{"report_id":"12fbf556-080d-4625-98c1-04fae5d855a3","version":6,"status":"done","tags":[],"date":"2026-02-03T21:13:31Z","url":{"schema":"https","addr":"www.metamaskirstelkmgt.cyou/","fqdn":"www.metamaskirstelkmgt.cyou","domain":"metamaskirstelkmgt.cyou","tld":"cyou"},"ip":{"addr":"13.203.136.234","port":0,"asn":16509,"as":"AMAZON-02","country":"India","country_code":"IN"},"final":{"url":{"schema":"https","addr":"www.metamaskirstelkmgt.cyou/","fqdn":"www.metamaskirstelkmgt.cyou","domain":"metamaskirstelkmgt.cyou","tld":"cyou"},"title":"metamaskirstelkmgt.cyou/","dom":{"size":125358,"mime_type":"text/html; charset=utf-8","magic":"JavaScript source, Unicode text, UTF-8 text, with very long lines (1804)","md5":"6b2908d13735a6c0305edc96743479ad","sha1":"cda31dba6310ea0d243ee37d97cda92a94517ac3","sha256":"fae383cde51ef63b95ceaa2998d6368d12dbbde290d951850529979a19a7e05d","sha512":"524f3ccc854b2bf9824149dfdf5f3a7ea7893d3529330dd1e1e5a512dc3615554689ab6464a28ee5973b701e89fdd3aab807abeebe9feac6a1eed6059ed004e0","ssdeep":"1536:WkrB9uvPOHkvpJzHItcASG+pChf1pnhLjGNauciFM7+OW/EN2zT33zG4PFo4FM4f:WuHbnhLjVF+OW/NzGXhmrWM","tlshash":"26c3d91173a460662737908adc3bee9e3a70e207a1065ad4ff9c50b93fc6c399da754c","dom_hash":"domhash410c5d62fd61e8f0d868927ac802ce61","first_seen":"2026-02-03T21:13:38.932575Z","last_seen":"2026-02-03T21:13:38.932575Z","times_seen":1,"resource_available":false,"data":null}},"submit":{"url":{"schema":"https","addr":"www.metamaskirstelkmgt.cyou/","fqdn":"www.metamaskirstelkmgt.cyou","domain":"metamaskirstelkmgt.cyou","tld":"cyou"},"ip":{"addr":"13.203.136.234","port":0,"asn":16509,"as":"AMAZON-02","country":"India","country_code":"IN"},"tags":null,"meta":null},"settings":{"access":"public","device_type":"desktop","expires_at":"2027-03-10T21:13:31Z","useragent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0","referer":"","cookies":null,"exit_node":"z0yflva4pidy47h"},"stats":{"alert_count":{"ids":0,"urlquery":0,"analyzer":2}},"detection":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-02-03","alert":"Sinkholed","trigger":"www.metamaskirstelkmgt.cyou","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-02-03","alert":"Sinkholed","trigger":"www.metamaskirstelkmgt.cyou","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null},"summary":[{"fqdn":"www.metamaskirstelkmgt.cyou","ip":{"addr":"13.203.136.234","port":443,"asn":16509,"as":"AMAZON-02","country":"India","country_code":"IN"},"domain_registered":"2026-01-13","domain_rank":0,"first_seen":"2026-02-03T21:13:34.094227Z","last_seen":"2026-02-03T21:13:34.094227Z","alert_count":72,"request_count":36,"received_data":4589199,"sent_data":18767,"comment":"","tags":null,"fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"PHP","description":"PHP is a general-purpose scripting language used for web development.","website":"https://php.net","common_platform_enumeration":"cpe:2.3:a:php:php:*:*:*:*:*:*:*:*","icon":"PHP.svg","categories":["Programming languages"]},{"name":"Vue.js","description":"Vue.js is an open-source model–view–viewmodel JavaScript framework for building user interfaces and single-page applications.","website":"https://vuejs.org","common_platform_enumeration":"","icon":"vue.svg","categories":["JavaScript frameworks"]},{"name":"jQuery:3.2.1","description":"jQuery is a JavaScript library which is a free, open-source software designed to simplify HTML DOM tree traversal and manipulation, as well as event handling, CSS animation, and Ajax.","website":"https://jquery.com","common_platform_enumeration":"cpe:2.3:a:jquery:jquery:*:*:*:*:*:*:*:*","icon":"jQuery.svg","categories":["JavaScript libraries"]},{"name":"Clipboard.js","description":"","website":"https://clipboardjs.com/","common_platform_enumeration":"","icon":"Clipboard.js.svg","categories":["JavaScript libraries"]}]}],"files":null,"artifacts":{"windows_shortcuts":null,"files":null,"telegram":null,"pdfs":null,"clipboard":null},"sensors":{"ids":null,"analyzer":null,"urlquery":null},"javascript":{"script":[{"url":{"schema":"https","addr":"www.metamaskirstelkmgt.cyou/","fqdn":"www.metamaskirstelkmgt.cyou","domain":"metamaskirstelkmgt.cyou","tld":"cyou"},"ip":{"addr":"13.203.136.234","port":443,"asn":16509,"as":"AMAZON-02","country":"India","country_code":"IN"},"introduction_type":"scriptElement","is_inline":true,"md5":"535f1b932f19d3024f6a7018bbac71f2","sha1":"4e13396d0e06ed8437d5e79cf10dbff3e0ecdb8f","sha256":"47c8dd44e411350fddcde22aa0fac45b83a5b8f01a6d03885b1b4dd951c1bca4","sha512":"bb85e83876b14e5c61defb5857fd3e8fa7c99f9a69a24ce19588df0203c54acb37ddab3cb587c05bdd622761a8fec95f305f5907a917afc92e5dc75d8b478e72","ssdeep":"","tlshash":"81e068c360b7294c02208156304ac0035fa60873dfc288613c8c77a58ff9f5bc56a8a9","size":400,"data":"","first_seen":"2024-08-22T17:15:49.993005Z","last_seen":"2026-05-24T17:34:48.448279Z","times_seen":12,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"www.metamaskirstelkmgt.cyou/assets/index/js/web3provider.js","fqdn":"www.metamaskirstelkmgt.cyou","domain":"metamaskirstelkmgt.cyou","tld":"cyou"},"ip":{"addr":"13.203.136.234","port":443,"asn":16509,"as":"AMAZON-02","country":"India","country_code":"IN"},"introduction_type":"scriptElement","is_inline":false,"md5":"ecd0acbd0f232a69f443beec9cd608bf","sha1":"1bbb9cee94841cece182da632767fa43970eb013","sha256":"54335e7705b99ad9f87bd7296dfe88f6c8b78f16703f9ecc27e43a62b5be765e","sha512":"e632544468f0d6d6e6ff8dade483d70f2f3ba38dc222a1e7f1c1fdcdb7d2a1615df52fce2d909ff654d71b942306a50d1e62fdf430628e527e70ead3cc6dea68","ssdeep":"6144:W47GR6PGawV6G7MzqnTaO8V4bHEzQva4qUY2OhwznWoxACNvmsZ4KDGAmq+8q+2Z:XGwjw9nHAamsZ3GAOqwJGPv6","tlshash":"bc15f984b664b061839a65e0043f540ff27aba2d780b44bcf654d8f6bcbd989553bf38","size":955210,"data":"","first_seen":"2023-03-07T12:26:47Z","last_seen":"2026-08-15T02:09:38.792236Z","times_seen":510,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"www.metamaskirstelkmgt.cyou/","fqdn":"www.metamaskirstelkmgt.cyou","domain":"metamaskirstelkmgt.cyou","tld":"cyou"},"ip":{"addr":"13.203.136.234","port":443,"asn":16509,"as":"AMAZON-02","country":"India","country_code":"IN"},"introduction_type":"scriptElement","is_inline":true,"md5":"f5a6eded6149a61e630df6df9f558f9e","sha1":"5b5e33c6c0b1a932670c22986fba5e04fcc5dad1","sha256":"8f7aec65b523575a28d8329e4a642fe6672899df903fe8de6a03bed50bb994c9","sha512":"31a320fd912a037b1a59d663c5242dc2d79302788b9f3a4d83cfdd6f20e4b80772e97402e613fad42193e7a069bc095bae2c471e235be15f0f8c78de02430f13","ssdeep":"","tlshash":"4101e01a7abf256043af713b6bae7b4531314047150cd9053d3c4bd12f78d8624ad6dd","size":659,"data":"","first_seen":"2026-02-03T21:13:39.040664Z","last_seen":"2026-02-03T21:13:39.040664Z","times_seen":1,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"www.metamaskirstelkmgt.cyou/assets/index/js/ethers-v4.min.js","fqdn":"www.metamaskirstelkmgt.cyou","domain":"metamaskirstelkmgt.cyou","tld":"cyou"},"ip":{"addr":"13.203.136.234","port":443,"asn":16509,"as":"AMAZON-02","country":"India","country_code":"IN"},"introduction_type":"scriptElement","is_inline":false,"md5":"0e66b864a27c5961a702e18683961608","sha1":"febc146fcf4c2d021f8635670ce4b2f35232e8e7","sha256":"2f426ca96f459f9229cf53665db2de4ec82d15ce49f767915378d87f733ccf9a","sha512":"917e5aa6a7aa64f2dadfe49152f1f6f3107cdc8bce974ed47e364bfcb060267081cfeb2f7cecee4a458828ed822ee9729d97d1bc2f8b47335553e1925ee4eecd","ssdeep":"3072:IMVv7CFGHyjUW15Co8psvoZ0pDrDQciPOP24fuayKqlKT4D2no:IvBfiqDQvPOP2TaytwTg2o","tlshash":"c0541b8472a0b062939629a4142f200bf27bb92d588d046cf745d8f77df99c99a3bf35","size":303580,"data":"","first_seen":"2023-03-07T14:42:37Z","last_seen":"2026-08-12T17:58:04.997994Z","times_seen":50,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"www.metamaskirstelkmgt.cyou/assets/index/js/bignumber.min.js","fqdn":"www.metamaskirstelkmgt.cyou","domain":"metamaskirstelkmgt.cyou","tld":"cyou"},"ip":{"addr":"13.203.136.234","port":443,"asn":16509,"as":"AMAZON-02","country":"India","country_code":"IN"},"introduction_type":"scriptElement","is_inline":false,"md5":"220b87873ab81287f915af82e3ba9a33","sha1":"ced2ebc27d644716effa64115643dd1770ba04eb","sha256":"266103c2cedfaf94d60f5a638555639fb2b86f2b66386660fd3d057715ebf463","sha512":"ddd12920edadffa6de43bed4fda62056a26999291cbd6b9314ee1684242b4a2dad49057753e938a65c122a554ec4a89bb2777a67fd1ebe60a5b0c9782d567b22","ssdeep":"384:W/NxaJsOM+a9fxrSZwieoa+gPIbMPzvP22niiXuB/CeTa4pLG950/GrVh:0xdxcZ9epPzP2/VlTDiX0/6","tlshash":"e582fcd875e3f09d62ff20e100e75443e17a9f0ba84c1976a2509496b831ddba2aff35","size":18565,"data":"","first_seen":"2023-03-07T12:03:15Z","last_seen":"2026-08-15T22:28:30.117877Z","times_seen":826,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"www.metamaskirstelkmgt.cyou/assets/index/js/w3model.js","fqdn":"www.metamaskirstelkmgt.cyou","domain":"metamaskirstelkmgt.cyou","tld":"cyou"},"ip":{"addr":"13.203.136.234","port":443,"asn":16509,"as":"AMAZON-02","country":"India","country_code":"IN"},"introduction_type":"scriptElement","is_inline":false,"md5":"aac4569bbff2c557800aa919fb86114e","sha1":"d19621d1d38e488b417c28b3efd879b481566d80","sha256":"5851c751870f4d385689f84d0e346c92234a1c7776f98099222eb30565370864","sha512":"c7498c4cbc7f499a907eadf8de3895070e007505654dd31579067b2de7075a0fb5a1acf3b869d68e0e31ca3bd3c5b99c27a14e6cdf5401d5c25e546c579753a0","ssdeep":"6144:g76dr/jrE/0NNWS9UO2/HP2jz05O1HaeJ3qZEZDj9+b+Q88MzfFNo8vq5:O6d9DZzaneYZEl5+qQ8zztN85","tlshash":"8394aee93582f42157f366b740af1806b33d691b140c88a0f255edd5e8f84aa913bff9","size":429874,"data":"","first_seen":"2023-03-07T12:26:47Z","last_seen":"2026-08-12T17:58:05.025374Z","times_seen":61,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"www.metamaskirstelkmgt.cyou/","fqdn":"www.metamaskirstelkmgt.cyou","domain":"metamaskirstelkmgt.cyou","tld":"cyou"},"ip":{"addr":"13.203.136.234","port":443,"asn":16509,"as":"AMAZON-02","country":"India","country_code":"IN"},"introduction_type":"Function","is_inline":false,"md5":"29d0c84b9d1d8da446a6062c6a840ad9","sha1":"6d6b3a6065667c7c50d92f3889c85ed65a9ad784","sha256":"3c3cbdb71d0d2c22f504f4d63d8a6ffe8d250cde7e58300619be35b6bbab26a1","sha512":"52cfcbf2f7c3521c5a6c6120099ee6822d16e04ffbc04720da925a11242c8c2050f9cfc8d864a6d39a0036ac599f701080195a29a7c5e8d3e9308b91f9f0390f","ssdeep":"","tlshash":"428004d533c350004753117c04571cc4d034447014444d405040d4531c570315115c7c","size":37,"data":"","first_seen":"2023-04-11T21:31:25Z","last_seen":"2026-08-21T06:22:30.295976Z","times_seen":746602,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"www.metamaskirstelkmgt.cyou/assets/index/js/layer.js","fqdn":"www.metamaskirstelkmgt.cyou","domain":"metamaskirstelkmgt.cyou","tld":"cyou"},"ip":{"addr":"13.203.136.234","port":443,"asn":16509,"as":"AMAZON-02","country":"India","country_code":"IN"},"introduction_type":"scriptElement","is_inline":false,"md5":"c07601c9dc7a051f684ada8b5a588c1e","sha1":"10b905cb285468743b548c66ec0a54f7204ed392","sha256":"96f235f5991ceb8e21a80d7090eced3d3792b451b52e3614713a07e23d1d563c","sha512":"d14baec3781b4ad8aa2b284184d7d02be413ca75df4ec69f3274f1acaa1dc71dc51f552a5e0d8dc74ae0f4326031512a11bd53bf90a6fd869493f78ba7810ea7","ssdeep":"384:B13Cih5R93iKTtXSt/KrGriu46K+Lxz6PTElH0jlhpPtwo:B1Siz3i0QtvTKiFSb2o","tlshash":"72a2c76a755034976323906ad10f7a0b31b21d24d7078128f22bb4be1dbcd99a2b7f5f","size":22724,"data":"","first_seen":"2023-04-07T18:53:04Z","last_seen":"2026-08-16T22:58:43.43797Z","times_seen":11308,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"www.metamaskirstelkmgt.cyou/assets/index/js/clipboard.min.js","fqdn":"www.metamaskirstelkmgt.cyou","domain":"metamaskirstelkmgt.cyou","tld":"cyou"},"ip":{"addr":"13.203.136.234","port":443,"asn":16509,"as":"AMAZON-02","country":"India","country_code":"IN"},"introduction_type":"scriptElement","is_inline":false,"md5":"0ada63b6e3a8a44f2b90b59ea02bcc76","sha1":"d95e207a62c5c223610cad1b3a8e01ac96a185ad","sha256":"6a570be3a0d236133803873c360529709de838739848397c76c9186ff6bf3bb0","sha512":"d9f26d0c63d1f4a7397d1e3ef622d6121f55da2c6685a45aeb647e53a32cea0ba833482630cb9b46a0ef25bc68c8c820378b8dbf8d3566956c2e114dcaad1269","ssdeep":"192:YCHX4U7153pB7BoWsBwuLJoHu4wamacW/C8ZU10QkAVJNeSjSUzo:YTe36WsB9LJqwPVWacJQnjSUzo","tlshash":"95229658729071b196e760a9513f424bf332a469609a80d4b239d8e1bdbcdce5427f38","size":10488,"data":"","first_seen":"2023-04-08T20:30:18Z","last_seen":"2026-08-17T13:06:37.140557Z","times_seen":106,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"www.metamaskirstelkmgt.cyou/assets/index/js/lang2.js","fqdn":"www.metamaskirstelkmgt.cyou","domain":"metamaskirstelkmgt.cyou","tld":"cyou"},"ip":{"addr":"13.203.136.234","port":443,"asn":16509,"as":"AMAZON-02","country":"India","country_code":"IN"},"introduction_type":"scriptElement","is_inline":false,"md5":"268ec6fad7ccaf24dd7e973fefe6042d","sha1":"dfa79c5865dcc56ba53cc0894c3731f714ad60d8","sha256":"11ba5b9aa1b45aec2da18c50c65deb801e81f873cf1af54aae8502ec3ed5de94","sha512":"e42714c97783a52f10215c8ae50e7bdffac37b0f67a0ae172dfe4157b3c987106d49965f83617d5e06491d791ef852ef57fd9ade0fdb39ec08e79024549df9d5","ssdeep":"3072:HIDkCD9Fn90I7kAKK2Kh6OOQw4VCtl3Op:oDoIkKMOOQwoU6","tlshash":"48a3c5fb458b1489102ea20ca2cd350ba65d51bbbf123a013bddb1393f8d59dc4b9b6d","size":104644,"data":"","first_seen":"2026-02-03T21:13:38.944446Z","last_seen":"2026-02-03T21:13:38.944446Z","times_seen":1,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"www.metamaskirstelkmgt.cyou/","fqdn":"www.metamaskirstelkmgt.cyou","domain":"metamaskirstelkmgt.cyou","tld":"cyou"},"ip":{"addr":"13.203.136.234","port":443,"asn":16509,"as":"AMAZON-02","country":"India","country_code":"IN"},"introduction_type":"scriptElement","is_inline":true,"md5":"796bd260533219066747878460dfef7a","sha1":"29568c9f23d538b2d8685271ad18177c64c93bed","sha256":"d92efd96638c3106aab8da4bb7085d13bc77b5e67d4995893b723c995087a7b9","sha512":"aeb4e36b4ecbb68457868f49b1247a0687ce27d08be02fabf709fc955271940b6f34b1f92979031b24238368d76572da209e534796136ef9c959a8f08fc3e324","ssdeep":"768:dfYe2GNauU9ih7hJA9/1+OW/EN3mzT33zc:KjGNauciFM7+OW/EN2zT33zc","tlshash":"06139605b2f819141327203e48bf6489a938b14b454eed04beada6d09fcdd39e9e77dc","size":42842,"data":"","first_seen":"2026-02-03T21:13:39.043327Z","last_seen":"2026-02-03T21:13:39.043327Z","times_seen":1,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"www.metamaskirstelkmgt.cyou/","fqdn":"www.metamaskirstelkmgt.cyou","domain":"metamaskirstelkmgt.cyou","tld":"cyou"},"ip":{"addr":"13.203.136.234","port":443,"asn":16509,"as":"AMAZON-02","country":"India","country_code":"IN"},"introduction_type":"scriptElement","is_inline":true,"md5":"e70638753446c4d173a851dc9ccd6a8c","sha1":"ac751c7bf0254d4fd2abe4ca93f24b2e579dc3e0","sha256":"c6ad7bae9808f33993000cad13e4896eeadc95d9ed2ac9843ebf563ae80a00b4","sha512":"0e619c27650719b3bd9ba7b94332ea59fdc4fe86e7ed2a6b46baddac1a3ee10f7dd0322602f3bdbdbdac2d444cef8b71e551772c0f1dde23a8ad797d59e846c3","ssdeep":"","tlshash":"cab092081168c1234a6f20968b9fb2853424101fa709e409341f8384ef6446782455df","size":127,"data":"","first_seen":"2026-02-03T21:13:39.046048Z","last_seen":"2026-02-03T21:13:39.046048Z","times_seen":1,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"www.metamaskirstelkmgt.cyou/","fqdn":"www.metamaskirstelkmgt.cyou","domain":"metamaskirstelkmgt.cyou","tld":"cyou"},"ip":{"addr":"13.203.136.234","port":443,"asn":16509,"as":"AMAZON-02","country":"India","country_code":"IN"},"introduction_type":"Function","is_inline":false,"md5":"973e831379b94d060af9b2e9bc78f49e","sha1":"83448e2204ac7f3afafeb07ffa3d2b92a7e31ce2","sha256":"814148cbc3bea44c7786594a53ca13a6326ad08dfd73abbb11e82c285a15109b","sha512":"45e6d9b25a24e2c9a1c34173df38587cad6d7d85753f8211d4e0dff58e73be9e4cb99724024ead994c6cef70aaa958f9f15fb628bc9d83a52b39ca44844f8080","ssdeep":"","tlshash":"5c90027528c2201060173256547658e601308030d4588d51010498a1985543156065ac","size":49,"data":"","first_seen":"2023-04-11T21:45:58Z","last_seen":"2026-08-21T04:50:10.644027Z","times_seen":38329,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"www.metamaskirstelkmgt.cyou/","fqdn":"www.metamaskirstelkmgt.cyou","domain":"metamaskirstelkmgt.cyou","tld":"cyou"},"ip":{"addr":"13.203.136.234","port":443,"asn":16509,"as":"AMAZON-02","country":"India","country_code":"IN"},"introduction_type":"Function","is_inline":false,"md5":"29d0c84b9d1d8da446a6062c6a840ad9","sha1":"6d6b3a6065667c7c50d92f3889c85ed65a9ad784","sha256":"3c3cbdb71d0d2c22f504f4d63d8a6ffe8d250cde7e58300619be35b6bbab26a1","sha512":"52cfcbf2f7c3521c5a6c6120099ee6822d16e04ffbc04720da925a11242c8c2050f9cfc8d864a6d39a0036ac599f701080195a29a7c5e8d3e9308b91f9f0390f","ssdeep":"","tlshash":"428004d533c350004753117c04571cc4d034447014444d405040d4531c570315115c7c","size":37,"data":"","first_seen":"2023-04-11T21:31:25Z","last_seen":"2026-08-21T06:22:30.295976Z","times_seen":746602,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"www.metamaskirstelkmgt.cyou/assets/index/js/evmchain.js","fqdn":"www.metamaskirstelkmgt.cyou","domain":"metamaskirstelkmgt.cyou","tld":"cyou"},"ip":{"addr":"13.203.136.234","port":443,"asn":16509,"as":"AMAZON-02","country":"India","country_code":"IN"},"introduction_type":"scriptElement","is_inline":false,"md5":"103cf7a3766e010c9499d24721aaf984","sha1":"ca4e27f04aa5be91c32e0942583f39bca5277a1f","sha256":"d93c05813c158faf533a332c1b49f2a9f0432e0454fdefd1a2c9f11428b7a4e9","sha512":"373140cc684cfd8e2aaaf34a7da1e0a5f4bffd39a86c6979203068f9e2991f33be45968c05076b2d06042de30952e9076eb054c27bae0d4d5c91f94db5923b67","ssdeep":"384:3LyedkdCfFDM33MPH0mz7Cb4h/iUJbstZ4xWXZrTOHnf+RJvDqvGKifPauiy1Bes:SCtC8bh9gWe3FptN9Ra6SAzjQiKTsDn","tlshash":"daa2d9f3d354a98e8b7990cc1ce93719c1078c89c45e41feea964aded8f6067a119f23","size":22657,"data":"","first_seen":"2023-03-07T01:24:55Z","last_seen":"2026-08-16T07:06:37.588566Z","times_seen":729,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"www.metamaskirstelkmgt.cyou/assets/index/js/web3.min.js","fqdn":"www.metamaskirstelkmgt.cyou","domain":"metamaskirstelkmgt.cyou","tld":"cyou"},"ip":{"addr":"13.203.136.234","port":443,"asn":16509,"as":"AMAZON-02","country":"India","country_code":"IN"},"introduction_type":"scriptElement","is_inline":false,"md5":"50b331ceab5cb032bac85cf6eaf4c513","sha1":"9b4f1751f59e6fb18b266d96adefff3b32ecdf48","sha256":"efeff3f4191acfc1a20fef7e327521c4a696edf0dca7a2d86d4045a49a5cde17","sha512":"4bf3be807e6ccecffefdd532966d79269fc9649b08a169694953304fac804b8461ee46b36915314b3141c27a84dbf8c1a6172bef1a2f4d025aa29884640ce2f8","ssdeep":"6144:9ggS4Whgg8WMRelCSJ70OSJeXiqP70X+C8kSlXnfCM7XZfcwJ4ywB8b2IRQFwfCD:K/K+C8R67GFCamsZKpams2JKAF","tlshash":"1c55d9c4b6907061c3666a90442f900ee33ef96d384d016dfa57ecf77cb8a89552af39","size":1337884,"data":"","first_seen":"2023-04-20T20:54:22Z","last_seen":"2026-08-18T01:43:12.648269Z","times_seen":155,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"www.metamaskirstelkmgt.cyou/assets/index/js/abi.js","fqdn":"www.metamaskirstelkmgt.cyou","domain":"metamaskirstelkmgt.cyou","tld":"cyou"},"ip":{"addr":"13.203.136.234","port":443,"asn":16509,"as":"AMAZON-02","country":"India","country_code":"IN"},"introduction_type":"scriptElement","is_inline":false,"md5":"7686cb141a314863e4225a0459e04918","sha1":"d0c3408a5a3c1f7db38f9796eea2ae6d31f707d1","sha256":"239eaf9fdf247ae60f252352b6750733a3270b84075c455ad87464a935c15ac9","sha512":"bc8a2a470e2eac3dcfa4d78928685a2c49011e061f76efa494467cd169b7215b8c720d28645c7fb9fe7778ddc91a812fed8968291a80fc06ac307f53e647fd2f","ssdeep":"96:p8OOjUOj8lhj8VLMj8eLMj8HLMjMRLSOjtOjylZj+zjMtLMjUjVJMjqJntHeHwIX:AI+Z","tlshash":"a2a160b6e42e9c874889269419e90613756041a38ccdad037a9c463d5feec2f947f71f","size":4831,"data":"","first_seen":"2024-08-21T07:09:15.373416Z","last_seen":"2026-08-12T17:58:05.018394Z","times_seen":39,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"www.metamaskirstelkmgt.cyou/assets/index/js/scroll.js","fqdn":"www.metamaskirstelkmgt.cyou","domain":"metamaskirstelkmgt.cyou","tld":"cyou"},"ip":{"addr":"13.203.136.234","port":443,"asn":16509,"as":"AMAZON-02","country":"India","country_code":"IN"},"introduction_type":"scriptElement","is_inline":false,"md5":"76ab7009a8811f47b2e611d3de470c6f","sha1":"382a4768c62e1afb8dc3a161a18627e228a01a18","sha256":"4a738e36d8741e7a5e8aa7be3967b81bb2dbb09e9b9299e38400c506bafa1b75","sha512":"0099c6c33252701e7a5fc05221e010a868d7acb81f81be56648f4746a9c74b89a6dfc548cd02f76fb5e5050dae2f99ce963418efbab7faeb267cc17947d3dbac","ssdeep":"","tlshash":"2a1189f5b74f20ae6aa23023807e5408fc1dd8334816546bb99554e85cb8908a3aaf79","size":1082,"data":"","first_seen":"2024-08-21T07:09:15.365586Z","last_seen":"2026-02-03T21:13:39.004445Z","times_seen":6,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"www.metamaskirstelkmgt.cyou/assets/index/js/jquery-3.2.1.min.js","fqdn":"www.metamaskirstelkmgt.cyou","domain":"metamaskirstelkmgt.cyou","tld":"cyou"},"ip":{"addr":"13.203.136.234","port":443,"asn":16509,"as":"AMAZON-02","country":"India","country_code":"IN"},"introduction_type":"scriptElement","is_inline":false,"md5":"0fca26b5a37a66d68d0f4406976be4b5","sha1":"ee000eb654b3bd37185665d3901e93b34ce1aa52","sha256":"8c2812ded6436715279f8fd8db58de307aa39ab0296fe3cf0e879067c51e9b18","sha512":"cf010995991a8f8b50cfb4b466d3b457b0a6addc4f2fd96c48c33d40ac251de400894828ccd99662b13fc9ca25c676ef0aee05faa4910530ff9996d03c411645","ssdeep":"1536:GYE1JVoiB9JqZdXXe2pD3PgoIiulrUdTJSFk/zkZ4HjL5o8srOaS9TwD6b7/Jp94:t4J+R3jL5TCOauTwD6FdnCVQNea98HrF","tlshash":"7a93d7d9b6d6706287b734a851bf410bb17aa8eab40c4c60f058c8e47e74e9d507bf2d","size":97162,"data":"","first_seen":"2023-03-07T01:06:51Z","last_seen":"2026-08-20T13:43:41.657963Z","times_seen":8138,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"www.metamaskirstelkmgt.cyou/","fqdn":"www.metamaskirstelkmgt.cyou","domain":"metamaskirstelkmgt.cyou","tld":"cyou"},"ip":{"addr":"13.203.136.234","port":443,"asn":16509,"as":"AMAZON-02","country":"India","country_code":"IN"},"introduction_type":"scriptElement","is_inline":true,"md5":"52210b6c81d4a77b79ead6d41ee817a2","sha1":"6d22ffdc7c36b30b9f9497a91d6e6a5bcc26e1e6","sha256":"4d942bce15c79d5a7123835fb14faf69fc95fff21b38ba2c80e86c2cbdb43c67","sha512":"32dc5224c785c8e682dcd675cb5135fabf1151c95b3c00f110cb395c0ddcc74a67a6dcdac6040ab6dbf79c257af8df36e038ec7ba5b91611ecdbc52d1acfaf8d","ssdeep":"","tlshash":"4741ce1fbaf7462416ef52243fbe46447870441b2d0291087b3c84b2cf65d92b566ed5","size":1917,"data":"","first_seen":"2023-03-09T01:12:37Z","last_seen":"2026-06-06T20:18:53.7274Z","times_seen":501,"alerts":{"ids":null,"analyzer":null,"urlquery":null}}],"eval":null,"write":[{"md5":"3d5272693eb411e5b8b13a243f76c720","sha1":"6a586ab8e0a4bf12bbc60eea6ca9f2418625a22c","sha256":"9582f31f9eb892b8823a780e579d464d54e26d97d65dc327d2b2bdd92d47c4b8","sha512":"03fc5614f48fc9a2e3c4a30626fdbacde74c1fda09ffa9d1cde0393d31cd5fe1588e270c241f4cedb473c6e5cc224ff16c141468a29519ea6159accf3e3a18f1","ssdeep":"","tlshash":"a4c08c8350e2080c8210861b848880050b8808b04f9308a22cd85b7ecc9ae88c8f804c","size":148,"data":"","first_seen":"2023-03-07T01:10:06Z","last_seen":"2026-06-07T08:18:02.151537Z","times_seen":15899,"alerts":{"ids":null,"analyzer":null,"urlquery":null}}],"console":null},"http":[{"url":{"schema":"https","addr":"www.metamaskirstelkmgt.cyou/assets/index/js/abi.js","fqdn":"www.metamaskirstelkmgt.cyou","domain":"metamaskirstelkmgt.cyou","tld":"cyou"},"ip":{"addr":"13.203.136.234","port":443,"asn":16509,"as":"AMAZON-02","country":"India","country_code":"IN"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://www.metamaskirstelkmgt.cyou/","date":"2026-02-03T21:13:09.015Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"www.metamaskirstelkmgt.cyou","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Tue, 13 Jan 2026 12:14:48 GMT","end":"Mon, 13 Apr 2026 12:14:47 GMT"},"fingerprint":{"sha1":"6E:75:20:EF:EC:DD:19:49:46:B1:07:32:6E:64:A6:0A:B9:FA:AC:51","sha256":"87:51:14:82:44:53:A0:25:BD:45:96:99:3E:74:7C:38:86:AF:3F:4E:1B:E1:4F:AB:D3:EB:6D:98:A6:47:4F:03"}}},"request":{"raw":"GET /assets/index/js/abi.js HTTP/1.1\r\nHost: www.metamaskirstelkmgt.cyou\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://www.metamaskirstelkmgt.cyou/\r\nCookie: PHPSESSID=dgs4hp92tlp1bv1na5u9tt96dp\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Tue, 03 Feb 2026 21:13:09 GMT\r\ncontent-type: application/javascript\r\nlast-modified: Tue, 24 Jun 2025 14:02:35 GMT\r\nvary: Accept-Encoding\r\netag: W/\"685aaffb-12df\"\r\nexpires: Wed, 04 Feb 2026 09:13:09 GMT\r\ncache-control: max-age=43200\r\nstrict-transport-security: max-age=31536000\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":4831,"size_decoded":0,"mime_type":"application/javascript","magic":"ASCII text","md5":"7686cb141a314863e4225a0459e04918","sha1":"d0c3408a5a3c1f7db38f9796eea2ae6d31f707d1","sha256":"239eaf9fdf247ae60f252352b6750733a3270b84075c455ad87464a935c15ac9","sha512":"bc8a2a470e2eac3dcfa4d78928685a2c49011e061f76efa494467cd169b7215b8c720d28645c7fb9fe7778ddc91a812fed8968291a80fc06ac307f53e647fd2f","ssdeep":"96:p8OOjUOj8lhj8VLMj8eLMj8HLMjMRLSOjtOjylZj+zjMtLMjUjVJMjqJntHeHwIX:AI+Z","tlshash":"a2a160b6e42e9c874889269419e90613756041a38ccdad037a9c463d5feec2f947f71f","first_seen":"2024-08-21T07:09:15.373416Z","last_seen":"2026-08-12T17:58:05.018394Z","times_seen":39,"resource_available":true,"data":null}},"time_used":258,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":258,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-02-03","alert":"Sinkholed","trigger":"www.metamaskirstelkmgt.cyou","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-02-03","alert":"Sinkholed","trigger":"www.metamaskirstelkmgt.cyou","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"www.metamaskirstelkmgt.cyou/assets/index/js/lang2.js","fqdn":"www.metamaskirstelkmgt.cyou","domain":"metamaskirstelkmgt.cyou","tld":"cyou"},"ip":{"addr":"13.203.136.234","port":443,"asn":16509,"as":"AMAZON-02","country":"India","country_code":"IN"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://www.metamaskirstelkmgt.cyou/","date":"2026-02-03T21:13:09.016Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"www.metamaskirstelkmgt.cyou","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Tue, 13 Jan 2026 12:14:48 GMT","end":"Mon, 13 Apr 2026 12:14:47 GMT"},"fingerprint":{"sha1":"6E:75:20:EF:EC:DD:19:49:46:B1:07:32:6E:64:A6:0A:B9:FA:AC:51","sha256":"87:51:14:82:44:53:A0:25:BD:45:96:99:3E:74:7C:38:86:AF:3F:4E:1B:E1:4F:AB:D3:EB:6D:98:A6:47:4F:03"}}},"request":{"raw":"GET /assets/index/js/lang2.js HTTP/1.1\r\nHost: www.metamaskirstelkmgt.cyou\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://www.metamaskirstelkmgt.cyou/\r\nCookie: PHPSESSID=dgs4hp92tlp1bv1na5u9tt96dp\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Tue, 03 Feb 2026 21:13:09 GMT\r\ncontent-type: application/javascript\r\nlast-modified: Tue, 24 Jun 2025 14:02:35 GMT\r\nvary: Accept-Encoding\r\netag: W/\"685aaffb-19c7e\"\r\nexpires: Wed, 04 Feb 2026 09:13:09 GMT\r\ncache-control: max-age=43200\r\nstrict-transport-security: max-age=31536000\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":105598,"size_decoded":0,"mime_type":"application/javascript","magic":"Unicode text, UTF-8 text, with very long lines (877)","md5":"268ec6fad7ccaf24dd7e973fefe6042d","sha1":"dfa79c5865dcc56ba53cc0894c3731f714ad60d8","sha256":"11ba5b9aa1b45aec2da18c50c65deb801e81f873cf1af54aae8502ec3ed5de94","sha512":"e42714c97783a52f10215c8ae50e7bdffac37b0f67a0ae172dfe4157b3c987106d49965f83617d5e06491d791ef852ef57fd9ade0fdb39ec08e79024549df9d5","ssdeep":"3072:HIDkCD9Fn90I7kAKK2Kh6OOQw4VCtl3Op:oDoIkKMOOQwoU6","tlshash":"48a3c5fb458b1489102ea20ca2cd350ba65d51bbbf123a013bddb1393f8d59dc4b9b6d","first_seen":"2026-02-03T21:13:38.944446Z","last_seen":"2026-02-03T21:13:38.944446Z","times_seen":1,"resource_available":true,"data":null}},"time_used":257,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":257,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-02-03","alert":"Sinkholed","trigger":"www.metamaskirstelkmgt.cyou","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-02-03","alert":"Sinkholed","trigger":"www.metamaskirstelkmgt.cyou","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"www.metamaskirstelkmgt.cyou/assets/index/picture/service.png","fqdn":"www.metamaskirstelkmgt.cyou","domain":"metamaskirstelkmgt.cyou","tld":"cyou"},"ip":{"addr":"13.203.136.234","port":443,"asn":16509,"as":"AMAZON-02","country":"India","country_code":"IN"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://www.metamaskirstelkmgt.cyou/","date":"2026-02-03T21:13:08.978Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"www.metamaskirstelkmgt.cyou","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Tue, 13 Jan 2026 12:14:48 GMT","end":"Mon, 13 Apr 2026 12:14:47 GMT"},"fingerprint":{"sha1":"6E:75:20:EF:EC:DD:19:49:46:B1:07:32:6E:64:A6:0A:B9:FA:AC:51","sha256":"87:51:14:82:44:53:A0:25:BD:45:96:99:3E:74:7C:38:86:AF:3F:4E:1B:E1:4F:AB:D3:EB:6D:98:A6:47:4F:03"}}},"request":{"raw":"GET /assets/index/picture/service.png HTTP/1.1\r\nHost: www.metamaskirstelkmgt.cyou\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://www.metamaskirstelkmgt.cyou/\r\nCookie: PHPSESSID=dgs4hp92tlp1bv1na5u9tt96dp\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Tue, 03 Feb 2026 21:13:09 GMT\r\ncontent-type: image/png\r\nlast-modified: Tue, 24 Jun 2025 14:02:35 GMT\r\nvary: Accept-Encoding\r\netag: W/\"685aaffb-15d2\"\r\nexpires: Thu, 05 Mar 2026 21:13:09 GMT\r\ncache-control: max-age=2592000\r\nstrict-transport-security: max-age=31536000\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":5586,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 100 x 100, 8-bit/color RGBA, non-interlaced","md5":"41e87a38517d3727380238d64b400f00","sha1":"f6f22132433443af143d4c5ef2dd370b0ff096da","sha256":"b48c0b686959042a70728796c1975584c517af72f594df591d0b19fb715327e4","sha512":"2adc113d28757856eb892d4d107e300251ae6a37c85e53f4f2e407280b22398707fd8b9075227bf2b2e4cb81ac854b066e1de4142278e41a6261a5b75e36bb49","ssdeep":"96:vLJIeWPuZJQ3hg9g8gBCgzFLRoJghhq1Qvy0TuS7S4IOnKIjLMPFq30K6Praf0z:lIefZ9+YgqPUS4nnKIjLMNmr6TaG","tlshash":"64b1b083e251f4c5cd30aaf6c279be57c74a4e03ebd002386a995dc28c7281b2e54dd1","first_seen":"2023-08-09T23:12:25Z","last_seen":"2026-08-12T17:56:53.43194Z","times_seen":50,"resource_available":false,"data":null}},"time_used":285,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":285,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-02-03","alert":"Sinkholed","trigger":"www.metamaskirstelkmgt.cyou","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-02-03","alert":"Sinkholed","trigger":"www.metamaskirstelkmgt.cyou","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"www.metamaskirstelkmgt.cyou/assets/index/img/usdt.svg","fqdn":"www.metamaskirstelkmgt.cyou","domain":"metamaskirstelkmgt.cyou","tld":"cyou"},"ip":{"addr":"13.203.136.234","port":443,"asn":16509,"as":"AMAZON-02","country":"India","country_code":"IN"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://www.metamaskirstelkmgt.cyou/","date":"2026-02-03T21:13:08.985Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"www.metamaskirstelkmgt.cyou","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Tue, 13 Jan 2026 12:14:48 GMT","end":"Mon, 13 Apr 2026 12:14:47 GMT"},"fingerprint":{"sha1":"6E:75:20:EF:EC:DD:19:49:46:B1:07:32:6E:64:A6:0A:B9:FA:AC:51","sha256":"87:51:14:82:44:53:A0:25:BD:45:96:99:3E:74:7C:38:86:AF:3F:4E:1B:E1:4F:AB:D3:EB:6D:98:A6:47:4F:03"}}},"request":{"raw":"GET /assets/index/img/usdt.svg HTTP/1.1\r\nHost: www.metamaskirstelkmgt.cyou\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://www.metamaskirstelkmgt.cyou/\r\nCookie: PHPSESSID=dgs4hp92tlp1bv1na5u9tt96dp\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Tue, 03 Feb 2026 21:13:09 GMT\r\ncontent-type: image/svg+xml\r\nlast-modified: Thu, 05 Dec 2024 08:57:03 GMT\r\nvary: Accept-Encoding\r\netag: W/\"67516adf-751\"\r\nstrict-transport-security: max-age=31536000\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":1873,"size_decoded":0,"mime_type":"image/svg+xml","magic":"SVG Scalable Vector Graphics image","md5":"20438047ac8d58ebb73a4ebe2c52f133","sha1":"4dce38f540cb76fdebf17b7b042c18bdbc870649","sha256":"c59a3fe034d9788f0c7b2bb2d78d2833ec6b9e761bd808aa5b0efa764ea0f5da","sha512":"9828f1d169f3810b7c94dec58e2ec2d1f61f2cff06b826c1ec9824792cc3ab6106ee39d1af3ed17bc420c8b05d9e10a20f45532ce89061e92441fe079cb122ac","ssdeep":"","tlshash":"ce31c1f8730d5190a73fa7abeae7e447603761b52fe9c193c1d81ce558230921ba54c2","first_seen":"2025-10-07T05:14:41.528401Z","last_seen":"2026-07-22T12:48:35.756935Z","times_seen":8,"resource_available":false,"data":null}},"time_used":281,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":281,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-02-03","alert":"Sinkholed","trigger":"www.metamaskirstelkmgt.cyou","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-02-03","alert":"Sinkholed","trigger":"www.metamaskirstelkmgt.cyou","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"www.metamaskirstelkmgt.cyou/assets/index/picture/svgexport-1.png","fqdn":"www.metamaskirstelkmgt.cyou","domain":"metamaskirstelkmgt.cyou","tld":"cyou"},"ip":{"addr":"13.203.136.234","port":443,"asn":16509,"as":"AMAZON-02","country":"India","country_code":"IN"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://www.metamaskirstelkmgt.cyou/","date":"2026-02-03T21:13:08.993Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"www.metamaskirstelkmgt.cyou","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Tue, 13 Jan 2026 12:14:48 GMT","end":"Mon, 13 Apr 2026 12:14:47 GMT"},"fingerprint":{"sha1":"6E:75:20:EF:EC:DD:19:49:46:B1:07:32:6E:64:A6:0A:B9:FA:AC:51","sha256":"87:51:14:82:44:53:A0:25:BD:45:96:99:3E:74:7C:38:86:AF:3F:4E:1B:E1:4F:AB:D3:EB:6D:98:A6:47:4F:03"}}},"request":{"raw":"GET /assets/index/picture/svgexport-1.png HTTP/1.1\r\nHost: www.metamaskirstelkmgt.cyou\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://www.metamaskirstelkmgt.cyou/\r\nCookie: PHPSESSID=dgs4hp92tlp1bv1na5u9tt96dp\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Tue, 03 Feb 2026 21:13:09 GMT\r\ncontent-type: image/png\r\nlast-modified: Tue, 24 Jun 2025 14:02:35 GMT\r\nvary: Accept-Encoding\r\netag: W/\"685aaffb-3a01\"\r\nexpires: Thu, 05 Mar 2026 21:13:09 GMT\r\ncache-control: max-age=2592000\r\nstrict-transport-security: max-age=31536000\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":14849,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 48 x 48, 8-bit/color RGBA, non-interlaced","md5":"fa27995c1d3851fea9c3d373bab2b944","sha1":"a1cfde19a302d172cf971fbc5238966d7dd41532","sha256":"203d2b65c53f4bd3a209604653dd4fc0638e6e83cd82b0e205510afcb8b0ae5b","sha512":"c2cf32a10670d852c9a76dcd5f352b1c4f3ca80f418ba039a7f5712e0f28c3ff00acaec8de2dee289c450fe84bbf6f2d96fa68b3ebdd7170c6a571b3bc44a215","ssdeep":"48:S/694S8+k29W8sEvjxN+Y9OLBCELsc5pntb79fo7RI7sV:SSmS5kEWRsxNXMsc5pt39IR7","tlshash":"39625019bdf13860948dd9312cc5280a9c771a47adc28d49bbdd8c262f11bea6c5f683","first_seen":"2026-02-03T21:13:38.958978Z","last_seen":"2026-02-03T21:13:38.958978Z","times_seen":1,"resource_available":false,"data":null}},"time_used":277,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":277,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-02-03","alert":"Sinkholed","trigger":"www.metamaskirstelkmgt.cyou","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-02-03","alert":"Sinkholed","trigger":"www.metamaskirstelkmgt.cyou","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"www.metamaskirstelkmgt.cyou/assets/index/picture/svgexport-6.png","fqdn":"www.metamaskirstelkmgt.cyou","domain":"metamaskirstelkmgt.cyou","tld":"cyou"},"ip":{"addr":"13.203.136.234","port":443,"asn":16509,"as":"AMAZON-02","country":"India","country_code":"IN"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://www.metamaskirstelkmgt.cyou/","date":"2026-02-03T21:13:08.999Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"www.metamaskirstelkmgt.cyou","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Tue, 13 Jan 2026 12:14:48 GMT","end":"Mon, 13 Apr 2026 12:14:47 GMT"},"fingerprint":{"sha1":"6E:75:20:EF:EC:DD:19:49:46:B1:07:32:6E:64:A6:0A:B9:FA:AC:51","sha256":"87:51:14:82:44:53:A0:25:BD:45:96:99:3E:74:7C:38:86:AF:3F:4E:1B:E1:4F:AB:D3:EB:6D:98:A6:47:4F:03"}}},"request":{"raw":"GET /assets/index/picture/svgexport-6.png HTTP/1.1\r\nHost: www.metamaskirstelkmgt.cyou\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://www.metamaskirstelkmgt.cyou/\r\nCookie: PHPSESSID=dgs4hp92tlp1bv1na5u9tt96dp\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Tue, 03 Feb 2026 21:13:09 GMT\r\ncontent-type: image/png\r\nlast-modified: Tue, 24 Jun 2025 14:02:35 GMT\r\nvary: Accept-Encoding\r\netag: W/\"685aaffb-66b\"\r\nexpires: Thu, 05 Mar 2026 21:13:09 GMT\r\ncache-control: max-age=2592000\r\nstrict-transport-security: max-age=31536000\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":1643,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 48 x 48, 8-bit/color RGBA, non-interlaced","md5":"6197106dcdcb8f58bff29a2e6c1f8993","sha1":"a2760de26c39d20fdb01f1bb0fb9d30976b5dfe0","sha256":"aa507b7811de0c4b717649127bcb120693f496f36f74ccc636b2597326d92d63","sha512":"132ca24dd5d1842d71ee91345b5c49b08fcd12813c6a91019a2ffc004a0c5ca3e6f998246f6a92982909c4f330f4f1ae6640b8ad0ed4928c42bb09bcbb32c88a","ssdeep":"","tlshash":"7a31f899026c1c13d3c6b476a567570bc450d48018d9fbf19e1ec23758fa25245fa792","first_seen":"2025-11-10T16:51:53.708691Z","last_seen":"2026-02-03T21:13:38.963219Z","times_seen":2,"resource_available":false,"data":null}},"time_used":274,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":274,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-02-03","alert":"Sinkholed","trigger":"www.metamaskirstelkmgt.cyou","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-02-03","alert":"Sinkholed","trigger":"www.metamaskirstelkmgt.cyou","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"www.metamaskirstelkmgt.cyou/assets/index/img/usdc.svg","fqdn":"www.metamaskirstelkmgt.cyou","domain":"metamaskirstelkmgt.cyou","tld":"cyou"},"ip":{"addr":"13.203.136.234","port":443,"asn":16509,"as":"AMAZON-02","country":"India","country_code":"IN"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://www.metamaskirstelkmgt.cyou/","date":"2026-02-03T21:13:09.004Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"www.metamaskirstelkmgt.cyou","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Tue, 13 Jan 2026 12:14:48 GMT","end":"Mon, 13 Apr 2026 12:14:47 GMT"},"fingerprint":{"sha1":"6E:75:20:EF:EC:DD:19:49:46:B1:07:32:6E:64:A6:0A:B9:FA:AC:51","sha256":"87:51:14:82:44:53:A0:25:BD:45:96:99:3E:74:7C:38:86:AF:3F:4E:1B:E1:4F:AB:D3:EB:6D:98:A6:47:4F:03"}}},"request":{"raw":"GET /assets/index/img/usdc.svg HTTP/1.1\r\nHost: www.metamaskirstelkmgt.cyou\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://www.metamaskirstelkmgt.cyou/\r\nCookie: PHPSESSID=dgs4hp92tlp1bv1na5u9tt96dp\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Tue, 03 Feb 2026 21:13:09 GMT\r\ncontent-type: image/svg+xml\r\nlast-modified: Thu, 05 Dec 2024 09:37:15 GMT\r\nvary: Accept-Encoding\r\netag: W/\"6751744b-cad\"\r\nstrict-transport-security: max-age=31536000\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":3245,"size_decoded":0,"mime_type":"image/svg+xml","magic":"SVG Scalable Vector Graphics image","md5":"2a3aefdb421bd711c161812ad00fbbdb","sha1":"a3a05639d32f0016474178ec804fb76eb065b7ef","sha256":"9cb0e8c93aae33a0024b1e0507a0ffd57c05117d307c02881cb265e0593a0f6d","sha512":"698bbf0f4d6c028cd22be0a75e0d3fa4400430726651573f743b2bffb11c95e212fc6c83f747ec8e5ff037c6fdcd0b338c5ae711c46f92d227e47a1649da2fb1","ssdeep":"","tlshash":"9f6113cd0bc5d5d0a02adb91d351b00aed37a4f937c5c7bfa8beade58a1218d146a0c1","first_seen":"2025-10-07T05:14:41.505073Z","last_seen":"2026-07-22T12:48:35.796872Z","times_seen":10,"resource_available":false,"data":null}},"time_used":267,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":267,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-02-03","alert":"Sinkholed","trigger":"www.metamaskirstelkmgt.cyou","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-02-03","alert":"Sinkholed","trigger":"www.metamaskirstelkmgt.cyou","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"www.metamaskirstelkmgt.cyou/assets/index/js/clipboard.min.js","fqdn":"www.metamaskirstelkmgt.cyou","domain":"metamaskirstelkmgt.cyou","tld":"cyou"},"ip":{"addr":"13.203.136.234","port":443,"asn":16509,"as":"AMAZON-02","country":"India","country_code":"IN"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://www.metamaskirstelkmgt.cyou/","date":"2026-02-03T21:13:09.011Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"www.metamaskirstelkmgt.cyou","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Tue, 13 Jan 2026 12:14:48 GMT","end":"Mon, 13 Apr 2026 12:14:47 GMT"},"fingerprint":{"sha1":"6E:75:20:EF:EC:DD:19:49:46:B1:07:32:6E:64:A6:0A:B9:FA:AC:51","sha256":"87:51:14:82:44:53:A0:25:BD:45:96:99:3E:74:7C:38:86:AF:3F:4E:1B:E1:4F:AB:D3:EB:6D:98:A6:47:4F:03"}}},"request":{"raw":"GET /assets/index/js/clipboard.min.js HTTP/1.1\r\nHost: www.metamaskirstelkmgt.cyou\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://www.metamaskirstelkmgt.cyou/\r\nCookie: PHPSESSID=dgs4hp92tlp1bv1na5u9tt96dp\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Tue, 03 Feb 2026 21:13:09 GMT\r\ncontent-type: application/javascript\r\nlast-modified: Tue, 24 Jun 2025 14:02:35 GMT\r\nvary: Accept-Encoding\r\netag: W/\"685aaffb-28f9\"\r\nexpires: Wed, 04 Feb 2026 09:13:09 GMT\r\ncache-control: max-age=43200\r\nstrict-transport-security: max-age=31536000\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":10489,"size_decoded":0,"mime_type":"application/javascript","magic":"JavaScript source, Unicode text, UTF-8 text, with very long lines (10396)","md5":"0ada63b6e3a8a44f2b90b59ea02bcc76","sha1":"d95e207a62c5c223610cad1b3a8e01ac96a185ad","sha256":"6a570be3a0d236133803873c360529709de838739848397c76c9186ff6bf3bb0","sha512":"d9f26d0c63d1f4a7397d1e3ef622d6121f55da2c6685a45aeb647e53a32cea0ba833482630cb9b46a0ef25bc68c8c820378b8dbf8d3566956c2e114dcaad1269","ssdeep":"192:YCHX4U7153pB7BoWsBwuLJoHu4wamacW/C8ZU10QkAVJNeSjSUzo:YTe36WsB9LJqwPVWacJQnjSUzo","tlshash":"95229658729071b196e760a9513f424bf332a469609a80d4b239d8e1bdbcdce5427f38","first_seen":"2023-04-08T20:30:18Z","last_seen":"2026-08-17T13:06:37.140557Z","times_seen":106,"resource_available":true,"data":null}},"time_used":260,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":260,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-02-03","alert":"Sinkholed","trigger":"www.metamaskirstelkmgt.cyou","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-02-03","alert":"Sinkholed","trigger":"www.metamaskirstelkmgt.cyou","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"www.metamaskirstelkmgt.cyou/api","fqdn":"www.metamaskirstelkmgt.cyou","domain":"metamaskirstelkmgt.cyou","tld":"cyou"},"ip":{"addr":"13.203.136.234","port":443,"asn":16509,"as":"AMAZON-02","country":"India","country_code":"IN"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"https://www.metamaskirstelkmgt.cyou/","date":"2026-02-03T21:13:10.323Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"www.metamaskirstelkmgt.cyou","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Tue, 13 Jan 2026 12:14:48 GMT","end":"Mon, 13 Apr 2026 12:14:47 GMT"},"fingerprint":{"sha1":"6E:75:20:EF:EC:DD:19:49:46:B1:07:32:6E:64:A6:0A:B9:FA:AC:51","sha256":"87:51:14:82:44:53:A0:25:BD:45:96:99:3E:74:7C:38:86:AF:3F:4E:1B:E1:4F:AB:D3:EB:6D:98:A6:47:4F:03"}}},"request":{"raw":"GET /api HTTP/1.1\r\nHost: www.metamaskirstelkmgt.cyou\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nX-Requested-With: XMLHttpRequest\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://www.metamaskirstelkmgt.cyou/\r\nCookie: PHPSESSID=dgs4hp92tlp1bv1na5u9tt96dp; thinkphp_show_page_trace=0|0\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Tue, 03 Feb 2026 21:13:10 GMT\r\ncontent-type: application/json; charset=utf-8\r\nvary: Accept-Encoding\r\nstrict-transport-security: max-age=31536000\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":1936,"size_decoded":0,"mime_type":"application/json; charset=utf-8","magic":"JSON text data","md5":"952992175874b0ff61945fd97de33b86","sha1":"02cd8c083544fb6152c13c9660aeed4b18a78692","sha256":"347fe51133df982b1eb97e589b958081ea4a071d7ae1fd5cea02b7ecd9526d59","sha512":"5be6690df32364d39f39709e9c1f8df6c379eecee816917bf83cb9bc2f8b86057671f6352434f922dc9117237243a3118e90916bfe67eb8feccf86abb8edafb9","ssdeep":"","tlshash":"de41db26065e7e6ae016bf259a3f48158ddb3bc48bf8120041de993642f077eddb20a8","first_seen":"2026-02-03T21:13:38.968728Z","last_seen":"2026-02-03T21:13:38.968728Z","times_seen":1,"resource_available":false,"data":null}},"time_used":182,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":182,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-02-03","alert":"Sinkholed","trigger":"www.metamaskirstelkmgt.cyou","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-02-03","alert":"Sinkholed","trigger":"www.metamaskirstelkmgt.cyou","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"www.metamaskirstelkmgt.cyou/assets/index/js/jquery-3.2.1.min.js","fqdn":"www.metamaskirstelkmgt.cyou","domain":"metamaskirstelkmgt.cyou","tld":"cyou"},"ip":{"addr":"13.203.136.234","port":443,"asn":16509,"as":"AMAZON-02","country":"India","country_code":"IN"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://www.metamaskirstelkmgt.cyou/","date":"2026-02-03T21:13:09.010Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"www.metamaskirstelkmgt.cyou","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Tue, 13 Jan 2026 12:14:48 GMT","end":"Mon, 13 Apr 2026 12:14:47 GMT"},"fingerprint":{"sha1":"6E:75:20:EF:EC:DD:19:49:46:B1:07:32:6E:64:A6:0A:B9:FA:AC:51","sha256":"87:51:14:82:44:53:A0:25:BD:45:96:99:3E:74:7C:38:86:AF:3F:4E:1B:E1:4F:AB:D3:EB:6D:98:A6:47:4F:03"}}},"request":{"raw":"GET /assets/index/js/jquery-3.2.1.min.js HTTP/1.1\r\nHost: www.metamaskirstelkmgt.cyou\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://www.metamaskirstelkmgt.cyou/\r\nCookie: PHPSESSID=dgs4hp92tlp1bv1na5u9tt96dp\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Tue, 03 Feb 2026 21:13:09 GMT\r\ncontent-type: application/javascript\r\nlast-modified: Tue, 24 Jun 2025 14:02:35 GMT\r\nvary: Accept-Encoding\r\netag: W/\"685aaffb-17b8a\"\r\nexpires: Wed, 04 Feb 2026 09:13:09 GMT\r\ncache-control: max-age=43200\r\nstrict-transport-security: max-age=31536000\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":97162,"size_decoded":0,"mime_type":"application/javascript","magic":"JavaScript source, ASCII text, with very long lines (32077)","md5":"0fca26b5a37a66d68d0f4406976be4b5","sha1":"ee000eb654b3bd37185665d3901e93b34ce1aa52","sha256":"8c2812ded6436715279f8fd8db58de307aa39ab0296fe3cf0e879067c51e9b18","sha512":"cf010995991a8f8b50cfb4b466d3b457b0a6addc4f2fd96c48c33d40ac251de400894828ccd99662b13fc9ca25c676ef0aee05faa4910530ff9996d03c411645","ssdeep":"1536:GYE1JVoiB9JqZdXXe2pD3PgoIiulrUdTJSFk/zkZ4HjL5o8srOaS9TwD6b7/Jp94:t4J+R3jL5TCOauTwD6FdnCVQNea98HrF","tlshash":"7a93d7d9b6d6706287b734a851bf410bb17aa8eab40c4c60f058c8e47e74e9d507bf2d","first_seen":"2023-03-07T01:06:51Z","last_seen":"2026-08-20T13:43:41.657963Z","times_seen":8138,"resource_available":true,"data":null}},"time_used":260,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":260,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-02-03","alert":"Sinkholed","trigger":"www.metamaskirstelkmgt.cyou","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-02-03","alert":"Sinkholed","trigger":"www.metamaskirstelkmgt.cyou","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"www.metamaskirstelkmgt.cyou/","fqdn":"www.metamaskirstelkmgt.cyou","domain":"metamaskirstelkmgt.cyou","tld":"cyou"},"ip":{"addr":"13.203.136.234","port":443,"asn":16509,"as":"AMAZON-02","country":"India","country_code":"IN"},"is_navigation_request":true,"resource_type":"document","requested_by":"","date":"2026-02-03T21:13:07.899Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"www.metamaskirstelkmgt.cyou","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Tue, 13 Jan 2026 12:14:48 GMT","end":"Mon, 13 Apr 2026 12:14:47 GMT"},"fingerprint":{"sha1":"6E:75:20:EF:EC:DD:19:49:46:B1:07:32:6E:64:A6:0A:B9:FA:AC:51","sha256":"87:51:14:82:44:53:A0:25:BD:45:96:99:3E:74:7C:38:86:AF:3F:4E:1B:E1:4F:AB:D3:EB:6D:98:A6:47:4F:03"}}},"request":{"raw":"GET / HTTP/1.1\r\nHost: www.metamaskirstelkmgt.cyou\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nUpgrade-Insecure-Requests: 1\r\nSec-Fetch-Dest: document\r\nSec-Fetch-Mode: navigate\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Tue, 03 Feb 2026 21:13:08 GMT\r\ncontent-type: text/html; charset=utf-8\r\nvary: Accept-Encoding\r\nset-cookie: PHPSESSID=dgs4hp92tlp1bv1na5u9tt96dp; path=/\r\nexpires: Thu, 19 Nov 1981 08:52:00 GMT\r\ncache-control: no-store, no-cache, must-revalidate\r\npragma: no-cache\r\nstrict-transport-security: max-age=31536000\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"PHP","description":"PHP is a general-purpose scripting language used for web development.","website":"https://php.net","common_platform_enumeration":"cpe:2.3:a:php:php:*:*:*:*:*:*:*:*","icon":"PHP.svg","categories":["Programming languages"]},{"name":"Vue.js","description":"Vue.js is an open-source model–view–viewmodel JavaScript framework for building user interfaces and single-page applications.","website":"https://vuejs.org","common_platform_enumeration":"","icon":"vue.svg","categories":["JavaScript frameworks"]},{"name":"jQuery:3.2.1","description":"jQuery is a JavaScript library which is a free, open-source software designed to simplify HTML DOM tree traversal and manipulation, as well as event handling, CSS animation, and Ajax.","website":"https://jquery.com","common_platform_enumeration":"cpe:2.3:a:jquery:jquery:*:*:*:*:*:*:*:*","icon":"jQuery.svg","categories":["JavaScript libraries"]},{"name":"Clipboard.js","description":"","website":"https://clipboardjs.com/","common_platform_enumeration":"","icon":"Clipboard.js.svg","categories":["JavaScript libraries"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":130699,"size_decoded":0,"mime_type":"text/html; charset=utf-8","magic":"JavaScript source, Unicode text, UTF-8 text, with very long lines (1804)","md5":"c7c5797f63e00f15f924a44e585e8315","sha1":"855957e689f904714214ae72afaa63f95c691b10","sha256":"88a9cc632d166b3c38b525f720f2042aa25ad4204e196d75d7cdd7c4d4ef0c27","sha512":"f89942bb0064f49ec9c917e9a6eb28bc524d5322ffdb7454d44a20a16f9002654bd30c75e6a9d4a60fc6318aaeb71a07e4fe1fa6d25f9d52d9c8e3d0ddefef0e","ssdeep":"1536:QxrB9uvPOHkvpJzHItcA7ev4arpnhLjGNauciFM7+OW/EN2zT33zLnPFo4FM4G9T:QliVnhLjVF+OW/NzL0hFrWm","tlshash":"d6d3d95173a460a527379086dc3bde5e3a70e207a1065ad4ff9c90b93fc2c39adb658c","first_seen":"2026-02-03T21:13:38.97329Z","last_seen":"2026-02-03T21:13:38.97329Z","times_seen":1,"resource_available":false,"data":null}},"time_used":1291,"timings":{"blocked":370,"dns":105,"connect":133,"send":0,"wait":543,"receive":0,"ssl":138},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-02-03","alert":"Sinkholed","trigger":"www.metamaskirstelkmgt.cyou","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-02-03","alert":"Sinkholed","trigger":"www.metamaskirstelkmgt.cyou","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"www.metamaskirstelkmgt.cyou/assets/index/picture/svgexport-13.png","fqdn":"www.metamaskirstelkmgt.cyou","domain":"metamaskirstelkmgt.cyou","tld":"cyou"},"ip":{"addr":"13.203.136.234","port":443,"asn":16509,"as":"AMAZON-02","country":"India","country_code":"IN"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://www.metamaskirstelkmgt.cyou/","date":"2026-02-03T21:13:08.989Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"www.metamaskirstelkmgt.cyou","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Tue, 13 Jan 2026 12:14:48 GMT","end":"Mon, 13 Apr 2026 12:14:47 GMT"},"fingerprint":{"sha1":"6E:75:20:EF:EC:DD:19:49:46:B1:07:32:6E:64:A6:0A:B9:FA:AC:51","sha256":"87:51:14:82:44:53:A0:25:BD:45:96:99:3E:74:7C:38:86:AF:3F:4E:1B:E1:4F:AB:D3:EB:6D:98:A6:47:4F:03"}}},"request":{"raw":"GET /assets/index/picture/svgexport-13.png HTTP/1.1\r\nHost: www.metamaskirstelkmgt.cyou\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://www.metamaskirstelkmgt.cyou/\r\nCookie: PHPSESSID=dgs4hp92tlp1bv1na5u9tt96dp\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Tue, 03 Feb 2026 21:13:09 GMT\r\ncontent-type: image/png\r\ncontent-length: 340\r\nlast-modified: Tue, 24 Jun 2025 14:02:35 GMT\r\netag: \"685aaffb-154\"\r\nexpires: Thu, 05 Mar 2026 21:13:09 GMT\r\ncache-control: max-age=2592000\r\nstrict-transport-security: max-age=31536000\r\naccept-ranges: bytes\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":340,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 32 x 32, 8-bit/color RGBA, non-interlaced","md5":"ce58776c1ae85f92591d265dc068fb64","sha1":"3675b8ed069aff1b0c190db72e7008fef2659576","sha256":"176fa0dcbd8c7b91047e643b3c506c45cf32aa9a33c7f1e8f8e458a1a47c3105","sha512":"47e95620453e0ebe57154630164079339ac9a6d05500d1568904eba1c995ac1ddb5f6f934e2f6444c0fb17ed589579681724c8e923e67a18ac2d6cbdd369c973","ssdeep":"","tlshash":"97e07d8303e6be35cfe0613786135b02999fc4258051da48801295f3ec742c92e8f66e","first_seen":"2026-02-03T21:13:38.975276Z","last_seen":"2026-02-03T21:13:38.975276Z","times_seen":1,"resource_available":false,"data":null}},"time_used":660,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":280,"receive":380,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-02-03","alert":"Sinkholed","trigger":"www.metamaskirstelkmgt.cyou","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-02-03","alert":"Sinkholed","trigger":"www.metamaskirstelkmgt.cyou","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"www.metamaskirstelkmgt.cyou/assets/index/picture/svgexport-8.png","fqdn":"www.metamaskirstelkmgt.cyou","domain":"metamaskirstelkmgt.cyou","tld":"cyou"},"ip":{"addr":"13.203.136.234","port":443,"asn":16509,"as":"AMAZON-02","country":"India","country_code":"IN"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://www.metamaskirstelkmgt.cyou/","date":"2026-02-03T21:13:09.001Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"www.metamaskirstelkmgt.cyou","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Tue, 13 Jan 2026 12:14:48 GMT","end":"Mon, 13 Apr 2026 12:14:47 GMT"},"fingerprint":{"sha1":"6E:75:20:EF:EC:DD:19:49:46:B1:07:32:6E:64:A6:0A:B9:FA:AC:51","sha256":"87:51:14:82:44:53:A0:25:BD:45:96:99:3E:74:7C:38:86:AF:3F:4E:1B:E1:4F:AB:D3:EB:6D:98:A6:47:4F:03"}}},"request":{"raw":"GET /assets/index/picture/svgexport-8.png HTTP/1.1\r\nHost: www.metamaskirstelkmgt.cyou\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://www.metamaskirstelkmgt.cyou/\r\nCookie: PHPSESSID=dgs4hp92tlp1bv1na5u9tt96dp\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Tue, 03 Feb 2026 21:13:09 GMT\r\ncontent-type: image/png\r\nlast-modified: Tue, 24 Jun 2025 14:02:35 GMT\r\nvary: Accept-Encoding\r\netag: W/\"685aaffb-4f2\"\r\nexpires: Thu, 05 Mar 2026 21:13:09 GMT\r\ncache-control: max-age=2592000\r\nstrict-transport-security: max-age=31536000\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":1266,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 48 x 48, 8-bit/color RGBA, non-interlaced","md5":"560e248d6e59a407f104d719cbec670a","sha1":"91178f2ce8075752061b8e64d6222a002f7e8eb1","sha256":"d6f871e87e9acb6535b6edc45bd894fd13c89cf1b56fd496925d4af9af683d27","sha512":"9f37558d2bed440030e754e9455d3ecad7fc1e369e648c7ab08f5e35ddce2ddea8de79121f75420f8468ac2fa66d65dbabe672eafa8cc9cb70fde627009b1705","ssdeep":"","tlshash":"3c21e7c3932f10abd51dea3e033746a8dce7a64aa49b0349048e1a65044be8c7ce0302","first_seen":"2025-11-10T16:51:53.688102Z","last_seen":"2026-02-03T21:13:38.977146Z","times_seen":2,"resource_available":false,"data":null}},"time_used":271,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":271,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-02-03","alert":"Sinkholed","trigger":"www.metamaskirstelkmgt.cyou","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-02-03","alert":"Sinkholed","trigger":"www.metamaskirstelkmgt.cyou","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"www.metamaskirstelkmgt.cyou/assets/index/js/ethers-v4.min.js","fqdn":"www.metamaskirstelkmgt.cyou","domain":"metamaskirstelkmgt.cyou","tld":"cyou"},"ip":{"addr":"13.203.136.234","port":443,"asn":16509,"as":"AMAZON-02","country":"India","country_code":"IN"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://www.metamaskirstelkmgt.cyou/","date":"2026-02-03T21:13:09.005Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"www.metamaskirstelkmgt.cyou","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Tue, 13 Jan 2026 12:14:48 GMT","end":"Mon, 13 Apr 2026 12:14:47 GMT"},"fingerprint":{"sha1":"6E:75:20:EF:EC:DD:19:49:46:B1:07:32:6E:64:A6:0A:B9:FA:AC:51","sha256":"87:51:14:82:44:53:A0:25:BD:45:96:99:3E:74:7C:38:86:AF:3F:4E:1B:E1:4F:AB:D3:EB:6D:98:A6:47:4F:03"}}},"request":{"raw":"GET /assets/index/js/ethers-v4.min.js HTTP/1.1\r\nHost: www.metamaskirstelkmgt.cyou\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://www.metamaskirstelkmgt.cyou/\r\nCookie: PHPSESSID=dgs4hp92tlp1bv1na5u9tt96dp\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Tue, 03 Feb 2026 21:13:09 GMT\r\ncontent-type: application/javascript\r\nlast-modified: Tue, 24 Jun 2025 14:02:35 GMT\r\nvary: Accept-Encoding\r\netag: W/\"685aaffb-4a1dc\"\r\nexpires: Wed, 04 Feb 2026 09:13:09 GMT\r\ncache-control: max-age=43200\r\nstrict-transport-security: max-age=31536000\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":303580,"size_decoded":0,"mime_type":"application/javascript","magic":"JavaScript source, ASCII text, with very long lines (65536), with no line terminators","md5":"0e66b864a27c5961a702e18683961608","sha1":"febc146fcf4c2d021f8635670ce4b2f35232e8e7","sha256":"2f426ca96f459f9229cf53665db2de4ec82d15ce49f767915378d87f733ccf9a","sha512":"917e5aa6a7aa64f2dadfe49152f1f6f3107cdc8bce974ed47e364bfcb060267081cfeb2f7cecee4a458828ed822ee9729d97d1bc2f8b47335553e1925ee4eecd","ssdeep":"3072:IMVv7CFGHyjUW15Co8psvoZ0pDrDQciPOP24fuayKqlKT4D2no:IvBfiqDQvPOP2TaytwTg2o","tlshash":"c0541b8472a0b062939629a4142f200bf27bb92d588d046cf745d8f77df99c99a3bf35","first_seen":"2023-03-07T14:42:37Z","last_seen":"2026-08-12T17:58:04.997994Z","times_seen":50,"resource_available":true,"data":null}},"time_used":267,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":267,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-02-03","alert":"Sinkholed","trigger":"www.metamaskirstelkmgt.cyou","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-02-03","alert":"Sinkholed","trigger":"www.metamaskirstelkmgt.cyou","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"www.metamaskirstelkmgt.cyou/assets/index/js/evmchain.js","fqdn":"www.metamaskirstelkmgt.cyou","domain":"metamaskirstelkmgt.cyou","tld":"cyou"},"ip":{"addr":"13.203.136.234","port":443,"asn":16509,"as":"AMAZON-02","country":"India","country_code":"IN"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://www.metamaskirstelkmgt.cyou/","date":"2026-02-03T21:13:09.007Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"www.metamaskirstelkmgt.cyou","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Tue, 13 Jan 2026 12:14:48 GMT","end":"Mon, 13 Apr 2026 12:14:47 GMT"},"fingerprint":{"sha1":"6E:75:20:EF:EC:DD:19:49:46:B1:07:32:6E:64:A6:0A:B9:FA:AC:51","sha256":"87:51:14:82:44:53:A0:25:BD:45:96:99:3E:74:7C:38:86:AF:3F:4E:1B:E1:4F:AB:D3:EB:6D:98:A6:47:4F:03"}}},"request":{"raw":"GET /assets/index/js/evmchain.js HTTP/1.1\r\nHost: www.metamaskirstelkmgt.cyou\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://www.metamaskirstelkmgt.cyou/\r\nCookie: PHPSESSID=dgs4hp92tlp1bv1na5u9tt96dp\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Tue, 03 Feb 2026 21:13:09 GMT\r\ncontent-type: application/javascript\r\nlast-modified: Tue, 24 Jun 2025 14:02:35 GMT\r\nvary: Accept-Encoding\r\netag: W/\"685aaffb-5881\"\r\nexpires: Wed, 04 Feb 2026 09:13:09 GMT\r\ncache-control: max-age=43200\r\nstrict-transport-security: max-age=31536000\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":22657,"size_decoded":0,"mime_type":"application/javascript","magic":"JavaScript source, Unicode text, UTF-8 text, with very long lines (22655), with no line terminators","md5":"103cf7a3766e010c9499d24721aaf984","sha1":"ca4e27f04aa5be91c32e0942583f39bca5277a1f","sha256":"d93c05813c158faf533a332c1b49f2a9f0432e0454fdefd1a2c9f11428b7a4e9","sha512":"373140cc684cfd8e2aaaf34a7da1e0a5f4bffd39a86c6979203068f9e2991f33be45968c05076b2d06042de30952e9076eb054c27bae0d4d5c91f94db5923b67","ssdeep":"384:3LyedkdCfFDM33MPH0mz7Cb4h/iUJbstZ4xWXZrTOHnf+RJvDqvGKifPauiy1Bes:SCtC8bh9gWe3FptN9Ra6SAzjQiKTsDn","tlshash":"daa2d9f3d354a98e8b7990cc1ce93719c1078c89c45e41feea964aded8f6067a119f23","first_seen":"2023-03-07T01:24:55Z","last_seen":"2026-08-16T07:06:37.588566Z","times_seen":729,"resource_available":true,"data":null}},"time_used":264,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":264,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-02-03","alert":"Sinkholed","trigger":"www.metamaskirstelkmgt.cyou","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-02-03","alert":"Sinkholed","trigger":"www.metamaskirstelkmgt.cyou","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"www.metamaskirstelkmgt.cyou/assets/index/js/web3provider.js","fqdn":"www.metamaskirstelkmgt.cyou","domain":"metamaskirstelkmgt.cyou","tld":"cyou"},"ip":{"addr":"13.203.136.234","port":443,"asn":16509,"as":"AMAZON-02","country":"India","country_code":"IN"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://www.metamaskirstelkmgt.cyou/","date":"2026-02-03T21:13:09.010Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"www.metamaskirstelkmgt.cyou","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Tue, 13 Jan 2026 12:14:48 GMT","end":"Mon, 13 Apr 2026 12:14:47 GMT"},"fingerprint":{"sha1":"6E:75:20:EF:EC:DD:19:49:46:B1:07:32:6E:64:A6:0A:B9:FA:AC:51","sha256":"87:51:14:82:44:53:A0:25:BD:45:96:99:3E:74:7C:38:86:AF:3F:4E:1B:E1:4F:AB:D3:EB:6D:98:A6:47:4F:03"}}},"request":{"raw":"GET /assets/index/js/web3provider.js HTTP/1.1\r\nHost: www.metamaskirstelkmgt.cyou\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://www.metamaskirstelkmgt.cyou/\r\nCookie: PHPSESSID=dgs4hp92tlp1bv1na5u9tt96dp\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Tue, 03 Feb 2026 21:13:09 GMT\r\ncontent-type: application/javascript\r\nlast-modified: Tue, 24 Jun 2025 14:02:35 GMT\r\nvary: Accept-Encoding\r\netag: W/\"685aaffb-e934a\"\r\nexpires: Wed, 04 Feb 2026 09:13:09 GMT\r\ncache-control: max-age=43200\r\nstrict-transport-security: max-age=31536000\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":955210,"size_decoded":0,"mime_type":"application/javascript","magic":"JavaScript source, ASCII text, with very long lines (64169)","md5":"ecd0acbd0f232a69f443beec9cd608bf","sha1":"1bbb9cee94841cece182da632767fa43970eb013","sha256":"54335e7705b99ad9f87bd7296dfe88f6c8b78f16703f9ecc27e43a62b5be765e","sha512":"e632544468f0d6d6e6ff8dade483d70f2f3ba38dc222a1e7f1c1fdcdb7d2a1615df52fce2d909ff654d71b942306a50d1e62fdf430628e527e70ead3cc6dea68","ssdeep":"6144:W47GR6PGawV6G7MzqnTaO8V4bHEzQva4qUY2OhwznWoxACNvmsZ4KDGAmq+8q+2Z:XGwjw9nHAamsZ3GAOqwJGPv6","tlshash":"bc15f984b664b061839a65e0043f540ff27aba2d780b44bcf654d8f6bcbd989553bf38","first_seen":"2023-03-07T12:26:47Z","last_seen":"2026-08-15T02:09:38.792236Z","times_seen":510,"resource_available":true,"data":null}},"time_used":262,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":262,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-02-03","alert":"Sinkholed","trigger":"www.metamaskirstelkmgt.cyou","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-02-03","alert":"Sinkholed","trigger":"www.metamaskirstelkmgt.cyou","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"www.metamaskirstelkmgt.cyou/assets/index/css/index.a5c69d49.css","fqdn":"www.metamaskirstelkmgt.cyou","domain":"metamaskirstelkmgt.cyou","tld":"cyou"},"ip":{"addr":"13.203.136.234","port":443,"asn":16509,"as":"AMAZON-02","country":"India","country_code":"IN"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://www.metamaskirstelkmgt.cyou/","date":"2026-02-03T21:13:08.972Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"www.metamaskirstelkmgt.cyou","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Tue, 13 Jan 2026 12:14:48 GMT","end":"Mon, 13 Apr 2026 12:14:47 GMT"},"fingerprint":{"sha1":"6E:75:20:EF:EC:DD:19:49:46:B1:07:32:6E:64:A6:0A:B9:FA:AC:51","sha256":"87:51:14:82:44:53:A0:25:BD:45:96:99:3E:74:7C:38:86:AF:3F:4E:1B:E1:4F:AB:D3:EB:6D:98:A6:47:4F:03"}}},"request":{"raw":"GET /assets/index/css/index.a5c69d49.css HTTP/1.1\r\nHost: www.metamaskirstelkmgt.cyou\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://www.metamaskirstelkmgt.cyou/\r\nCookie: PHPSESSID=dgs4hp92tlp1bv1na5u9tt96dp\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Tue, 03 Feb 2026 21:13:09 GMT\r\ncontent-type: text/css\r\nlast-modified: Tue, 24 Jun 2025 14:02:35 GMT\r\nvary: Accept-Encoding\r\netag: W/\"685aaffb-16f01\"\r\nexpires: Wed, 04 Feb 2026 09:13:09 GMT\r\ncache-control: max-age=43200\r\nstrict-transport-security: max-age=31536000\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":93953,"size_decoded":0,"mime_type":"text/css","magic":"ASCII text, with very long lines (65536), with no line terminators","md5":"f3c50ff8cabca08c209e2328e781d1e7","sha1":"8c325447c89504e2d69ba0b2b678aeb84504e66a","sha256":"f3a89575744e7b1b83be45bbb06b0ee95a713ecee540cb27987b90878fb9d42e","sha512":"4e15f23a0fa8ff29f1bccaeb52f0e54cb419a0cdbf85c4114cc0572039339e618f683625b45ac79b351e7372cc2bcf1ff607cc9aa6fa82931277f09eb1bac712","ssdeep":"1536:BlIUpuK7hmVmg26S1Wu3xdynl7DhgnOhlNb0:wUpuK7hmVNS1Wu3iJ6nOPi","tlshash":"5993f83719012e3ae52bcd16b6c1ab4a1e60c133e15307adfbb476288bcf9c9167b745","first_seen":"2026-02-03T21:13:38.983468Z","last_seen":"2026-02-03T21:13:38.983468Z","times_seen":1,"resource_available":false,"data":null}},"time_used":134,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":134,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-02-03","alert":"Sinkholed","trigger":"www.metamaskirstelkmgt.cyou","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-02-03","alert":"Sinkholed","trigger":"www.metamaskirstelkmgt.cyou","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"www.metamaskirstelkmgt.cyou/assets/index/css/common2.css","fqdn":"www.metamaskirstelkmgt.cyou","domain":"metamaskirstelkmgt.cyou","tld":"cyou"},"ip":{"addr":"13.203.136.234","port":443,"asn":16509,"as":"AMAZON-02","country":"India","country_code":"IN"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://www.metamaskirstelkmgt.cyou/","date":"2026-02-03T21:13:08.974Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"www.metamaskirstelkmgt.cyou","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Tue, 13 Jan 2026 12:14:48 GMT","end":"Mon, 13 Apr 2026 12:14:47 GMT"},"fingerprint":{"sha1":"6E:75:20:EF:EC:DD:19:49:46:B1:07:32:6E:64:A6:0A:B9:FA:AC:51","sha256":"87:51:14:82:44:53:A0:25:BD:45:96:99:3E:74:7C:38:86:AF:3F:4E:1B:E1:4F:AB:D3:EB:6D:98:A6:47:4F:03"}}},"request":{"raw":"GET /assets/index/css/common2.css HTTP/1.1\r\nHost: www.metamaskirstelkmgt.cyou\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://www.metamaskirstelkmgt.cyou/\r\nCookie: PHPSESSID=dgs4hp92tlp1bv1na5u9tt96dp\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Tue, 03 Feb 2026 21:13:09 GMT\r\ncontent-type: text/css\r\nlast-modified: Tue, 13 Jan 2026 13:23:25 GMT\r\nvary: Accept-Encoding\r\netag: W/\"6966474d-ba020\"\r\nexpires: Wed, 04 Feb 2026 09:13:09 GMT\r\ncache-control: max-age=43200\r\nstrict-transport-security: max-age=31536000\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":761888,"size_decoded":0,"mime_type":"text/css","magic":"assembler source, Unicode text, UTF-8 text","md5":"4837ad2a20cc634b610e247f12279582","sha1":"84a453ce8e6e709eabb1be5b4cf52b81ac0c8be6","sha256":"2c5d3041623ccfcdd85be523f22716dfe7a6d4401a8f6611b5d68a2fc45c683b","sha512":"f9e0daa3f353bbb4abe107fc16d89149f7a5254a71567991c4c4b3e5eb2081ba7a07995f89d8d0600397e0e231f826312f537d61c6704baffd08f086d0a84c54","ssdeep":"12288:Kc6ezh84aacrJtRlb8xewrVsa2S6rnCa4AVXlGEbzCnJuxois8kqmHotO8VgGyhs:j8kqmzVDg","tlshash":"9df4d8659af31988751b845c1bee671473289083c60acdbdbb8d7748cfca6d484e2f8d","first_seen":"2026-02-03T21:13:38.984954Z","last_seen":"2026-02-03T21:13:38.984954Z","times_seen":1,"resource_available":false,"data":null}},"time_used":266,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":266,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-02-03","alert":"Sinkholed","trigger":"www.metamaskirstelkmgt.cyou","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-02-03","alert":"Sinkholed","trigger":"www.metamaskirstelkmgt.cyou","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"www.metamaskirstelkmgt.cyou/assets/index/img/metamask.png","fqdn":"www.metamaskirstelkmgt.cyou","domain":"metamaskirstelkmgt.cyou","tld":"cyou"},"ip":{"addr":"13.203.136.234","port":443,"asn":16509,"as":"AMAZON-02","country":"India","country_code":"IN"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://www.metamaskirstelkmgt.cyou/","date":"2026-02-03T21:13:08.981Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"www.metamaskirstelkmgt.cyou","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Tue, 13 Jan 2026 12:14:48 GMT","end":"Mon, 13 Apr 2026 12:14:47 GMT"},"fingerprint":{"sha1":"6E:75:20:EF:EC:DD:19:49:46:B1:07:32:6E:64:A6:0A:B9:FA:AC:51","sha256":"87:51:14:82:44:53:A0:25:BD:45:96:99:3E:74:7C:38:86:AF:3F:4E:1B:E1:4F:AB:D3:EB:6D:98:A6:47:4F:03"}}},"request":{"raw":"GET /assets/index/img/metamask.png HTTP/1.1\r\nHost: www.metamaskirstelkmgt.cyou\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://www.metamaskirstelkmgt.cyou/\r\nCookie: PHPSESSID=dgs4hp92tlp1bv1na5u9tt96dp\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Tue, 03 Feb 2026 21:13:09 GMT\r\ncontent-type: image/png\r\nlast-modified: Tue, 13 Jan 2026 13:50:28 GMT\r\nvary: Accept-Encoding\r\netag: W/\"69664da4-abd9\"\r\nexpires: Thu, 05 Mar 2026 21:13:09 GMT\r\ncache-control: max-age=2592000\r\nstrict-transport-security: max-age=31536000\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":43993,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 396 x 155, 8-bit/color RGBA, non-interlaced","md5":"5ebd1d0e0c44447007cc4f0052693de2","sha1":"46709e5ca6cb502a45648777971af84a5812e9c7","sha256":"a53ca4181bde69a1716c7a2e8eb5fe18ac1035fbbde6f868d826c93a491aef88","sha512":"56adf3a73ee982ec6224e1a14baaacdc12e734cf3abfae58fff23ab3bbc1896b7117461174ff901fbec34ebd4bdcb687fa158906a8f6249de28b2d7d2d84735c","ssdeep":"768:YUWH9U5cmh+inUydct+6Yypo0bAXdnLxe:YLUYzye86YFXxe","tlshash":"9113d038fdf2736c81e5227b25d910859eb75b87d5410c88bede9823af197dc0c4b5a2","first_seen":"2026-02-03T21:13:38.986697Z","last_seen":"2026-02-03T21:13:38.986697Z","times_seen":1,"resource_available":false,"data":null}},"time_used":283,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":283,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-02-03","alert":"Sinkholed","trigger":"www.metamaskirstelkmgt.cyou","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-02-03","alert":"Sinkholed","trigger":"www.metamaskirstelkmgt.cyou","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"www.metamaskirstelkmgt.cyou/assets/index/picture/svgexport-2.png","fqdn":"www.metamaskirstelkmgt.cyou","domain":"metamaskirstelkmgt.cyou","tld":"cyou"},"ip":{"addr":"13.203.136.234","port":443,"asn":16509,"as":"AMAZON-02","country":"India","country_code":"IN"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://www.metamaskirstelkmgt.cyou/","date":"2026-02-03T21:13:08.994Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"www.metamaskirstelkmgt.cyou","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Tue, 13 Jan 2026 12:14:48 GMT","end":"Mon, 13 Apr 2026 12:14:47 GMT"},"fingerprint":{"sha1":"6E:75:20:EF:EC:DD:19:49:46:B1:07:32:6E:64:A6:0A:B9:FA:AC:51","sha256":"87:51:14:82:44:53:A0:25:BD:45:96:99:3E:74:7C:38:86:AF:3F:4E:1B:E1:4F:AB:D3:EB:6D:98:A6:47:4F:03"}}},"request":{"raw":"GET /assets/index/picture/svgexport-2.png HTTP/1.1\r\nHost: www.metamaskirstelkmgt.cyou\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://www.metamaskirstelkmgt.cyou/\r\nCookie: PHPSESSID=dgs4hp92tlp1bv1na5u9tt96dp\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Tue, 03 Feb 2026 21:13:09 GMT\r\ncontent-type: image/png\r\ncontent-length: 844\r\nlast-modified: Tue, 24 Jun 2025 14:02:35 GMT\r\netag: \"685aaffb-34c\"\r\nexpires: Thu, 05 Mar 2026 21:13:09 GMT\r\ncache-control: max-age=2592000\r\nstrict-transport-security: max-age=31536000\r\naccept-ranges: bytes\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":844,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 48 x 48, 8-bit/color RGBA, non-interlaced","md5":"d96be76bb5d8d7657f2abd077de64379","sha1":"96f4499276e20886488e34fe641c2a3129551061","sha256":"a04a779c67646c86803f987bfd1fcadca2444b3d7834bd501cf55267b0e8b0d2","sha512":"3eadb8f3dc4df4e64a4d073b5b3d6d1eb9ab8ce2e35d207734e331f36c7d32b7fd7b7bd4160480738c0e2bba1356c6fd9ef69bb4356c3ec3ac7ab0fe5e203a59","ssdeep":"","tlshash":"d40175a3c71ba954c9dd6b314ccb6e720a0b917d4261062f020b7fc75c8777b20da207","first_seen":"2025-10-07T03:26:06.279142Z","last_seen":"2026-08-12T17:58:04.999635Z","times_seen":30,"resource_available":false,"data":null}},"time_used":679,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":276,"receive":403,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-02-03","alert":"Sinkholed","trigger":"www.metamaskirstelkmgt.cyou","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-02-03","alert":"Sinkholed","trigger":"www.metamaskirstelkmgt.cyou","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"www.metamaskirstelkmgt.cyou/assets/index/picture/svgexport-10.png","fqdn":"www.metamaskirstelkmgt.cyou","domain":"metamaskirstelkmgt.cyou","tld":"cyou"},"ip":{"addr":"13.203.136.234","port":443,"asn":16509,"as":"AMAZON-02","country":"India","country_code":"IN"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://www.metamaskirstelkmgt.cyou/","date":"2026-02-03T21:13:09.003Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"www.metamaskirstelkmgt.cyou","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Tue, 13 Jan 2026 12:14:48 GMT","end":"Mon, 13 Apr 2026 12:14:47 GMT"},"fingerprint":{"sha1":"6E:75:20:EF:EC:DD:19:49:46:B1:07:32:6E:64:A6:0A:B9:FA:AC:51","sha256":"87:51:14:82:44:53:A0:25:BD:45:96:99:3E:74:7C:38:86:AF:3F:4E:1B:E1:4F:AB:D3:EB:6D:98:A6:47:4F:03"}}},"request":{"raw":"GET /assets/index/picture/svgexport-10.png HTTP/1.1\r\nHost: www.metamaskirstelkmgt.cyou\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://www.metamaskirstelkmgt.cyou/\r\nCookie: PHPSESSID=dgs4hp92tlp1bv1na5u9tt96dp\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Tue, 03 Feb 2026 21:13:09 GMT\r\ncontent-type: image/png\r\nlast-modified: Tue, 24 Jun 2025 14:02:35 GMT\r\nvary: Accept-Encoding\r\netag: W/\"685aaffb-5fd\"\r\nexpires: Thu, 05 Mar 2026 21:13:09 GMT\r\ncache-control: max-age=2592000\r\nstrict-transport-security: max-age=31536000\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":1533,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 48 x 48, 8-bit/color RGBA, non-interlaced","md5":"c9f6118aea186f4ad0d764b97485cb71","sha1":"c737510412ec6008afac65f805d3b196d1c8e373","sha256":"fa44a264e31f405f3b4a6813ee6f911701bbd9959a2ed07e8c56956e23854123","sha512":"e9d4513ed9ef1004def68c5aa287efa486f6ff4f5b7500b6f8c49450d9c38a74cad682ba4870dc3963fe1e9804bbe87cc284f70b767f5b4dd7defa689e5c36fa","ssdeep":"","tlshash":"f731b70fba910c88c95f08756853027ddd4f8662d730536b41f207360e9b58e78c35d2","first_seen":"2025-11-10T16:51:53.682333Z","last_seen":"2026-02-03T21:13:38.990674Z","times_seen":2,"resource_available":false,"data":null}},"time_used":269,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":269,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-02-03","alert":"Sinkholed","trigger":"www.metamaskirstelkmgt.cyou","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-02-03","alert":"Sinkholed","trigger":"www.metamaskirstelkmgt.cyou","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"www.metamaskirstelkmgt.cyou/assets/index/js/bignumber.min.js","fqdn":"www.metamaskirstelkmgt.cyou","domain":"metamaskirstelkmgt.cyou","tld":"cyou"},"ip":{"addr":"13.203.136.234","port":443,"asn":16509,"as":"AMAZON-02","country":"India","country_code":"IN"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://www.metamaskirstelkmgt.cyou/","date":"2026-02-03T21:13:09.006Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"www.metamaskirstelkmgt.cyou","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Tue, 13 Jan 2026 12:14:48 GMT","end":"Mon, 13 Apr 2026 12:14:47 GMT"},"fingerprint":{"sha1":"6E:75:20:EF:EC:DD:19:49:46:B1:07:32:6E:64:A6:0A:B9:FA:AC:51","sha256":"87:51:14:82:44:53:A0:25:BD:45:96:99:3E:74:7C:38:86:AF:3F:4E:1B:E1:4F:AB:D3:EB:6D:98:A6:47:4F:03"}}},"request":{"raw":"GET /assets/index/js/bignumber.min.js HTTP/1.1\r\nHost: www.metamaskirstelkmgt.cyou\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://www.metamaskirstelkmgt.cyou/\r\nCookie: PHPSESSID=dgs4hp92tlp1bv1na5u9tt96dp\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Tue, 03 Feb 2026 21:13:09 GMT\r\ncontent-type: application/javascript\r\nlast-modified: Tue, 24 Jun 2025 14:02:35 GMT\r\nvary: Accept-Encoding\r\netag: W/\"685aaffb-4885\"\r\nexpires: Wed, 04 Feb 2026 09:13:09 GMT\r\ncache-control: max-age=43200\r\nstrict-transport-security: max-age=31536000\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":18565,"size_decoded":0,"mime_type":"application/javascript","magic":"JavaScript source, Unicode text, UTF-8 text, with very long lines (18564), with no line terminators","md5":"220b87873ab81287f915af82e3ba9a33","sha1":"ced2ebc27d644716effa64115643dd1770ba04eb","sha256":"266103c2cedfaf94d60f5a638555639fb2b86f2b66386660fd3d057715ebf463","sha512":"ddd12920edadffa6de43bed4fda62056a26999291cbd6b9314ee1684242b4a2dad49057753e938a65c122a554ec4a89bb2777a67fd1ebe60a5b0c9782d567b22","ssdeep":"384:W/NxaJsOM+a9fxrSZwieoa+gPIbMPzvP22niiXuB/CeTa4pLG950/GrVh:0xdxcZ9epPzP2/VlTDiX0/6","tlshash":"e582fcd875e3f09d62ff20e100e75443e17a9f0ba84c1976a2509496b831ddba2aff35","first_seen":"2023-03-07T12:03:15Z","last_seen":"2026-08-15T22:28:30.117877Z","times_seen":826,"resource_available":true,"data":null}},"time_used":264,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":264,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-02-03","alert":"Sinkholed","trigger":"www.metamaskirstelkmgt.cyou","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-02-03","alert":"Sinkholed","trigger":"www.metamaskirstelkmgt.cyou","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"www.metamaskirstelkmgt.cyou/assets/index/js/web3.min.js","fqdn":"www.metamaskirstelkmgt.cyou","domain":"metamaskirstelkmgt.cyou","tld":"cyou"},"ip":{"addr":"13.203.136.234","port":443,"asn":16509,"as":"AMAZON-02","country":"India","country_code":"IN"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://www.metamaskirstelkmgt.cyou/","date":"2026-02-03T21:13:09.009Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"www.metamaskirstelkmgt.cyou","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Tue, 13 Jan 2026 12:14:48 GMT","end":"Mon, 13 Apr 2026 12:14:47 GMT"},"fingerprint":{"sha1":"6E:75:20:EF:EC:DD:19:49:46:B1:07:32:6E:64:A6:0A:B9:FA:AC:51","sha256":"87:51:14:82:44:53:A0:25:BD:45:96:99:3E:74:7C:38:86:AF:3F:4E:1B:E1:4F:AB:D3:EB:6D:98:A6:47:4F:03"}}},"request":{"raw":"GET /assets/index/js/web3.min.js HTTP/1.1\r\nHost: www.metamaskirstelkmgt.cyou\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://www.metamaskirstelkmgt.cyou/\r\nCookie: PHPSESSID=dgs4hp92tlp1bv1na5u9tt96dp\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Tue, 03 Feb 2026 21:13:09 GMT\r\ncontent-type: application/javascript\r\nlast-modified: Tue, 24 Jun 2025 14:02:35 GMT\r\nvary: Accept-Encoding\r\netag: W/\"685aaffb-146a1c\"\r\nexpires: Wed, 04 Feb 2026 09:13:09 GMT\r\ncache-control: max-age=43200\r\nstrict-transport-security: max-age=31536000\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":1337884,"size_decoded":0,"mime_type":"application/javascript","magic":"JavaScript source, ASCII text, with very long lines (63842)","md5":"b8264772685dd79e72d854b4619a603b","sha1":"b96164dd553333d7894997093457f04b0c0766e8","sha256":"ececd85853602912a75e478ab98b9f5a0d8a21f3f6e392b475a37f920ebe7b6f","sha512":"73cbea194f7067ef594a90ff82a2ab7af43bf975d33c3e3ecd3c306a9747be19574451d882d36fd1397a9f69a72eb8fce38cd2e5e8499dc3a78d418d774d347c","ssdeep":"6144:9ggS4Whgg8WMRelCSJ70OSJeXiqP70X+C8kSlXnfCM7XZfcwJ4ywB8b2IRQFw3:K/K+C8R67GV","tlshash":"7f2597c0b6907056c3656e91442f900ae33efe693c4d0169fa57ecf37cb8a85552af3a","first_seen":"2025-08-21T03:25:46.594345Z","last_seen":"2026-08-18T01:43:12.539948Z","times_seen":85,"resource_available":false,"data":null}},"time_used":263,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":263,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-02-03","alert":"Sinkholed","trigger":"www.metamaskirstelkmgt.cyou","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-02-03","alert":"Sinkholed","trigger":"www.metamaskirstelkmgt.cyou","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"www.metamaskirstelkmgt.cyou/assets/index/css/style.css","fqdn":"www.metamaskirstelkmgt.cyou","domain":"metamaskirstelkmgt.cyou","tld":"cyou"},"ip":{"addr":"13.203.136.234","port":443,"asn":16509,"as":"AMAZON-02","country":"India","country_code":"IN"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://www.metamaskirstelkmgt.cyou/","date":"2026-02-03T21:13:08.976Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"www.metamaskirstelkmgt.cyou","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Tue, 13 Jan 2026 12:14:48 GMT","end":"Mon, 13 Apr 2026 12:14:47 GMT"},"fingerprint":{"sha1":"6E:75:20:EF:EC:DD:19:49:46:B1:07:32:6E:64:A6:0A:B9:FA:AC:51","sha256":"87:51:14:82:44:53:A0:25:BD:45:96:99:3E:74:7C:38:86:AF:3F:4E:1B:E1:4F:AB:D3:EB:6D:98:A6:47:4F:03"}}},"request":{"raw":"GET /assets/index/css/style.css HTTP/1.1\r\nHost: www.metamaskirstelkmgt.cyou\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://www.metamaskirstelkmgt.cyou/\r\nCookie: PHPSESSID=dgs4hp92tlp1bv1na5u9tt96dp\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Tue, 03 Feb 2026 21:13:09 GMT\r\ncontent-type: text/css\r\nlast-modified: Tue, 13 Jan 2026 13:22:52 GMT\r\nvary: Accept-Encoding\r\netag: W/\"6966472c-79d6\"\r\nexpires: Wed, 04 Feb 2026 09:13:09 GMT\r\ncache-control: max-age=43200\r\nstrict-transport-security: max-age=31536000\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":31190,"size_decoded":0,"mime_type":"text/css","magic":"assembler source, Unicode text, UTF-8 text, with very long lines (5738)","md5":"cbb5f4c5cdffc23b39be1ddeec41d6cb","sha1":"e9dbc44396719328dd7edbf4dfe8668c0ee65a91","sha256":"a1aff9f09afe5d9dd8afe6a11b819b443c9743e6c4a7f266a6393f71a21410c9","sha512":"84b3017e56d8c51908e42f67263be3c741a93a3a9ec7bb8f38dbd99b5f58323fd3176d0febd1f2b13d0e48d55145f70c338b0406c3ecc2d6f3b57ff898f6a8b2","ssdeep":"384:l28lPWyKw5wSLUt638F7F43IIJCLt34O1a6EQH4PUxRw+kK2Ukb:lSyX5psF7F2o2Ukb","tlshash":"3de25f535a630802f362c0e76ee58b97677842c3c21aee39fbc5715ccf860b9557268b","first_seen":"2026-02-03T21:13:38.997619Z","last_seen":"2026-02-03T21:13:38.997619Z","times_seen":1,"resource_available":false,"data":null}},"time_used":286,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":286,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-02-03","alert":"Sinkholed","trigger":"www.metamaskirstelkmgt.cyou","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-02-03","alert":"Sinkholed","trigger":"www.metamaskirstelkmgt.cyou","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"www.metamaskirstelkmgt.cyou/assets/index/picture/svgexport-3.png","fqdn":"www.metamaskirstelkmgt.cyou","domain":"metamaskirstelkmgt.cyou","tld":"cyou"},"ip":{"addr":"13.203.136.234","port":443,"asn":16509,"as":"AMAZON-02","country":"India","country_code":"IN"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://www.metamaskirstelkmgt.cyou/","date":"2026-02-03T21:13:08.996Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"www.metamaskirstelkmgt.cyou","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Tue, 13 Jan 2026 12:14:48 GMT","end":"Mon, 13 Apr 2026 12:14:47 GMT"},"fingerprint":{"sha1":"6E:75:20:EF:EC:DD:19:49:46:B1:07:32:6E:64:A6:0A:B9:FA:AC:51","sha256":"87:51:14:82:44:53:A0:25:BD:45:96:99:3E:74:7C:38:86:AF:3F:4E:1B:E1:4F:AB:D3:EB:6D:98:A6:47:4F:03"}}},"request":{"raw":"GET /assets/index/picture/svgexport-3.png HTTP/1.1\r\nHost: www.metamaskirstelkmgt.cyou\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://www.metamaskirstelkmgt.cyou/\r\nCookie: PHPSESSID=dgs4hp92tlp1bv1na5u9tt96dp\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Tue, 03 Feb 2026 21:13:09 GMT\r\ncontent-type: image/png\r\ncontent-length: 847\r\nlast-modified: Tue, 24 Jun 2025 14:02:35 GMT\r\netag: \"685aaffb-34f\"\r\nexpires: Thu, 05 Mar 2026 21:13:09 GMT\r\ncache-control: max-age=2592000\r\nstrict-transport-security: max-age=31536000\r\naccept-ranges: bytes\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":847,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 48 x 48, 8-bit/color RGBA, non-interlaced","md5":"30a9eb155e415d00d91e2f64d740d226","sha1":"56369fe70c47ec7cd0339ec1dca6b537d84843ea","sha256":"32103492ccceca92e1f27f1228ae1a68d885912385e79611e5810fc8d897ffde","sha512":"8e71d7665e83086285292856b15b819ea9b290355c8ae627aeb973b1c93d135a35e649ce697eae9911dc6a6c6729f3443ae2e22fa27dc29c354d51a3edb7bd89","ssdeep":"","tlshash":"6d0186dbe319292bc6c6a33081cea725a40959134737db2c03792025488acbe8da2607","first_seen":"2025-10-07T03:26:06.295631Z","last_seen":"2026-08-12T17:58:04.966299Z","times_seen":30,"resource_available":false,"data":null}},"time_used":679,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":276,"receive":403,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-02-03","alert":"Sinkholed","trigger":"www.metamaskirstelkmgt.cyou","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-02-03","alert":"Sinkholed","trigger":"www.metamaskirstelkmgt.cyou","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"www.metamaskirstelkmgt.cyou/assets/index/picture/svgexport-4.png","fqdn":"www.metamaskirstelkmgt.cyou","domain":"metamaskirstelkmgt.cyou","tld":"cyou"},"ip":{"addr":"13.203.136.234","port":443,"asn":16509,"as":"AMAZON-02","country":"India","country_code":"IN"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://www.metamaskirstelkmgt.cyou/","date":"2026-02-03T21:13:08.997Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"www.metamaskirstelkmgt.cyou","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Tue, 13 Jan 2026 12:14:48 GMT","end":"Mon, 13 Apr 2026 12:14:47 GMT"},"fingerprint":{"sha1":"6E:75:20:EF:EC:DD:19:49:46:B1:07:32:6E:64:A6:0A:B9:FA:AC:51","sha256":"87:51:14:82:44:53:A0:25:BD:45:96:99:3E:74:7C:38:86:AF:3F:4E:1B:E1:4F:AB:D3:EB:6D:98:A6:47:4F:03"}}},"request":{"raw":"GET /assets/index/picture/svgexport-4.png HTTP/1.1\r\nHost: www.metamaskirstelkmgt.cyou\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://www.metamaskirstelkmgt.cyou/\r\nCookie: PHPSESSID=dgs4hp92tlp1bv1na5u9tt96dp\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Tue, 03 Feb 2026 21:13:09 GMT\r\ncontent-type: image/png\r\nlast-modified: Tue, 24 Jun 2025 14:02:35 GMT\r\nvary: Accept-Encoding\r\netag: W/\"685aaffb-4af\"\r\nexpires: Thu, 05 Mar 2026 21:13:09 GMT\r\ncache-control: max-age=2592000\r\nstrict-transport-security: max-age=31536000\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":1199,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 48 x 48, 8-bit/color RGBA, non-interlaced","md5":"99252e0411ba157366c6b76afeaec2ce","sha1":"7bebf35443cf74ac7113b223fede9bb0d203b5e4","sha256":"c17413cff7db73fee11fae5b1f74777614e0059a9fc8ae3e92f80d315c373bf0","sha512":"6b544b950ffdadea4ff479930b3091ac492cd0480e2466020ea1ce2d2f1626d5dbeba93490431046116286ab1e1c6b70c5e1f2abe784e67ed105252c1ad9e7e8","ssdeep":"","tlshash":"6921d7831bd1d066eb086b720cc19317ac2fa2357ab5a154940c03e06f9148c18ceb6b","first_seen":"2025-11-10T16:51:53.669452Z","last_seen":"2026-02-03T21:13:39.00199Z","times_seen":2,"resource_available":false,"data":null}},"time_used":275,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":275,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-02-03","alert":"Sinkholed","trigger":"www.metamaskirstelkmgt.cyou","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-02-03","alert":"Sinkholed","trigger":"www.metamaskirstelkmgt.cyou","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"www.metamaskirstelkmgt.cyou/assets/index/js/layer.js","fqdn":"www.metamaskirstelkmgt.cyou","domain":"metamaskirstelkmgt.cyou","tld":"cyou"},"ip":{"addr":"13.203.136.234","port":443,"asn":16509,"as":"AMAZON-02","country":"India","country_code":"IN"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://www.metamaskirstelkmgt.cyou/","date":"2026-02-03T21:13:09.012Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"www.metamaskirstelkmgt.cyou","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Tue, 13 Jan 2026 12:14:48 GMT","end":"Mon, 13 Apr 2026 12:14:47 GMT"},"fingerprint":{"sha1":"6E:75:20:EF:EC:DD:19:49:46:B1:07:32:6E:64:A6:0A:B9:FA:AC:51","sha256":"87:51:14:82:44:53:A0:25:BD:45:96:99:3E:74:7C:38:86:AF:3F:4E:1B:E1:4F:AB:D3:EB:6D:98:A6:47:4F:03"}}},"request":{"raw":"GET /assets/index/js/layer.js HTTP/1.1\r\nHost: www.metamaskirstelkmgt.cyou\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://www.metamaskirstelkmgt.cyou/\r\nCookie: PHPSESSID=dgs4hp92tlp1bv1na5u9tt96dp\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Tue, 03 Feb 2026 21:13:09 GMT\r\ncontent-type: application/javascript\r\nlast-modified: Tue, 24 Jun 2025 14:02:35 GMT\r\nvary: Accept-Encoding\r\netag: W/\"685aaffb-58d2\"\r\nexpires: Wed, 04 Feb 2026 09:13:09 GMT\r\ncache-control: max-age=43200\r\nstrict-transport-security: max-age=31536000\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":22738,"size_decoded":0,"mime_type":"application/javascript","magic":"JavaScript source, Unicode text, UTF-8 text, with very long lines (22666)","md5":"c07601c9dc7a051f684ada8b5a588c1e","sha1":"10b905cb285468743b548c66ec0a54f7204ed392","sha256":"96f235f5991ceb8e21a80d7090eced3d3792b451b52e3614713a07e23d1d563c","sha512":"d14baec3781b4ad8aa2b284184d7d02be413ca75df4ec69f3274f1acaa1dc71dc51f552a5e0d8dc74ae0f4326031512a11bd53bf90a6fd869493f78ba7810ea7","ssdeep":"384:B13Cih5R93iKTtXSt/KrGriu46K+Lxz6PTElH0jlhpPtwo:B1Siz3i0QtvTKiFSb2o","tlshash":"72a2c76a755034976323906ad10f7a0b31b21d24d7078128f22bb4be1dbcd99a2b7f5f","first_seen":"2023-04-07T18:53:04Z","last_seen":"2026-08-16T22:58:43.43797Z","times_seen":11308,"resource_available":true,"data":null}},"time_used":259,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":259,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-02-03","alert":"Sinkholed","trigger":"www.metamaskirstelkmgt.cyou","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-02-03","alert":"Sinkholed","trigger":"www.metamaskirstelkmgt.cyou","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"www.metamaskirstelkmgt.cyou/assets/index/js/scroll.js","fqdn":"www.metamaskirstelkmgt.cyou","domain":"metamaskirstelkmgt.cyou","tld":"cyou"},"ip":{"addr":"13.203.136.234","port":443,"asn":16509,"as":"AMAZON-02","country":"India","country_code":"IN"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://www.metamaskirstelkmgt.cyou/","date":"2026-02-03T21:13:09.017Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"www.metamaskirstelkmgt.cyou","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Tue, 13 Jan 2026 12:14:48 GMT","end":"Mon, 13 Apr 2026 12:14:47 GMT"},"fingerprint":{"sha1":"6E:75:20:EF:EC:DD:19:49:46:B1:07:32:6E:64:A6:0A:B9:FA:AC:51","sha256":"87:51:14:82:44:53:A0:25:BD:45:96:99:3E:74:7C:38:86:AF:3F:4E:1B:E1:4F:AB:D3:EB:6D:98:A6:47:4F:03"}}},"request":{"raw":"GET /assets/index/js/scroll.js HTTP/1.1\r\nHost: www.metamaskirstelkmgt.cyou\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://www.metamaskirstelkmgt.cyou/\r\nCookie: PHPSESSID=dgs4hp92tlp1bv1na5u9tt96dp\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Tue, 03 Feb 2026 21:13:09 GMT\r\ncontent-type: application/javascript\r\nlast-modified: Tue, 24 Jun 2025 14:02:35 GMT\r\nvary: Accept-Encoding\r\netag: W/\"685aaffb-43a\"\r\nexpires: Wed, 04 Feb 2026 09:13:09 GMT\r\ncache-control: max-age=43200\r\nstrict-transport-security: max-age=31536000\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":1082,"size_decoded":0,"mime_type":"application/javascript","magic":"JavaScript source, ASCII text, with CRLF line terminators","md5":"76ab7009a8811f47b2e611d3de470c6f","sha1":"382a4768c62e1afb8dc3a161a18627e228a01a18","sha256":"4a738e36d8741e7a5e8aa7be3967b81bb2dbb09e9b9299e38400c506bafa1b75","sha512":"0099c6c33252701e7a5fc05221e010a868d7acb81f81be56648f4746a9c74b89a6dfc548cd02f76fb5e5050dae2f99ce963418efbab7faeb267cc17947d3dbac","ssdeep":"","tlshash":"2a1189f5b74f20ae6aa23023807e5408fc1dd8334816546bb99554e85cb8908a3aaf79","first_seen":"2024-08-21T07:09:15.365586Z","last_seen":"2026-02-03T21:13:39.004445Z","times_seen":6,"resource_available":true,"data":null}},"time_used":256,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":256,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-02-03","alert":"Sinkholed","trigger":"www.metamaskirstelkmgt.cyou","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-02-03","alert":"Sinkholed","trigger":"www.metamaskirstelkmgt.cyou","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"www.metamaskirstelkmgt.cyou/assets/index/picture/svgexport-9.png","fqdn":"www.metamaskirstelkmgt.cyou","domain":"metamaskirstelkmgt.cyou","tld":"cyou"},"ip":{"addr":"13.203.136.234","port":443,"asn":16509,"as":"AMAZON-02","country":"India","country_code":"IN"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://www.metamaskirstelkmgt.cyou/","date":"2026-02-03T21:13:09.002Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"www.metamaskirstelkmgt.cyou","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Tue, 13 Jan 2026 12:14:48 GMT","end":"Mon, 13 Apr 2026 12:14:47 GMT"},"fingerprint":{"sha1":"6E:75:20:EF:EC:DD:19:49:46:B1:07:32:6E:64:A6:0A:B9:FA:AC:51","sha256":"87:51:14:82:44:53:A0:25:BD:45:96:99:3E:74:7C:38:86:AF:3F:4E:1B:E1:4F:AB:D3:EB:6D:98:A6:47:4F:03"}}},"request":{"raw":"GET /assets/index/picture/svgexport-9.png HTTP/1.1\r\nHost: www.metamaskirstelkmgt.cyou\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://www.metamaskirstelkmgt.cyou/\r\nCookie: PHPSESSID=dgs4hp92tlp1bv1na5u9tt96dp\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Tue, 03 Feb 2026 21:13:09 GMT\r\ncontent-type: image/png\r\nlast-modified: Tue, 24 Jun 2025 14:02:35 GMT\r\nvary: Accept-Encoding\r\netag: W/\"685aaffb-87d\"\r\nexpires: Thu, 05 Mar 2026 21:13:09 GMT\r\ncache-control: max-age=2592000\r\nstrict-transport-security: max-age=31536000\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":2173,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 48 x 48, 8-bit/color RGBA, non-interlaced","md5":"4b1869e71efa67a206b136cd19a38cfd","sha1":"b6ae299bf245626934bea9d2240c7456ecff13e1","sha256":"75494d578864f35d4d8b17df3c293eaa130295bf8003f54d2aa1c5a5c5570121","sha512":"f2ac13582db8d3d60f4a0fb4bae0bf87a0539eda634da5ccf81b0efb2bdd946e655c2ec382c52be81f90ea83a93142dcc7e2999e305af9cdce0a255dfb473a78","ssdeep":"","tlshash":"79410941c3252839db00267528f6677bd463c8c94207d1b69ae2846c8db1fa81baf0c3","first_seen":"2025-11-10T16:51:53.710151Z","last_seen":"2026-02-03T21:13:39.006396Z","times_seen":2,"resource_available":false,"data":null}},"time_used":270,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":270,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-02-03","alert":"Sinkholed","trigger":"www.metamaskirstelkmgt.cyou","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-02-03","alert":"Sinkholed","trigger":"www.metamaskirstelkmgt.cyou","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"www.metamaskirstelkmgt.cyou/assets/index/img/photo.jpg","fqdn":"www.metamaskirstelkmgt.cyou","domain":"metamaskirstelkmgt.cyou","tld":"cyou"},"ip":{"addr":"13.203.136.234","port":443,"asn":16509,"as":"AMAZON-02","country":"India","country_code":"IN"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://www.metamaskirstelkmgt.cyou/","date":"2026-02-03T21:13:08.991Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"www.metamaskirstelkmgt.cyou","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Tue, 13 Jan 2026 12:14:48 GMT","end":"Mon, 13 Apr 2026 12:14:47 GMT"},"fingerprint":{"sha1":"6E:75:20:EF:EC:DD:19:49:46:B1:07:32:6E:64:A6:0A:B9:FA:AC:51","sha256":"87:51:14:82:44:53:A0:25:BD:45:96:99:3E:74:7C:38:86:AF:3F:4E:1B:E1:4F:AB:D3:EB:6D:98:A6:47:4F:03"}}},"request":{"raw":"GET /assets/index/img/photo.jpg HTTP/1.1\r\nHost: www.metamaskirstelkmgt.cyou\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://www.metamaskirstelkmgt.cyou/\r\nCookie: PHPSESSID=dgs4hp92tlp1bv1na5u9tt96dp\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Tue, 03 Feb 2026 21:13:09 GMT\r\ncontent-type: image/jpeg\r\nlast-modified: Mon, 12 Jan 2026 11:26:42 GMT\r\nvary: Accept-Encoding\r\netag: W/\"6964da72-23feb\"\r\nexpires: Thu, 05 Mar 2026 21:13:09 GMT\r\ncache-control: max-age=2592000\r\nstrict-transport-security: max-age=31536000\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":147435,"size_decoded":0,"mime_type":"image/jpeg","magic":"JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, progressive, precision 8, 1280x960, components 3","md5":"a23893337a50230c4f6b8be6212ff530","sha1":"d20a471122fa9787ad04abeade6992b420a8e9d0","sha256":"5fae9d20f38cc96d4917ab477eabb6fcc6ad498c939b757cec60802c0f33534a","sha512":"e836f1b648082f6e5ce18772732762a3d05e92799d766aa57b3294795bad153eb2d842154765e1e623816223a9917848055d9a016d0c4ef268213dddfe013dba","ssdeep":"3072:l+Jo1pX9KVR71FVbxxIBnvcBnhpdtKmlNu+yvkTYp8Q:l++9MRJFbxiEBnvdtKmlNuf8TY+Q","tlshash":"eae312679a47a863ee34213ccee3bd4c6b32b3565230a2d1a6bf54578eb40163df058d","first_seen":"2026-02-03T21:13:39.007727Z","last_seen":"2026-02-03T21:13:39.007727Z","times_seen":1,"resource_available":false,"data":null}},"time_used":278,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":278,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-02-03","alert":"Sinkholed","trigger":"www.metamaskirstelkmgt.cyou","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-02-03","alert":"Sinkholed","trigger":"www.metamaskirstelkmgt.cyou","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"www.metamaskirstelkmgt.cyou/assets/index/picture/svgexport-7.png","fqdn":"www.metamaskirstelkmgt.cyou","domain":"metamaskirstelkmgt.cyou","tld":"cyou"},"ip":{"addr":"13.203.136.234","port":443,"asn":16509,"as":"AMAZON-02","country":"India","country_code":"IN"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://www.metamaskirstelkmgt.cyou/","date":"2026-02-03T21:13:09.000Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"www.metamaskirstelkmgt.cyou","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Tue, 13 Jan 2026 12:14:48 GMT","end":"Mon, 13 Apr 2026 12:14:47 GMT"},"fingerprint":{"sha1":"6E:75:20:EF:EC:DD:19:49:46:B1:07:32:6E:64:A6:0A:B9:FA:AC:51","sha256":"87:51:14:82:44:53:A0:25:BD:45:96:99:3E:74:7C:38:86:AF:3F:4E:1B:E1:4F:AB:D3:EB:6D:98:A6:47:4F:03"}}},"request":{"raw":"GET /assets/index/picture/svgexport-7.png HTTP/1.1\r\nHost: www.metamaskirstelkmgt.cyou\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://www.metamaskirstelkmgt.cyou/\r\nCookie: PHPSESSID=dgs4hp92tlp1bv1na5u9tt96dp\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Tue, 03 Feb 2026 21:13:09 GMT\r\ncontent-type: image/png\r\ncontent-length: 992\r\nlast-modified: Tue, 24 Jun 2025 14:02:35 GMT\r\netag: \"685aaffb-3e0\"\r\nexpires: Thu, 05 Mar 2026 21:13:09 GMT\r\ncache-control: max-age=2592000\r\nstrict-transport-security: max-age=31536000\r\naccept-ranges: bytes\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":992,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 48 x 48, 8-bit/color RGBA, non-interlaced","md5":"1f0ae5177268201ad7f640546c263f47","sha1":"240a550ba2ffa3b236eda6b951f7568b4e10573c","sha256":"8ce49704260e1d21ad15c15b7b3138002e7f4b052208890673a2d67c50470a04","sha512":"dad3bef3cfdbfa9dfd772dce9f018801b092300c98acd3cb7b3f86ae2f9d0b52cc49de3c7c754c742756b37627d20057814c84e51f196bc52492dfd274dc0505","ssdeep":"","tlshash":"9711c8d795f50295f6f234366d2687a0a1452487201c39c5e88d5d040c9718239909b1","first_seen":"2025-11-10T16:51:53.715998Z","last_seen":"2026-02-03T21:13:39.009331Z","times_seen":2,"resource_available":false,"data":null}},"time_used":675,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":272,"receive":403,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-02-03","alert":"Sinkholed","trigger":"www.metamaskirstelkmgt.cyou","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-02-03","alert":"Sinkholed","trigger":"www.metamaskirstelkmgt.cyou","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"www.metamaskirstelkmgt.cyou/assets/index/js/w3model.js","fqdn":"www.metamaskirstelkmgt.cyou","domain":"metamaskirstelkmgt.cyou","tld":"cyou"},"ip":{"addr":"13.203.136.234","port":443,"asn":16509,"as":"AMAZON-02","country":"India","country_code":"IN"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://www.metamaskirstelkmgt.cyou/","date":"2026-02-03T21:13:09.008Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"www.metamaskirstelkmgt.cyou","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Tue, 13 Jan 2026 12:14:48 GMT","end":"Mon, 13 Apr 2026 12:14:47 GMT"},"fingerprint":{"sha1":"6E:75:20:EF:EC:DD:19:49:46:B1:07:32:6E:64:A6:0A:B9:FA:AC:51","sha256":"87:51:14:82:44:53:A0:25:BD:45:96:99:3E:74:7C:38:86:AF:3F:4E:1B:E1:4F:AB:D3:EB:6D:98:A6:47:4F:03"}}},"request":{"raw":"GET /assets/index/js/w3model.js HTTP/1.1\r\nHost: www.metamaskirstelkmgt.cyou\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://www.metamaskirstelkmgt.cyou/\r\nCookie: PHPSESSID=dgs4hp92tlp1bv1na5u9tt96dp\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Tue, 03 Feb 2026 21:13:09 GMT\r\ncontent-type: application/javascript\r\nlast-modified: Tue, 24 Jun 2025 14:02:35 GMT\r\nvary: Accept-Encoding\r\netag: W/\"685aaffb-68f32\"\r\nexpires: Wed, 04 Feb 2026 09:13:09 GMT\r\ncache-control: max-age=43200\r\nstrict-transport-security: max-age=31536000\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":429874,"size_decoded":0,"mime_type":"application/javascript","magic":"JavaScript source, ASCII text, with very long lines (44112)","md5":"aac4569bbff2c557800aa919fb86114e","sha1":"d19621d1d38e488b417c28b3efd879b481566d80","sha256":"5851c751870f4d385689f84d0e346c92234a1c7776f98099222eb30565370864","sha512":"c7498c4cbc7f499a907eadf8de3895070e007505654dd31579067b2de7075a0fb5a1acf3b869d68e0e31ca3bd3c5b99c27a14e6cdf5401d5c25e546c579753a0","ssdeep":"6144:g76dr/jrE/0NNWS9UO2/HP2jz05O1HaeJ3qZEZDj9+b+Q88MzfFNo8vq5:O6d9DZzaneYZEl5+qQ8zztN85","tlshash":"8394aee93582f42157f366b740af1806b33d691b140c88a0f255edd5e8f84aa913bff9","first_seen":"2023-03-07T12:26:47Z","last_seen":"2026-08-12T17:58:05.025374Z","times_seen":61,"resource_available":true,"data":null}},"time_used":263,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":263,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-02-03","alert":"Sinkholed","trigger":"www.metamaskirstelkmgt.cyou","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-02-03","alert":"Sinkholed","trigger":"www.metamaskirstelkmgt.cyou","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"www.metamaskirstelkmgt.cyou/favicon.ico","fqdn":"www.metamaskirstelkmgt.cyou","domain":"metamaskirstelkmgt.cyou","tld":"cyou"},"ip":{"addr":"13.203.136.234","port":443,"asn":16509,"as":"AMAZON-02","country":"India","country_code":"IN"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://www.metamaskirstelkmgt.cyou/","date":"2026-02-03T21:13:10.400Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"www.metamaskirstelkmgt.cyou","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Tue, 13 Jan 2026 12:14:48 GMT","end":"Mon, 13 Apr 2026 12:14:47 GMT"},"fingerprint":{"sha1":"6E:75:20:EF:EC:DD:19:49:46:B1:07:32:6E:64:A6:0A:B9:FA:AC:51","sha256":"87:51:14:82:44:53:A0:25:BD:45:96:99:3E:74:7C:38:86:AF:3F:4E:1B:E1:4F:AB:D3:EB:6D:98:A6:47:4F:03"}}},"request":{"raw":"GET /favicon.ico HTTP/1.1\r\nHost: www.metamaskirstelkmgt.cyou\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://www.metamaskirstelkmgt.cyou/\r\nCookie: PHPSESSID=dgs4hp92tlp1bv1na5u9tt96dp; thinkphp_show_page_trace=0|0\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Tue, 03 Feb 2026 21:13:10 GMT\r\ncontent-type: image/x-icon\r\ncontent-length: 4414\r\nlast-modified: Tue, 13 Jan 2026 13:34:23 GMT\r\netag: \"696649df-113e\"\r\nstrict-transport-security: max-age=31536000\r\naccept-ranges: bytes\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":4414,"size_decoded":0,"mime_type":"image/x-icon","magic":"MS Windows icon resource - 1 icon, 32x32, 32 bits/pixel","md5":"3898d899f8c979c99c6a226b0d934b9a","sha1":"d8fd484aab7f3c85998995b9df0ecf6af924ee9d","sha256":"8b772a7295435c75ca882f5d9197e581fa7bb795bfa34f02a438ef7841f59280","sha512":"5f5977b6dbbee5700bf14983bb77caad875d3cf053e6f16aa25e3073d213228d0026f226f36400e8c60bc198734fb8b90d3493c0dbc5b5533adb9f10363c7636","ssdeep":"48:SF3Dx4Qp59/qza7nYV/JgSmQdD3m6oHhNxD47/UcHRw7EAe:SUQpL/qc4mSm16oHhNxa/UB7Et","tlshash":"4291a6930e189f6dfbc278bc8d7d6c8974e09c210e0119e1e4f3d05b0b93e8ace29965","first_seen":"2026-02-03T21:13:39.032043Z","last_seen":"2026-02-03T21:13:39.032043Z","times_seen":1,"resource_available":false,"data":null}},"time_used":134,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":133,"receive":1,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-02-03","alert":"Sinkholed","trigger":"www.metamaskirstelkmgt.cyou","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-02-03","alert":"Sinkholed","trigger":"www.metamaskirstelkmgt.cyou","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"www.metamaskirstelkmgt.cyou/assets/index/images/shadow-grey.png","fqdn":"www.metamaskirstelkmgt.cyou","domain":"metamaskirstelkmgt.cyou","tld":"cyou"},"ip":{"addr":"13.203.136.234","port":443,"asn":16509,"as":"AMAZON-02","country":"India","country_code":"IN"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://www.metamaskirstelkmgt.cyou/","date":"2026-02-03T21:13:12.729Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"www.metamaskirstelkmgt.cyou","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Tue, 13 Jan 2026 12:14:48 GMT","end":"Mon, 13 Apr 2026 12:14:47 GMT"},"fingerprint":{"sha1":"6E:75:20:EF:EC:DD:19:49:46:B1:07:32:6E:64:A6:0A:B9:FA:AC:51","sha256":"87:51:14:82:44:53:A0:25:BD:45:96:99:3E:74:7C:38:86:AF:3F:4E:1B:E1:4F:AB:D3:EB:6D:98:A6:47:4F:03"}}},"request":{"raw":"GET /assets/index/images/shadow-grey.png HTTP/1.1\r\nHost: www.metamaskirstelkmgt.cyou\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://www.metamaskirstelkmgt.cyou/assets/index/css/index.a5c69d49.css\r\nCookie: PHPSESSID=dgs4hp92tlp1bv1na5u9tt96dp; thinkphp_show_page_trace=0|0\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Tue, 03 Feb 2026 21:13:12 GMT\r\ncontent-type: image/png\r\ncontent-length: 136\r\nlast-modified: Tue, 24 Jun 2025 14:02:35 GMT\r\netag: \"685aaffb-88\"\r\nexpires: Thu, 05 Mar 2026 21:13:12 GMT\r\ncache-control: max-age=2592000\r\nstrict-transport-security: max-age=31536000\r\naccept-ranges: bytes\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":136,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 1 x 6, 4-bit colormap, non-interlaced","md5":"5a962adf74d92ae702467b3f47976547","sha1":"36f74049375584e3fa69b5ef87e9572336ff9e7a","sha256":"ad4ebea1c3496dd2924789ee009174a2c6289d1200e9811f458fd46f172d1d6f","sha512":"4ace23fe7ec6c7271710030fd423aace13eafac68ac3e76366ce4ce9bdc702caf71c9bdc2fb6a32c8e9791546098617cc0259decd8bb8489afdbce43e1b53a73","ssdeep":"","tlshash":"47c09bf3a615dc754a0d153b42e98271f429511e07046d0e5a13c216741e3448d56793","first_seen":"2023-04-15T10:50:30Z","last_seen":"2026-08-21T05:19:19.569006Z","times_seen":20321,"resource_available":false,"data":null}},"time_used":133,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":133,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-02-03","alert":"Sinkholed","trigger":"www.metamaskirstelkmgt.cyou","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-02-03","alert":"Sinkholed","trigger":"www.metamaskirstelkmgt.cyou","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"www.metamaskirstelkmgt.cyou/assets/index/picture/svgexport-5.png","fqdn":"www.metamaskirstelkmgt.cyou","domain":"metamaskirstelkmgt.cyou","tld":"cyou"},"ip":{"addr":"13.203.136.234","port":443,"asn":16509,"as":"AMAZON-02","country":"India","country_code":"IN"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://www.metamaskirstelkmgt.cyou/","date":"2026-02-03T21:13:08.998Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"www.metamaskirstelkmgt.cyou","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Tue, 13 Jan 2026 12:14:48 GMT","end":"Mon, 13 Apr 2026 12:14:47 GMT"},"fingerprint":{"sha1":"6E:75:20:EF:EC:DD:19:49:46:B1:07:32:6E:64:A6:0A:B9:FA:AC:51","sha256":"87:51:14:82:44:53:A0:25:BD:45:96:99:3E:74:7C:38:86:AF:3F:4E:1B:E1:4F:AB:D3:EB:6D:98:A6:47:4F:03"}}},"request":{"raw":"GET /assets/index/picture/svgexport-5.png HTTP/1.1\r\nHost: www.metamaskirstelkmgt.cyou\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://www.metamaskirstelkmgt.cyou/\r\nCookie: PHPSESSID=dgs4hp92tlp1bv1na5u9tt96dp\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Tue, 03 Feb 2026 21:13:09 GMT\r\ncontent-type: image/png\r\ncontent-length: 871\r\nlast-modified: Tue, 24 Jun 2025 14:02:35 GMT\r\netag: \"685aaffb-367\"\r\nexpires: Thu, 05 Mar 2026 21:13:09 GMT\r\ncache-control: max-age=2592000\r\nstrict-transport-security: max-age=31536000\r\naccept-ranges: bytes\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":871,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 48 x 48, 8-bit/color RGBA, non-interlaced","md5":"051219dd6836dbf804ea6ec0e74e4f87","sha1":"96db9fa4f219a8e31255791676dc9e90a148f506","sha256":"97b28253509bf9df6893bde2d34723b1f355f0e9bfbe56c16ad561786beb56c1","sha512":"3ed5d69d00c834af3125dba38cb843a8f88b3b0f16592fbe59ae6f6c3de8580f4750fa97208c643bd4a3a4655a8f8b84748d6449661aa8e629bc0e5a02644d60","ssdeep":"","tlshash":"8211920742b8adbec65328b8eaf0484acc3ec11c6011421a680933e90c89fc6c5b6e30","first_seen":"2025-11-10T16:51:53.721009Z","last_seen":"2026-02-03T21:13:39.036254Z","times_seen":2,"resource_available":false,"data":null}},"time_used":677,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":274,"receive":403,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-02-03","alert":"Sinkholed","trigger":"www.metamaskirstelkmgt.cyou","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-02-03","alert":"Sinkholed","trigger":"www.metamaskirstelkmgt.cyou","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"www.metamaskirstelkmgt.cyou/assets/index/js/theme/default/layer.css?v=3.5.1","fqdn":"www.metamaskirstelkmgt.cyou","domain":"metamaskirstelkmgt.cyou","tld":"cyou"},"ip":{"addr":"13.203.136.234","port":443,"asn":16509,"as":"AMAZON-02","country":"India","country_code":"IN"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://www.metamaskirstelkmgt.cyou/","date":"2026-02-03T21:13:10.141Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"www.metamaskirstelkmgt.cyou","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Tue, 13 Jan 2026 12:14:48 GMT","end":"Mon, 13 Apr 2026 12:14:47 GMT"},"fingerprint":{"sha1":"6E:75:20:EF:EC:DD:19:49:46:B1:07:32:6E:64:A6:0A:B9:FA:AC:51","sha256":"87:51:14:82:44:53:A0:25:BD:45:96:99:3E:74:7C:38:86:AF:3F:4E:1B:E1:4F:AB:D3:EB:6D:98:A6:47:4F:03"}}},"request":{"raw":"GET /assets/index/js/theme/default/layer.css?v=3.5.1 HTTP/1.1\r\nHost: www.metamaskirstelkmgt.cyou\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://www.metamaskirstelkmgt.cyou/\r\nCookie: PHPSESSID=dgs4hp92tlp1bv1na5u9tt96dp\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Tue, 03 Feb 2026 21:13:10 GMT\r\ncontent-type: text/css\r\nlast-modified: Tue, 24 Jun 2025 14:02:35 GMT\r\nvary: Accept-Encoding\r\netag: W/\"685aaffb-37bf\"\r\nexpires: Wed, 04 Feb 2026 09:13:10 GMT\r\ncache-control: max-age=43200\r\nstrict-transport-security: max-age=31536000\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":14271,"size_decoded":0,"mime_type":"text/css","magic":"ASCII text, with very long lines (14271), with no line terminators","md5":"c234eb06d5f32055092294e78957f17d","sha1":"f15ee0bcb9694f32f5e1d524f2653aa0dd043402","sha256":"5cdf3edb27b0c9f8e48918c486e9ae65a9e5beab806b64c4a7bc5bac53c0f540","sha512":"3f06b51116d7f8026d81c7eb6a3c4d871462d09fe0a5b8cc8b7feaf20cbc88b0b6a545f0ec7cbc17566a9ff609405f58fad6eddfb3a8b3f6d530ede8fa3fad5c","ssdeep":"96:mp+Ntha8qNEp+wRY1vUPXi0nMLPD2OtLzAyPHL/LztJDzyv2OQ7KGx1j9d2/nWUU:1ELr2Otzrzzt42OQ7KGx1j8WUq4S3cU","tlshash":"f75242e144911299b0278721d6dc7eba32f88d43e5630caef2573c1f874c6dba2b6647","first_seen":"2023-03-10T11:40:20Z","last_seen":"2026-08-21T03:50:12.42917Z","times_seen":57450,"resource_available":false,"data":null}},"time_used":133,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":133,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-02-03","alert":"Sinkholed","trigger":"www.metamaskirstelkmgt.cyou","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-02-03","alert":"Sinkholed","trigger":"www.metamaskirstelkmgt.cyou","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}}]}