAwNGU0NDVkZGRiMDQwN2MyOTNlYjJkNTRmMDNmYzQ0YzFkYzFjNDFhY2Y5Yzg0MWQzY2JjNjAzZjUxZjMyZDYifQ%3D%3D; SITE_TOTAL_ID=3c6c7b94394b9ebde77373f18a7ee7b7\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Fri, 17 Oct 2025 02:20:40 GMT\r\ncontent-type: image/png\r\ncontent-length: 762\r\nlast-modified: Thu, 11 Sep 2025 06:31:12 GMT\r\netag: \"68c26cb0-2fa\"\r\nexpires: Sun, 16 Nov 2025 02:20:40 GMT\r\ncache-control: max-age=2592000\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: quic=\":443\"; h3=\":443\"; h3-29=\":443\"; h3-27=\":443\";h3-25=\":443\"; h3-T050=\":443\"; h3-Q050=\":443\";h3-Q049=\":443\";h3-Q048=\":443\"; h3-Q046=\":443\"; h3-Q043=\":443\"\r\naccept-ranges: bytes\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":762,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 42 x 42, 8-bit/color RGBA, non-interlaced","md5":"214aee318b1921c9d0a518e7236f6798","sha1":"80344471faf6fbd958fa82f20128e004b71845f3","sha256":"f4d884cc4ffdaeed56d30b53ce28453c401a187591cc6ed20700b98e5e9fcbd9","sha512":"f8316fa75057752ff636710dd30eca9b9c360bcfa1a28e1fd0659b4da48d530f13e81afb14f28a38f941f0aaca142b04afdbad0052a7621835c7904c3a10af5a","ssdeep":"","tlshash":"6601b54d4520e4699a3612a3b87ac2f10c1eb01462b79dde8532e31f3432704f0842c3","first_seen":"2023-05-20T12:09:29Z","last_seen":"2026-07-23T15:53:23.503147Z","times_seen":249,"resource_available":false,"data":null}},"time_used":679,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":679,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2025-10-17","alert":"Sinkholed","trigger":"coinbaseow.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2025-10-17","alert":"Sinkholed","trigger":"coinbaseow.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-10-17","alert":"Sinkholed","trigger":"coinbaseow.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"www.coinbaseok.com/US.json","fqdn":"www.coinbaseok.com","domain":"coinbaseok.com","tld":"com"},"ip":{"addr":"0.0.0.0","port":0,"asn":0,"as":"","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"https://coinbaseow.com/h5/","date":"2025-10-17T02:20:40.263Z","timestamp":0,"http_version":"","security_state":"broken","security_info":null,"request":{"raw":"GET /US.json HTTP/1.1\r\nHost: www.coinbaseok.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nOrigin: https://coinbaseow.com\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://coinbaseow.com/\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"","headers":null,"cookies":null,"status_code":"","status_text":"","fingerprints":null,"data":{"size":0,"size_decoded":0,"mime_type":"","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-07-25T04:51:46.086242Z","times_seen":17521484,"resource_available":true,"data":null}},"time_used":722,"timings":{"blocked":0,"dns":49,"connect":331,"send":0,"wait":0,"receive":0,"ssl":339},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2025-10-17","alert":"Sinkholed","trigger":"www.coinbaseok.com","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2025-10-17","alert":"Sinkholed","trigger":"www.coinbaseok.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-10-17","alert":"Sinkholed","trigger":"www.coinbaseok.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2025-10-17","alert":"Sinkholed","trigger":"www.coinbaseok.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"coinbaseow.com/api/menu?lang=zh","fqdn":"coinbaseow.com","domain":"coinbaseow.com","tld":"com"},"ip":{"addr":"202.79.173.8","port":443,"asn":152194,"as":"CTG Server Limited","country":"Singapore","country_code":"SG"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"https://coinbaseow.com/h5/","date":"2025-10-17T02:20:41.240Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"www.coinbaseoq.shop","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Thu, 09 Oct 2025 07:16:50 GMT","end":"Wed, 07 Jan 2026 07:16:49 GMT"},"fingerprint":{"sha1":"71:AC:C8:1A:43:33:1E:D9:F5:BE:92:DB:27:46:FC:E2:F0:DA:07:A7","sha256":"59:AC:48:87:76:46:B0:7F:ED:AA:98:8C:AD:DD:7C:40:7E:52:F9:11:1D:71:85:35:F8:29:5D:27:D6:19:43:90"}}},"request":{"raw":"GET /api/menu?lang=zh HTTP/1.1\r\nHost: coinbaseow.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nAuthorization: \r\nContent-Type: application/x-www-form-urlencoded\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://coinbaseow.com/h5/\r\nCookie: angela_session=eyJpdiI6IkU5NTd0Yk1pQVhSTUVheklOYU1CNmc9PSIsInZhbHVlIjoiK0RtZCszOFpTMURXV2lcL0p0QjZ4V3N4UmJuZnJDYVZpclkzWDFTZ201TFRuVmJxRVBBR0NnUGI5b0U4UTlNa3BXRHEreFU1VXF3OXNGaDFNdVwvb3RcLzRYRG1YQWlyNUk1cUs4VHE4NmMzOVFpNWdwZ2FRbnVabWJwelBHYUVtcEciLCJtYWMiOiI2Nzk2MDAzZGM5NjIwOTI0YTAxZjczMjVkOGMwNGVlM2Y2YjlkZTQyZTlmMjBjOTUzYjYzMmI4NzlmNjQ5NWI5In0%3D; SITE_TOTAL_ID=3c6c7b94394b9ebde77373f18a7ee7b7\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ncontent-type: application/json\r\nvary: Accept-Encoding\r\naccess-control-allow-origin: *\r\naccess-control-allow-methods: POST,GET,OPTIONS,DELETE\r\naccess-control-allow-headers: x-requested-with,content-type,Authorization\r\ncache-control: no-cache, private\r\ndate: Fri, 17 Oct 2025 02:20:41 GMT\r\nset-cookie: angela_session=eyJpdiI6IkxmY3IxU1R4UFZvZ2hIS2EyNTlRNXc9PSIsInZhbHVlIjoiTEFjUnlHT1VvMlV6b0RQbnpQbnluQnZzalVNanE4eG41RmF6U1dwZHBWRURKS29nNEJ5RHBybEo0Q3Q2OEE1bUwrcTFhVnJFNzlZSWFuc1hiNjU0M3oxSHZEa2NuOVRpbndmaWZobUs0dVwvTjd2eVRcLzE3dnVkdG8yMmI3ZlhZcSIsIm1hYyI6IjRlZDk2OGZmMzVlMmI5MTQxZThmZjJhOGI1MWNhNzZiMjJjMWY2MTRkNWQ1MGJhMjYwZWI4ZjIzMDRmYmFjZjIifQ%3D%3D; expires=Fri, 17-Oct-2025 04:20:41 GMT; Max-Age=7200; path=/; httponly\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: quic=\":443\"; h3=\":443\"; h3-29=\":443\"; h3-27=\":443\";h3-25=\":443\"; h3-T050=\":443\"; h3-Q050=\":443\";h3-Q049=\":443\";h3-Q048=\":443\"; h3-Q046=\":443\"; h3-Q043=\":443\"\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":977,"size_decoded":0,"mime_type":"application/json","magic":"JSON text data","md5":"bb4931335eec1d0bbf0b3bb385f32135","sha1":"03646878162d2e6cdf5e01ce8e57fb8634480d69","sha256":"97ee93adc5ecc5c800d65ed811ad4ccde0ac6019bddaee4c9fefda2dc635b536","sha512":"e86c278e2a9c367a4cebfcbdb49c21df43daeb4bdafba45f13b0afd6eabd80eeddb7a9a95535ab72033892903dd1f9cfa5e8a3f395a86b9d7233b6b34e965d5e","ssdeep":"","tlshash":"cf1129ec5eb83c2dc2fb32f468e3155e249a0546dde4b9a61befad9c02e81804297481","first_seen":"2025-10-17T02:21:05.155573Z","last_seen":"2025-10-17T02:21:05.155573Z","times_seen":1,"resource_available":false,"data":null}},"time_used":366,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":366,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2025-10-17","alert":"Sinkholed","trigger":"coinbaseow.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2025-10-17","alert":"Sinkholed","trigger":"coinbaseow.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-10-17","alert":"Sinkholed","trigger":"coinbaseow.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"coinbaseow.com/h5/static/iconfont/iconfont.woff2","fqdn":"coinbaseow.com","domain":"coinbaseow.com","tld":"com"},"ip":{"addr":"202.79.173.8","port":443,"asn":152194,"as":"CTG Server Limited","country":"Singapore","country_code":"SG"},"is_navigation_request":false,"resource_type":"font","requested_by":"https://coinbaseow.com/h5/","date":"2025-10-17T02:20:41.310Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"www.coinbaseoq.shop","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Thu, 09 Oct 2025 07:16:50 GMT","end":"Wed, 07 Jan 2026 07:16:49 GMT"},"fingerprint":{"sha1":"71:AC:C8:1A:43:33:1E:D9:F5:BE:92:DB:27:46:FC:E2:F0:DA:07:A7","sha256":"59:AC:48:87:76:46:B0:7F:ED:AA:98:8C:AD:DD:7C:40:7E:52:F9:11:1D:71:85:35:F8:29:5D:27:D6:19:43:90"}}},"request":{"raw":"GET /h5/static/iconfont/iconfont.woff2 HTTP/1.1\r\nHost: coinbaseow.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: identity\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://coinbaseow.com/h5/\r\nCookie: angela_session=eyJpdiI6IkU5NTd0Yk1pQVhSTUVheklOYU1CNmc9PSIsInZhbHVlIjoiK0RtZCszOFpTMURXV2lcL0p0QjZ4V3N4UmJuZnJDYVZpclkzWDFTZ201TFRuVmJxRVBBR0NnUGI5b0U4UTlNa3BXRHEreFU1VXF3OXNGaDFNdVwvb3RcLzRYRG1YQWlyNUk1cUs4VHE4NmMzOVFpNWdwZ2FRbnVabWJwelBHYUVtcEciLCJtYWMiOiI2Nzk2MDAzZGM5NjIwOTI0YTAxZjczMjVkOGMwNGVlM2Y2YjlkZTQyZTlmMjBjOTUzYjYzMmI4NzlmNjQ5NWI5In0%3D; SITE_TOTAL_ID=3c6c7b94394b9ebde77373f18a7ee7b7\r\nSec-Fetch-Dest: font\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Fri, 17 Oct 2025 02:20:41 GMT\r\ncontent-type: font/woff2\r\ncontent-length: 32744\r\nlast-modified: Thu, 11 Sep 2025 06:31:12 GMT\r\netag: \"68c26cb0-7fe8\"\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: quic=\":443\"; h3=\":443\"; h3-29=\":443\"; h3-27=\":443\";h3-25=\":443\"; h3-T050=\":443\"; h3-Q050=\":443\";h3-Q049=\":443\";h3-Q048=\":443\"; h3-Q046=\":443\"; h3-Q043=\":443\"\r\naccept-ranges: bytes\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":32744,"size_decoded":0,"mime_type":"font/woff2","magic":"Web Open Font Format (Version 2), TrueType, length 32744, version 1.0","md5":"5b8f35b173333c5161098c675e902401","sha1":"c33837d28eff55458d49ef00e68ae9a04da46f05","sha256":"912327f77b1b2d3092e0cda25efdd0c5045ef17d018864d1cefba33db7727fce","sha512":"38a8b9a82c69376f1664e4e76f31605a6ad31e611e2f282c46a40044624072a48ed8f9fd49735136afbd21ba61cc9ac9795828e6fcb33ad4b662bd41cf6b4084","ssdeep":"768:9P1NcXcebJOUlU8WQKAfiDvCcj+IWL3OJ:9dNcXceNOUSD3AfmCcfJ","tlshash":"cee2f1303175ab40c3e6ef396e7b1c46d8724a3892785ee1e3d16e4d142bccd19d5a2b","first_seen":"2023-05-20T12:09:29Z","last_seen":"2026-07-23T15:53:23.484958Z","times_seen":426,"resource_available":false,"data":null}},"time_used":359,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":358,"receive":1,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2025-10-17","alert":"Sinkholed","trigger":"coinbaseow.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2025-10-17","alert":"Sinkholed","trigger":"coinbaseow.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-10-17","alert":"Sinkholed","trigger":"coinbaseow.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"coinbaseow.com/h5/","fqdn":"coinbaseow.com","domain":"coinbaseow.com","tld":"com"},"ip":{"addr":"202.79.173.8","port":443,"asn":152194,"as":"CTG Server Limited","country":"Singapore","country_code":"SG"},"is_navigation_request":true,"resource_type":"document","requested_by":"","date":"2025-10-17T02:20:37.599Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"www.coinbaseoq.shop","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Thu, 09 Oct 2025 07:16:50 GMT","end":"Wed, 07 Jan 2026 07:16:49 GMT"},"fingerprint":{"sha1":"71:AC:C8:1A:43:33:1E:D9:F5:BE:92:DB:27:46:FC:E2:F0:DA:07:A7","sha256":"59:AC:48:87:76:46:B0:7F:ED:AA:98:8C:AD:DD:7C:40:7E:52:F9:11:1D:71:85:35:F8:29:5D:27:D6:19:43:90"}}},"request":{"raw":"GET /h5/ HTTP/1.1\r\nHost: coinbaseow.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nCookie: angela_session=eyJpdiI6Ik41Zk9jTkxrNjI4NndXNXFSMjN5aWc9PSIsInZhbHVlIjoiaDhmYVljVDVCQTJFeVZnYzNkWndpbEYyNm1wR1RoMm1sWWxTTzRQb1B6eWREd2ZyZjBcL1RKa2lmVldKdUxCK3JPZ1d0NXcyVVM3WVQrZTFuSlpMNFhWYzZ1RVhvTTZCYlV1cXZHd3ZBSGdhaEVxN0J4OWxMVXlcL21XbHFPZnkwYyIsIm1hYyI6IjAwNGU0NDVkZGRiMDQwN2MyOTNlYjJkNTRmMDNmYzQ0YzFkYzFjNDFhY2Y5Yzg0MWQzY2JjNjAzZjUxZjMyZDYifQ%3D%3D; SITE_TOTAL_ID=3c6c7b94394b9ebde77373f18a7ee7b7\r\nUpgrade-Insecure-Requests: 1\r\nSec-Fetch-Dest: document\r\nSec-Fetch-Mode: navigate\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Fri, 17 Oct 2025 02:20:37 GMT\r\ncontent-type: text/html\r\ncontent-length: 1001\r\nlast-modified: Thu, 11 Sep 2025 06:31:12 GMT\r\netag: \"68c26cb0-3e9\"\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: quic=\":443\"; h3=\":443\"; h3-29=\":443\"; h3-27=\":443\";h3-25=\":443\"; h3-T050=\":443\"; h3-Q050=\":443\";h3-Q049=\":443\";h3-Q048=\":443\"; h3-Q046=\":443\"; h3-Q043=\":443\"\r\naccept-ranges: bytes\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":1001,"size_decoded":0,"mime_type":"text/html","magic":"HTML document, Unicode text, UTF-8 text, with very long lines (447), with CRLF line terminators","md5":"12210d7f7546d89c871a769099676b37","sha1":"7044e95f8b52000112b949728b5d8276ff16cbb7","sha256":"a237a765fdcd6e70bd83b2080679badfb9c3122d60aef08e61405b48a6334e2e","sha512":"ec52a9868cc9ca77eec7a20c305868aa73bddb33867b6053921fb5cb144b470f586eb546e90b2824df3968cdbcdb154008b4ffbefc164a3794979d81721e9a99","ssdeep":"","tlshash":"f01110d62d00d6582721a66979b9f21cc8af86a62c61e802b8cc1d9d5fe0fc84f39c58","first_seen":"2025-09-15T12:55:02.74043Z","last_seen":"2025-10-17T02:21:05.167429Z","times_seen":6,"resource_available":false,"data":null}},"time_used":347,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":347,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2025-10-17","alert":"Sinkholed","trigger":"coinbaseow.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2025-10-17","alert":"Sinkholed","trigger":"coinbaseow.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-10-17","alert":"Sinkholed","trigger":"coinbaseow.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"coinbaseow.com/h5/static/image/nav/nav-2.png","fqdn":"coinbaseow.com","domain":"coinbaseow.com","tld":"com"},"ip":{"addr":"202.79.173.8","port":443,"asn":152194,"as":"CTG Server Limited","country":"Singapore","country_code":"SG"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://coinbaseow.com/h5/","date":"2025-10-17T02:20:40.234Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"www.coinbaseoq.shop","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Thu, 09 Oct 2025 07:16:50 GMT","end":"Wed, 07 Jan 2026 07:16:49 GMT"},"fingerprint":{"sha1":"71:AC:C8:1A:43:33:1E:D9:F5:BE:92:DB:27:46:FC:E2:F0:DA:07:A7","sha256":"59:AC:48:87:76:46:B0:7F:ED:AA:98:8C:AD:DD:7C:40:7E:52:F9:11:1D:71:85:35:F8:29:5D:27:D6:19:43:90"}}},"request":{"raw":"GET /h5/static/image/nav/nav-2.png HTTP/1.1\r\nHost: coinbaseow.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://coinbaseow.com/h5/\r\nCookie: angela_session=eyJpdiI6Ik41Zk9jTkxrNjI4NndXNXFSMjN5aWc9PSIsInZhbHVlIjoiaDhmYVljVDVCQTJFeVZnYzNkWndpbEYyNm1wR1RoMm1sWWxTTzRQb1B6eWREd2ZyZjBcL1RKa2lmVldKdUxCK3JPZ1d0NXcyVVM3WVQrZTFuSlpMNFhWYzZ1RVhvTTZCYlV1cXZHd3ZBSGdhaEVxN0J4OWxMVXlcL21XbHFPZnkwYyIsIm1hYyI6IjAwNGU0NDVkZGRiMDQwN2MyOTNlYjJkNTRmMDNmYzQ0YzFkYzFjNDFhY2Y5Yzg0MWQzY2JjNjAzZjUxZjMyZDYifQ%3D%3D; SITE_TOTAL_ID=3c6c7b94394b9ebde77373f18a7ee7b7\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Fri, 17 Oct 2025 02:20:40 GMT\r\ncontent-type: image/png\r\ncontent-length: 355\r\nlast-modified: Thu, 11 Sep 2025 06:31:12 GMT\r\netag: \"68c26cb0-163\"\r\nexpires: Sun, 16 Nov 2025 02:20:40 GMT\r\ncache-control: max-age=2592000\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: quic=\":443\"; h3=\":443\"; h3-29=\":443\"; h3-27=\":443\";h3-25=\":443\"; h3-T050=\":443\"; h3-Q050=\":443\";h3-Q049=\":443\";h3-Q048=\":443\"; h3-Q046=\":443\"; h3-Q043=\":443\"\r\naccept-ranges: bytes\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":355,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 40 x 36, 8-bit/color RGBA, non-interlaced","md5":"bba6863c9929a3858b0fb3c77201ae8d","sha1":"f6d7dfa984b3ccf6d38d9d9051c0462578bfe9fc","sha256":"7519ccca854d4151acb7e3ef7546148612fa8be43bc7af75d98e29d65d7463fa","sha512":"9faabc908c44d52e21e308b116394e8fb4c12e31f3446b4bd8a7f5c7c418d4c064309f6c841614d018649652286b08d4ee6ebd1bf97134eae8fe3b0d9a090591","ssdeep":"","tlshash":"04e0c0c5f7e774c0d39223bf413e08260433c1ad3d55069ca31bcc55592b00b80c00d7","first_seen":"2023-05-20T12:09:29Z","last_seen":"2026-07-23T15:53:23.463704Z","times_seen":244,"resource_available":false,"data":null}},"time_used":682,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":682,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2025-10-17","alert":"Sinkholed","trigger":"coinbaseow.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2025-10-17","alert":"Sinkholed","trigger":"coinbaseow.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"coinbaseow.com/upload/1649148730316674.jpg","fqdn":"coinbaseow.com","domain":"coinbaseow.com","tld":"com"},"ip":{"addr":"202.79.173.8","port":443,"asn":152194,"as":"CTG Server Limited","country":"Singapore","country_code":"SG"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://coinbaseow.com/h5/","date":"2025-10-17T02:20:41.667Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"www.coinbaseoq.shop","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Thu, 09 Oct 2025 07:16:50 GMT","end":"Wed, 07 Jan 2026 07:16:49 GMT"},"fingerprint":{"sha1":"71:AC:C8:1A:43:33:1E:D9:F5:BE:92:DB:27:46:FC:E2:F0:DA:07:A7","sha256":"59:AC:48:87:76:46:B0:7F:ED:AA:98:8C:AD:DD:7C:40:7E:52:F9:11:1D:71:85:35:F8:29:5D:27:D6:19:43:90"}}},"request":{"raw":"GET /upload/1649148730316674.jpg HTTP/1.1\r\nHost: coinbaseow.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://coinbaseow.com/h5/\r\nCookie: angela_session=eyJpdiI6Ik9XZnRTS1psYWU3ZDFIQ3dcLzhuOU5BPT0iLCJ2YWx1ZSI6IjZ2WHYzRDU1bmtTRFFrVjMwdmt5eFJxcDRVYkhWMXdWdzNQMUVpMlZEd3dcL2JRaHQySGRWSTNrelROK0k1WDhBS1d3YVlZc2ViZVkwXC9cL2JNZmlET0tTNVVXUW1SdTNDQ0lpenZKVDA3UUR3WGFDaXVNVzdDckhtbGowbGpER1VnIiwibWFjIjoiNjM3ZWE4ZDgxODE2YjQ3NjczNDA2ZjFmZTVlYzkzZmZkN2QwOTVkNDhhYmY4YTU2Njg1YjA2MDQxNWYwOWE3OSJ9; SITE_TOTAL_ID=3c6c7b94394b9ebde77373f18a7ee7b7\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Fri, 17 Oct 2025 02:20:41 GMT\r\ncontent-type: image/jpeg\r\nlast-modified: Tue, 05 Apr 2022 08:52:10 GMT\r\nvary: Accept-Encoding\r\netag: W/\"624c033a-ad7d\"\r\nexpires: Sun, 16 Nov 2025 02:20:41 GMT\r\ncache-control: max-age=2592000\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: quic=\":443\"; h3=\":443\"; h3-29=\":443\"; h3-27=\":443\";h3-25=\":443\"; h3-T050=\":443\"; h3-Q050=\":443\";h3-Q049=\":443\";h3-Q048=\":443\"; h3-Q046=\":443\"; h3-Q043=\":443\"\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":44413,"size_decoded":0,"mime_type":"image/jpeg","magic":"JPEG image data, progressive, precision 8, 1024x504, components 3","md5":"80cc7d37be4302ccfa36a2157f1c086c","sha1":"91f3a6cc65fd3a46ae0592f387beef9cecebb758","sha256":"8695a59b482753a90177a09c5dc2a3f2af62fa6ddadce6a5be0abdf354adcccb","sha512":"f5adf59c1a6356bade7c0f1e6bce4a15bb2633e9acf12131700801c1101f9e68163616fd3e68222613187a7b3c94fbca5b6a84d484216d382a7bdd57f483cdc9","ssdeep":"768:zgMt1SWsnqNmckgKOHOoVVQUyPUXljNpUqoOXLtarjgEZRfUdx7Ici:MMnSpYmcnKuBIKp7oULtarjgYGxRi","tlshash":"3513f2434970f87ed878a6b28cd7cd90e5a1058c6da52e2bf3615a18ed0cf115c7397d","first_seen":"2023-09-19T01:40:28Z","last_seen":"2026-03-05T02:10:15.567522Z","times_seen":13,"resource_available":false,"data":null}},"time_used":349,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":349,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2025-10-17","alert":"Sinkholed","trigger":"coinbaseow.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2025-10-17","alert":"Sinkholed","trigger":"coinbaseow.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-10-17","alert":"Sinkholed","trigger":"coinbaseow.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"coinbaseow.com/h5/static/image/icon/favicon.ico","fqdn":"coinbaseow.com","domain":"coinbaseow.com","tld":"com"},"ip":{"addr":"202.79.173.8","port":443,"asn":152194,"as":"CTG Server Limited","country":"Singapore","country_code":"SG"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://coinbaseow.com/h5/","date":"2025-10-17T02:20:40.992Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"www.coinbaseoq.shop","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Thu, 09 Oct 2025 07:16:50 GMT","end":"Wed, 07 Jan 2026 07:16:49 GMT"},"fingerprint":{"sha1":"71:AC:C8:1A:43:33:1E:D9:F5:BE:92:DB:27:46:FC:E2:F0:DA:07:A7","sha256":"59:AC:48:87:76:46:B0:7F:ED:AA:98:8C:AD:DD:7C:40:7E:52:F9:11:1D:71:85:35:F8:29:5D:27:D6:19:43:90"}}},"request":{"raw":"GET /h5/static/image/icon/favicon.ico HTTP/1.1\r\nHost: coinbaseow.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://coinbaseow.com/h5/\r\nCookie: angela_session=eyJpdiI6IkU5NTd0Yk1pQVhSTUVheklOYU1CNmc9PSIsInZhbHVlIjoiK0RtZCszOFpTMURXV2lcL0p0QjZ4V3N4UmJuZnJDYVZpclkzWDFTZ201TFRuVmJxRVBBR0NnUGI5b0U4UTlNa3BXRHEreFU1VXF3OXNGaDFNdVwvb3RcLzRYRG1YQWlyNUk1cUs4VHE4NmMzOVFpNWdwZ2FRbnVabWJwelBHYUVtcEciLCJtYWMiOiI2Nzk2MDAzZGM5NjIwOTI0YTAxZjczMjVkOGMwNGVlM2Y2YjlkZTQyZTlmMjBjOTUzYjYzMmI4NzlmNjQ5NWI5In0%3D; SITE_TOTAL_ID=3c6c7b94394b9ebde77373f18a7ee7b7\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Fri, 17 Oct 2025 02:20:41 GMT\r\ncontent-type: image/x-icon\r\ncontent-length: 54384\r\nlast-modified: Thu, 11 Sep 2025 06:31:12 GMT\r\netag: \"68c26cb0-d470\"\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: quic=\":443\"; h3=\":443\"; h3-29=\":443\"; h3-27=\":443\";h3-25=\":443\"; h3-T050=\":443\"; h3-Q050=\":443\";h3-Q049=\":443\";h3-Q048=\":443\"; h3-Q046=\":443\"; h3-Q043=\":443\"\r\naccept-ranges: bytes\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":54384,"size_decoded":0,"mime_type":"image/x-icon","magic":"PNG image data, 768 x 512, 8-bit/color RGBA, non-interlaced","md5":"8b0c09fbfc77925c279c156a3630d9a0","sha1":"3a420a9f5be1b77768de6b6967b12417d015d1c1","sha256":"d58f985b8f44e29abb40b30b1028497ec356f5d0456d4d1acbcd87722b7bf6aa","sha512":"63a4adf3f4956babe20ecad7bcd26239df09d7a1ec4bdd028496a9ae561b76318c0fe133bed357a9cad9e8321ea2fdc4a52c6d2e7015bc9a08ced1ca3f454163","ssdeep":"1536:geqBDARmrUbFZCUWdSt3/Ews87zcoJAFya1v9nSQxnuSV:geWARmjdwt3oajz+nSSV","tlshash":"7333f20a55c6cd8ddcdf75702bcff9ea3d01d1a1200676f68966b10ce28ee059a3456e","first_seen":"2025-09-15T12:55:02.733156Z","last_seen":"2025-10-17T02:21:05.179355Z","times_seen":6,"resource_available":false,"data":null}},"time_used":349,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":347,"receive":2,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2025-10-17","alert":"Sinkholed","trigger":"coinbaseow.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2025-10-17","alert":"Sinkholed","trigger":"coinbaseow.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-10-17","alert":"Sinkholed","trigger":"coinbaseow.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"coinbaseow.com/api/news/list","fqdn":"coinbaseow.com","domain":"coinbaseow.com","tld":"com"},"ip":{"addr":"202.79.173.8","port":443,"asn":152194,"as":"CTG Server Limited","country":"Singapore","country_code":"SG"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"https://coinbaseow.com/h5/","date":"2025-10-17T02:20:41.222Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"www.coinbaseoq.shop","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Thu, 09 Oct 2025 07:16:50 GMT","end":"Wed, 07 Jan 2026 07:16:49 GMT"},"fingerprint":{"sha1":"71:AC:C8:1A:43:33:1E:D9:F5:BE:92:DB:27:46:FC:E2:F0:DA:07:A7","sha256":"59:AC:48:87:76:46:B0:7F:ED:AA:98:8C:AD:DD:7C:40:7E:52:F9:11:1D:71:85:35:F8:29:5D:27:D6:19:43:90"}}},"request":{"raw":"POST /api/news/list HTTP/1.1\r\nHost: coinbaseow.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nAuthorization: \r\nContent-Type: application/x-www-form-urlencoded\r\nContent-Length: 14\r\nOrigin: https://coinbaseow.com\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://coinbaseow.com/h5/\r\nCookie: angela_session=eyJpdiI6IkU5NTd0Yk1pQVhSTUVheklOYU1CNmc9PSIsInZhbHVlIjoiK0RtZCszOFpTMURXV2lcL0p0QjZ4V3N4UmJuZnJDYVZpclkzWDFTZ201TFRuVmJxRVBBR0NnUGI5b0U4UTlNa3BXRHEreFU1VXF3OXNGaDFNdVwvb3RcLzRYRG1YQWlyNUk1cUs4VHE4NmMzOVFpNWdwZ2FRbnVabWJwelBHYUVtcEciLCJtYWMiOiI2Nzk2MDAzZGM5NjIwOTI0YTAxZjczMjVkOGMwNGVlM2Y2YjlkZTQyZTlmMjBjOTUzYjYzMmI4NzlmNjQ5NWI5In0%3D; SITE_TOTAL_ID=3c6c7b94394b9ebde77373f18a7ee7b7\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"POST"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ncontent-type: application/json\r\nvary: Accept-Encoding\r\naccess-control-allow-origin: *\r\naccess-control-allow-methods: POST,GET,OPTIONS,DELETE\r\naccess-control-allow-headers: x-requested-with,content-type,Authorization\r\ncache-control: no-cache, private\r\ndate: Fri, 17 Oct 2025 02:20:41 GMT\r\nset-cookie: angela_session=eyJpdiI6InI4NmtSRk5sd1d2ZENueU0zM2ZiUUE9PSIsInZhbHVlIjoic0c4T21lODJsZWE5OWdoNVFBRm9OeGtzTmUyYXVkY3dNcHJrSjVuR2FFMjJXSTUxdkNZWkJLbDF3K0p6djJhZUZiQ0lPRzNvVm9cL3Z6ZXZyUSs2SlpmRnRrd2s3SDBJNDR2d09DZ2RycSt6ckJreTNUR3Q2OGxqa3EzcFdMZGtPIiwibWFjIjoiNzBhNTc1NjkzZDE2OGM0YjRkMTIyNjU3ODFhMGMzZWJiMTkwY2MwNmE2Mzk5ZTBkZjRmNTEyNTAxMGQ0MjZlYyJ9; expires=Fri, 17-Oct-2025 04:20:41 GMT; Max-Age=7200; path=/; httponly\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: quic=\":443\"; h3=\":443\"; h3-29=\":443\"; h3-27=\":443\";h3-25=\":443\"; h3-T050=\":443\"; h3-Q050=\":443\";h3-Q049=\":443\";h3-Q048=\":443\"; h3-Q046=\":443\"; h3-Q043=\":443\"\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":368,"size_decoded":0,"mime_type":"application/json","magic":"JSON text data","md5":"3d56d005ca0a695cedf6dbb5edc8be15","sha1":"e1908c058fb7c7b6ee291e7b0ea9e5fa6c43fe0d","sha256":"af769ea62aecc7b7a87ef7858293e30b1d7d55278c8948a1c5ddea7b29a5a03b","sha512":"2fc7e6e92c51b0ad1b17426e8c4cf0f90d4e4cf3b9449b1ff2f2cba9e901f6dadca9ed3f7c837810e917efd9ef460bad46cef319a754860279a52b6f31303329","ssdeep":"","tlshash":"0de0c07d2600adff53d023c8648fb545d9dd2042864587ad49cc8ca8d3586f8403b427","first_seen":"2025-09-15T12:55:02.727578Z","last_seen":"2025-10-17T02:21:05.073164Z","times_seen":6,"resource_available":false,"data":null}},"time_used":369,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":369,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2025-10-17","alert":"Sinkholed","trigger":"coinbaseow.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2025-10-17","alert":"Sinkholed","trigger":"coinbaseow.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-10-17","alert":"Sinkholed","trigger":"coinbaseow.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"coinbaseow.com/","fqdn":"coinbaseow.com","domain":"coinbaseow.com","tld":"com"},"ip":{"addr":"0.0.0.0","port":0,"asn":0,"as":"","country":"","country_code":"zz"},"is_navigation_request":true,"resource_type":"document","requested_by":"","date":"2025-10-17T02:20:34.301Z","timestamp":0,"http_version":"","security_state":"broken","security_info":null,"request":{"raw":"GET / HTTP/1.1\r\nHost: coinbaseow.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nUpgrade-Insecure-Requests: 1\r\nSec-Fetch-Dest: document\r\nSec-Fetch-Mode: navigate\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"","headers":null,"cookies":null,"status_code":"","status_text":"","fingerprints":null,"data":{"size":0,"size_decoded":0,"mime_type":"","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-07-25T04:51:46.086242Z","times_seen":17521484,"resource_available":true,"data":null}},"time_used":777,"timings":{"blocked":0,"dns":73,"connect":347,"send":0,"wait":0,"receive":0,"ssl":354},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2025-10-17","alert":"Sinkholed","trigger":"coinbaseow.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2025-10-17","alert":"Sinkholed","trigger":"coinbaseow.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-10-17","alert":"Sinkholed","trigger":"coinbaseow.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"coinbaseow.com/h5/static/image/nav/nav-3.png","fqdn":"coinbaseow.com","domain":"coinbaseow.com","tld":"com"},"ip":{"addr":"202.79.173.8","port":443,"asn":152194,"as":"CTG Server Limited","country":"Singapore","country_code":"SG"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://coinbaseow.com/h5/","date":"2025-10-17T02:20:40.236Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"www.coinbaseoq.shop","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Thu, 09 Oct 2025 07:16:50 GMT","end":"Wed, 07 Jan 2026 07:16:49 GMT"},"fingerprint":{"sha1":"71:AC:C8:1A:43:33:1E:D9:F5:BE:92:DB:27:46:FC:E2:F0:DA:07:A7","sha256":"59:AC:48:87:76:46:B0:7F:ED:AA:98:8C:AD:DD:7C:40:7E:52:F9:11:1D:71:85:35:F8:29:5D:27:D6:19:43:90"}}},"request":{"raw":"GET /h5/static/image/nav/nav-3.png HTTP/1.1\r\nHost: coinbaseow.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://coinbaseow.com/h5/\r\nCookie: angela_session=eyJpdiI6Ik41Zk9jTkxrNjI4NndXNXFSMjN5aWc9PSIsInZhbHVlIjoiaDhmYVljVDVCQTJFeVZnYzNkWndpbEYyNm1wR1RoMm1sWWxTTzRQb1B6eWREd2ZyZjBcL1RKa2lmVldKdUxCK3JPZ1d0NXcyVVM3WVQrZTFuSlpMNFhWYzZ1RVhvTTZCYlV1cXZHd3ZBSGdhaEVxN0J4OWxMVXlcL21XbHFPZnkwYyIsIm1hYyI6IjAwNGU0NDVkZGRiMDQwN2MyOTNlYjJkNTRmMDNmYzQ0YzFkYzFjNDFhY2Y5Yzg0MWQzY2JjNjAzZjUxZjMyZDYifQ%3D%3D; SITE_TOTAL_ID=3c6c7b94394b9ebde77373f18a7ee7b7\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Fri, 17 Oct 2025 02:20:40 GMT\r\ncontent-type: image/png\r\nlast-modified: Thu, 11 Sep 2025 06:31:12 GMT\r\nvary: Accept-Encoding\r\netag: W/\"68c26cb0-4d0\"\r\nexpires: Sun, 16 Nov 2025 02:20:40 GMT\r\ncache-control: max-age=2592000\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: quic=\":443\"; h3=\":443\"; h3-29=\":443\"; h3-27=\":443\";h3-25=\":443\"; h3-T050=\":443\"; h3-Q050=\":443\";h3-Q049=\":443\";h3-Q048=\":443\"; h3-Q046=\":443\"; h3-Q043=\":443\"\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":1232,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 44 x 45, 8-bit/color RGBA, non-interlaced","md5":"fd57dd6dbb1f72619420449aafe1d852","sha1":"bb99e3ba6404a1c00482576775530a0bcbf1d254","sha256":"67989dd943d26961cb26b505d15c64cb24c3ed0aacb607d32ef5d864ec1af3ef","sha512":"dbf4768c4a3c8eb9b84cf98a6086eb518d4c6cd56b57848466b8eb600191eb08c4086f19de41e62d9566ea7ba0fdf857b405108649fce438320f6f8371539181","ssdeep":"","tlshash":"f821b4d98b6c15e3c8e40c8fc53cac1b822ab45a189e2f0a46b999a70453319cf5d280","first_seen":"2023-05-20T12:09:28Z","last_seen":"2026-07-23T15:53:23.502074Z","times_seen":244,"resource_available":false,"data":null}},"time_used":682,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":682,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2025-10-17","alert":"Sinkholed","trigger":"coinbaseow.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2025-10-17","alert":"Sinkholed","trigger":"coinbaseow.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-10-17","alert":"Sinkholed","trigger":"coinbaseow.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"coinbaseow.com/h5/static/image/icon/home-nav-9.png","fqdn":"coinbaseow.com","domain":"coinbaseow.com","tld":"com"},"ip":{"addr":"202.79.173.8","port":443,"asn":152194,"as":"CTG Server Limited","country":"Singapore","country_code":"SG"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://coinbaseow.com/h5/","date":"2025-10-17T02:20:41.729Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"www.coinbaseoq.shop","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Thu, 09 Oct 2025 07:16:50 GMT","end":"Wed, 07 Jan 2026 07:16:49 GMT"},"fingerprint":{"sha1":"71:AC:C8:1A:43:33:1E:D9:F5:BE:92:DB:27:46:FC:E2:F0:DA:07:A7","sha256":"59:AC:48:87:76:46:B0:7F:ED:AA:98:8C:AD:DD:7C:40:7E:52:F9:11:1D:71:85:35:F8:29:5D:27:D6:19:43:90"}}},"request":{"raw":"GET /h5/static/image/icon/home-nav-9.png HTTP/1.1\r\nHost: coinbaseow.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://coinbaseow.com/h5/\r\nCookie: angela_session=eyJpdiI6IlwveTR4N0o4QTNJTWlRdnNpSFBOUjJRPT0iLCJ2YWx1ZSI6IkRFdTRyWjBQc0xzNEsybnZwU3FJWG5sUjhWellva1RRbXhPQTlcL0FMKzJTblFlVXNqbHBOWWpPVEpnZ3l0WTlFMmtNcmp1R0JDc2c3dkVub0xOcUIzRnBUdWsrQWpxa1UrckkyXC9iMTBoMHFQUXFiWTFHd0Y0NUtqWE5nY0ppZ08iLCJtYWMiOiIyN2MwODJlOWRkOTg4MDVjZTBlMDBmOWY2NWQ0NmJkMjIwYjk4YWU4MTgwNGJmZDhmNzM0N2Y5MWM5Yjg3OGY0In0%3D; SITE_TOTAL_ID=3c6c7b94394b9ebde77373f18a7ee7b7\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Fri, 17 Oct 2025 02:20:41 GMT\r\ncontent-type: image/png\r\nlast-modified: Thu, 11 Sep 2025 06:31:12 GMT\r\nvary: Accept-Encoding\r\netag: W/\"68c26cb0-1016\"\r\nexpires: Sun, 16 Nov 2025 02:20:41 GMT\r\ncache-control: max-age=2592000\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: quic=\":443\"; h3=\":443\"; h3-29=\":443\"; h3-27=\":443\";h3-25=\":443\"; h3-T050=\":443\"; h3-Q050=\":443\";h3-Q049=\":443\";h3-Q048=\":443\"; h3-Q046=\":443\"; h3-Q043=\":443\"\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":4118,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 46 x 46, 8-bit/color RGBA, non-interlaced","md5":"96c006351f3bb1ed5a7236df6973d412","sha1":"21e63fd42a6940bbdf4caa8c84080df20716e4dd","sha256":"964df4170b2a82ff0a89d2f8cbd51da5c5ec91058609cf4b067413e182a90ee7","sha512":"fbff1d8e41b9d90a5de270acc44574c0f71acebd75991fc227c10082f4aec543e9c6206d36f9083f0f07405d287685e0448b0e378a37c3601f9dd7c5fca9e3f2","ssdeep":"96:PSTknmWIrD/+NGdGDHCnH5o+U3PfNdIhD1xHQbJDY0bIIzFiEtNg:PSTkn5HinO+UffuDHQBY0bfzUMg","tlshash":"5a815ecee4722e0b4ad9e3865ad562b7a7128b419f949402fccc8c473820479cdcd6e3","first_seen":"2023-05-20T12:09:29Z","last_seen":"2026-06-02T15:51:10.741921Z","times_seen":87,"resource_available":false,"data":null}},"time_used":347,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":347,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2025-10-17","alert":"Sinkholed","trigger":"coinbaseow.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2025-10-17","alert":"Sinkholed","trigger":"coinbaseow.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-10-17","alert":"Sinkholed","trigger":"coinbaseow.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"coinbaseow.com/h5/static/image/icon/home-nav-4.png","fqdn":"coinbaseow.com","domain":"coinbaseow.com","tld":"com"},"ip":{"addr":"202.79.173.8","port":443,"asn":152194,"as":"CTG Server Limited","country":"Singapore","country_code":"SG"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://coinbaseow.com/h5/","date":"2025-10-17T02:20:41.732Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"www.coinbaseoq.shop","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Thu, 09 Oct 2025 07:16:50 GMT","end":"Wed, 07 Jan 2026 07:16:49 GMT"},"fingerprint":{"sha1":"71:AC:C8:1A:43:33:1E:D9:F5:BE:92:DB:27:46:FC:E2:F0:DA:07:A7","sha256":"59:AC:48:87:76:46:B0:7F:ED:AA:98:8C:AD:DD:7C:40:7E:52:F9:11:1D:71:85:35:F8:29:5D:27:D6:19:43:90"}}},"request":{"raw":"GET /h5/static/image/icon/home-nav-4.png HTTP/1.1\r\nHost: coinbaseow.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://coinbaseow.com/h5/\r\nCookie: angela_session=eyJpdiI6IlwveTR4N0o4QTNJTWlRdnNpSFBOUjJRPT0iLCJ2YWx1ZSI6IkRFdTRyWjBQc0xzNEsybnZwU3FJWG5sUjhWellva1RRbXhPQTlcL0FMKzJTblFlVXNqbHBOWWpPVEpnZ3l0WTlFMmtNcmp1R0JDc2c3dkVub0xOcUIzRnBUdWsrQWpxa1UrckkyXC9iMTBoMHFQUXFiWTFHd0Y0NUtqWE5nY0ppZ08iLCJtYWMiOiIyN2MwODJlOWRkOTg4MDVjZTBlMDBmOWY2NWQ0NmJkMjIwYjk4YWU4MTgwNGJmZDhmNzM0N2Y5MWM5Yjg3OGY0In0%3D; SITE_TOTAL_ID=3c6c7b94394b9ebde77373f18a7ee7b7\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Fri, 17 Oct 2025 02:20:41 GMT\r\ncontent-type: image/png\r\nlast-modified: Thu, 11 Sep 2025 06:31:12 GMT\r\nvary: Accept-Encoding\r\netag: W/\"68c26cb0-1c9e\"\r\nexpires: Sun, 16 Nov 2025 02:20:41 GMT\r\ncache-control: max-age=2592000\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: quic=\":443\"; h3=\":443\"; h3-29=\":443\"; h3-27=\":443\";h3-25=\":443\"; h3-T050=\":443\"; h3-Q050=\":443\";h3-Q049=\":443\";h3-Q048=\":443\"; h3-Q046=\":443\"; h3-Q043=\":443\"\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":7326,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 85 x 91, 8-bit/color RGBA, non-interlaced","md5":"51931449f7f1add2f1b23c1d3fb0c50d","sha1":"2472606e33ee28b6d1b24adaa15c2cc2e3f2e3a5","sha256":"115a31c73bb313b73626ce78e057499e508d55d8208315a1590c473dd47030a4","sha512":"2ee2fa2fdd8c200b57884f31fc1ef92115683646bec270d2736fde25ab5f1e5c952a66018efde827acffe759ae84198ccb39fb52a6b85047eecbd0947a7d30e2","ssdeep":"192:MknvFTRsSsJfpk4hEfHtdgcV73LJ6vRrhPnD:fnvFTRsSsBpfEfDlJe7nD","tlshash":"dee18e01ec61bc50a6258a85a4edd14b8f17d3d0ad9858ebbde5d55280d34f8576ccc3","first_seen":"2023-05-20T12:09:29Z","last_seen":"2026-07-19T00:07:26.688304Z","times_seen":190,"resource_available":false,"data":null}},"time_used":348,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":348,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2025-10-17","alert":"Sinkholed","trigger":"coinbaseow.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2025-10-17","alert":"Sinkholed","trigger":"coinbaseow.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-10-17","alert":"Sinkholed","trigger":"coinbaseow.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"coinbaseow.com/h5/static/image/icon/home-nav-10.png","fqdn":"coinbaseow.com","domain":"coinbaseow.com","tld":"com"},"ip":{"addr":"202.79.173.8","port":443,"asn":152194,"as":"CTG Server Limited","country":"Singapore","country_code":"SG"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://coinbaseow.com/h5/","date":"2025-10-17T02:20:41.734Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"www.coinbaseoq.shop","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Thu, 09 Oct 2025 07:16:50 GMT","end":"Wed, 07 Jan 2026 07:16:49 GMT"},"fingerprint":{"sha1":"71:AC:C8:1A:43:33:1E:D9:F5:BE:92:DB:27:46:FC:E2:F0:DA:07:A7","sha256":"59:AC:48:87:76:46:B0:7F:ED:AA:98:8C:AD:DD:7C:40:7E:52:F9:11:1D:71:85:35:F8:29:5D:27:D6:19:43:90"}}},"request":{"raw":"GET /h5/static/image/icon/home-nav-10.png HTTP/1.1\r\nHost: coinbaseow.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://coinbaseow.com/h5/\r\nCookie: angela_session=eyJpdiI6IlwveTR4N0o4QTNJTWlRdnNpSFBOUjJRPT0iLCJ2YWx1ZSI6IkRFdTRyWjBQc0xzNEsybnZwU3FJWG5sUjhWellva1RRbXhPQTlcL0FMKzJTblFlVXNqbHBOWWpPVEpnZ3l0WTlFMmtNcmp1R0JDc2c3dkVub0xOcUIzRnBUdWsrQWpxa1UrckkyXC9iMTBoMHFQUXFiWTFHd0Y0NUtqWE5nY0ppZ08iLCJtYWMiOiIyN2MwODJlOWRkOTg4MDVjZTBlMDBmOWY2NWQ0NmJkMjIwYjk4YWU4MTgwNGJmZDhmNzM0N2Y5MWM5Yjg3OGY0In0%3D; SITE_TOTAL_ID=3c6c7b94394b9ebde77373f18a7ee7b7\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Fri, 17 Oct 2025 02:20:41 GMT\r\ncontent-type: image/png\r\nlast-modified: Thu, 11 Sep 2025 06:31:12 GMT\r\nvary: Accept-Encoding\r\netag: W/\"68c26cb0-daa\"\r\nexpires: Sun, 16 Nov 2025 02:20:41 GMT\r\ncache-control: max-age=2592000\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: quic=\":443\"; h3=\":443\"; h3-29=\":443\"; h3-27=\":443\";h3-25=\":443\"; h3-T050=\":443\"; h3-Q050=\":443\";h3-Q049=\":443\";h3-Q048=\":443\"; h3-Q046=\":443\"; h3-Q043=\":443\"\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":3498,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 43 x 43, 8-bit/color RGBA, non-interlaced","md5":"0f68f241c0b1be6b0d358a55726edbfe","sha1":"b89870c0c736f34c4eb9e1a97861fe7169590811","sha256":"b50accd09373fd6a0eae6994ca2070f41986d766e5125c218d05659dfad454f1","sha512":"6ab288b25cecd701cf59adc30b31819a67f1021c3931454e6da5a7fa010540edb9cc13bc36f7b2d856c56e34f49c6b2b99b9e67241a66f4592e67429a502ae51","ssdeep":"","tlshash":"0c713b40db42acf07b58bb5c6be061675a2f87c046c2a0426dffe82325304a7cdca6d3","first_seen":"2023-06-06T10:11:01Z","last_seen":"2026-06-02T15:51:10.744042Z","times_seen":59,"resource_available":false,"data":null}},"time_used":347,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":347,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2025-10-17","alert":"Sinkholed","trigger":"coinbaseow.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2025-10-17","alert":"Sinkholed","trigger":"coinbaseow.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-10-17","alert":"Sinkholed","trigger":"coinbaseow.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"coinbaseow.com/h5/static/index.css","fqdn":"coinbaseow.com","domain":"coinbaseow.com","tld":"com"},"ip":{"addr":"202.79.173.8","port":443,"asn":152194,"as":"CTG Server Limited","country":"Singapore","country_code":"SG"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://coinbaseow.com/h5/","date":"2025-10-17T02:20:38.134Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"www.coinbaseoq.shop","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Thu, 09 Oct 2025 07:16:50 GMT","end":"Wed, 07 Jan 2026 07:16:49 GMT"},"fingerprint":{"sha1":"71:AC:C8:1A:43:33:1E:D9:F5:BE:92:DB:27:46:FC:E2:F0:DA:07:A7","sha256":"59:AC:48:87:76:46:B0:7F:ED:AA:98:8C:AD:DD:7C:40:7E:52:F9:11:1D:71:85:35:F8:29:5D:27:D6:19:43:90"}}},"request":{"raw":"GET /h5/static/index.css HTTP/1.1\r\nHost: coinbaseow.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://coinbaseow.com/h5/\r\nCookie: angela_session=eyJpdiI6Ik41Zk9jTkxrNjI4NndXNXFSMjN5aWc9PSIsInZhbHVlIjoiaDhmYVljVDVCQTJFeVZnYzNkWndpbEYyNm1wR1RoMm1sWWxTTzRQb1B6eWREd2ZyZjBcL1RKa2lmVldKdUxCK3JPZ1d0NXcyVVM3WVQrZTFuSlpMNFhWYzZ1RVhvTTZCYlV1cXZHd3ZBSGdhaEVxN0J4OWxMVXlcL21XbHFPZnkwYyIsIm1hYyI6IjAwNGU0NDVkZGRiMDQwN2MyOTNlYjJkNTRmMDNmYzQ0YzFkYzFjNDFhY2Y5Yzg0MWQzY2JjNjAzZjUxZjMyZDYifQ%3D%3D; SITE_TOTAL_ID=3c6c7b94394b9ebde77373f18a7ee7b7\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Fri, 17 Oct 2025 02:20:38 GMT\r\ncontent-type: text/css\r\nlast-modified: Thu, 11 Sep 2025 06:31:12 GMT\r\nvary: Accept-Encoding\r\netag: W/\"68c26cb0-1793e\"\r\nexpires: Fri, 17 Oct 2025 14:20:38 GMT\r\ncache-control: max-age=43200\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: quic=\":443\"; h3=\":443\"; h3-29=\":443\"; h3-27=\":443\";h3-25=\":443\"; h3-T050=\":443\"; h3-Q050=\":443\";h3-Q049=\":443\";h3-Q048=\":443\"; h3-Q046=\":443\"; h3-Q043=\":443\"\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":96574,"size_decoded":0,"mime_type":"text/css","magic":"ASCII text, with very long lines (65536), with no line terminators","md5":"2de2f2d3943b4b382a28a439daff5939","sha1":"70d04e1c3567cb4f248b29046b98386f215a4d38","sha256":"8a35934d019c2b120a31ae6c51c75b2327f22637824b2a2c2faf4ce17ae9d4d8","sha512":"eba9271e30d6e4b21954078e3ccd839a55e1dcc8212fa375c18dce42104d19a92655c2f289401525b0c9565971a31573b928666515a3ca89b1801bbd48c1de95","ssdeep":"1536:OlIApuK7hmVmb2RS1Wu3xdynGJ7eh/nrhlvbc:VApuK7hmVrS1Wu3iG41nrPI","tlshash":"f393f73719012e39e52bcd26b6c1ab5a1e61c033e15307adfba47628cbcf9c9167b345","first_seen":"2025-07-20T12:48:29.443135Z","last_seen":"2026-07-24T22:10:14.432199Z","times_seen":2817,"resource_available":false,"data":null}},"time_used":694,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":694,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2025-10-17","alert":"Sinkholed","trigger":"coinbaseow.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2025-10-17","alert":"Sinkholed","trigger":"coinbaseow.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-10-17","alert":"Sinkholed","trigger":"coinbaseow.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"coinbaseow.com/api/currency/new_timeshar?from=1760664041\u0026to=1760667641\u0026symbol=LTC%2FUSDT\u0026period=1min\u0026lang=zh","fqdn":"coinbaseow.com","domain":"coinbaseow.com","tld":"com"},"ip":{"addr":"202.79.173.8","port":443,"asn":152194,"as":"CTG Server Limited","country":"Singapore","country_code":"SG"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"https://coinbaseow.com/h5/","date":"2025-10-17T02:20:44.173Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"www.coinbaseoq.shop","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Thu, 09 Oct 2025 07:16:50 GMT","end":"Wed, 07 Jan 2026 07:16:49 GMT"},"fingerprint":{"sha1":"71:AC:C8:1A:43:33:1E:D9:F5:BE:92:DB:27:46:FC:E2:F0:DA:07:A7","sha256":"59:AC:48:87:76:46:B0:7F:ED:AA:98:8C:AD:DD:7C:40:7E:52:F9:11:1D:71:85:35:F8:29:5D:27:D6:19:43:90"}}},"request":{"raw":"GET /api/currency/new_timeshar?from=1760664041\u0026to=1760667641\u0026symbol=LTC%2FUSDT\u0026period=1min\u0026lang=zh HTTP/1.1\r\nHost: coinbaseow.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nAuthorization: \r\nContent-Type: application/x-www-form-urlencoded\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://coinbaseow.com/h5/\r\nCookie: angela_session=eyJpdiI6IndCM2VlNVBMYllFa1BRR0FGVnJpdEE9PSIsInZhbHVlIjoiRXh0eHNcL2lJY3JycXBtdWlMWU50b1p4U3pIZDZicUUwVUg3Y2ZFNzdtUzUyNVJLclpDZmpEcyttM2RUTTR3bVJXSERiQTdQbGp4dTlsUVdzamlJM2dlTEx0ZzFQM251Sjg0YUpSQUFBQzdOWFBQNllYU2Z5dHBCK2I0eXhlajhHIiwibWFjIjoiYjcwYTUyNWRmYTQ1ZjJmNjNmNGVhMGQ5ZDczYzdmZmMzMWIwNWM3ODY2OGY4Y2RiMTUzZmMyMzU4OTc5OTY5MyJ9; SITE_TOTAL_ID=3c6c7b94394b9ebde77373f18a7ee7b7\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ncontent-type: application/json\r\nvary: Accept-Encoding\r\ncache-control: no-cache, private\r\ndate: Fri, 17 Oct 2025 02:20:44 GMT\r\naccess-control-allow-origin: *, *\r\naccess-control-allow-headers: Content-Type, Authorization, X-Requested-With, Origin, Content-Type, Cookie, X-CSRF-TOKEN, Accept, Authorization, X-XSRF-TOKEN\r\naccess-control-expose-headers: Authorization, authenticated\r\naccess-control-allow-methods: GET, POST, PUT, DELETE, OPTIONS, GET, POST, PATCH, PUT, OPTIONS\r\naccess-control-allow-credentials: false\r\nset-cookie: angela_session=eyJpdiI6InBhTnNIQTJBblwvRTdSN0VKWVBnTlZnPT0iLCJ2YWx1ZSI6IkNcL2U4cmEwbWloNkc3M3Rrb1RYMEFIYjdxeW9uS1o5S25Kd3JZdU9QSXY3MjhVNlZleDA2aGR6UDdSeFwvY3FqKzlBNVNDSTYwS3hNMFF1dzAzTGhhUlRoVnRYdTJIR2xiXC9qS1lIRk8ySFpYQnJ6T1NtVllIU1JJZ2dXNHdGbklIIiwibWFjIjoiYmQ0ZTQ5OTQ1ZDQ3NjIwNWIzNzc1MDI3MTI3YmJhMjNmNWZjMTNjMjlhZTZlMGMwM2EyZGQ2ODNhYzg4NWUwOCJ9; expires=Fri, 17-Oct-2025 04:20:44 GMT; Max-Age=7200; path=/; httponly\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: quic=\":443\"; h3=\":443\"; h3-29=\":443\"; h3-27=\":443\";h3-25=\":443\"; h3-T050=\":443\"; h3-Q050=\":443\";h3-Q049=\":443\";h3-Q048=\":443\"; h3-Q046=\":443\"; h3-Q043=\":443\"\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":12477,"size_decoded":0,"mime_type":"application/json","magic":"JSON text data","md5":"fa822e9d966995065c37f73ea9b075c7","sha1":"2affc134faca2d3a7860a31bf90d5d64beb1c4d8","sha256":"22d0478dfda4fa082ba8fa706e12675b8fbb4f5b75a8a0a61a9b2afde4202c77","sha512":"d73210fe96daf48d28b52bb59fc865b66f1ef0d1b7b5268c6d846fe506126a37e62bdd1f0125d1dec80c7be90d425a159f6a63b38cdcdfe9f2a8e465c330d66c","ssdeep":"192:v+ycEUcq6VgJdRBhOmV8I0vHQfJwCFrN2MwyAFrQ4lZkWqhtzw/tPB+qDTTju/0r:VMcsAMubFv/","tlshash":"00423040566d07a0d03a28c4aab389a8477f736750838ed5cabe0d8259e9f7bf111d7b","first_seen":"2025-10-17T02:21:05.208827Z","last_seen":"2025-10-17T02:21:05.208827Z","times_seen":1,"resource_available":false,"data":null}},"time_used":442,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":442,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2025-10-17","alert":"Sinkholed","trigger":"coinbaseow.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2025-10-17","alert":"Sinkholed","trigger":"coinbaseow.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-10-17","alert":"Sinkholed","trigger":"coinbaseow.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"coinbaseow.com/api/currency/new_timeshar?from=1760664041\u0026to=1760667641\u0026symbol=BCH%2FUSDT\u0026period=1min\u0026lang=zh","fqdn":"coinbaseow.com","domain":"coinbaseow.com","tld":"com"},"ip":{"addr":"202.79.173.8","port":443,"asn":152194,"as":"CTG Server Limited","country":"Singapore","country_code":"SG"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"https://coinbaseow.com/h5/","date":"2025-10-17T02:20:45.433Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"www.coinbaseoq.shop","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Thu, 09 Oct 2025 07:16:50 GMT","end":"Wed, 07 Jan 2026 07:16:49 GMT"},"fingerprint":{"sha1":"71:AC:C8:1A:43:33:1E:D9:F5:BE:92:DB:27:46:FC:E2:F0:DA:07:A7","sha256":"59:AC:48:87:76:46:B0:7F:ED:AA:98:8C:AD:DD:7C:40:7E:52:F9:11:1D:71:85:35:F8:29:5D:27:D6:19:43:90"}}},"request":{"raw":"GET /api/currency/new_timeshar?from=1760664041\u0026to=1760667641\u0026symbol=BCH%2FUSDT\u0026period=1min\u0026lang=zh HTTP/1.1\r\nHost: coinbaseow.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nAuthorization: \r\nContent-Type: application/x-www-form-urlencoded\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://coinbaseow.com/h5/\r\nCookie: angela_session=eyJpdiI6IkhmS1JzdWpwbmErSHA5R2d0VTl2MEE9PSIsInZhbHVlIjoiOTI1TnppVXJwRlVGb09RQmtcL2FpV0xDUTRQbFIzMGxNZ0taV0Nwd2JSTE5WWlQ0MUgxZStHZk1KUkZ5M2lFbmpGYnRRZUJ4XC9vb0srdGpuU05maDVocGJsV2d5SjZiVzJzT0Y4NEZuc1lXZWtWUDVMK1p6MzdCVlpMd3N3bTlvZCIsIm1hYyI6IjZmNzA1OWRlYTBhZTQ1YzBhNjA5MmRjODg3MjQ4YTRjNGYxZTk2ODE0YmQzOWNiNDczMWVkMjZlYmM0Yjg0MDgifQ%3D%3D; SITE_TOTAL_ID=3c6c7b94394b9ebde77373f18a7ee7b7\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ncontent-type: application/json\r\nvary: Accept-Encoding\r\ncache-control: no-cache, private\r\ndate: Fri, 17 Oct 2025 02:20:45 GMT\r\naccess-control-allow-origin: *, *\r\naccess-control-allow-headers: Content-Type, Authorization, X-Requested-With, Origin, Content-Type, Cookie, X-CSRF-TOKEN, Accept, Authorization, X-XSRF-TOKEN\r\naccess-control-expose-headers: Authorization, authenticated\r\naccess-control-allow-methods: GET, POST, PUT, DELETE, OPTIONS, GET, POST, PATCH, PUT, OPTIONS\r\naccess-control-allow-credentials: false\r\nset-cookie: angela_session=eyJpdiI6IlJcL09QaVV1TGpHOEVoUG10aEl5SGp3PT0iLCJ2YWx1ZSI6ImFqN0Y2WTVlXC9KMW1CWUYxYWZrXC9VR1UrSk5EdmV1dUI5ZEV2QkdSV0VBM3R5Wjh1d0hINzcwM3dKa29vTkhRdmhORXZuZm54MjFNN0kyVHBEQWxcL0FENDhYSVcyMml2SmZSVm02WVhSMGE4ZCtEU0g4S3lINlZ0TkhkdGh0RFNWIiwibWFjIjoiNWQyZGM2ODBhNTA4ZmI2ZmRkOGYxNjdiNTAwZGE2ZDY0YzllY2FhZGM3NDYxMTYxYjcxOWNlOTU1YjhjNGNlOSJ9; expires=Fri, 17-Oct-2025 04:20:45 GMT; Max-Age=7200; path=/; httponly\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: quic=\":443\"; h3=\":443\"; h3-29=\":443\"; h3-27=\":443\";h3-25=\":443\"; h3-T050=\":443\"; h3-Q050=\":443\";h3-Q049=\":443\";h3-Q048=\":443\"; h3-Q046=\":443\"; h3-Q043=\":443\"\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":12679,"size_decoded":0,"mime_type":"application/json","magic":"JSON text data","md5":"ee2733ae65feca8925f60e5fab2e0ac6","sha1":"e62756736bbae969461cbdcec6df226337e5902c","sha256":"52e6c098ea7e937d265ebe37ae17aa3100c0220389994ddd4d7ba7c56d7d2a3d","sha512":"3b498a03b447d0502a51a25c2b098b770c4490ab748c74717a6c8bc303d0bc8e17b924880be00aecca62da1dc976db8a1da4156fb96fe17c90a8197a6c958375","ssdeep":"192:v1NGFDDTUd3NmlIqR4waETQznW2Q4WJF2T1TMiXP5JihA6Cnn/xTaFGSgzQMCLm0:BTgJoxrAbmw","tlshash":"80428d805bb802f0d03ae4c47692a9bf477b23572483ce5942bf25d259e1e7af115e3b","first_seen":"2025-10-17T02:21:05.213709Z","last_seen":"2025-10-17T02:21:05.213709Z","times_seen":1,"resource_available":false,"data":null}},"time_used":385,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":385,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2025-10-17","alert":"Sinkholed","trigger":"coinbaseow.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2025-10-17","alert":"Sinkholed","trigger":"coinbaseow.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-10-17","alert":"Sinkholed","trigger":"coinbaseow.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"coinbaseow.com/api/currency/new_timeshar?from=1760664041\u0026to=1760667641\u0026symbol=ETH%2FUSDT\u0026period=1min\u0026lang=zh","fqdn":"coinbaseow.com","domain":"coinbaseow.com","tld":"com"},"ip":{"addr":"202.79.173.8","port":443,"asn":152194,"as":"CTG Server Limited","country":"Singapore","country_code":"SG"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"https://coinbaseow.com/h5/","date":"2025-10-17T02:20:43.343Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"www.coinbaseoq.shop","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Thu, 09 Oct 2025 07:16:50 GMT","end":"Wed, 07 Jan 2026 07:16:49 GMT"},"fingerprint":{"sha1":"71:AC:C8:1A:43:33:1E:D9:F5:BE:92:DB:27:46:FC:E2:F0:DA:07:A7","sha256":"59:AC:48:87:76:46:B0:7F:ED:AA:98:8C:AD:DD:7C:40:7E:52:F9:11:1D:71:85:35:F8:29:5D:27:D6:19:43:90"}}},"request":{"raw":"GET /api/currency/new_timeshar?from=1760664041\u0026to=1760667641\u0026symbol=ETH%2FUSDT\u0026period=1min\u0026lang=zh HTTP/1.1\r\nHost: coinbaseow.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nAuthorization: \r\nContent-Type: application/x-www-form-urlencoded\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://coinbaseow.com/h5/\r\nCookie: angela_session=eyJpdiI6IkNxNklQNE5SY0t3YVlCRXhZVXB0U1E9PSIsInZhbHVlIjoiQnhiSlN4RUdXVmFEclZVNjVlbjRwTzI0K0JhaHBUYTZLcjlkSlAySlZrOU9wSkFZT21XZUxYbnpNbXRkb0U1RjFTWUZrMGpKUVwvbjk3YTRERWhPajR0RnlIb0hMV1AraWpVZnp6ZGlcL2NLeEp5U3o2b3ErOG9wa0dyaHExdk9LdiIsIm1hYyI6Ijg0ZmM2YmE4OWZlNTIyZWRkN2I3NjBkZWY0ZDA4OGUzM2IxNjg1ZTFkMmE1YzUzY2U1NDNlZmZjMDUwZGU2MWYifQ%3D%3D; SITE_TOTAL_ID=3c6c7b94394b9ebde77373f18a7ee7b7\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ncontent-type: application/json\r\nvary: Accept-Encoding\r\ncache-control: no-cache, private\r\ndate: Fri, 17 Oct 2025 02:20:43 GMT\r\naccess-control-allow-origin: *, *\r\naccess-control-allow-headers: Content-Type, Authorization, X-Requested-With, Origin, Content-Type, Cookie, X-CSRF-TOKEN, Accept, Authorization, X-XSRF-TOKEN\r\naccess-control-expose-headers: Authorization, authenticated\r\naccess-control-allow-methods: GET, POST, PUT, DELETE, OPTIONS, GET, POST, PATCH, PUT, OPTIONS\r\naccess-control-allow-credentials: false\r\nset-cookie: angela_session=eyJpdiI6ImhzWmc5THIwaVoxSVVrQ3p5MEhuZXc9PSIsInZhbHVlIjoieks1MkQxSk40K3VUTU1DVFFQVXBxV213SnpLdHlVRDdwYXQwY0x0cXJ0S2dlc08xdnRDVXFxQmtQRGprVVRpY2ViWEoyMHFyaWUrMGxIZjdpOFNZbk4zNzVKamdJRW5WK1pwNkNac29scFwvRnBFczNsQ0tqMVpXcjRDSHUwXC9YcSIsIm1hYyI6ImFiMGRhZjU0OGI1YjNjNjA5OGM0ZTY5YzBhYTNiYjUxOWY3NDBmYjI5MWYwNWY1MDkwOWI4ZWNjNTQ5MTk0ZDIifQ%3D%3D; expires=Fri, 17-Oct-2025 04:20:43 GMT; Max-Age=7200; path=/; httponly\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: quic=\":443\"; h3=\":443\"; h3-29=\":443\"; h3-27=\":443\";h3-25=\":443\"; h3-T050=\":443\"; h3-Q050=\":443\";h3-Q049=\":443\";h3-Q048=\":443\"; h3-Q046=\":443\"; h3-Q043=\":443\"\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":12890,"size_decoded":0,"mime_type":"application/json","magic":"JSON text data","md5":"b2fbe8c1865fdd39093c7b733caf10cb","sha1":"ff21109d5a3fb84691edbda5ccd330a994c42048","sha256":"85202d8e4bf0282cce1b85b650ec3cf5728658b4e270685f1220abbff1b789ce","sha512":"dbbab3421725842f69ad10eba42bb58e08bd10717f744a1b20741532d969503d96beec1e45bbc51ae35ad4a7729926ba37128a7c9d7a8c2576afa4a410a4bc73","ssdeep":"384:iuIpPQq9jYSLMaXn+cqSeoZwymea9aZFcXZoFH5xvezwtNc4kJmT5n6ewSq/fpr/:iuIpPQq9jYSLMaXn+cqSeoZwymea9aZa","tlshash":"03426c44d3bd1160c03b1894bdb35878477e236761838f9a46be0bc299d1ebef159a3b","first_seen":"2025-10-17T02:21:05.22451Z","last_seen":"2025-10-17T02:21:05.22451Z","times_seen":1,"resource_available":false,"data":null}},"time_used":430,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":430,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2025-10-17","alert":"Sinkholed","trigger":"coinbaseow.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2025-10-17","alert":"Sinkholed","trigger":"coinbaseow.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-10-17","alert":"Sinkholed","trigger":"coinbaseow.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"coinbaseow.com/h5/static/image/nav/nav-4.png","fqdn":"coinbaseow.com","domain":"coinbaseow.com","tld":"com"},"ip":{"addr":"202.79.173.8","port":443,"asn":152194,"as":"CTG Server Limited","country":"Singapore","country_code":"SG"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://coinbaseow.com/h5/","date":"2025-10-17T02:20:40.238Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"www.coinbaseoq.shop","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Thu, 09 Oct 2025 07:16:50 GMT","end":"Wed, 07 Jan 2026 07:16:49 GMT"},"fingerprint":{"sha1":"71:AC:C8:1A:43:33:1E:D9:F5:BE:92:DB:27:46:FC:E2:F0:DA:07:A7","sha256":"59:AC:48:87:76:46:B0:7F:ED:AA:98:8C:AD:DD:7C:40:7E:52:F9:11:1D:71:85:35:F8:29:5D:27:D6:19:43:90"}}},"request":{"raw":"GET /h5/static/image/nav/nav-4.png HTTP/1.1\r\nHost: coinbaseow.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://coinbaseow.com/h5/\r\nCookie: angela_session=eyJpdiI6Ik41Zk9jTkxrNjI4NndXNXFSMjN5aWc9PSIsInZhbHVlIjoiaDhmYVljVDVCQTJFeVZnYzNkWndpbEYyNm1wR1RoMm1sWWxTTzRQb1B6eWREd2ZyZjBcL1RKa2lmVldKdUxCK3JPZ1d0NXcyVVM3WVQrZTFuSlpMNFhWYzZ1RVhvTTZCYlV1cXZHd3ZBSGdhaEVxN0J4OWxMVXlcL21XbHFPZnkwYyIsIm1hYyI6IjAwNGU0NDVkZGRiMDQwN2MyOTNlYjJkNTRmMDNmYzQ0YzFkYzFjNDFhY2Y5Yzg0MWQzY2JjNjAzZjUxZjMyZDYifQ%3D%3D; SITE_TOTAL_ID=3c6c7b94394b9ebde77373f18a7ee7b7\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Fri, 17 Oct 2025 02:20:40 GMT\r\ncontent-type: image/png\r\nlast-modified: Thu, 11 Sep 2025 06:31:12 GMT\r\nvary: Accept-Encoding\r\netag: W/\"68c26cb0-49b\"\r\nexpires: Sun, 16 Nov 2025 02:20:40 GMT\r\ncache-control: max-age=2592000\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: quic=\":443\"; h3=\":443\"; h3-29=\":443\"; h3-27=\":443\";h3-25=\":443\"; h3-T050=\":443\"; h3-Q050=\":443\";h3-Q049=\":443\";h3-Q048=\":443\"; h3-Q046=\":443\"; h3-Q043=\":443\"\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":1179,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 46 x 46, 8-bit/color RGBA, non-interlaced","md5":"3b9bd6a518d868bfdf6bc671def3327d","sha1":"0002af2d238c42d44f95ffdecc0ee1957ead1e8e","sha256":"ba5a50079d685b02f29d59f5f4d16331b8c29fa2aff5eed2ffb116d1dfe572b4","sha512":"a17dc0cecdae39b67412c192887ed80d8295ed87c71d29227b916b4f7a0aa9f382677d226091e185b3a503cc5f57140c38277191a84ac2135efd6eaa085c2ab8","ssdeep":"","tlshash":"f021d7efb1c21012c729e2be1c0e9779b62da302a7b8444225c5f892fd890c33354f4e","first_seen":"2023-05-20T12:09:29Z","last_seen":"2026-07-19T00:07:26.706148Z","times_seen":204,"resource_available":false,"data":null}},"time_used":682,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":682,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2025-10-17","alert":"Sinkholed","trigger":"coinbaseow.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2025-10-17","alert":"Sinkholed","trigger":"coinbaseow.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-10-17","alert":"Sinkholed","trigger":"coinbaseow.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"coinbaseow.com/api/getSiteConfig?lang=zh","fqdn":"coinbaseow.com","domain":"coinbaseow.com","tld":"com"},"ip":{"addr":"202.79.173.8","port":443,"asn":152194,"as":"CTG Server Limited","country":"Singapore","country_code":"SG"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"https://coinbaseow.com/h5/","date":"2025-10-17T02:20:40.251Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"www.coinbaseoq.shop","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Thu, 09 Oct 2025 07:16:50 GMT","end":"Wed, 07 Jan 2026 07:16:49 GMT"},"fingerprint":{"sha1":"71:AC:C8:1A:43:33:1E:D9:F5:BE:92:DB:27:46:FC:E2:F0:DA:07:A7","sha256":"59:AC:48:87:76:46:B0:7F:ED:AA:98:8C:AD:DD:7C:40:7E:52:F9:11:1D:71:85:35:F8:29:5D:27:D6:19:43:90"}}},"request":{"raw":"GET /api/getSiteConfig?lang=zh HTTP/1.1\r\nHost: coinbaseow.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nAuthorization: \r\nContent-Type: application/x-www-form-urlencoded\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://coinbaseow.com/h5/\r\nCookie: angela_session=eyJpdiI6Ik41Zk9jTkxrNjI4NndXNXFSMjN5aWc9PSIsInZhbHVlIjoiaDhmYVljVDVCQTJFeVZnYzNkWndpbEYyNm1wR1RoMm1sWWxTTzRQb1B6eWREd2ZyZjBcL1RKa2lmVldKdUxCK3JPZ1d0NXcyVVM3WVQrZTFuSlpMNFhWYzZ1RVhvTTZCYlV1cXZHd3ZBSGdhaEVxN0J4OWxMVXlcL21XbHFPZnkwYyIsIm1hYyI6IjAwNGU0NDVkZGRiMDQwN2MyOTNlYjJkNTRmMDNmYzQ0YzFkYzFjNDFhY2Y5Yzg0MWQzY2JjNjAzZjUxZjMyZDYifQ%3D%3D; SITE_TOTAL_ID=3c6c7b94394b9ebde77373f18a7ee7b7\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ncontent-type: application/json\r\nvary: Accept-Encoding\r\naccess-control-allow-origin: *\r\naccess-control-allow-methods: POST,GET,OPTIONS,DELETE\r\naccess-control-allow-headers: x-requested-with,content-type,Authorization\r\ncache-control: no-cache, private\r\ndate: Fri, 17 Oct 2025 02:20:40 GMT\r\nset-cookie: angela_session=eyJpdiI6IkU5NTd0Yk1pQVhSTUVheklOYU1CNmc9PSIsInZhbHVlIjoiK0RtZCszOFpTMURXV2lcL0p0QjZ4V3N4UmJuZnJDYVZpclkzWDFTZ201TFRuVmJxRVBBR0NnUGI5b0U4UTlNa3BXRHEreFU1VXF3OXNGaDFNdVwvb3RcLzRYRG1YQWlyNUk1cUs4VHE4NmMzOVFpNWdwZ2FRbnVabWJwelBHYUVtcEciLCJtYWMiOiI2Nzk2MDAzZGM5NjIwOTI0YTAxZjczMjVkOGMwNGVlM2Y2YjlkZTQyZTlmMjBjOTUzYjYzMmI4NzlmNjQ5NWI5In0%3D; expires=Fri, 17-Oct-2025 04:20:40 GMT; Max-Age=7200; path=/; httponly\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: quic=\":443\"; h3=\":443\"; h3-29=\":443\"; h3-27=\":443\";h3-25=\":443\"; h3-T050=\":443\"; h3-Q050=\":443\";h3-Q049=\":443\";h3-Q048=\":443\"; h3-Q046=\":443\"; h3-Q043=\":443\"\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":26,"size_decoded":0,"mime_type":"application/json","magic":"JSON text data","md5":"7d1efbbb93bf6803e0430046a02190e6","sha1":"4adda235eb50321b9c27036fdbd63e6f6fd24a14","sha256":"dd3407fe52da9be03003f5d4d82604d15e1fce8b012ea2c5db4830cb94a86a1a","sha512":"ac982e74169ba7085d84260d3cab66c4a18c42126060cf205f7aa5de9621f8514781bffcb7202a5cc03005e0d3d10d7432d5ef3692da0e3c0b4d74aadaa7e32b","ssdeep":"","tlshash":"fb8000080288ac2803020202b8882800828a0082c0a222220808882a830e8a0283232e","first_seen":"2025-04-18T14:40:57.337157Z","last_seen":"2026-04-18T14:47:45.392104Z","times_seen":69,"resource_available":false,"data":null}},"time_used":688,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":688,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2025-10-17","alert":"Sinkholed","trigger":"coinbaseow.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2025-10-17","alert":"Sinkholed","trigger":"coinbaseow.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-10-17","alert":"Sinkholed","trigger":"coinbaseow.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"coinbaseow.com/api/currency/quotation_new?lang=zh","fqdn":"coinbaseow.com","domain":"coinbaseow.com","tld":"com"},"ip":{"addr":"202.79.173.8","port":443,"asn":152194,"as":"CTG Server Limited","country":"Singapore","country_code":"SG"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"https://coinbaseow.com/h5/","date":"2025-10-17T02:20:41.237Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"www.coinbaseoq.shop","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Thu, 09 Oct 2025 07:16:50 GMT","end":"Wed, 07 Jan 2026 07:16:49 GMT"},"fingerprint":{"sha1":"71:AC:C8:1A:43:33:1E:D9:F5:BE:92:DB:27:46:FC:E2:F0:DA:07:A7","sha256":"59:AC:48:87:76:46:B0:7F:ED:AA:98:8C:AD:DD:7C:40:7E:52:F9:11:1D:71:85:35:F8:29:5D:27:D6:19:43:90"}}},"request":{"raw":"GET /api/currency/quotation_new?lang=zh HTTP/1.1\r\nHost: coinbaseow.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nAuthorization: \r\nContent-Type: application/x-www-form-urlencoded\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://coinbaseow.com/h5/\r\nCookie: angela_session=eyJpdiI6IkU5NTd0Yk1pQVhSTUVheklOYU1CNmc9PSIsInZhbHVlIjoiK0RtZCszOFpTMURXV2lcL0p0QjZ4V3N4UmJuZnJDYVZpclkzWDFTZ201TFRuVmJxRVBBR0NnUGI5b0U4UTlNa3BXRHEreFU1VXF3OXNGaDFNdVwvb3RcLzRYRG1YQWlyNUk1cUs4VHE4NmMzOVFpNWdwZ2FRbnVabWJwelBHYUVtcEciLCJtYWMiOiI2Nzk2MDAzZGM5NjIwOTI0YTAxZjczMjVkOGMwNGVlM2Y2YjlkZTQyZTlmMjBjOTUzYjYzMmI4NzlmNjQ5NWI5In0%3D; SITE_TOTAL_ID=3c6c7b94394b9ebde77373f18a7ee7b7\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ncontent-type: application/json\r\nvary: Accept-Encoding\r\naccess-control-allow-origin: *\r\naccess-control-allow-methods: POST,GET,OPTIONS,DELETE\r\naccess-control-allow-headers: x-requested-with,content-type,Authorization\r\ncache-control: no-cache, private\r\ndate: Fri, 17 Oct 2025 02:20:41 GMT\r\nset-cookie: angela_session=eyJpdiI6IlwveTR4N0o4QTNJTWlRdnNpSFBOUjJRPT0iLCJ2YWx1ZSI6IkRFdTRyWjBQc0xzNEsybnZwU3FJWG5sUjhWellva1RRbXhPQTlcL0FMKzJTblFlVXNqbHBOWWpPVEpnZ3l0WTlFMmtNcmp1R0JDc2c3dkVub0xOcUIzRnBUdWsrQWpxa1UrckkyXC9iMTBoMHFQUXFiWTFHd0Y0NUtqWE5nY0ppZ08iLCJtYWMiOiIyN2MwODJlOWRkOTg4MDVjZTBlMDBmOWY2NWQ0NmJkMjIwYjk4YWU4MTgwNGJmZDhmNzM0N2Y5MWM5Yjg3OGY0In0%3D; expires=Fri, 17-Oct-2025 04:20:41 GMT; Max-Age=7200; path=/; httponly\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: quic=\":443\"; h3=\":443\"; h3-29=\":443\"; h3-27=\":443\";h3-25=\":443\"; h3-T050=\":443\"; h3-Q050=\":443\";h3-Q049=\":443\";h3-Q048=\":443\"; h3-Q046=\":443\"; h3-Q043=\":443\"\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":24696,"size_decoded":0,"mime_type":"application/json","magic":"JSON text data","md5":"68125f75f89a981ae6119a48ec28ee67","sha1":"2c7f302e260a1beb466066989910db90d22e1e11","sha256":"18eb3d7b68c2d7ef5860bee9daf1e0af7202cb8dc20ecbddf32a35ae54dc24b9","sha512":"138ab943a320be181a334e7cd249a8bf73a8cfd8d57eb236cbd843b3dbc08c32382eb1f98395877de9f452c985241116205b8a55e4c8c7ca9d05c8969601f32a","ssdeep":"768:pm+RbX94GmbiHIz/o0ys0l15QWPzNCE36a9:NEir","tlshash":"6cb2cf9d322d8a78c2f69ec2dede32a9359075079ec28f85d3dd9fc842c4576e20b512","first_seen":"2025-10-17T02:21:05.245762Z","last_seen":"2025-10-17T02:21:05.245762Z","times_seen":1,"resource_available":false,"data":null}},"time_used":446,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":446,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2025-10-17","alert":"Sinkholed","trigger":"coinbaseow.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2025-10-17","alert":"Sinkholed","trigger":"coinbaseow.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-10-17","alert":"Sinkholed","trigger":"coinbaseow.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"coinbaseow.com/api/currency/new_timeshar?from=1760664041\u0026to=1760667641\u0026symbol=EOS%2FUSDT\u0026period=1min\u0026lang=zh","fqdn":"coinbaseow.com","domain":"coinbaseow.com","tld":"com"},"ip":{"addr":"202.79.173.8","port":443,"asn":152194,"as":"CTG Server Limited","country":"Singapore","country_code":"SG"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"https://coinbaseow.com/h5/","date":"2025-10-17T02:20:44.624Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"www.coinbaseoq.shop","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Thu, 09 Oct 2025 07:16:50 GMT","end":"Wed, 07 Jan 2026 07:16:49 GMT"},"fingerprint":{"sha1":"71:AC:C8:1A:43:33:1E:D9:F5:BE:92:DB:27:46:FC:E2:F0:DA:07:A7","sha256":"59:AC:48:87:76:46:B0:7F:ED:AA:98:8C:AD:DD:7C:40:7E:52:F9:11:1D:71:85:35:F8:29:5D:27:D6:19:43:90"}}},"request":{"raw":"GET /api/currency/new_timeshar?from=1760664041\u0026to=1760667641\u0026symbol=EOS%2FUSDT\u0026period=1min\u0026lang=zh HTTP/1.1\r\nHost: coinbaseow.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nAuthorization: \r\nContent-Type: application/x-www-form-urlencoded\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://coinbaseow.com/h5/\r\nCookie: angela_session=eyJpdiI6InBhTnNIQTJBblwvRTdSN0VKWVBnTlZnPT0iLCJ2YWx1ZSI6IkNcL2U4cmEwbWloNkc3M3Rrb1RYMEFIYjdxeW9uS1o5S25Kd3JZdU9QSXY3MjhVNlZleDA2aGR6UDdSeFwvY3FqKzlBNVNDSTYwS3hNMFF1dzAzTGhhUlRoVnRYdTJIR2xiXC9qS1lIRk8ySFpYQnJ6T1NtVllIU1JJZ2dXNHdGbklIIiwibWFjIjoiYmQ0ZTQ5OTQ1ZDQ3NjIwNWIzNzc1MDI3MTI3YmJhMjNmNWZjMTNjMjlhZTZlMGMwM2EyZGQ2ODNhYzg4NWUwOCJ9; SITE_TOTAL_ID=3c6c7b94394b9ebde77373f18a7ee7b7\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ncontent-type: application/json\r\nvary: Accept-Encoding\r\ncache-control: no-cache, private\r\ndate: Fri, 17 Oct 2025 02:20:44 GMT\r\naccess-control-allow-origin: *, *\r\naccess-control-allow-headers: Content-Type, Authorization, X-Requested-With, Origin, Content-Type, Cookie, X-CSRF-TOKEN, Accept, Authorization, X-XSRF-TOKEN\r\naccess-control-expose-headers: Authorization, authenticated\r\naccess-control-allow-methods: GET, POST, PUT, DELETE, OPTIONS, GET, POST, PATCH, PUT, OPTIONS\r\naccess-control-allow-credentials: false\r\nset-cookie: angela_session=eyJpdiI6ImhqTTVwZ1JhRllwbDFlVTArekExT1E9PSIsInZhbHVlIjoiZTRxeTk1SjJPRyt4Vm82Q1g0dnJIMTBYQ2hFQ2JCSFVPSjhUYTh0YnlRRE9jNDY1UStEWUppY3pneUE2ZCtuRGt0eEo4M0hra0pTZERRcjg0RUdJaUJDV2NmaGJiXC9OS3hGXC9BNnJmM3ZVbFM5RFpaMkxKWlhzdko5ZVJXSlBrSSIsIm1hYyI6ImUzMGM2Y2I1ZTRkZmEyZjcxN2Y2ZmJhOWU2MmRkZTJiZTIwZTgwMjRhZGE5OTQwM2RhNjgyMDdiMjMyNmFhNTgifQ%3D%3D; expires=Fri, 17-Oct-2025 04:20:44 GMT; Max-Age=7200; path=/; httponly\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: quic=\":443\"; h3=\":443\"; h3-29=\":443\"; h3-27=\":443\";h3-25=\":443\"; h3-T050=\":443\"; h3-Q050=\":443\";h3-Q049=\":443\";h3-Q048=\":443\"; h3-Q046=\":443\"; h3-Q043=\":443\"\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":36,"size_decoded":0,"mime_type":"application/json","magic":"JSON text data","md5":"136b02255a623f7c44544d5266e21ee6","sha1":"d16732370a4b4c9c029637920cd26afa2d422390","sha256":"fcca40d39e392ed1fed0515a2ed890128e3a461bc12240751cf2df7506160f86","sha512":"cc52574d8ea557037eccc98a0d0831b18956f9f6dc5d9c88dcb4b5a4a5abc88ba79470d35c772cc38bd8bc28159b911093b3375b72634bc6bea5ee8bc1c8e6c2","ssdeep":"","tlshash":"ba8000a2280e2c830c0a38cc880c8b8220e8a0808a200320ce8ea238cb080acb883830","first_seen":"2023-04-07T14:59:17Z","last_seen":"2026-07-23T15:53:23.475087Z","times_seen":219,"resource_available":false,"data":null}},"time_used":423,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":423,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2025-10-17","alert":"Sinkholed","trigger":"coinbaseow.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2025-10-17","alert":"Sinkholed","trigger":"coinbaseow.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-10-17","alert":"Sinkholed","trigger":"coinbaseow.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"coinbaseow.com/h5","fqdn":"coinbaseow.com","domain":"coinbaseow.com","tld":"com"},"ip":{"addr":"202.79.173.8","port":443,"asn":152194,"as":"CTG Server Limited","country":"Singapore","country_code":"SG"},"is_navigation_request":true,"resource_type":"document","requested_by":"","date":"2025-10-17T02:20:37.249Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"www.coinbaseoq.shop","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Thu, 09 Oct 2025 07:16:50 GMT","end":"Wed, 07 Jan 2026 07:16:49 GMT"},"fingerprint":{"sha1":"71:AC:C8:1A:43:33:1E:D9:F5:BE:92:DB:27:46:FC:E2:F0:DA:07:A7","sha256":"59:AC:48:87:76:46:B0:7F:ED:AA:98:8C:AD:DD:7C:40:7E:52:F9:11:1D:71:85:35:F8:29:5D:27:D6:19:43:90"}}},"request":{"raw":"GET /h5 HTTP/1.1\r\nHost: coinbaseow.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nCookie: angela_session=eyJpdiI6Ik41Zk9jTkxrNjI4NndXNXFSMjN5aWc9PSIsInZhbHVlIjoiaDhmYVljVDVCQTJFeVZnYzNkWndpbEYyNm1wR1RoMm1sWWxTTzRQb1B6eWREd2ZyZjBcL1RKa2lmVldKdUxCK3JPZ1d0NXcyVVM3WVQrZTFuSlpMNFhWYzZ1RVhvTTZCYlV1cXZHd3ZBSGdhaEVxN0J4OWxMVXlcL21XbHFPZnkwYyIsIm1hYyI6IjAwNGU0NDVkZGRiMDQwN2MyOTNlYjJkNTRmMDNmYzQ0YzFkYzFjNDFhY2Y5Yzg0MWQzY2JjNjAzZjUxZjMyZDYifQ%3D%3D; SITE_TOTAL_ID=3c6c7b94394b9ebde77373f18a7ee7b7\r\nUpgrade-Insecure-Requests: 1\r\nSec-Fetch-Dest: document\r\nSec-Fetch-Mode: navigate\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 301 Moved Permanently\r\nserver: nginx\r\ndate: Fri, 17 Oct 2025 02:20:37 GMT\r\ncontent-type: text/html\r\ncontent-length: 162\r\nlocation: https://coinbaseow.com/h5/\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: quic=\":443\"; h3=\":443\"; h3-29=\":443\"; h3-27=\":443\";h3-25=\":443\"; h3-T050=\":443\"; h3-Q050=\":443\";h3-Q049=\":443\";h3-Q048=\":443\"; h3-Q046=\":443\"; h3-Q043=\":443\"\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"301","status_text":"Moved Permanently","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":1001,"size_decoded":0,"mime_type":"text/html","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-07-25T04:51:46.086242Z","times_seen":17521484,"resource_available":true,"data":null}},"time_used":347,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":347,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2025-10-17","alert":"Sinkholed","trigger":"coinbaseow.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2025-10-17","alert":"Sinkholed","trigger":"coinbaseow.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-10-17","alert":"Sinkholed","trigger":"coinbaseow.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}}]}