{"report_id":"17375ad2-250a-4e02-bf0f-51712a257c39","version":6,"status":"done","tags":["crypto","phishing"],"date":"2025-08-19T12:46:50Z","url":{"schema":"https","addr":"midnight-gd.com/connect.html","fqdn":"midnight-gd.com","domain":"midnight-gd.com","tld":"com"},"ip":{"addr":"192.3.141.250","port":0,"asn":36352,"as":"AS-COLOCROSSING","country":"United States","country_code":"US"},"final":{"url":{"schema":"https","addr":"midnight-gd.com/connect.html","fqdn":"midnight-gd.com","domain":"midnight-gd.com","tld":"com"},"title":"Connect"},"submit":{"url":{"schema":"https","addr":"midnight-gd.com/connect.html","fqdn":"midnight-gd.com","domain":"midnight-gd.com","tld":"com"},"ip":{"addr":"192.3.141.250","port":0,"asn":36352,"as":"AS-COLOCROSSING","country":"United States","country_code":"US"},"tags":null,"meta":null},"settings":{"access":"public","device_type":"desktop","expires_at":"2026-09-23T12:46:50Z","useragent":"Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0","referer":"","cookies":null,"exit_node":"z0yflva4pidy47h"},"stats":{"alert_count":{"ids":0,"urlquery":2,"analyzer":2}},"detection":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2025-08-19","alert":"Sinkholed","trigger":"midnight-gd.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"phishtank","sensor_type":"Blocklist","title":"PhishTank","description":"PhishTank","scan_date":"2025-08-16","alert":"Phishing - Other","trigger":"midnight-gd.com/connect.html","verdict":"phishing","severity":"medium","comment":"Other","link":"http://phishtank.com","meta":null}],"urlquery":[{"sensor_name":"urlquery","alert":"Phishing - Generic Crypto/Wallet","verdict":"phishing","severity":"medium","comment":"Asset commenly seen with Generic Crypto/Wallet phishing","tags":["crypto","phishing"],"meta":null},{"sensor_name":"urlquery","alert":"Phishing - Generic Crypto/Wallet","verdict":"phishing","severity":"medium","comment":"Asset commenly seen with Generic Crypto/Wallet phishing","tags":["crypto","phishing"],"meta":null}]},"summary":[{"fqdn":"midnight-gd.com","ip":{"addr":"192.3.141.250","port":443,"asn":36352,"as":"AS-COLOCROSSING","country":"United States","country_code":"US"},"domain_registered":"unknown","domain_rank":0,"first_seen":"2025-08-18T11:46:11.125854Z","last_seen":"2025-08-18T11:46:11.125854Z","alert_count":165,"request_count":99,"received_data":1967144,"sent_data":44883,"comment":"","tags":null,"fingerprints":[{"name":"LiteSpeed","description":"LiteSpeed is a high-scalability web server.","website":"https://litespeedtech.com","common_platform_enumeration":"cpe:2.3:a:litespeedtech:litespeed_web_server:*:*:*:*:*:*:*:*","icon":"LiteSpeed.svg","categories":["Web servers"]},{"name":"Bootstrap:5.3.3","description":"Bootstrap is a free and open-source CSS framework directed at responsive, mobile-first front-end web development. It contains CSS and JavaScript-based design templates for typography, forms, buttons, navigation, and other interface components.","website":"https://getbootstrap.com","common_platform_enumeration":"cpe:2.3:a:getbootstrap:bootstrap:*:*:*:*:*:*:*:*","icon":"Bootstrap.svg","categories":["UI frameworks"]},{"name":"jQuery:3.5.1","description":"jQuery is a JavaScript library which is a free, open-source software designed to simplify HTML DOM tree traversal and manipulation, as well as event handling, CSS animation, and Ajax.","website":"https://jquery.com","common_platform_enumeration":"cpe:2.3:a:jquery:jquery:*:*:*:*:*:*:*:*","icon":"jQuery.svg","categories":["JavaScript libraries"]},{"name":"Google Hosted Libraries","description":"Google Hosted Libraries is a stable, reliable, high-speed, globally available content distribution network for the most popular, open-source JavaScript libraries.","website":"https://developers.google.com/speed/libraries","common_platform_enumeration":"","icon":"Google Developers.svg","categories":["CDN"]},{"name":"BootstrapCDN:4.5.2","description":"BootstrapCDN is a powerful and reliable Content Delivery Network (CDN) that delivers static resources, including CSS, JavaScript, and font files, for the widely-used Bootstrap framework. By leveraging multiple server locations worldwide, BootstrapCDN accelerates website loading times, ensuring a smooth and visually appealing user experience. Additionally, it ensures website compatibility with various devices and browsers. The service reduces bandwidth usage and server load, improving web performance for developers and end-users alike.","website":"https://www.bootstrapcdn.com/","common_platform_enumeration":"","icon":"BootstrapCDN.png","categories":["CDN"]},{"name":"jsDelivr","description":"JSDelivr is a free public CDN for open-source projects. It can serve web files directly from the npm registry and GitHub repositories without any configuration.","website":"https://www.jsdelivr.com/","common_platform_enumeration":"","icon":"jsdelivr-icon.svg","categories":["CDN"]}]},{"fqdn":"play-lh.googleusercontent.com","ip":{"addr":"142.250.178.86","port":443,"asn":15169,"as":"GOOGLE","country":"United States","country_code":"US"},"domain_registered":"2008-11-17","domain_rank":3758,"first_seen":"2019-09-30T06:57:53Z","last_seen":"2025-08-13T04:08:46.432052Z","alert_count":0,"request_count":5,"received_data":219717,"sent_data":2488,"comment":"","tags":null,"fingerprints":null},{"fqdn":"fonts.googleapis.com","ip":{"addr":"142.250.74.10","port":443,"asn":15169,"as":"GOOGLE","country":"United States","country_code":"US"},"domain_registered":"2005-01-25","domain_rank":313,"first_seen":"2012-05-23T12:41:44Z","last_seen":"2025-08-13T15:14:14.224423Z","alert_count":0,"request_count":1,"received_data":15149,"sent_data":566,"comment":"","tags":null,"fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}]},{"fqdn":"cdn.jsdelivr.net","ip":{"addr":"104.16.175.226","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"domain_registered":"2012-05-16","domain_rank":1678,"first_seen":"2012-09-30T00:15:09Z","last_seen":"2025-08-13T15:26:13.000794Z","alert_count":0,"request_count":2,"received_data":315800,"sent_data":897,"comment":"","tags":null,"fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}]},{"fqdn":"lh3.googleusercontent.com","ip":{"addr":"142.250.74.33","port":443,"asn":15169,"as":"GOOGLE","country":"United States","country_code":"US"},"domain_registered":"2008-11-17","domain_rank":303,"first_seen":"2012-05-22T07:35:05Z","last_seen":"2025-08-13T23:26:05.676726Z","alert_count":0,"request_count":1,"received_data":4360,"sent_data":516,"comment":"","tags":null,"fingerprints":null}],"files":null,"artifacts":{"windows_shortcuts":null,"files":null,"telegram":null,"pdfs":null,"clipboard":null},"sensors":{"ids":[{"sensor_name":"suricata","description":"Suricata /w Emerging Threats Pro","alerts":null}],"analyzer":null,"urlquery":[{"sensor_name":"urlquery","alert":"Phishing - Generic Crypto/Wallet","verdict":"phishing","severity":"medium","comment":"Asset commenly seen with Generic Crypto/Wallet phishing","tags":["crypto","phishing"],"meta":null}]},"javascript":{"script":[{"url":{"schema":"https","addr":"midnight-gd.com/connect.html","fqdn":"midnight-gd.com","domain":"midnight-gd.com","tld":"com"},"ip":{"addr":"192.3.141.250","port":443,"asn":36352,"as":"AS-COLOCROSSING","country":"United States","country_code":"US"},"introduction_type":"scriptElement","is_inline":true,"md5":"6ef7741aceceb904e0771a858c3161ea","sha1":"f7247023d0185f50a3061965441b48c01d32b12a","sha256":"719ac12adbe2ace285cc7930b66a014b50791204cc1e9bd599457caed0933ea9","sha512":"a9fc4801a1d467ec561654b55f18a4f1bb9efa3982d88c20842532cbae0da530735b7114765518095913d1390bc8df28ce9cf6a4066821c1fa7a83ad59471ee2","ssdeep":"","tlshash":"bad012157ebc155016bf660761e788247b1506a2d14b8d2066ba7bc90f10d5564d3045","size":196,"data":"","first_seen":"2025-08-18T11:46:15.523613Z","last_seen":"2025-08-19T12:46:52.46248Z","times_seen":2,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"midnight-gd.com/connect.html","fqdn":"midnight-gd.com","domain":"midnight-gd.com","tld":"com"},"ip":{"addr":"192.3.141.250","port":443,"asn":36352,"as":"AS-COLOCROSSING","country":"United States","country_code":"US"},"introduction_type":"scriptElement","is_inline":true,"md5":"a97865fd0b3665c787b7e027c946421c","sha1":"585bb8416c516d65ee743821aa8e22db4c171594","sha256":"73fcd80471b5adfdebd694597342176583a908dfcb5de2436d0efe59168173a0","sha512":"71622532997fb5628798805b024439dc49d63f052b206ff3ae99c94e8e63623b3d56b591d6453ac86213794715049a7a8cc04e9cb51eff62808e67c17a0c785a","ssdeep":"","tlshash":"0611a81bb7fd83c0287b676f93be8bf9286105171642db247adc57a00f1090a3cb359a","size":1042,"data":"","first_seen":"2025-08-18T11:46:15.525817Z","last_seen":"2025-08-19T12:46:52.464385Z","times_seen":2,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"cdn.jsdelivr.net/npm/bootstrap@5.3.3/dist/js/bootstrap.bundle.min.js","fqdn":"cdn.jsdelivr.net","domain":"jsdelivr.net","tld":"net"},"ip":{"addr":"104.16.175.226","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"scriptElement","is_inline":false,"md5":"2e477967e482f32e65d4ea9b2fd8e106","sha1":"ddc6e9ead6d16ae9237399ce41e8c1620cc59c36","sha256":"0833b2e9c3a26c258476c46266e6877fc75218625162e0460be9a3a098a61c6c","sha512":"ecf8bfa2d7656db091f8b9d6f85ecfc057120c93ae5090773b1b441db838bd232fcef26375ee0fa35bf8051f4675cf5a5cd50d155518f922b9d70593f161741a","ssdeep":"1536:WmwIiEEO+TBR2t4J9RirWDKsVA5y7fy3YJtC/r/45wZbfbXZTb0WU078:HwORx3YCD45wZbDZTb0g8","tlshash":"ce73c5593244b4730ade85b68037430bf2265998b24b812cb57cadde2a7dcc67277f78","size":80721,"data":"","first_seen":"2024-02-25T11:27:02Z","last_seen":"2026-08-04T19:09:59.9542Z","times_seen":30443,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"midnight-gd.com/ajax.googleapis.com/ajax/libs/jquery/3.5.1/jquery.min.js","fqdn":"midnight-gd.com","domain":"midnight-gd.com","tld":"com"},"ip":{"addr":"192.3.141.250","port":443,"asn":36352,"as":"AS-COLOCROSSING","country":"United States","country_code":"US"},"introduction_type":"scriptElement","is_inline":false,"md5":"dc5e7f18c8d36ac1d3d4753a87c98d0a","sha1":"c8e1c8b386dc5b7a9184c763c88d19a346eb3342","sha256":"f7f6a5894f1d19ddad6fa392b2ece2c5e578cbf7da4ea805b6885eb6985b6e3d","sha512":"6cb4f4426f559c06190df97229c05a436820d21498350ac9f118a5625758435171418a022ed523bae46e668f9f8ea871feab6aff58ad2740b67a30f196d65516","ssdeep":"1536:AjExXUqrnxDjoXEZxkMV4SYSt0zvDD6ip3h8cApwEjOPrBeU6QLiTFbc0QlQvakF:AYh8eip3huuf6IidlrvakdtQ47GK1","tlshash":"a993f9ddb2c6702257a720ba007f510bf236199d6c4d8450f265d8e9bcb8a4e827bf7d","size":89476,"data":"","first_seen":"2023-03-07T01:02:01Z","last_seen":"2026-08-04T18:33:53.264329Z","times_seen":265159,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"midnight-gd.com/stackpath.bootstrapcdn.com/bootstrap/4.5.2/js/bootstrap.min.js","fqdn":"midnight-gd.com","domain":"midnight-gd.com","tld":"com"},"ip":{"addr":"192.3.141.250","port":443,"asn":36352,"as":"AS-COLOCROSSING","country":"United States","country_code":"US"},"introduction_type":"scriptElement","is_inline":false,"md5":"02d223393e00c273efdcb1ade8f4f8b1","sha1":"0cc93b8421d89c24a889642428b363cb831de78a","sha256":"79c599dd760cec0c1621a1af49d9a2a49da5d45e1b37d4575bace0a5e0226582","sha512":"339296df3b6e2080a65488634aa5ded35a15d9ba5edb8f203b1aa695c62b13302fc2cecfc37cfa04ad2219baf0bddad4414862dde5e0b71a7923c3c3a3d61f8d","ssdeep":"768:wfAnnayQIk8HVheIE8Dg76TXQI4vPKMEK6viTlCDFm4n6xOp6Pxg3/wCVaAk2:wfUnTcWCw6xJxg7aAz","tlshash":"0343a54a7254787206df747a817b060bb3366c99a50a816cb8699ced2f7cd483277f3c","size":60044,"data":"","first_seen":"2023-03-07T01:06:50Z","last_seen":"2026-08-04T17:05:17.049693Z","times_seen":14809,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"midnight-gd.com/connect.html","fqdn":"midnight-gd.com","domain":"midnight-gd.com","tld":"com"},"ip":{"addr":"192.3.141.250","port":443,"asn":36352,"as":"AS-COLOCROSSING","country":"United States","country_code":"US"},"introduction_type":"scriptElement","is_inline":true,"md5":"dd6a64c416a3d92698287136d2e0dc3c","sha1":"a6d92196656a503a2851334b6b100b6232c9d4d4","sha256":"65f41427e47e26a08fcf4489492cfa97ab482841996207b7bbb09072edfa4859","sha512":"1d6f6aa0934239b7239a6aae83fbabe8612d97841b5ef797ae50ef992e531d5bd1bb5169dc694fad30a922a2467d88ec07ca587ef9227ebaa0566bf2bf6ddd44","ssdeep":"96:uJ89Rbg0hw+VBFcXSB7oBYfCyFq4P5shOk/65J+GF+S6ps0:M83BtcIr3NuhOkcxEVL","tlshash":"baa16502a7f8a37008ab11d7e7bf97e12f35181b1a019960be9d2bd01f54e147e7378a","size":4904,"data":"","first_seen":"2025-08-18T11:46:15.527873Z","last_seen":"2025-08-19T12:46:52.465756Z","times_seen":2,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"midnight-gd.com/connect.html","fqdn":"midnight-gd.com","domain":"midnight-gd.com","tld":"com"},"ip":{"addr":"192.3.141.250","port":443,"asn":36352,"as":"AS-COLOCROSSING","country":"United States","country_code":"US"},"introduction_type":"scriptElement","is_inline":true,"md5":"b1dd5d8ea79c12ab6983630eb6ff5f4c","sha1":"a8d7c48eb2d25eb51847388088370dfbfa295e72","sha256":"17bba75ef9d4daf3aa8790c18fe38aa36415e25628e0cb66c51e1393a647a7cd","sha512":"b4861c954b1441a927522941c36394a4dbea4c0acf52f2c4f3e861024ee4be08a58ed875bf57f069afb03af5d4efbb27b3f05c9225680abca239f92f9da7b2f0","ssdeep":"","tlshash":"c9f02729d3f667320373629986d64ae96554406b3001ce393ffc51901fe1c192eb3699","size":496,"data":"","first_seen":"2025-08-18T11:46:15.530098Z","last_seen":"2025-08-19T12:46:52.467586Z","times_seen":2,"alerts":{"ids":null,"analyzer":null,"urlquery":null}}],"eval":null,"write":null,"console":null},"http":[{"url":{"schema":"https","addr":"midnight-gd.com/static/logo/bitkeep.jpg","fqdn":"midnight-gd.com","domain":"midnight-gd.com","tld":"com"},"ip":{"addr":"192.3.141.250","port":443,"asn":36352,"as":"AS-COLOCROSSING","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://midnight-gd.com/connect.html","date":"2025-08-19T12:46:28.944Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"midnight-gd.com","organization":""},"issuer":{"commonName":"R10","organization":"Let's Encrypt"},"validity":{"start":"Fri, 08 Aug 2025 21:56:18 GMT","end":"Thu, 06 Nov 2025 21:56:17 GMT"},"fingerprint":{"sha1":"57:AB:C1:2A:94:4B:D1:B7:3F:B9:E2:25:D6:6C:A1:FE:87:79:5E:06","sha256":"45:20:67:6D:CB:DC:27:76:A1:38:40:DC:34:04:B4:D8:74:41:3A:A9:57:69:E6:92:F2:D4:D0:4F:FB:E3:6B:49"}}},"request":{"raw":"GET /static/logo/bitkeep.jpg HTTP/1.1\r\nHost: midnight-gd.com\r\nUser-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://midnight-gd.com/connect.html\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\ncache-control: public, max-age=31536000\r\nexpires: Wed, 19 Aug 2026 12:46:28 GMT\r\ncontent-type: image/jpeg\r\nlast-modified: Wed, 30 Aug 2023 02:32:10 GMT\r\naccept-ranges: bytes\r\ncontent-length: 12042\r\ndate: Tue, 19 Aug 2025 12:46:28 GMT\r\nserver: LiteSpeed\r\nx-content-type-options: nosniff\r\nx-xss-protection: 1; mode=block\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"LiteSpeed","description":"LiteSpeed is a high-scalability web server.","website":"https://litespeedtech.com","common_platform_enumeration":"cpe:2.3:a:litespeedtech:litespeed_web_server:*:*:*:*:*:*:*:*","icon":"LiteSpeed.svg","categories":["Web servers"]}],"data":{"size":12042,"size_decoded":0,"mime_type":"image/jpeg","magic":"JPEG image data, baseline, precision 8, 400x400, components 3","md5":"66d74cb438855098d4a61aec2aba71b6","sha1":"0dc06a5dd938feeeb96b0b649cafe65b80965a54","sha256":"795fbd7c08bf5ccf7e82dc12c7dd309d9da4b2aee2dab5e0a678f7ac4e17fa12","sha512":"dcf184f4f6784c65af565aea28834a0bf6600c86a799723cd0beb3c441d1e40b1336cd3c52a10050d20abbae3867c2f8778700ae6c6ce5564897ea44ffec5793","ssdeep":"192:DVLc50id6aj4jkeR7YjTq8iyrfgPyvfzDtphLig6IWVd73N6gjhmUiPMO/SbU+7g:N616aCkeRCriWzxphLigsX73AgjQnrYc","tlshash":"0042bfa77775a49be6a4fd78226fc514a3f228015c16ab2c123fa8730e0c34d1b029e7","first_seen":"2023-05-01T21:31:16Z","last_seen":"2026-07-21T05:16:19.681898Z","times_seen":654,"resource_available":false,"data":null}},"time_used":437,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":432,"receive":5,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2025-08-19","alert":"Sinkholed","trigger":"midnight-gd.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":[{"sensor_name":"urlquery","alert":"Phishing - Generic Crypto/Wallet","verdict":"phishing","severity":"medium","comment":"Asset commenly seen with Generic Crypto/Wallet phishing","tags":["crypto","phishing"],"meta":null}]}},{"url":{"schema":"https","addr":"midnight-gd.com/static/logo/hashkey_me.jpg","fqdn":"midnight-gd.com","domain":"midnight-gd.com","tld":"com"},"ip":{"addr":"192.3.141.250","port":443,"asn":36352,"as":"AS-COLOCROSSING","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://midnight-gd.com/connect.html","date":"2025-08-19T12:46:29.014Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"midnight-gd.com","organization":""},"issuer":{"commonName":"R10","organization":"Let's Encrypt"},"validity":{"start":"Fri, 08 Aug 2025 21:56:18 GMT","end":"Thu, 06 Nov 2025 21:56:17 GMT"},"fingerprint":{"sha1":"57:AB:C1:2A:94:4B:D1:B7:3F:B9:E2:25:D6:6C:A1:FE:87:79:5E:06","sha256":"45:20:67:6D:CB:DC:27:76:A1:38:40:DC:34:04:B4:D8:74:41:3A:A9:57:69:E6:92:F2:D4:D0:4F:FB:E3:6B:49"}}},"request":{"raw":"GET /static/logo/hashkey_me.jpg HTTP/1.1\r\nHost: midnight-gd.com\r\nUser-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://midnight-gd.com/connect.html\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\ncache-control: public, max-age=31536000\r\nexpires: Wed, 19 Aug 2026 12:46:28 GMT\r\ncontent-type: image/jpeg\r\nlast-modified: Wed, 30 Aug 2023 02:32:10 GMT\r\naccept-ranges: bytes\r\ncontent-length: 9614\r\ndate: Tue, 19 Aug 2025 12:46:28 GMT\r\nserver: LiteSpeed\r\nx-content-type-options: nosniff\r\nx-xss-protection: 1; mode=block\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"LiteSpeed","description":"LiteSpeed is a high-scalability web server.","website":"https://litespeedtech.com","common_platform_enumeration":"cpe:2.3:a:litespeedtech:litespeed_web_server:*:*:*:*:*:*:*:*","icon":"LiteSpeed.svg","categories":["Web servers"]}],"data":{"size":9614,"size_decoded":0,"mime_type":"image/jpeg","magic":"JPEG image data, baseline, precision 8, 400x400, components 3","md5":"df8b9be6ab001c952141bcc0d2dd3a18","sha1":"dcdb9772083c0f2d339681a1585df3cbcdf95aab","sha256":"cad836e38abd3a18bc965f97dea766e39ada552a301ed8144c8516101ddfd0a0","sha512":"3de4d38b6e0380bc30b7eef8d726ef66b8c16df84385b6378aec1bed7f718398f9a497a101a210048096e463288de8c75cedb8506277b18b1e71de6b5efc0e22","ssdeep":"192:vI/kesMj3sdYv3Yj/TVlMF+kAehO27g8qh5cF13ZVxLD9qXV7X:wYWsGYD3M4kAehbe5cF13ZVxLDgN","tlshash":"3512cf67b81ec900e795c6f4894208e9cb20df16d6ddb54f93bb435a33502283c7807a","first_seen":"2023-05-01T21:31:16Z","last_seen":"2026-07-21T05:16:19.614936Z","times_seen":729,"resource_available":false,"data":null}},"time_used":454,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":451,"receive":3,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2025-08-19","alert":"Sinkholed","trigger":"midnight-gd.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":[{"sensor_name":"urlquery","alert":"Phishing - Generic Crypto/Wallet","verdict":"phishing","severity":"medium","comment":"Asset commenly seen with Generic Crypto/Wallet phishing","tags":["crypto","phishing"],"meta":null}]}},{"url":{"schema":"https","addr":"midnight-gd.com/static/logo/d'cent.jpg","fqdn":"midnight-gd.com","domain":"midnight-gd.com","tld":"com"},"ip":{"addr":"192.3.141.250","port":443,"asn":36352,"as":"AS-COLOCROSSING","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://midnight-gd.com/connect.html","date":"2025-08-19T12:46:29.025Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"midnight-gd.com","organization":""},"issuer":{"commonName":"R10","organization":"Let's Encrypt"},"validity":{"start":"Fri, 08 Aug 2025 21:56:18 GMT","end":"Thu, 06 Nov 2025 21:56:17 GMT"},"fingerprint":{"sha1":"57:AB:C1:2A:94:4B:D1:B7:3F:B9:E2:25:D6:6C:A1:FE:87:79:5E:06","sha256":"45:20:67:6D:CB:DC:27:76:A1:38:40:DC:34:04:B4:D8:74:41:3A:A9:57:69:E6:92:F2:D4:D0:4F:FB:E3:6B:49"}}},"request":{"raw":"GET /static/logo/d'cent.jpg HTTP/1.1\r\nHost: midnight-gd.com\r\nUser-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://midnight-gd.com/connect.html\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\ncache-control: public, max-age=31536000\r\nexpires: Wed, 19 Aug 2026 12:46:28 GMT\r\ncontent-type: image/jpeg\r\nlast-modified: Sat, 06 Jul 2024 19:34:48 GMT\r\naccept-ranges: bytes\r\ncontent-length: 1669\r\ndate: Tue, 19 Aug 2025 12:46:28 GMT\r\nserver: LiteSpeed\r\nx-content-type-options: nosniff\r\nx-xss-protection: 1; mode=block\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"LiteSpeed","description":"LiteSpeed is a high-scalability web server.","website":"https://litespeedtech.com","common_platform_enumeration":"cpe:2.3:a:litespeedtech:litespeed_web_server:*:*:*:*:*:*:*:*","icon":"LiteSpeed.svg","categories":["Web servers"]}],"data":{"size":1669,"size_decoded":0,"mime_type":"image/jpeg","magic":"PNG image data, 225 x 225, 8-bit colormap, non-interlaced","md5":"0b398b637bc6d8c1f5f9b70b0f46c66f","sha1":"dd8ac5abc32a370ff3cbea3cd321e09a374d160e","sha256":"510fb98cd844b6fb094fdff69789b8e8735187eabb6cf4ae2db715ed51889f6c","sha512":"b5a87942434fe56518c6ed3e5e21251de04966c2740285aefb58d17d5bc6994ade9dd8026315fd31e3879e28245bd67f6111e9adb244954eb013bb885183515a","ssdeep":"","tlshash":"8331f872e8700670e1f51572240a6e1b5668c6ab06aec7274681c256910504afea91bb","first_seen":"2024-03-12T05:24:20Z","last_seen":"2026-06-09T14:27:02.985144Z","times_seen":43,"resource_available":false,"data":null}},"time_used":459,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":459,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2025-08-19","alert":"Sinkholed","trigger":"midnight-gd.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"midnight-gd.com/static/font/fa-regular-401.html","fqdn":"midnight-gd.com","domain":"midnight-gd.com","tld":"com"},"ip":{"addr":"192.3.141.250","port":443,"asn":36352,"as":"AS-COLOCROSSING","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"font","requested_by":"https://midnight-gd.com/connect.html","date":"2025-08-19T12:46:29.706Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"midnight-gd.com","organization":""},"issuer":{"commonName":"R10","organization":"Let's Encrypt"},"validity":{"start":"Fri, 08 Aug 2025 21:56:18 GMT","end":"Thu, 06 Nov 2025 21:56:17 GMT"},"fingerprint":{"sha1":"57:AB:C1:2A:94:4B:D1:B7:3F:B9:E2:25:D6:6C:A1:FE:87:79:5E:06","sha256":"45:20:67:6D:CB:DC:27:76:A1:38:40:DC:34:04:B4:D8:74:41:3A:A9:57:69:E6:92:F2:D4:D0:4F:FB:E3:6B:49"}}},"request":{"raw":"GET /static/font/fa-regular-401.html HTTP/1.1\r\nHost: midnight-gd.com\r\nUser-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0\r\nAccept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: identity\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://midnight-gd.com/static/connect-css/font-awesome.css\r\nSec-Fetch-Dest: font\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\ncache-control: public, max-age=2592000\r\nexpires: Thu, 18 Sep 2025 12:46:29 GMT\r\ncontent-type: text/html\r\nlast-modified: Wed, 30 Aug 2023 02:32:10 GMT\r\naccept-ranges: bytes\r\ncontent-length: 207\r\ndate: Tue, 19 Aug 2025 12:46:29 GMT\r\nserver: LiteSpeed\r\nx-content-type-options: nosniff\r\nx-xss-protection: 1; mode=block\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"LiteSpeed","description":"LiteSpeed is a high-scalability web server.","website":"https://litespeedtech.com","common_platform_enumeration":"cpe:2.3:a:litespeedtech:litespeed_web_server:*:*:*:*:*:*:*:*","icon":"LiteSpeed.svg","categories":["Web servers"]}],"data":{"size":207,"size_decoded":0,"mime_type":"text/html","magic":"HTML document, ASCII text","md5":"e46c4e5e1fbc64b1bae9ebd9bcef7fcf","sha1":"d767b3cb0ad66544c649e4165fc4b37e3c17e370","sha256":"e9639e3c4681ce85f852fbac48e2eeee5ba51296dbfec57c200d59b76237ab80","sha512":"d82048fdcff225197a7e9f0b7f22d470518420a4b10ea3327d604804d04d0d97efadafc84a0aaa23650146f59d94373438dc18bb822e26fd60283c384940ddb9","ssdeep":"","tlshash":"dad0224ed30a032b0a20071035c11beb998f1322757612398f42583e6185b2d81e23c8","first_seen":"2023-04-05T03:09:50Z","last_seen":"2026-08-04T19:11:49.662451Z","times_seen":17198,"resource_available":true,"data":null}},"time_used":108,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":108,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2025-08-19","alert":"Sinkholed","trigger":"midnight-gd.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"midnight-gd.com/static/logo/coinomi.jpg","fqdn":"midnight-gd.com","domain":"midnight-gd.com","tld":"com"},"ip":{"addr":"192.3.141.250","port":443,"asn":36352,"as":"AS-COLOCROSSING","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://midnight-gd.com/connect.html","date":"2025-08-19T12:46:28.934Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"midnight-gd.com","organization":""},"issuer":{"commonName":"R10","organization":"Let's Encrypt"},"validity":{"start":"Fri, 08 Aug 2025 21:56:18 GMT","end":"Thu, 06 Nov 2025 21:56:17 GMT"},"fingerprint":{"sha1":"57:AB:C1:2A:94:4B:D1:B7:3F:B9:E2:25:D6:6C:A1:FE:87:79:5E:06","sha256":"45:20:67:6D:CB:DC:27:76:A1:38:40:DC:34:04:B4:D8:74:41:3A:A9:57:69:E6:92:F2:D4:D0:4F:FB:E3:6B:49"}}},"request":{"raw":"GET /static/logo/coinomi.jpg HTTP/1.1\r\nHost: midnight-gd.com\r\nUser-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://midnight-gd.com/connect.html\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\ncache-control: public, max-age=31536000\r\nexpires: Wed, 19 Aug 2026 12:46:28 GMT\r\ncontent-type: image/jpeg\r\nlast-modified: Wed, 30 Aug 2023 02:32:10 GMT\r\naccept-ranges: bytes\r\ncontent-length: 17507\r\ndate: Tue, 19 Aug 2025 12:46:28 GMT\r\nserver: LiteSpeed\r\nx-content-type-options: nosniff\r\nx-xss-protection: 1; mode=block\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"LiteSpeed","description":"LiteSpeed is a high-scalability web server.","website":"https://litespeedtech.com","common_platform_enumeration":"cpe:2.3:a:litespeedtech:litespeed_web_server:*:*:*:*:*:*:*:*","icon":"LiteSpeed.svg","categories":["Web servers"]}],"data":{"size":17507,"size_decoded":0,"mime_type":"image/jpeg","magic":"JPEG image data, baseline, precision 8, 400x400, components 3","md5":"8bec00af795032b272969d8604dea45f","sha1":"6fc98a9dcfd3ed4f6d2f4daf4076aa366b755ea5","sha256":"cee38ba709752168c77e15fa9fbb7fc075d5cf73f06224aadd745b0094364408","sha512":"86866fc18a72436b8eaac6901f600744980a18d02d5061d06836396aa9449fa6b86bb7ccacb041d9996aa75501f628a7f0282fb2acd2cd8324a5deaa5a9d3c2b","ssdeep":"384:MM8i91ZGte7UkcvKKXBOtLXSvdXPL8HPwCYDkYu9Ev1a2Bl8:38i91ZGsbsBOtLXSJz64NQG1aw8","tlshash":"da72c0d1786c0d4445bf9ff48d03e2366a86c2924dc9fd1cae6568a4db04fefd2c6184","first_seen":"2023-05-01T21:31:16Z","last_seen":"2026-08-01T19:57:43.642628Z","times_seen":746,"resource_available":false,"data":null}},"time_used":417,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":411,"receive":6,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2025-08-19","alert":"Sinkholed","trigger":"midnight-gd.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":[{"sensor_name":"urlquery","alert":"Phishing - Generic Crypto/Wallet","verdict":"phishing","severity":"medium","comment":"Asset commenly seen with Generic Crypto/Wallet phishing","tags":["crypto","phishing"],"meta":null}]}},{"url":{"schema":"https","addr":"midnight-gd.com/static/logo/spatium.jpg","fqdn":"midnight-gd.com","domain":"midnight-gd.com","tld":"com"},"ip":{"addr":"192.3.141.250","port":443,"asn":36352,"as":"AS-COLOCROSSING","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://midnight-gd.com/connect.html","date":"2025-08-19T12:46:29.029Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"midnight-gd.com","organization":""},"issuer":{"commonName":"R10","organization":"Let's Encrypt"},"validity":{"start":"Fri, 08 Aug 2025 21:56:18 GMT","end":"Thu, 06 Nov 2025 21:56:17 GMT"},"fingerprint":{"sha1":"57:AB:C1:2A:94:4B:D1:B7:3F:B9:E2:25:D6:6C:A1:FE:87:79:5E:06","sha256":"45:20:67:6D:CB:DC:27:76:A1:38:40:DC:34:04:B4:D8:74:41:3A:A9:57:69:E6:92:F2:D4:D0:4F:FB:E3:6B:49"}}},"request":{"raw":"GET /static/logo/spatium.jpg HTTP/1.1\r\nHost: midnight-gd.com\r\nUser-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://midnight-gd.com/connect.html\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\ncache-control: public, max-age=31536000\r\nexpires: Wed, 19 Aug 2026 12:46:29 GMT\r\ncontent-type: image/jpeg\r\nlast-modified: Sat, 06 Jul 2024 19:34:48 GMT\r\naccept-ranges: bytes\r\ncontent-length: 2288\r\ndate: Tue, 19 Aug 2025 12:46:29 GMT\r\nserver: LiteSpeed\r\nx-content-type-options: nosniff\r\nx-xss-protection: 1; mode=block\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"LiteSpeed","description":"LiteSpeed is a high-scalability web server.","website":"https://litespeedtech.com","common_platform_enumeration":"cpe:2.3:a:litespeedtech:litespeed_web_server:*:*:*:*:*:*:*:*","icon":"LiteSpeed.svg","categories":["Web servers"]}],"data":{"size":2288,"size_decoded":0,"mime_type":"image/jpeg","magic":"PNG image data, 225 x 225, 8-bit colormap, non-interlaced","md5":"03d857b5eb03c241657a5942b72e2e61","sha1":"0d17a8ad7afee1997c10f88ea39dea0804383b75","sha256":"54308490875238503f21a742d2cb2eacf9003d71d9d3f63cadd8326ca76e8980","sha512":"733b67173b49a210797cafe3d5a0b72745ca90258796f88506f56e88d8646427f54feb9398e5e7e7c5f20397362f2749f306cc28a1827015b0f0ae87c1eb46f8","ssdeep":"","tlshash":"b8412bf660717c6096c571bfeb9d58d63474c1a32aa8311e4200773e6152a31afccd73","first_seen":"2024-01-24T22:55:52Z","last_seen":"2026-06-09T14:27:02.940361Z","times_seen":45,"resource_available":false,"data":null}},"time_used":171,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":170,"receive":1,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2025-08-19","alert":"Sinkholed","trigger":"midnight-gd.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"midnight-gd.com/assets/css2","fqdn":"midnight-gd.com","domain":"midnight-gd.com","tld":"com"},"ip":{"addr":"192.3.141.250","port":443,"asn":36352,"as":"AS-COLOCROSSING","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://midnight-gd.com/connect.html","date":"2025-08-19T12:46:29.525Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"midnight-gd.com","organization":""},"issuer":{"commonName":"R10","organization":"Let's Encrypt"},"validity":{"start":"Fri, 08 Aug 2025 21:56:18 GMT","end":"Thu, 06 Nov 2025 21:56:17 GMT"},"fingerprint":{"sha1":"57:AB:C1:2A:94:4B:D1:B7:3F:B9:E2:25:D6:6C:A1:FE:87:79:5E:06","sha256":"45:20:67:6D:CB:DC:27:76:A1:38:40:DC:34:04:B4:D8:74:41:3A:A9:57:69:E6:92:F2:D4:D0:4F:FB:E3:6B:49"}}},"request":{"raw":"GET /assets/css2 HTTP/1.1\r\nHost: midnight-gd.com\r\nUser-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://midnight-gd.com/connect.html\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\ncache-control: public, max-age=2592000\r\nexpires: Thu, 18 Sep 2025 12:46:29 GMT\r\nlast-modified: Sat, 02 Aug 2025 07:25:58 GMT\r\naccept-ranges: bytes\r\ncontent-length: 839\r\ndate: Tue, 19 Aug 2025 12:46:29 GMT\r\nserver: LiteSpeed\r\nx-content-type-options: nosniff\r\nx-xss-protection: 1; mode=block\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"LiteSpeed","description":"LiteSpeed is a high-scalability web server.","website":"https://litespeedtech.com","common_platform_enumeration":"cpe:2.3:a:litespeedtech:litespeed_web_server:*:*:*:*:*:*:*:*","icon":"LiteSpeed.svg","categories":["Web servers"]}],"data":{"size":0,"size_decoded":0,"mime_type":"application/x-unknown-content-type","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-08-04T18:58:17.234169Z","times_seen":17712185,"resource_available":true,"data":null}},"time_used":106,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":106,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2025-08-19","alert":"Sinkholed","trigger":"midnight-gd.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"midnight-gd.com/static/logo/iotex.jpg","fqdn":"midnight-gd.com","domain":"midnight-gd.com","tld":"com"},"ip":{"addr":"192.3.141.250","port":443,"asn":36352,"as":"AS-COLOCROSSING","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://midnight-gd.com/connect.html","date":"2025-08-19T12:46:28.921Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"midnight-gd.com","organization":""},"issuer":{"commonName":"R10","organization":"Let's Encrypt"},"validity":{"start":"Fri, 08 Aug 2025 21:56:18 GMT","end":"Thu, 06 Nov 2025 21:56:17 GMT"},"fingerprint":{"sha1":"57:AB:C1:2A:94:4B:D1:B7:3F:B9:E2:25:D6:6C:A1:FE:87:79:5E:06","sha256":"45:20:67:6D:CB:DC:27:76:A1:38:40:DC:34:04:B4:D8:74:41:3A:A9:57:69:E6:92:F2:D4:D0:4F:FB:E3:6B:49"}}},"request":{"raw":"GET /static/logo/iotex.jpg HTTP/1.1\r\nHost: midnight-gd.com\r\nUser-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://midnight-gd.com/connect.html\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\ncache-control: public, max-age=31536000\r\nexpires: Wed, 19 Aug 2026 12:46:28 GMT\r\ncontent-type: image/jpeg\r\nlast-modified: Wed, 30 Aug 2023 02:32:10 GMT\r\naccept-ranges: bytes\r\ncontent-length: 42520\r\ndate: Tue, 19 Aug 2025 12:46:28 GMT\r\nserver: LiteSpeed\r\nx-content-type-options: nosniff\r\nx-xss-protection: 1; mode=block\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"LiteSpeed","description":"LiteSpeed is a high-scalability web server.","website":"https://litespeedtech.com","common_platform_enumeration":"cpe:2.3:a:litespeedtech:litespeed_web_server:*:*:*:*:*:*:*:*","icon":"LiteSpeed.svg","categories":["Web servers"]}],"data":{"size":42520,"size_decoded":0,"mime_type":"image/jpeg","magic":"PNG image data, 300 x 300, 8-bit/color RGB, non-interlaced","md5":"3fe53678156109a5573577b455372e2f","sha1":"0c3770a0a4de09890bdb9f96c145a310969e55c8","sha256":"a401620f0e23dd13672366ef07827f8a40f5152b32d90251c0dedef15673260a","sha512":"da332d689f1c6e501ad94722c9ac3becaf1b264ee914d792e78a16d4c706051cde0dd40f5eb8ee32466bb9835a2d1dafd871943605ca41110b4fb9aa074d665a","ssdeep":"768:fpOnNNHXw6Ot9XPxw7De9zFp3HtsB9QAwVsmVcClQTJ3Z/W/jtUv022k6hP3zcmu:fpKw6ObXPxw7kp3U9zwVAClSnertYr6y","tlshash":"4613f2d689bc8346e2f9f2e71b9f0f6654354f701b53052726202cabe5da4d01a8d8ed","first_seen":"2023-05-04T02:59:55Z","last_seen":"2026-06-25T01:06:10.284473Z","times_seen":327,"resource_available":false,"data":null}},"time_used":353,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":187,"receive":166,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2025-08-19","alert":"Sinkholed","trigger":"midnight-gd.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":[{"sensor_name":"urlquery","alert":"Phishing - Generic Crypto/Wallet","verdict":"phishing","severity":"medium","comment":"Asset commenly seen with Generic Crypto/Wallet phishing","tags":["crypto","phishing"],"meta":null}]}},{"url":{"schema":"https","addr":"midnight-gd.com/static/logo/xinfin.jpg","fqdn":"midnight-gd.com","domain":"midnight-gd.com","tld":"com"},"ip":{"addr":"192.3.141.250","port":443,"asn":36352,"as":"AS-COLOCROSSING","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://midnight-gd.com/connect.html","date":"2025-08-19T12:46:29.020Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"midnight-gd.com","organization":""},"issuer":{"commonName":"R10","organization":"Let's Encrypt"},"validity":{"start":"Fri, 08 Aug 2025 21:56:18 GMT","end":"Thu, 06 Nov 2025 21:56:17 GMT"},"fingerprint":{"sha1":"57:AB:C1:2A:94:4B:D1:B7:3F:B9:E2:25:D6:6C:A1:FE:87:79:5E:06","sha256":"45:20:67:6D:CB:DC:27:76:A1:38:40:DC:34:04:B4:D8:74:41:3A:A9:57:69:E6:92:F2:D4:D0:4F:FB:E3:6B:49"}}},"request":{"raw":"GET /static/logo/xinfin.jpg HTTP/1.1\r\nHost: midnight-gd.com\r\nUser-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://midnight-gd.com/connect.html\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\ncache-control: public, max-age=31536000\r\nexpires: Wed, 19 Aug 2026 12:46:28 GMT\r\ncontent-type: image/jpeg\r\nlast-modified: Wed, 30 Aug 2023 02:32:10 GMT\r\naccept-ranges: bytes\r\ncontent-length: 8981\r\ndate: Tue, 19 Aug 2025 12:46:28 GMT\r\nserver: LiteSpeed\r\nx-content-type-options: nosniff\r\nx-xss-protection: 1; mode=block\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"LiteSpeed","description":"LiteSpeed is a high-scalability web server.","website":"https://litespeedtech.com","common_platform_enumeration":"cpe:2.3:a:litespeedtech:litespeed_web_server:*:*:*:*:*:*:*:*","icon":"LiteSpeed.svg","categories":["Web servers"]}],"data":{"size":8981,"size_decoded":0,"mime_type":"image/jpeg","magic":"JPEG image data, baseline, precision 8, 400x400, components 3","md5":"60f87e16077bd56afa4dce8e0651f619","sha1":"6a803a4c96451869d22c84920d262c6c6a0b7f52","sha256":"886989ea7749a43c57edbc97d5e2d133061c68c204c25b5ded17b9dfd623a9a5","sha512":"3f0bef602cd653e85a682ee0c0f78cf2ff965b013efea89578fd7c43c58d921cd8b2a18af8459d9977e72ffc9ea67f2ac4bc1d94b33923b3f77a412e23ee617a","ssdeep":"96:U7lcn2U1OsATWXaRCAHGroxs8XFZo6Kqwwlpfqx6f5s61c3PyiZcqe8isTWYQCp+:XBlXaHx91WrPV6fu3PyiZcnQVBpOHP","tlshash":"a602ae8b7b2c4266f200cfba566b112a5e671821f133decf4b66e5a8f0b1851d43c4e4","first_seen":"2023-05-01T21:31:16Z","last_seen":"2026-07-21T05:16:19.621903Z","times_seen":596,"resource_available":false,"data":null}},"time_used":458,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":152,"receive":306,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2025-08-19","alert":"Sinkholed","trigger":"midnight-gd.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":[{"sensor_name":"urlquery","alert":"Phishing - Generic Crypto/Wallet","verdict":"phishing","severity":"medium","comment":"Asset commenly seen with Generic Crypto/Wallet phishing","tags":["crypto","phishing"],"meta":null}]}},{"url":{"schema":"https","addr":"midnight-gd.com/static/logo/binance.png","fqdn":"midnight-gd.com","domain":"midnight-gd.com","tld":"com"},"ip":{"addr":"192.3.141.250","port":443,"asn":36352,"as":"AS-COLOCROSSING","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://midnight-gd.com/connect.html","date":"2025-08-19T12:46:28.907Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"midnight-gd.com","organization":""},"issuer":{"commonName":"R10","organization":"Let's Encrypt"},"validity":{"start":"Fri, 08 Aug 2025 21:56:18 GMT","end":"Thu, 06 Nov 2025 21:56:17 GMT"},"fingerprint":{"sha1":"57:AB:C1:2A:94:4B:D1:B7:3F:B9:E2:25:D6:6C:A1:FE:87:79:5E:06","sha256":"45:20:67:6D:CB:DC:27:76:A1:38:40:DC:34:04:B4:D8:74:41:3A:A9:57:69:E6:92:F2:D4:D0:4F:FB:E3:6B:49"}}},"request":{"raw":"GET /static/logo/binance.png HTTP/1.1\r\nHost: midnight-gd.com\r\nUser-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://midnight-gd.com/connect.html\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\ncache-control: public, max-age=31536000\r\nexpires: Wed, 19 Aug 2026 12:46:28 GMT\r\ncontent-type: image/png\r\nlast-modified: Wed, 30 Aug 2023 02:32:10 GMT\r\naccept-ranges: bytes\r\ncontent-length: 18169\r\ndate: Tue, 19 Aug 2025 12:46:28 GMT\r\nserver: LiteSpeed\r\nx-content-type-options: nosniff\r\nx-xss-protection: 1; mode=block\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"LiteSpeed","description":"LiteSpeed is a high-scalability web server.","website":"https://litespeedtech.com","common_platform_enumeration":"cpe:2.3:a:litespeedtech:litespeed_web_server:*:*:*:*:*:*:*:*","icon":"LiteSpeed.svg","categories":["Web servers"]}],"data":{"size":18169,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 200 x 200, 8-bit/color RGB, non-interlaced","md5":"1bfc29872ffb0da4ff35ab78d50f801b","sha1":"848ad68f5c93aa926146c12a3781ef339aa83753","sha256":"e0cef852b42b855fcc807983add61cbc2effe074c00bbfbce1e65c92b2bc76d7","sha512":"8d37fc2b428d0ad5238c11878dd660f352c310065a3535ba2855f406ae9c11aba6b63e667f732d5964cf8584e0b1ac6d589802c7cfee57669976ee9d0f928124","ssdeep":"384:i+/CgyDGeAfGCNr/uMCOYRgCLOX3MNcZnzlY+Hn4vNiUIc/T0Ys:j/ZeBCNr/uMGRgCLOHMN4RdHneIUX7s","tlshash":"1182d0a65dbb2be703bc65f6f46596b2f0d246d75eb26428f18050d116202f08f1e332","first_seen":"2023-05-18T08:37:00Z","last_seen":"2026-04-09T09:26:10.893195Z","times_seen":223,"resource_available":false,"data":null}},"time_used":265,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":249,"receive":16,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2025-08-19","alert":"Sinkholed","trigger":"midnight-gd.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"midnight-gd.com/static/logo/bifrost.jpg","fqdn":"midnight-gd.com","domain":"midnight-gd.com","tld":"com"},"ip":{"addr":"192.3.141.250","port":443,"asn":36352,"as":"AS-COLOCROSSING","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://midnight-gd.com/connect.html","date":"2025-08-19T12:46:29.032Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"midnight-gd.com","organization":""},"issuer":{"commonName":"R10","organization":"Let's Encrypt"},"validity":{"start":"Fri, 08 Aug 2025 21:56:18 GMT","end":"Thu, 06 Nov 2025 21:56:17 GMT"},"fingerprint":{"sha1":"57:AB:C1:2A:94:4B:D1:B7:3F:B9:E2:25:D6:6C:A1:FE:87:79:5E:06","sha256":"45:20:67:6D:CB:DC:27:76:A1:38:40:DC:34:04:B4:D8:74:41:3A:A9:57:69:E6:92:F2:D4:D0:4F:FB:E3:6B:49"}}},"request":{"raw":"GET /static/logo/bifrost.jpg HTTP/1.1\r\nHost: midnight-gd.com\r\nUser-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://midnight-gd.com/connect.html\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\ncache-control: public, max-age=31536000\r\nexpires: Wed, 19 Aug 2026 12:46:29 GMT\r\ncontent-type: image/jpeg\r\nlast-modified: Sat, 06 Jul 2024 19:34:48 GMT\r\naccept-ranges: bytes\r\ncontent-length: 3571\r\ndate: Tue, 19 Aug 2025 12:46:29 GMT\r\nserver: LiteSpeed\r\nx-content-type-options: nosniff\r\nx-xss-protection: 1; mode=block\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"LiteSpeed","description":"LiteSpeed is a high-scalability web server.","website":"https://litespeedtech.com","common_platform_enumeration":"cpe:2.3:a:litespeedtech:litespeed_web_server:*:*:*:*:*:*:*:*","icon":"LiteSpeed.svg","categories":["Web servers"]}],"data":{"size":3571,"size_decoded":0,"mime_type":"image/jpeg","magic":"JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, baseline, precision 8, 225x225, components 3","md5":"20b080f7f4635bad7635382f03390aca","sha1":"f4c666248b295312bff11c2b68ab5eb8a9018c7c","sha256":"6913fa7f98bd640ff243bfbdf75c6e07b38c483a00bf19aae2cd16e9e32b4d46","sha512":"facf3b8b503662dda7e0f837ee09ba5a18d35d983a0a879790f9b9071b86ec24c165375ddcbcc5fae67c43efaa654f993e367bb5245ed6804bafdcdcdbaf3c1d","ssdeep":"","tlshash":"a3712937f21da14fc9551d7077073a1a190ab33a56e8e52fa106282ae8f2245fc035ca","first_seen":"2023-07-01T21:53:11Z","last_seen":"2026-07-01T03:16:04.827046Z","times_seen":50,"resource_available":false,"data":null}},"time_used":473,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":179,"receive":294,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2025-08-19","alert":"Sinkholed","trigger":"midnight-gd.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":[{"sensor_name":"urlquery","alert":"Phishing - Generic Crypto/Wallet","verdict":"phishing","severity":"medium","comment":"Asset commenly seen with Generic Crypto/Wallet phishing","tags":["crypto","phishing"],"meta":null}]}},{"url":{"schema":"https","addr":"midnight-gd.com/static/logo/trezor.jpg","fqdn":"midnight-gd.com","domain":"midnight-gd.com","tld":"com"},"ip":{"addr":"192.3.141.250","port":443,"asn":36352,"as":"AS-COLOCROSSING","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://midnight-gd.com/connect.html","date":"2025-08-19T12:46:29.036Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"midnight-gd.com","organization":""},"issuer":{"commonName":"R10","organization":"Let's Encrypt"},"validity":{"start":"Fri, 08 Aug 2025 21:56:18 GMT","end":"Thu, 06 Nov 2025 21:56:17 GMT"},"fingerprint":{"sha1":"57:AB:C1:2A:94:4B:D1:B7:3F:B9:E2:25:D6:6C:A1:FE:87:79:5E:06","sha256":"45:20:67:6D:CB:DC:27:76:A1:38:40:DC:34:04:B4:D8:74:41:3A:A9:57:69:E6:92:F2:D4:D0:4F:FB:E3:6B:49"}}},"request":{"raw":"GET /static/logo/trezor.jpg HTTP/1.1\r\nHost: midnight-gd.com\r\nUser-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://midnight-gd.com/connect.html\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\ncache-control: public, max-age=31536000\r\nexpires: Wed, 19 Aug 2026 12:46:29 GMT\r\ncontent-type: image/jpeg\r\nlast-modified: Sat, 06 Jul 2024 19:34:48 GMT\r\naccept-ranges: bytes\r\ncontent-length: 2423\r\ndate: Tue, 19 Aug 2025 12:46:29 GMT\r\nserver: LiteSpeed\r\nx-content-type-options: nosniff\r\nx-xss-protection: 1; mode=block\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"LiteSpeed","description":"LiteSpeed is a high-scalability web server.","website":"https://litespeedtech.com","common_platform_enumeration":"cpe:2.3:a:litespeedtech:litespeed_web_server:*:*:*:*:*:*:*:*","icon":"LiteSpeed.svg","categories":["Web servers"]}],"data":{"size":2423,"size_decoded":0,"mime_type":"image/jpeg","magic":"PNG image data, 200 x 200, 8-bit colormap, non-interlaced","md5":"96eda4e7d7d4b3ca4506aaa0a861ff85","sha1":"cce7d5dcc669efd73173b9038098e9bdc064affd","sha256":"37278521e91624a44c0aadcad4cecd68bdb074a8bbf19f91f9e3df201735b9b3","sha512":"7648184c589468b2de690facad8f7c5f8c89b21f4c953a9c272739392101817954335ceb616a05f92c782585e2ad5c5ed79114a65413b3c33b4e6c029e8c4e69","ssdeep":"","tlshash":"ec413b53921988b24e34382e3dc3e24fa078054cc7a148ee667fc22eb05f861e16cf06","first_seen":"2024-08-20T03:07:15.264742Z","last_seen":"2025-12-11T00:27:23.097474Z","times_seen":13,"resource_available":false,"data":null}},"time_used":466,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":451,"receive":15,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2025-08-19","alert":"Sinkholed","trigger":"midnight-gd.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"midnight-gd.com/assets/global/css/all.min.css","fqdn":"midnight-gd.com","domain":"midnight-gd.com","tld":"com"},"ip":{"addr":"192.3.141.250","port":443,"asn":36352,"as":"AS-COLOCROSSING","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://midnight-gd.com/connect.html","date":"2025-08-19T12:46:28.857Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"midnight-gd.com","organization":""},"issuer":{"commonName":"R10","organization":"Let's Encrypt"},"validity":{"start":"Fri, 08 Aug 2025 21:56:18 GMT","end":"Thu, 06 Nov 2025 21:56:17 GMT"},"fingerprint":{"sha1":"57:AB:C1:2A:94:4B:D1:B7:3F:B9:E2:25:D6:6C:A1:FE:87:79:5E:06","sha256":"45:20:67:6D:CB:DC:27:76:A1:38:40:DC:34:04:B4:D8:74:41:3A:A9:57:69:E6:92:F2:D4:D0:4F:FB:E3:6B:49"}}},"request":{"raw":"GET /assets/global/css/all.min.css HTTP/1.1\r\nHost: midnight-gd.com\r\nUser-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://midnight-gd.com/connect.html\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\ncache-control: public, max-age=2592000\r\nexpires: Thu, 18 Sep 2025 12:46:28 GMT\r\ncontent-type: text/css\r\nlast-modified: Tue, 29 Aug 2023 21:32:04 GMT\r\naccept-ranges: bytes\r\ncontent-encoding: br\r\nvary: Accept-Encoding\r\ncontent-length: 11936\r\ndate: Tue, 19 Aug 2025 12:46:28 GMT\r\nserver: LiteSpeed\r\nx-content-type-options: nosniff\r\nx-xss-protection: 1; mode=block\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"LiteSpeed","description":"LiteSpeed is a high-scalability web server.","website":"https://litespeedtech.com","common_platform_enumeration":"cpe:2.3:a:litespeedtech:litespeed_web_server:*:*:*:*:*:*:*:*","icon":"LiteSpeed.svg","categories":["Web servers"]}],"data":{"size":57197,"size_decoded":0,"mime_type":"text/css","magic":"ASCII text, with very long lines (57007), with CRLF line terminators","md5":"a4035a8cc8b8d6237b8e3102654f3c1a","sha1":"44236cdd2521c3fca9fddc112fcca2d2fd603608","sha256":"84b7873b8c1568ee4d475374886068221e404996a32bdfb693d63fa121199025","sha512":"81c242b7436e82ea35dbc82f2e54b279a6448ab2110a21ae19e6e35bf4fd58442edf53b6cb4608f02583f193bcd35731f53d61f0c9284062d39ebd1048fb0472","ssdeep":"768:2KC319PizNq4/xBo8UHJikQ2R/oMQyYJrX75CthZQz0:2KkPUE4/3uHEB2Wfd7stAI","tlshash":"cc430cb8e54c01c9a731c44fbf82b2bc61b6f73de5910d95f00e691c2ad26a811c5fba","first_seen":"2024-12-30T16:17:04.114481Z","last_seen":"2025-08-19T12:46:52.369525Z","times_seen":5,"resource_available":false,"data":null}},"time_used":218,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":110,"receive":108,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2025-08-19","alert":"Sinkholed","trigger":"midnight-gd.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"midnight-gd.com/static/logo/infinito.jpg","fqdn":"midnight-gd.com","domain":"midnight-gd.com","tld":"com"},"ip":{"addr":"192.3.141.250","port":443,"asn":36352,"as":"AS-COLOCROSSING","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://midnight-gd.com/connect.html","date":"2025-08-19T12:46:28.938Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"midnight-gd.com","organization":""},"issuer":{"commonName":"R10","organization":"Let's Encrypt"},"validity":{"start":"Fri, 08 Aug 2025 21:56:18 GMT","end":"Thu, 06 Nov 2025 21:56:17 GMT"},"fingerprint":{"sha1":"57:AB:C1:2A:94:4B:D1:B7:3F:B9:E2:25:D6:6C:A1:FE:87:79:5E:06","sha256":"45:20:67:6D:CB:DC:27:76:A1:38:40:DC:34:04:B4:D8:74:41:3A:A9:57:69:E6:92:F2:D4:D0:4F:FB:E3:6B:49"}}},"request":{"raw":"GET /static/logo/infinito.jpg HTTP/1.1\r\nHost: midnight-gd.com\r\nUser-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://midnight-gd.com/connect.html\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\ncache-control: public, max-age=31536000\r\nexpires: Wed, 19 Aug 2026 12:46:28 GMT\r\ncontent-type: image/jpeg\r\nlast-modified: Wed, 30 Aug 2023 02:32:10 GMT\r\naccept-ranges: bytes\r\ncontent-length: 9672\r\ndate: Tue, 19 Aug 2025 12:46:28 GMT\r\nserver: LiteSpeed\r\nx-content-type-options: nosniff\r\nx-xss-protection: 1; mode=block\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"LiteSpeed","description":"LiteSpeed is a high-scalability web server.","website":"https://litespeedtech.com","common_platform_enumeration":"cpe:2.3:a:litespeedtech:litespeed_web_server:*:*:*:*:*:*:*:*","icon":"LiteSpeed.svg","categories":["Web servers"]}],"data":{"size":9672,"size_decoded":0,"mime_type":"image/jpeg","magic":"JPEG image data, baseline, precision 8, 398x400, components 3","md5":"319a4e53a51ceba6ae824ed693002f84","sha1":"60b6e1e5cb3915e1987d70a551759a29087303fc","sha256":"3092ecd1ce7ffcbcb9fce2cd014089d9a634c28801ad584f95131eea56605df6","sha512":"eddf8c1a0bdfa0d6edc9a5733195ce965ca062b9b854b65f744f7157a2f7173cf0554114b40b3706a4b13efc129e32b63eda8da74f933e9cd74e8f65c98d6816","ssdeep":"192:8vtMi5Mi52zc3tPtfrDZpC8eEsfyzqV/+iF5ojb9yQ3+wYSC5x3I/yw:8vtMi5Mi5v3ttjXC8eDfyzTi09ydwYSB","tlshash":"ce12bf2cb64123c6cdb7d3bbb8adac3fb1a6599af8784d0d7707114422fde305151289","first_seen":"2023-05-01T21:31:16Z","last_seen":"2026-07-21T05:16:19.648812Z","times_seen":597,"resource_available":false,"data":null}},"time_used":425,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":422,"receive":3,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2025-08-19","alert":"Sinkholed","trigger":"midnight-gd.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":[{"sensor_name":"urlquery","alert":"Phishing - Generic Crypto/Wallet","verdict":"phishing","severity":"medium","comment":"Asset commenly seen with Generic Crypto/Wallet phishing","tags":["crypto","phishing"],"meta":null}]}},{"url":{"schema":"https","addr":"midnight-gd.com/static/connect-css/jquery.fancybox.min.css","fqdn":"midnight-gd.com","domain":"midnight-gd.com","tld":"com"},"ip":{"addr":"192.3.141.250","port":443,"asn":36352,"as":"AS-COLOCROSSING","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://midnight-gd.com/connect.html","date":"2025-08-19T12:46:29.135Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"midnight-gd.com","organization":""},"issuer":{"commonName":"R10","organization":"Let's Encrypt"},"validity":{"start":"Fri, 08 Aug 2025 21:56:18 GMT","end":"Thu, 06 Nov 2025 21:56:17 GMT"},"fingerprint":{"sha1":"57:AB:C1:2A:94:4B:D1:B7:3F:B9:E2:25:D6:6C:A1:FE:87:79:5E:06","sha256":"45:20:67:6D:CB:DC:27:76:A1:38:40:DC:34:04:B4:D8:74:41:3A:A9:57:69:E6:92:F2:D4:D0:4F:FB:E3:6B:49"}}},"request":{"raw":"GET /static/connect-css/jquery.fancybox.min.css HTTP/1.1\r\nHost: midnight-gd.com\r\nUser-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://midnight-gd.com/static/connect-css/style.css\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\ncache-control: public, max-age=2592000\r\nexpires: Thu, 18 Sep 2025 12:46:29 GMT\r\ncontent-type: text/css\r\nlast-modified: Wed, 30 Aug 2023 02:32:10 GMT\r\naccept-ranges: bytes\r\ncontent-encoding: br\r\nvary: Accept-Encoding\r\ncontent-length: 2938\r\ndate: Tue, 19 Aug 2025 12:46:29 GMT\r\nserver: LiteSpeed\r\nx-content-type-options: nosniff\r\nx-xss-protection: 1; mode=block\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"LiteSpeed","description":"LiteSpeed is a high-scalability web server.","website":"https://litespeedtech.com","common_platform_enumeration":"cpe:2.3:a:litespeedtech:litespeed_web_server:*:*:*:*:*:*:*:*","icon":"LiteSpeed.svg","categories":["Web servers"]}],"data":{"size":13735,"size_decoded":0,"mime_type":"text/css","magic":"Unicode text, UTF-8 text, with very long lines (13734), with no line terminators","md5":"35d290afd71a6053d8195ea13170b4e9","sha1":"a64676403bb5c23f9800963b0b8f0475b532601f","sha256":"e467f75601e845da217ae845b688b227a19fbf1e8fc776a42a4905869496d2e2","sha512":"0136028681f47450835a9bd6345bb647c95f2be3e963980e5b5e355f3cdc602772313640c5d9b72ae71252bbe8099b11de5663f3fde49b71a5170e42959f7788","ssdeep":"96:tGA07/mPQRZa6f3sNGzssDH7jGSWWf8+WDJT53RjRuCicfMAJpEbyZh5fN2WdZ:tVQfXcVa7KWdMT539MCeAL55fJ","tlshash":"b0524e63a140311c903bce21d7df8948e279d55266221affe68cf919cbc7be912d62c6","first_seen":"2023-04-05T04:47:26Z","last_seen":"2026-08-04T10:14:43.242322Z","times_seen":7054,"resource_available":false,"data":null}},"time_used":123,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":121,"receive":2,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2025-08-19","alert":"Sinkholed","trigger":"midnight-gd.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"midnight-gd.com/static/connect-css/font-awesome.css","fqdn":"midnight-gd.com","domain":"midnight-gd.com","tld":"com"},"ip":{"addr":"192.3.141.250","port":443,"asn":36352,"as":"AS-COLOCROSSING","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://midnight-gd.com/connect.html","date":"2025-08-19T12:46:29.136Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"midnight-gd.com","organization":""},"issuer":{"commonName":"R10","organization":"Let's Encrypt"},"validity":{"start":"Fri, 08 Aug 2025 21:56:18 GMT","end":"Thu, 06 Nov 2025 21:56:17 GMT"},"fingerprint":{"sha1":"57:AB:C1:2A:94:4B:D1:B7:3F:B9:E2:25:D6:6C:A1:FE:87:79:5E:06","sha256":"45:20:67:6D:CB:DC:27:76:A1:38:40:DC:34:04:B4:D8:74:41:3A:A9:57:69:E6:92:F2:D4:D0:4F:FB:E3:6B:49"}}},"request":{"raw":"GET /static/connect-css/font-awesome.css HTTP/1.1\r\nHost: midnight-gd.com\r\nUser-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://midnight-gd.com/static/connect-css/style.css\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\ncache-control: public, max-age=2592000\r\nexpires: Thu, 18 Sep 2025 12:46:29 GMT\r\ncontent-type: text/css\r\nlast-modified: Wed, 30 Aug 2023 02:32:10 GMT\r\naccept-ranges: bytes\r\ncontent-encoding: br\r\nvary: Accept-Encoding\r\ncontent-length: 32686\r\ndate: Tue, 19 Aug 2025 12:46:29 GMT\r\nserver: LiteSpeed\r\nx-content-type-options: nosniff\r\nx-xss-protection: 1; mode=block\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"LiteSpeed","description":"LiteSpeed is a high-scalability web server.","website":"https://litespeedtech.com","common_platform_enumeration":"cpe:2.3:a:litespeedtech:litespeed_web_server:*:*:*:*:*:*:*:*","icon":"LiteSpeed.svg","categories":["Web servers"]}],"data":{"size":225096,"size_decoded":0,"mime_type":"text/css","magic":"ASCII text, with CRLF line terminators","md5":"786659dc92950003485c910bd581f86f","sha1":"195cd816dc49ddc17a564d1ded19fa3888f9bf9e","sha256":"6ca33204948598a4a957ee42c10cd545bf460e21a43f5d40e52d226244e1bff4","sha512":"0efdc0c97c6de1c26e5315727250989552d7e2dbea21b8770ae5843f72282516b08b7df9943fde4262e3e34075d531ff97d112b8608cf75eed8c5a2767a105f0","ssdeep":"3072:Y5ZdUNYSXEDuw59dn9KFFoG+Undkb/RhNzGy0Z3qspTwab4dAzKjKu5YUUqwW76w:E98KYxy+1Lb9u","tlshash":"0024337e907f10564b23f7a4d203e2317b35e67cf6430949b2e6a89d55e1a0ea086fcd","first_seen":"2024-12-30T16:17:04.236851Z","last_seen":"2025-08-24T02:34:52.762412Z","times_seen":8,"resource_available":false,"data":null}},"time_used":285,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":122,"receive":163,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2025-08-19","alert":"Sinkholed","trigger":"midnight-gd.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"midnight-gd.com/static/connect-css/bootstrap.css","fqdn":"midnight-gd.com","domain":"midnight-gd.com","tld":"com"},"ip":{"addr":"192.3.141.250","port":443,"asn":36352,"as":"AS-COLOCROSSING","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://midnight-gd.com/connect.html","date":"2025-08-19T12:46:29.139Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"midnight-gd.com","organization":""},"issuer":{"commonName":"R10","organization":"Let's Encrypt"},"validity":{"start":"Fri, 08 Aug 2025 21:56:18 GMT","end":"Thu, 06 Nov 2025 21:56:17 GMT"},"fingerprint":{"sha1":"57:AB:C1:2A:94:4B:D1:B7:3F:B9:E2:25:D6:6C:A1:FE:87:79:5E:06","sha256":"45:20:67:6D:CB:DC:27:76:A1:38:40:DC:34:04:B4:D8:74:41:3A:A9:57:69:E6:92:F2:D4:D0:4F:FB:E3:6B:49"}}},"request":{"raw":"GET /static/connect-css/bootstrap.css HTTP/1.1\r\nHost: midnight-gd.com\r\nUser-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://midnight-gd.com/static/connect-css/style.css\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\ncache-control: public, max-age=2592000\r\nexpires: Thu, 18 Sep 2025 12:46:29 GMT\r\ncontent-type: text/css\r\nlast-modified: Wed, 23 Jul 2025 18:39:10 GMT\r\naccept-ranges: bytes\r\ncontent-encoding: br\r\nvary: Accept-Encoding\r\ncontent-length: 20350\r\ndate: Tue, 19 Aug 2025 12:46:29 GMT\r\nserver: LiteSpeed\r\nx-content-type-options: nosniff\r\nx-xss-protection: 1; mode=block\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"LiteSpeed","description":"LiteSpeed is a high-scalability web server.","website":"https://litespeedtech.com","common_platform_enumeration":"cpe:2.3:a:litespeedtech:litespeed_web_server:*:*:*:*:*:*:*:*","icon":"LiteSpeed.svg","categories":["Web servers"]}],"data":{"size":200921,"size_decoded":0,"mime_type":"text/css","magic":"ASCII text, with very long lines (683), with CRLF line terminators","md5":"6e699e81fdfb2e29e4a8fed29749e2c6","sha1":"26a75f4872af4221d167ed9b7dd1e4dc708b0a76","sha256":"8b66fe7be163f3cbdccbb15b4de25e8a2ec498ca15a334c71d5b45fb68d14e3b","sha512":"a5f82e8b2d3acb78dc5f1e011f79292c19058aafa6f3d771f6d7e79a5c8f646b71a9f52bbe67f4676dc3509767ea0a3bd1008e643aee64608d3d3a02e8e93fc8","ssdeep":"1536:h8BEbG6AH/keROujTYukR8GC+8GxL62fCRxpcY0xYm0h:h8BOGRk8Dfvq2OY0xYm0h","tlshash":"9814547ae940150b11738f7893d66a7bff790073c60226f678ef66148b95ac08da2dcd","first_seen":"2025-08-18T11:46:15.520055Z","last_seen":"2025-08-19T12:46:52.37706Z","times_seen":2,"resource_available":false,"data":null}},"time_used":284,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":283,"receive":1,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2025-08-19","alert":"Sinkholed","trigger":"midnight-gd.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"midnight-gd.com/static/logo/walle.jpg","fqdn":"midnight-gd.com","domain":"midnight-gd.com","tld":"com"},"ip":{"addr":"192.3.141.250","port":443,"asn":36352,"as":"AS-COLOCROSSING","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://midnight-gd.com/connect.html","date":"2025-08-19T12:46:28.902Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"midnight-gd.com","organization":""},"issuer":{"commonName":"R10","organization":"Let's Encrypt"},"validity":{"start":"Fri, 08 Aug 2025 21:56:18 GMT","end":"Thu, 06 Nov 2025 21:56:17 GMT"},"fingerprint":{"sha1":"57:AB:C1:2A:94:4B:D1:B7:3F:B9:E2:25:D6:6C:A1:FE:87:79:5E:06","sha256":"45:20:67:6D:CB:DC:27:76:A1:38:40:DC:34:04:B4:D8:74:41:3A:A9:57:69:E6:92:F2:D4:D0:4F:FB:E3:6B:49"}}},"request":{"raw":"GET /static/logo/walle.jpg HTTP/1.1\r\nHost: midnight-gd.com\r\nUser-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://midnight-gd.com/connect.html\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\ncache-control: public, max-age=31536000\r\nexpires: Wed, 19 Aug 2026 12:46:28 GMT\r\ncontent-type: image/jpeg\r\nlast-modified: Wed, 30 Aug 2023 02:32:10 GMT\r\naccept-ranges: bytes\r\ncontent-length: 4385\r\ndate: Tue, 19 Aug 2025 12:46:28 GMT\r\nserver: LiteSpeed\r\nx-content-type-options: nosniff\r\nx-xss-protection: 1; mode=block\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"LiteSpeed","description":"LiteSpeed is a high-scalability web server.","website":"https://litespeedtech.com","common_platform_enumeration":"cpe:2.3:a:litespeedtech:litespeed_web_server:*:*:*:*:*:*:*:*","icon":"LiteSpeed.svg","categories":["Web servers"]}],"data":{"size":4385,"size_decoded":0,"mime_type":"image/jpeg","magic":"JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, baseline, precision 8, 225x225, components 3","md5":"8aaa7397f533b7f06cbb667779fa82a2","sha1":"8fd75fa5ac328b68fdf589101a22763580ed8ab9","sha256":"8cecf985296b8abe99d5749f1dd32ed51748d97e642ecb7b0ea6602bf6de22ff","sha512":"5c996c2ffe0377be5c9b878c55564671e7c589a043e89a6eb5337df13a0af7435e458b08a00f9e90279ab99033846c9c3ee52534e1c94ea623d3f4dbb219c217","ssdeep":"96:fo8HzzrPGbqBr3Ca7I5tQ74j8dX10A+gtRE78Ot9/bD58O:fo8ea7I5i4j8dX1+uU8Ot5Dj","tlshash":"0e913c134d6b8991fb11d975a3e0715bd2147971a28aa9a1c0888a700f8ebd80d4e0e0","first_seen":"2023-05-18T08:37:00Z","last_seen":"2026-06-25T01:06:10.199626Z","times_seen":215,"resource_available":false,"data":null}},"time_used":245,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":219,"receive":26,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2025-08-19","alert":"Sinkholed","trigger":"midnight-gd.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":[{"sensor_name":"urlquery","alert":"Phishing - Generic Crypto/Wallet","verdict":"phishing","severity":"medium","comment":"Asset commenly seen with Generic Crypto/Wallet phishing","tags":["crypto","phishing"],"meta":null}]}},{"url":{"schema":"https","addr":"play-lh.googleusercontent.com/PD6ommpOAofmpJzNt5t4zDoGsloOi3O3EM8GoS0pGa6O5RAmRMvSD2CdY962LmaVwQ=s200","fqdn":"play-lh.googleusercontent.com","domain":"googleusercontent.com","tld":"com"},"ip":{"addr":"142.250.178.86","port":443,"asn":15169,"as":"GOOGLE","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://midnight-gd.com/connect.html","date":"2025-08-19T12:46:29.818Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"edgestatic.com","organization":""},"issuer":{"commonName":"WR2","organization":"Google Trust Services"},"validity":{"start":"Mon, 07 Jul 2025 08:34:02 GMT","end":"Mon, 29 Sep 2025 08:34:01 GMT"},"fingerprint":{"sha1":"70:9A:A8:F3:87:95:3F:23:2E:C5:AC:05:21:0A:30:1F:2B:07:70:3D","sha256":"1E:33:C7:99:EB:7F:84:FF:FB:CE:C1:0D:61:84:8D:A7:82:17:51:19:57:AD:89:11:98:C9:67:58:4C:8C:A3:05"}}},"request":{"raw":"GET /PD6ommpOAofmpJzNt5t4zDoGsloOi3O3EM8GoS0pGa6O5RAmRMvSD2CdY962LmaVwQ=s200 HTTP/1.1\r\nHost: play-lh.googleusercontent.com\r\nUser-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://midnight-gd.com/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\naccess-control-allow-origin: *\r\ntiming-allow-origin: *\r\naccess-control-expose-headers: Content-Length\r\ncontent-disposition: inline;filename=\"unnamed.png\"\r\nx-content-type-options: nosniff\r\nserver: fife\r\ncontent-length: 9447\r\nx-xss-protection: 0\r\ndate: Tue, 19 Aug 2025 12:46:30 GMT\r\nexpires: Wed, 20 Aug 2025 12:46:30 GMT\r\ncache-control: public, max-age=86400, no-transform\r\netag: \"v1\"\r\ncontent-type: image/png\r\nvary: Origin\r\nage: 0\r\nalt-svc: h3=\":443\"; ma=2592000,h3-29=\":443\"; ma=2592000\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":null,"data":{"size":9447,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 200 x 200, 8-bit/color RGB, non-interlaced","md5":"1907ad623d51619e947eaaee6e584581","sha1":"1545d16149009d581a57795cd4ba642c6ea0ebfb","sha256":"b52d8d71587bdbab7befb905551d904221175ffaff92e7d831a6e518b84887c8","sha512":"be671d61cf54e441b525af00e907f0c54afcd159b1e765165010705b700746a9407339cf10b13b09f7804252a0d18a0b3c41d6b9ac9bd23f1ffdae1fe37d5ca4","ssdeep":"192:A7/AT1UlDcraB+FhFop/dTwfL0nYiCgLuZN1Yc:A7e1UlD3BAvopHCTN1X","tlshash":"7912b0a76b2e9ceb424d4112102cfb71a755f3961b63e4b73bb145cd62211f0e89085f","first_seen":"2023-11-06T22:45:18Z","last_seen":"2025-09-27T12:41:18.237253Z","times_seen":40,"resource_available":false,"data":null}},"time_used":401,"timings":{"blocked":76,"dns":73,"connect":14,"send":0,"wait":172,"receive":1,"ssl":61},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"midnight-gd.com/static/logo/jade_wallet.jpg","fqdn":"midnight-gd.com","domain":"midnight-gd.com","tld":"com"},"ip":{"addr":"192.3.141.250","port":443,"asn":36352,"as":"AS-COLOCROSSING","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://midnight-gd.com/connect.html","date":"2025-08-19T12:46:28.953Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"midnight-gd.com","organization":""},"issuer":{"commonName":"R10","organization":"Let's Encrypt"},"validity":{"start":"Fri, 08 Aug 2025 21:56:18 GMT","end":"Thu, 06 Nov 2025 21:56:17 GMT"},"fingerprint":{"sha1":"57:AB:C1:2A:94:4B:D1:B7:3F:B9:E2:25:D6:6C:A1:FE:87:79:5E:06","sha256":"45:20:67:6D:CB:DC:27:76:A1:38:40:DC:34:04:B4:D8:74:41:3A:A9:57:69:E6:92:F2:D4:D0:4F:FB:E3:6B:49"}}},"request":{"raw":"GET /static/logo/jade_wallet.jpg HTTP/1.1\r\nHost: midnight-gd.com\r\nUser-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://midnight-gd.com/connect.html\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\ncache-control: public, max-age=31536000\r\nexpires: Wed, 19 Aug 2026 12:46:28 GMT\r\ncontent-type: image/jpeg\r\nlast-modified: Wed, 30 Aug 2023 02:32:10 GMT\r\naccept-ranges: bytes\r\ncontent-length: 10969\r\ndate: Tue, 19 Aug 2025 12:46:28 GMT\r\nserver: LiteSpeed\r\nx-content-type-options: nosniff\r\nx-xss-protection: 1; mode=block\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"LiteSpeed","description":"LiteSpeed is a high-scalability web server.","website":"https://litespeedtech.com","common_platform_enumeration":"cpe:2.3:a:litespeedtech:litespeed_web_server:*:*:*:*:*:*:*:*","icon":"LiteSpeed.svg","categories":["Web servers"]}],"data":{"size":10969,"size_decoded":0,"mime_type":"image/jpeg","magic":"JPEG image data, baseline, precision 8, 400x400, components 3","md5":"2976d6357a37a784f8e579cbea3cf824","sha1":"caf2d7979887e315b7176f3f8fa73e35b56793d0","sha256":"353c7ea72130625c1c2763a37a8bfafd67bfc0e743268650c718801446b9e6c2","sha512":"eb4d95b4bfc8dbaf8b026e9f49538dab1e3df790229bd970e85fcd836b85bf45b8cd8d979b3acc137b773e1c2e32bcde7638fa1cefe00d9990b746900a4e7d3e","ssdeep":"192:HZqWdWQAmSytBoG27ORGg/2+sI3MWt4oI87JxN3MBnXU0fbwk2TzmPtTk:Io1tq7rs8I3MWiBexkcQFk","tlshash":"3c328e9d2e77a65fd88ae27c077de43492b87e32c1521d0eac7850b62a109015cfe207","first_seen":"2023-05-01T21:31:16Z","last_seen":"2026-07-21T05:16:19.691111Z","times_seen":740,"resource_available":false,"data":null}},"time_used":451,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":447,"receive":4,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2025-08-19","alert":"Sinkholed","trigger":"midnight-gd.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":[{"sensor_name":"urlquery","alert":"Phishing - Generic Crypto/Wallet","verdict":"phishing","severity":"medium","comment":"Asset commenly seen with Generic Crypto/Wallet phishing","tags":["crypto","phishing"],"meta":null}]}},{"url":{"schema":"https","addr":"midnight-gd.com/static/logo/plasmapay.jpg","fqdn":"midnight-gd.com","domain":"midnight-gd.com","tld":"com"},"ip":{"addr":"192.3.141.250","port":443,"asn":36352,"as":"AS-COLOCROSSING","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://midnight-gd.com/connect.html","date":"2025-08-19T12:46:28.954Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"midnight-gd.com","organization":""},"issuer":{"commonName":"R10","organization":"Let's Encrypt"},"validity":{"start":"Fri, 08 Aug 2025 21:56:18 GMT","end":"Thu, 06 Nov 2025 21:56:17 GMT"},"fingerprint":{"sha1":"57:AB:C1:2A:94:4B:D1:B7:3F:B9:E2:25:D6:6C:A1:FE:87:79:5E:06","sha256":"45:20:67:6D:CB:DC:27:76:A1:38:40:DC:34:04:B4:D8:74:41:3A:A9:57:69:E6:92:F2:D4:D0:4F:FB:E3:6B:49"}}},"request":{"raw":"GET /static/logo/plasmapay.jpg HTTP/1.1\r\nHost: midnight-gd.com\r\nUser-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://midnight-gd.com/connect.html\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\ncache-control: public, max-age=31536000\r\nexpires: Wed, 19 Aug 2026 12:46:28 GMT\r\ncontent-type: image/jpeg\r\nlast-modified: Wed, 30 Aug 2023 02:32:10 GMT\r\naccept-ranges: bytes\r\ncontent-length: 12210\r\ndate: Tue, 19 Aug 2025 12:46:28 GMT\r\nserver: LiteSpeed\r\nx-content-type-options: nosniff\r\nx-xss-protection: 1; mode=block\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"LiteSpeed","description":"LiteSpeed is a high-scalability web server.","website":"https://litespeedtech.com","common_platform_enumeration":"cpe:2.3:a:litespeedtech:litespeed_web_server:*:*:*:*:*:*:*:*","icon":"LiteSpeed.svg","categories":["Web servers"]}],"data":{"size":12210,"size_decoded":0,"mime_type":"image/jpeg","magic":"JPEG image data, baseline, precision 8, 400x400, components 3","md5":"f54c916fdd25d7d018cc6476ed44cf2a","sha1":"cd650cdd741ed3777d5a620ce4e0b7242536180a","sha256":"22f4e24b77d61acd7bdd8b87371bf7c65539032dca69288d1d5f58624ef973f8","sha512":"c4b2671e2468d2d5c04cfc1c312f50e0682b950b3352612b954732fe96cac30817dec0a8371247241fa8875058d24a95e8ed8e57685a3689f2f6d43b59906ea7","ssdeep":"192:sYGwQJPI6eqAsObjENItMcxi0MyJELs+1aa/hEHKSEpZQbsoxJKdB2:ywQ5I6eqjOPEKLDMyOLsDa/W2BKyE","tlshash":"b842a0c9fd5044e8e8a2ea3845dc0b22f2d817447835dafd354ac13d586682a3d6facb","first_seen":"2023-05-01T21:31:16Z","last_seen":"2026-07-21T05:16:19.587245Z","times_seen":738,"resource_available":false,"data":null}},"time_used":455,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":449,"receive":6,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2025-08-19","alert":"Sinkholed","trigger":"midnight-gd.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":[{"sensor_name":"urlquery","alert":"Phishing - Generic Crypto/Wallet","verdict":"phishing","severity":"medium","comment":"Asset commenly seen with Generic Crypto/Wallet phishing","tags":["crypto","phishing"],"meta":null}]}},{"url":{"schema":"https","addr":"midnight-gd.com/static/logo/onto.jpg","fqdn":"midnight-gd.com","domain":"midnight-gd.com","tld":"com"},"ip":{"addr":"192.3.141.250","port":443,"asn":36352,"as":"AS-COLOCROSSING","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://midnight-gd.com/connect.html","date":"2025-08-19T12:46:29.028Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"midnight-gd.com","organization":""},"issuer":{"commonName":"R10","organization":"Let's Encrypt"},"validity":{"start":"Fri, 08 Aug 2025 21:56:18 GMT","end":"Thu, 06 Nov 2025 21:56:17 GMT"},"fingerprint":{"sha1":"57:AB:C1:2A:94:4B:D1:B7:3F:B9:E2:25:D6:6C:A1:FE:87:79:5E:06","sha256":"45:20:67:6D:CB:DC:27:76:A1:38:40:DC:34:04:B4:D8:74:41:3A:A9:57:69:E6:92:F2:D4:D0:4F:FB:E3:6B:49"}}},"request":{"raw":"GET /static/logo/onto.jpg HTTP/1.1\r\nHost: midnight-gd.com\r\nUser-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://midnight-gd.com/connect.html\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\ncache-control: public, max-age=31536000\r\nexpires: Wed, 19 Aug 2026 12:46:28 GMT\r\ncontent-type: image/jpeg\r\nlast-modified: Sat, 06 Jul 2024 19:34:48 GMT\r\naccept-ranges: bytes\r\ncontent-length: 1191\r\ndate: Tue, 19 Aug 2025 12:46:28 GMT\r\nserver: LiteSpeed\r\nx-content-type-options: nosniff\r\nx-xss-protection: 1; mode=block\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"LiteSpeed","description":"LiteSpeed is a high-scalability web server.","website":"https://litespeedtech.com","common_platform_enumeration":"cpe:2.3:a:litespeedtech:litespeed_web_server:*:*:*:*:*:*:*:*","icon":"LiteSpeed.svg","categories":["Web servers"]}],"data":{"size":1191,"size_decoded":0,"mime_type":"image/jpeg","magic":"PNG image data, 100 x 100, 8-bit colormap, non-interlaced","md5":"9deb12d838a0a76972629bde406573de","sha1":"25c58bab48712c2ec6dce72872999f593734a390","sha256":"bfa9b4039a85d12a95fac286419130a8ca9ad5573547a4cda57108d6cc7eb4aa","sha512":"b619c370ebec1a035a38e88ae845eebbe3349ba4fbb6cde7385c39ca72f27cfe291b0928f4dd5e9be318849ee1a916fa1099d24ed0144c59cf379fa5a1376e5b","ssdeep":"","tlshash":"3821b7bd56fbcd2940d8eaa05ea1533cba1154da40444237961edd1017049994ef394b","first_seen":"2024-08-20T03:07:15.302054Z","last_seen":"2025-08-24T02:34:52.776127Z","times_seen":12,"resource_available":false,"data":null}},"time_used":170,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":170,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2025-08-19","alert":"Sinkholed","trigger":"midnight-gd.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"midnight-gd.com/static/logo/halodefi_wallet.jpg","fqdn":"midnight-gd.com","domain":"midnight-gd.com","tld":"com"},"ip":{"addr":"192.3.141.250","port":443,"asn":36352,"as":"AS-COLOCROSSING","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://midnight-gd.com/connect.html","date":"2025-08-19T12:46:28.945Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"midnight-gd.com","organization":""},"issuer":{"commonName":"R10","organization":"Let's Encrypt"},"validity":{"start":"Fri, 08 Aug 2025 21:56:18 GMT","end":"Thu, 06 Nov 2025 21:56:17 GMT"},"fingerprint":{"sha1":"57:AB:C1:2A:94:4B:D1:B7:3F:B9:E2:25:D6:6C:A1:FE:87:79:5E:06","sha256":"45:20:67:6D:CB:DC:27:76:A1:38:40:DC:34:04:B4:D8:74:41:3A:A9:57:69:E6:92:F2:D4:D0:4F:FB:E3:6B:49"}}},"request":{"raw":"GET /static/logo/halodefi_wallet.jpg HTTP/1.1\r\nHost: midnight-gd.com\r\nUser-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://midnight-gd.com/connect.html\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\ncache-control: public, max-age=31536000\r\nexpires: Wed, 19 Aug 2026 12:46:28 GMT\r\ncontent-type: image/jpeg\r\nlast-modified: Wed, 30 Aug 2023 02:32:10 GMT\r\naccept-ranges: bytes\r\ncontent-length: 6941\r\ndate: Tue, 19 Aug 2025 12:46:28 GMT\r\nserver: LiteSpeed\r\nx-content-type-options: nosniff\r\nx-xss-protection: 1; mode=block\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"LiteSpeed","description":"LiteSpeed is a high-scalability web server.","website":"https://litespeedtech.com","common_platform_enumeration":"cpe:2.3:a:litespeedtech:litespeed_web_server:*:*:*:*:*:*:*:*","icon":"LiteSpeed.svg","categories":["Web servers"]}],"data":{"size":6941,"size_decoded":0,"mime_type":"image/jpeg","magic":"JPEG image data, baseline, precision 8, 400x400, components 3","md5":"b7b86cf653072d036c6ce25b21075ffd","sha1":"d1848f773e4ab91de17efa57c286d21bd38b3633","sha256":"3edd13023131a27bda3e49b23184bee8a7b8c0ab7d283bad63612eb7b339e7d8","sha512":"59c08978f0293fb0ae99fb4ad1ca0448164f1bab16797d4d5d8431cb572c7014df0d62270ba5c37a6f34ef3ec5e3e7b7cd0b00eb582c230bdcb1af41aea48780","ssdeep":"96:d58SnLFHGQDnbElAnKO5vMgiiuYqp29G1JEo5nzeJqNesGs2rdWANdb:/BFHGQ8gv/iSUJEmyJy6rdWANdb","tlshash":"43e1af4633240d1ee52efebb79f25031cd173554e64a864e98b948a60bbc07805ae285","first_seen":"2023-04-30T19:28:18Z","last_seen":"2026-07-21T05:16:19.638657Z","times_seen":572,"resource_available":false,"data":null}},"time_used":440,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":435,"receive":5,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2025-08-19","alert":"Sinkholed","trigger":"midnight-gd.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":[{"sensor_name":"urlquery","alert":"Phishing - Generic Crypto/Wallet","verdict":"phishing","severity":"medium","comment":"Asset commenly seen with Generic Crypto/Wallet phishing","tags":["crypto","phishing"],"meta":null}]}},{"url":{"schema":"https","addr":"midnight-gd.com/static/font/fa-regular-403.html","fqdn":"midnight-gd.com","domain":"midnight-gd.com","tld":"com"},"ip":{"addr":"192.3.141.250","port":443,"asn":36352,"as":"AS-COLOCROSSING","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"font","requested_by":"https://midnight-gd.com/connect.html","date":"2025-08-19T12:46:30.158Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"midnight-gd.com","organization":""},"issuer":{"commonName":"R10","organization":"Let's Encrypt"},"validity":{"start":"Fri, 08 Aug 2025 21:56:18 GMT","end":"Thu, 06 Nov 2025 21:56:17 GMT"},"fingerprint":{"sha1":"57:AB:C1:2A:94:4B:D1:B7:3F:B9:E2:25:D6:6C:A1:FE:87:79:5E:06","sha256":"45:20:67:6D:CB:DC:27:76:A1:38:40:DC:34:04:B4:D8:74:41:3A:A9:57:69:E6:92:F2:D4:D0:4F:FB:E3:6B:49"}}},"request":{"raw":"GET /static/font/fa-regular-403.html HTTP/1.1\r\nHost: midnight-gd.com\r\nUser-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0\r\nAccept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://midnight-gd.com/static/connect-css/font-awesome.css\r\nSec-Fetch-Dest: font\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\ncache-control: public, max-age=2592000\r\nexpires: Thu, 18 Sep 2025 12:46:30 GMT\r\ncontent-type: text/html\r\nlast-modified: Wed, 30 Aug 2023 02:32:10 GMT\r\naccept-ranges: bytes\r\ncontent-encoding: br\r\nvary: Accept-Encoding\r\ncontent-length: 137\r\ndate: Tue, 19 Aug 2025 12:46:30 GMT\r\nserver: LiteSpeed\r\nx-content-type-options: nosniff\r\nx-xss-protection: 1; mode=block\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"LiteSpeed","description":"LiteSpeed is a high-scalability web server.","website":"https://litespeedtech.com","common_platform_enumeration":"cpe:2.3:a:litespeedtech:litespeed_web_server:*:*:*:*:*:*:*:*","icon":"LiteSpeed.svg","categories":["Web servers"]}],"data":{"size":207,"size_decoded":0,"mime_type":"text/html","magic":"HTML document, ASCII text","md5":"e46c4e5e1fbc64b1bae9ebd9bcef7fcf","sha1":"d767b3cb0ad66544c649e4165fc4b37e3c17e370","sha256":"e9639e3c4681ce85f852fbac48e2eeee5ba51296dbfec57c200d59b76237ab80","sha512":"d82048fdcff225197a7e9f0b7f22d470518420a4b10ea3327d604804d04d0d97efadafc84a0aaa23650146f59d94373438dc18bb822e26fd60283c384940ddb9","ssdeep":"","tlshash":"dad0224ed30a032b0a20071035c11beb998f1322757612398f42583e6185b2d81e23c8","first_seen":"2023-04-05T03:09:50Z","last_seen":"2026-08-04T19:11:49.662451Z","times_seen":17198,"resource_available":true,"data":null}},"time_used":108,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":108,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2025-08-19","alert":"Sinkholed","trigger":"midnight-gd.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"midnight-gd.com/static/logo/easypocket.jpg","fqdn":"midnight-gd.com","domain":"midnight-gd.com","tld":"com"},"ip":{"addr":"192.3.141.250","port":443,"asn":36352,"as":"AS-COLOCROSSING","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://midnight-gd.com/connect.html","date":"2025-08-19T12:46:28.941Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"midnight-gd.com","organization":""},"issuer":{"commonName":"R10","organization":"Let's Encrypt"},"validity":{"start":"Fri, 08 Aug 2025 21:56:18 GMT","end":"Thu, 06 Nov 2025 21:56:17 GMT"},"fingerprint":{"sha1":"57:AB:C1:2A:94:4B:D1:B7:3F:B9:E2:25:D6:6C:A1:FE:87:79:5E:06","sha256":"45:20:67:6D:CB:DC:27:76:A1:38:40:DC:34:04:B4:D8:74:41:3A:A9:57:69:E6:92:F2:D4:D0:4F:FB:E3:6B:49"}}},"request":{"raw":"GET /static/logo/easypocket.jpg HTTP/1.1\r\nHost: midnight-gd.com\r\nUser-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://midnight-gd.com/connect.html\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\ncache-control: public, max-age=31536000\r\nexpires: Wed, 19 Aug 2026 12:46:28 GMT\r\ncontent-type: image/jpeg\r\nlast-modified: Wed, 30 Aug 2023 02:32:10 GMT\r\naccept-ranges: bytes\r\ncontent-length: 6077\r\ndate: Tue, 19 Aug 2025 12:46:28 GMT\r\nserver: LiteSpeed\r\nx-content-type-options: nosniff\r\nx-xss-protection: 1; mode=block\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"LiteSpeed","description":"LiteSpeed is a high-scalability web server.","website":"https://litespeedtech.com","common_platform_enumeration":"cpe:2.3:a:litespeedtech:litespeed_web_server:*:*:*:*:*:*:*:*","icon":"LiteSpeed.svg","categories":["Web servers"]}],"data":{"size":6077,"size_decoded":0,"mime_type":"image/jpeg","magic":"JPEG image data, baseline, precision 8, 400x400, components 3","md5":"68dcb1da71ecb585c52aa44ee3dcccc2","sha1":"8c702a4f8d1c68bba1dc8ba1ee165f9958ef708a","sha256":"97fd6f72e2ffccc20b821c4b8f0a1ab9644df31860bc236dc17390e83328aced","sha512":"c436c37758e9094362772efd93367ef493084329a8739ac7e781ff3f8e297eaec27ccda3fb352111fb70594c858a38b405eac88ffaef47c31cbde69d1de02dfd","ssdeep":"96:Z6oFdipXHSLJ2X9oLF1bKkovt2uokMLjmBpLoO8IPwTHsYAy7p5joa3:Z6oFdiZHSv1GbsRmB2IPqsYp59","tlshash":"f8c18e59f0899294d4dedc34f5e03832822d55f3db4c3e4e27072864b13d0aaaf9a0cb","first_seen":"2023-04-30T19:28:18Z","last_seen":"2026-07-21T05:16:19.695842Z","times_seen":729,"resource_available":false,"data":null}},"time_used":431,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":429,"receive":2,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2025-08-19","alert":"Sinkholed","trigger":"midnight-gd.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":[{"sensor_name":"urlquery","alert":"Phishing - Generic Crypto/Wallet","verdict":"phishing","severity":"medium","comment":"Asset commenly seen with Generic Crypto/Wallet phishing","tags":["crypto","phishing"],"meta":null}]}},{"url":{"schema":"https","addr":"midnight-gd.com/static/logo/unstoppable_wallet.jpg","fqdn":"midnight-gd.com","domain":"midnight-gd.com","tld":"com"},"ip":{"addr":"192.3.141.250","port":443,"asn":36352,"as":"AS-COLOCROSSING","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://midnight-gd.com/connect.html","date":"2025-08-19T12:46:28.944Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"midnight-gd.com","organization":""},"issuer":{"commonName":"R10","organization":"Let's Encrypt"},"validity":{"start":"Fri, 08 Aug 2025 21:56:18 GMT","end":"Thu, 06 Nov 2025 21:56:17 GMT"},"fingerprint":{"sha1":"57:AB:C1:2A:94:4B:D1:B7:3F:B9:E2:25:D6:6C:A1:FE:87:79:5E:06","sha256":"45:20:67:6D:CB:DC:27:76:A1:38:40:DC:34:04:B4:D8:74:41:3A:A9:57:69:E6:92:F2:D4:D0:4F:FB:E3:6B:49"}}},"request":{"raw":"GET /static/logo/unstoppable_wallet.jpg HTTP/1.1\r\nHost: midnight-gd.com\r\nUser-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://midnight-gd.com/connect.html\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\ncache-control: public, max-age=31536000\r\nexpires: Wed, 19 Aug 2026 12:46:28 GMT\r\ncontent-type: image/jpeg\r\nlast-modified: Wed, 30 Aug 2023 02:32:10 GMT\r\naccept-ranges: bytes\r\ncontent-length: 6859\r\ndate: Tue, 19 Aug 2025 12:46:28 GMT\r\nserver: LiteSpeed\r\nx-content-type-options: nosniff\r\nx-xss-protection: 1; mode=block\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"LiteSpeed","description":"LiteSpeed is a high-scalability web server.","website":"https://litespeedtech.com","common_platform_enumeration":"cpe:2.3:a:litespeedtech:litespeed_web_server:*:*:*:*:*:*:*:*","icon":"LiteSpeed.svg","categories":["Web servers"]}],"data":{"size":6859,"size_decoded":0,"mime_type":"image/jpeg","magic":"JPEG image data, baseline, precision 8, 400x400, components 3","md5":"73e8f4bb9a641d6c33e9610030b74a53","sha1":"8c09555af9ec61e077ad6304f780aefd40d469de","sha256":"f50a128c69596cbb101cec84c8c0c479af3f548c10fad011727f5d5f10ebb479","sha512":"9827f364780bf98a7486eb1b8f7d83b47925d5e1ee2870c17222da57991b3f0f73021ecb20dca73871599e1969465304b9eb7575233546783855c3b71df6f307","ssdeep":"192:wlqviSuns0AVZ/c6umyClei4AQbOSfBBVV:wl8izQV+tieipPSZXV","tlshash":"dfe19e47b6511949e89fe0fcfe3681459732a57449cf3e0e22f6985c7a1241db0e0e76","first_seen":"2023-04-30T19:28:18Z","last_seen":"2026-07-23T15:04:36.581477Z","times_seen":797,"resource_available":false,"data":null}},"time_used":437,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":435,"receive":2,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2025-08-19","alert":"Sinkholed","trigger":"midnight-gd.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":[{"sensor_name":"urlquery","alert":"Phishing - Generic Crypto/Wallet","verdict":"phishing","severity":"medium","comment":"Asset commenly seen with Generic Crypto/Wallet phishing","tags":["crypto","phishing"],"meta":null}]}},{"url":{"schema":"https","addr":"fonts.googleapis.com/css2?family=Urbanist:ital,wght@0,100;0,200;0,300;0,400;0,500;0,600;0,700;0,800;0,900;1,100;1,200;1,300;1,400;1,500;1,600;1,700;1,800;1,900\u0026amp;display=swap","fqdn":"fonts.googleapis.com","domain":"fonts.googleapis.com","tld":"googleapis.com"},"ip":{"addr":"142.250.74.10","port":443,"asn":15169,"as":"GOOGLE","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://midnight-gd.com/connect.html","date":"2025-08-19T12:46:29.137Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"upload.video.google.com","organization":""},"issuer":{"commonName":"WR2","organization":"Google Trust Services"},"validity":{"start":"Mon, 07 Jul 2025 08:35:11 GMT","end":"Mon, 29 Sep 2025 08:35:10 GMT"},"fingerprint":{"sha1":"DF:A1:DB:1F:BC:5E:31:D7:F8:FE:26:E3:B9:B3:02:98:B1:C8:50:EC","sha256":"A2:57:20:B6:AE:46:89:B9:39:C7:57:9B:1E:43:96:E3:5A:BC:7E:3F:1D:18:10:34:CC:53:3D:DB:78:4E:5C:21"}}},"request":{"raw":"GET /css2?family=Urbanist:ital,wght@0,100;0,200;0,300;0,400;0,500;0,600;0,700;0,800;0,900;1,100;1,200;1,300;1,400;1,500;1,600;1,700;1,800;1,900\u0026amp;display=swap HTTP/1.1\r\nHost: fonts.googleapis.com\r\nUser-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://midnight-gd.com/\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ncontent-type: text/css; charset=utf-8\r\nvary: Sec-Fetch-Dest, Sec-Fetch-Mode, Sec-Fetch-Site\r\naccess-control-allow-origin: *\r\ntiming-allow-origin: *\r\nlink: \u003chttps://fonts.gstatic.com\u003e; rel=preconnect; crossorigin\r\nstrict-transport-security: max-age=31536000\r\nexpires: Tue, 19 Aug 2025 12:46:29 GMT\r\ndate: Tue, 19 Aug 2025 12:46:29 GMT\r\ncache-control: private, max-age=86400\r\ncross-origin-opener-policy: same-origin-allow-popups\r\ncross-origin-resource-policy: cross-origin\r\ncontent-encoding: gzip\r\nserver: ESF\r\nx-xss-protection: 0\r\nx-frame-options: SAMEORIGIN\r\nx-content-type-options: nosniff\r\nalt-svc: h3=\":443\"; ma=2592000,h3-29=\":443\"; ma=2592000\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":14463,"size_decoded":0,"mime_type":"text/css; charset=utf-8","magic":"ASCII text","md5":"dbd3b43ed20f35ebfdfd1c60cbb2300f","sha1":"15d0a8c8071bf9ec8b65f1fe4aa84d7f13401520","sha256":"ec8da1d3983903b9605ddd968708dab7629089409c6d7c074db66b65da5a3a57","sha512":"3544fddee6763d9e56284aa41b51eed5f0b4cfd50b24932221f1e2147ec238dc53b7086fa1ee178f2b6d9e25b3fc70f613538a4ad8ed938c1912a9c40b2d49b9","ssdeep":"192:G37yip37yiiyipiyilyiplyikyipkyiPyipPyi2yip2yipyippyiIyipIyiTyip8:G3z3NUGBTyM/5wi9/uIbYh3","tlshash":"8052ad91492ba550ebd30dc222da7d32df0fa250b4459d35bbfe28d9fc62c2a53a171c","first_seen":"2025-05-30T12:51:46.102963Z","last_seen":"2025-08-24T02:34:52.745997Z","times_seen":28,"resource_available":false,"data":null}},"time_used":245,"timings":{"blocked":98,"dns":0,"connect":20,"send":0,"wait":36,"receive":0,"ssl":88},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"midnight-gd.com/static/logo/wallet_io.jpg","fqdn":"midnight-gd.com","domain":"midnight-gd.com","tld":"com"},"ip":{"addr":"192.3.141.250","port":443,"asn":36352,"as":"AS-COLOCROSSING","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://midnight-gd.com/connect.html","date":"2025-08-19T12:46:28.939Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"midnight-gd.com","organization":""},"issuer":{"commonName":"R10","organization":"Let's Encrypt"},"validity":{"start":"Fri, 08 Aug 2025 21:56:18 GMT","end":"Thu, 06 Nov 2025 21:56:17 GMT"},"fingerprint":{"sha1":"57:AB:C1:2A:94:4B:D1:B7:3F:B9:E2:25:D6:6C:A1:FE:87:79:5E:06","sha256":"45:20:67:6D:CB:DC:27:76:A1:38:40:DC:34:04:B4:D8:74:41:3A:A9:57:69:E6:92:F2:D4:D0:4F:FB:E3:6B:49"}}},"request":{"raw":"GET /static/logo/wallet_io.jpg HTTP/1.1\r\nHost: midnight-gd.com\r\nUser-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://midnight-gd.com/connect.html\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\ncache-control: public, max-age=31536000\r\nexpires: Wed, 19 Aug 2026 12:46:28 GMT\r\ncontent-type: image/jpeg\r\nlast-modified: Wed, 30 Aug 2023 02:32:10 GMT\r\naccept-ranges: bytes\r\ncontent-length: 12842\r\ndate: Tue, 19 Aug 2025 12:46:28 GMT\r\nserver: LiteSpeed\r\nx-content-type-options: nosniff\r\nx-xss-protection: 1; mode=block\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"LiteSpeed","description":"LiteSpeed is a high-scalability web server.","website":"https://litespeedtech.com","common_platform_enumeration":"cpe:2.3:a:litespeedtech:litespeed_web_server:*:*:*:*:*:*:*:*","icon":"LiteSpeed.svg","categories":["Web servers"]}],"data":{"size":12842,"size_decoded":0,"mime_type":"image/jpeg","magic":"JPEG image data, baseline, precision 8, 400x400, components 3","md5":"3b94a722de722a8972c8883eb2eabcf4","sha1":"42976f0e9169db09f109656e0450e6cdaff73281","sha256":"7ab4f55e993789177b55f53551ecdffc97ed6fb42300be796487f145e4f128d4","sha512":"fb5cf1b83498f888e659e08a4fa2ac1e43fd673be4113d66d82d4d684d7a477a6e8b3d60b93c12a37d3ea745807f615035e0a4e3b96b80947cfe81696aaa7dc3","ssdeep":"384:s9uMe8401VAxH6tMTTNpH5E3XN5XPch1NQ:hqp1aHlT5eXN5Si","tlshash":"e742b03d717d629ef004ce3451b3d0c9b71224689da3ac5d5c17bb690c92e332ba6ba3","first_seen":"2023-04-30T19:28:18Z","last_seen":"2026-07-23T15:04:36.512512Z","times_seen":706,"resource_available":false,"data":null}},"time_used":431,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":424,"receive":7,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2025-08-19","alert":"Sinkholed","trigger":"midnight-gd.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":[{"sensor_name":"urlquery","alert":"Phishing - Generic Crypto/Wallet","verdict":"phishing","severity":"medium","comment":"Asset commenly seen with Generic Crypto/Wallet phishing","tags":["crypto","phishing"],"meta":null}]}},{"url":{"schema":"https","addr":"midnight-gd.com/static/logo/trustee_wallet.jpg","fqdn":"midnight-gd.com","domain":"midnight-gd.com","tld":"com"},"ip":{"addr":"192.3.141.250","port":443,"asn":36352,"as":"AS-COLOCROSSING","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://midnight-gd.com/connect.html","date":"2025-08-19T12:46:28.950Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"midnight-gd.com","organization":""},"issuer":{"commonName":"R10","organization":"Let's Encrypt"},"validity":{"start":"Fri, 08 Aug 2025 21:56:18 GMT","end":"Thu, 06 Nov 2025 21:56:17 GMT"},"fingerprint":{"sha1":"57:AB:C1:2A:94:4B:D1:B7:3F:B9:E2:25:D6:6C:A1:FE:87:79:5E:06","sha256":"45:20:67:6D:CB:DC:27:76:A1:38:40:DC:34:04:B4:D8:74:41:3A:A9:57:69:E6:92:F2:D4:D0:4F:FB:E3:6B:49"}}},"request":{"raw":"GET /static/logo/trustee_wallet.jpg HTTP/1.1\r\nHost: midnight-gd.com\r\nUser-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://midnight-gd.com/connect.html\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\ncache-control: public, max-age=31536000\r\nexpires: Wed, 19 Aug 2026 12:46:28 GMT\r\ncontent-type: image/jpeg\r\nlast-modified: Wed, 30 Aug 2023 02:32:10 GMT\r\naccept-ranges: bytes\r\ncontent-length: 9631\r\ndate: Tue, 19 Aug 2025 12:46:28 GMT\r\nserver: LiteSpeed\r\nx-content-type-options: nosniff\r\nx-xss-protection: 1; mode=block\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"LiteSpeed","description":"LiteSpeed is a high-scalability web server.","website":"https://litespeedtech.com","common_platform_enumeration":"cpe:2.3:a:litespeedtech:litespeed_web_server:*:*:*:*:*:*:*:*","icon":"LiteSpeed.svg","categories":["Web servers"]}],"data":{"size":9631,"size_decoded":0,"mime_type":"image/jpeg","magic":"JPEG image data, baseline, precision 8, 400x400, components 3","md5":"5053513633960d52b22b7ada35c2be77","sha1":"d489998cf55f2bd8a18e15625bde018ef93cbabd","sha256":"da100c8001271aa0673900ad8cb38791ca36fa5d8070a34168b23ccbbd02af25","sha512":"2238f5114c143b0099595070948d441e8e1511bfafee9bf61acf86d2e13c781f323938b85cb4c83d08ea74cae82a2e0ee762bea98380602961281b51ecdef0ac","ssdeep":"192:0OfUZWfn5zS9fNqMsEnumMntIFQ/o3MDr5UCYsPKGaGQjNo:7fUIG9V5uRntIC/o8nCSSGAy","tlshash":"33129e3c77aea57299c0ed3f2ec1d6c8f99095f81cd5202f23e60599e55032c3e59ad4","first_seen":"2023-05-01T21:31:16Z","last_seen":"2026-07-14T08:40:56.069556Z","times_seen":417,"resource_available":false,"data":null}},"time_used":448,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":444,"receive":4,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2025-08-19","alert":"Sinkholed","trigger":"midnight-gd.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":[{"sensor_name":"urlquery","alert":"Phishing - Generic Crypto/Wallet","verdict":"phishing","severity":"medium","comment":"Asset commenly seen with Generic Crypto/Wallet phishing","tags":["crypto","phishing"],"meta":null}]}},{"url":{"schema":"https","addr":"midnight-gd.com/static/logo/atoken_wallet.jpg","fqdn":"midnight-gd.com","domain":"midnight-gd.com","tld":"com"},"ip":{"addr":"192.3.141.250","port":443,"asn":36352,"as":"AS-COLOCROSSING","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://midnight-gd.com/connect.html","date":"2025-08-19T12:46:29.018Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"midnight-gd.com","organization":""},"issuer":{"commonName":"R10","organization":"Let's Encrypt"},"validity":{"start":"Fri, 08 Aug 2025 21:56:18 GMT","end":"Thu, 06 Nov 2025 21:56:17 GMT"},"fingerprint":{"sha1":"57:AB:C1:2A:94:4B:D1:B7:3F:B9:E2:25:D6:6C:A1:FE:87:79:5E:06","sha256":"45:20:67:6D:CB:DC:27:76:A1:38:40:DC:34:04:B4:D8:74:41:3A:A9:57:69:E6:92:F2:D4:D0:4F:FB:E3:6B:49"}}},"request":{"raw":"GET /static/logo/atoken_wallet.jpg HTTP/1.1\r\nHost: midnight-gd.com\r\nUser-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://midnight-gd.com/connect.html\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\ncache-control: public, max-age=31536000\r\nexpires: Wed, 19 Aug 2026 12:46:28 GMT\r\ncontent-type: image/jpeg\r\nlast-modified: Wed, 30 Aug 2023 02:32:10 GMT\r\naccept-ranges: bytes\r\ncontent-length: 6772\r\ndate: Tue, 19 Aug 2025 12:46:28 GMT\r\nserver: LiteSpeed\r\nx-content-type-options: nosniff\r\nx-xss-protection: 1; mode=block\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"LiteSpeed","description":"LiteSpeed is a high-scalability web server.","website":"https://litespeedtech.com","common_platform_enumeration":"cpe:2.3:a:litespeedtech:litespeed_web_server:*:*:*:*:*:*:*:*","icon":"LiteSpeed.svg","categories":["Web servers"]}],"data":{"size":6772,"size_decoded":0,"mime_type":"image/jpeg","magic":"JPEG image data, baseline, precision 8, 400x400, components 3","md5":"9c57c0e2ec3176b7cababa8f05b5a604","sha1":"96fc6b70edee435b4c3aae29ffed43cf536f0e9b","sha256":"4989e81bf3bd85e60e9fb74a27bf360237bb0e0db53a7ff1aa7ab84b26b24af6","sha512":"62cab8c7b9107bcef9244c7a90b7b4db907ac66d187116eae7136737d258d494397b28e08a83c507db9d5f89d9e7f87cd7ee39ed3a2e3a5138d82423da10fe67","ssdeep":"96:o7qTk42sGoZZ62rbt0+iXlLVIY2mWceiHIuNZ08m4W6wVo7TVL/YVLd6lywoRoo5:4PsGI3NWlLVF2eIkZARw7R/YX6QJUgKy","tlshash":"cdd17e8a37d99f32bc49c4fea469e798af280117444c7c9fa3be6c834a916545ebc110","first_seen":"2023-04-30T19:28:18Z","last_seen":"2026-07-21T05:16:19.684923Z","times_seen":744,"resource_available":false,"data":null}},"time_used":460,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":161,"receive":299,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2025-08-19","alert":"Sinkholed","trigger":"midnight-gd.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":[{"sensor_name":"urlquery","alert":"Phishing - Generic Crypto/Wallet","verdict":"phishing","severity":"medium","comment":"Asset commenly seen with Generic Crypto/Wallet phishing","tags":["crypto","phishing"],"meta":null}]}},{"url":{"schema":"https","addr":"midnight-gd.com/static/logo/natrium.png","fqdn":"midnight-gd.com","domain":"midnight-gd.com","tld":"com"},"ip":{"addr":"192.3.141.250","port":443,"asn":36352,"as":"AS-COLOCROSSING","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://midnight-gd.com/connect.html","date":"2025-08-19T12:46:29.040Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"midnight-gd.com","organization":""},"issuer":{"commonName":"R10","organization":"Let's Encrypt"},"validity":{"start":"Fri, 08 Aug 2025 21:56:18 GMT","end":"Thu, 06 Nov 2025 21:56:17 GMT"},"fingerprint":{"sha1":"57:AB:C1:2A:94:4B:D1:B7:3F:B9:E2:25:D6:6C:A1:FE:87:79:5E:06","sha256":"45:20:67:6D:CB:DC:27:76:A1:38:40:DC:34:04:B4:D8:74:41:3A:A9:57:69:E6:92:F2:D4:D0:4F:FB:E3:6B:49"}}},"request":{"raw":"GET /static/logo/natrium.png HTTP/1.1\r\nHost: midnight-gd.com\r\nUser-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://midnight-gd.com/connect.html\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\ncache-control: public, max-age=31536000\r\nexpires: Wed, 19 Aug 2026 12:46:29 GMT\r\ncontent-type: image/png\r\nlast-modified: Sat, 06 Jul 2024 19:34:48 GMT\r\naccept-ranges: bytes\r\ncontent-length: 169740\r\ndate: Tue, 19 Aug 2025 12:46:29 GMT\r\nserver: LiteSpeed\r\nx-content-type-options: nosniff\r\nx-xss-protection: 1; mode=block\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"LiteSpeed","description":"LiteSpeed is a high-scalability web server.","website":"https://litespeedtech.com","common_platform_enumeration":"cpe:2.3:a:litespeedtech:litespeed_web_server:*:*:*:*:*:*:*:*","icon":"LiteSpeed.svg","categories":["Web servers"]}],"data":{"size":169740,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 512 x 512, 8-bit/color RGBA, non-interlaced","md5":"e582f842e4d2c16068df9912655c7f97","sha1":"a0c9bad306a93a358ab2a146529e8f204596c68e","sha256":"9a9634aa6e6ae896bfaff97cc6a0a6ce586cbc5c579ebf6306861cbc200f3731","sha512":"b94566ae3db35873ef800f0f7ab81b187b6ab535b2cf2a8af3c266e10be64c7afd923fa0fc660af2e57d5d9be580d8d78c35398edf03aa8e03963b853574bb73","ssdeep":"3072:80+vMfnqBKWpa+YjaGBbdflySrJ0BDpXWM2pwkjgEqP+6UUEwwQNjQVekoZg2LFE:H+vAKGxBV8WJ0tpXWM2JjgEoUCN4foOR","tlshash":"dff31268629806d0d4486bb3bf4657892564b41864b7ef0ca7c7e9c7e733e2073ae04f","first_seen":"2024-12-30T16:17:04.225885Z","last_seen":"2025-08-19T12:46:52.393268Z","times_seen":5,"resource_available":false,"data":null}},"time_used":499,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":448,"receive":51,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2025-08-19","alert":"Sinkholed","trigger":"midnight-gd.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"midnight-gd.com/static/connect-css/shortcodes.css","fqdn":"midnight-gd.com","domain":"midnight-gd.com","tld":"com"},"ip":{"addr":"192.3.141.250","port":443,"asn":36352,"as":"AS-COLOCROSSING","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://midnight-gd.com/connect.html","date":"2025-08-19T12:46:29.132Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"midnight-gd.com","organization":""},"issuer":{"commonName":"R10","organization":"Let's Encrypt"},"validity":{"start":"Fri, 08 Aug 2025 21:56:18 GMT","end":"Thu, 06 Nov 2025 21:56:17 GMT"},"fingerprint":{"sha1":"57:AB:C1:2A:94:4B:D1:B7:3F:B9:E2:25:D6:6C:A1:FE:87:79:5E:06","sha256":"45:20:67:6D:CB:DC:27:76:A1:38:40:DC:34:04:B4:D8:74:41:3A:A9:57:69:E6:92:F2:D4:D0:4F:FB:E3:6B:49"}}},"request":{"raw":"GET /static/connect-css/shortcodes.css HTTP/1.1\r\nHost: midnight-gd.com\r\nUser-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://midnight-gd.com/static/connect-css/style.css\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\ncache-control: public, max-age=2592000\r\nexpires: Thu, 18 Sep 2025 12:46:29 GMT\r\ncontent-type: text/css\r\nlast-modified: Wed, 23 Jul 2025 16:56:16 GMT\r\naccept-ranges: bytes\r\ncontent-encoding: br\r\nvary: Accept-Encoding\r\ncontent-length: 24432\r\ndate: Tue, 19 Aug 2025 12:46:29 GMT\r\nserver: LiteSpeed\r\nx-content-type-options: nosniff\r\nx-xss-protection: 1; mode=block\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"LiteSpeed","description":"LiteSpeed is a high-scalability web server.","website":"https://litespeedtech.com","common_platform_enumeration":"cpe:2.3:a:litespeedtech:litespeed_web_server:*:*:*:*:*:*:*:*","icon":"LiteSpeed.svg","categories":["Web servers"]}],"data":{"size":183079,"size_decoded":0,"mime_type":"text/css","magic":"ASCII text, with CRLF line terminators","md5":"70e7f0ac1e384f7a1d1dd4e784c80569","sha1":"edb2f72314dcae8f7d2f7c6572717660c9614616","sha256":"212d2789b6a9ac6941ba7aaa21b669b9df7227c022c5916a4b4ce94de1ed7aa7","sha512":"f3bdb059851e89f2db91e8736dc790f7bf714a8a70b3374ee59a900ad9e5dc46f6ef73d7cb2d1efd3cc6da0466c5d1cdade5277f91c63ecb7586e50864d002f9","ssdeep":"384:AP9PHyhgfoJy59seSvGXIIomczf4NYHC+6ByVARhy87y3nRG74btb3LyHXfLbFO7:AOC6P6ByVlbNhf8D+qc","tlshash":"280495ecda52005b2333cb2417e15366faa44463db4111a83bde52a88ff617c6179fee","first_seen":"2025-08-18T11:46:15.514065Z","last_seen":"2025-08-19T12:46:52.394149Z","times_seen":2,"resource_available":false,"data":null}},"time_used":283,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":109,"receive":174,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2025-08-19","alert":"Sinkholed","trigger":"midnight-gd.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"midnight-gd.com/static/logo/metamask.jpg","fqdn":"midnight-gd.com","domain":"midnight-gd.com","tld":"com"},"ip":{"addr":"192.3.141.250","port":443,"asn":36352,"as":"AS-COLOCROSSING","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://midnight-gd.com/connect.html","date":"2025-08-19T12:46:28.906Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"midnight-gd.com","organization":""},"issuer":{"commonName":"R10","organization":"Let's Encrypt"},"validity":{"start":"Fri, 08 Aug 2025 21:56:18 GMT","end":"Thu, 06 Nov 2025 21:56:17 GMT"},"fingerprint":{"sha1":"57:AB:C1:2A:94:4B:D1:B7:3F:B9:E2:25:D6:6C:A1:FE:87:79:5E:06","sha256":"45:20:67:6D:CB:DC:27:76:A1:38:40:DC:34:04:B4:D8:74:41:3A:A9:57:69:E6:92:F2:D4:D0:4F:FB:E3:6B:49"}}},"request":{"raw":"GET /static/logo/metamask.jpg HTTP/1.1\r\nHost: midnight-gd.com\r\nUser-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://midnight-gd.com/connect.html\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\ncache-control: public, max-age=31536000\r\nexpires: Wed, 19 Aug 2026 12:46:28 GMT\r\ncontent-type: image/jpeg\r\nlast-modified: Wed, 30 Aug 2023 02:32:10 GMT\r\naccept-ranges: bytes\r\ncontent-length: 9649\r\ndate: Tue, 19 Aug 2025 12:46:28 GMT\r\nserver: LiteSpeed\r\nx-content-type-options: nosniff\r\nx-xss-protection: 1; mode=block\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"LiteSpeed","description":"LiteSpeed is a high-scalability web server.","website":"https://litespeedtech.com","common_platform_enumeration":"cpe:2.3:a:litespeedtech:litespeed_web_server:*:*:*:*:*:*:*:*","icon":"LiteSpeed.svg","categories":["Web servers"]}],"data":{"size":9649,"size_decoded":0,"mime_type":"image/jpeg","magic":"JPEG image data, baseline, precision 8, 400x400, components 3","md5":"51db991750e9db40fbdc7d0f30242022","sha1":"e6118446bcb9637df1a291e227b4568ecbb975b8","sha256":"8511e927da4ac9ec04a813dfd6048297ca51639520463b8d6a61ccafd81500cc","sha512":"e55f577d849f33e2905ab163289e216c3c13abd922d4219c5fd592567898d3fde46acc1e8d036aa13b8a60498be990c18c408e56dbb0a94763ec481fe6598433","ssdeep":"192:D8Jsuc1VNFgDBoP8/UmUBYrOzj+MKSbNEyv3I4R3Cj:D8JsuIPFgDBoOJvhSbKj","tlshash":"3f129e963750d722d09edef3278d202e2e1759b32416eb6e531b40d44c6e5a6e827c78","first_seen":"2023-05-01T21:31:16Z","last_seen":"2026-06-26T01:27:54.613696Z","times_seen":497,"resource_available":false,"data":null}},"time_used":252,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":193,"receive":59,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2025-08-19","alert":"Sinkholed","trigger":"midnight-gd.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":[{"sensor_name":"urlquery","alert":"Phishing - Generic Crypto/Wallet","verdict":"phishing","severity":"medium","comment":"Asset commenly seen with Generic Crypto/Wallet phishing","tags":["crypto","phishing"],"meta":null}]}},{"url":{"schema":"https","addr":"midnight-gd.com/static/logo/cool_wallet_s.jpg","fqdn":"midnight-gd.com","domain":"midnight-gd.com","tld":"com"},"ip":{"addr":"192.3.141.250","port":443,"asn":36352,"as":"AS-COLOCROSSING","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://midnight-gd.com/connect.html","date":"2025-08-19T12:46:28.932Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"midnight-gd.com","organization":""},"issuer":{"commonName":"R10","organization":"Let's Encrypt"},"validity":{"start":"Fri, 08 Aug 2025 21:56:18 GMT","end":"Thu, 06 Nov 2025 21:56:17 GMT"},"fingerprint":{"sha1":"57:AB:C1:2A:94:4B:D1:B7:3F:B9:E2:25:D6:6C:A1:FE:87:79:5E:06","sha256":"45:20:67:6D:CB:DC:27:76:A1:38:40:DC:34:04:B4:D8:74:41:3A:A9:57:69:E6:92:F2:D4:D0:4F:FB:E3:6B:49"}}},"request":{"raw":"GET /static/logo/cool_wallet_s.jpg HTTP/1.1\r\nHost: midnight-gd.com\r\nUser-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://midnight-gd.com/connect.html\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\ncache-control: public, max-age=31536000\r\nexpires: Wed, 19 Aug 2026 12:46:28 GMT\r\ncontent-type: image/jpeg\r\nlast-modified: Wed, 30 Aug 2023 02:32:10 GMT\r\naccept-ranges: bytes\r\ncontent-length: 7236\r\ndate: Tue, 19 Aug 2025 12:46:28 GMT\r\nserver: LiteSpeed\r\nx-content-type-options: nosniff\r\nx-xss-protection: 1; mode=block\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"LiteSpeed","description":"LiteSpeed is a high-scalability web server.","website":"https://litespeedtech.com","common_platform_enumeration":"cpe:2.3:a:litespeedtech:litespeed_web_server:*:*:*:*:*:*:*:*","icon":"LiteSpeed.svg","categories":["Web servers"]}],"data":{"size":7236,"size_decoded":0,"mime_type":"image/jpeg","magic":"JPEG image data, baseline, precision 8, 400x400, components 3","md5":"97c7f6191718e13dd0297ac906b7b7c3","sha1":"72e2dc617e184515ae50cce89e3e1dc2f30e098d","sha256":"9d1eac67b14b71ed6228ee2e1f621461c2d886cece4de6d7f01d9863b736138f","sha512":"7cf15038d2cdf2560895c3ad89cee1026290950e2f82f8b90bec45aeb759760f48d01886e5865ab3951f07932b91bc541b21d8f172e81da4d3340940ca7692f7","ssdeep":"192:6AZZ6CJD6w66klLshDYu/7scdBUAlY4TvJ6ElfpLRdpfnORj:6AjbAgn77Y4TkE3Rd1ORj","tlshash":"62e19f4936f52e23eb0afbf47543e9960f52955178bf0c0f74912960223a7a2f448a5c","first_seen":"2023-05-01T21:31:16Z","last_seen":"2026-07-21T05:16:19.644228Z","times_seen":589,"resource_available":false,"data":null}},"time_used":411,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":407,"receive":4,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2025-08-19","alert":"Sinkholed","trigger":"midnight-gd.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":[{"sensor_name":"urlquery","alert":"Phishing - Generic Crypto/Wallet","verdict":"phishing","severity":"medium","comment":"Asset commenly seen with Generic Crypto/Wallet phishing","tags":["crypto","phishing"],"meta":null}]}},{"url":{"schema":"https","addr":"midnight-gd.com/static/logo/arculus.jpg","fqdn":"midnight-gd.com","domain":"midnight-gd.com","tld":"com"},"ip":{"addr":"192.3.141.250","port":443,"asn":36352,"as":"AS-COLOCROSSING","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://midnight-gd.com/connect.html","date":"2025-08-19T12:46:29.039Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"midnight-gd.com","organization":""},"issuer":{"commonName":"R10","organization":"Let's Encrypt"},"validity":{"start":"Fri, 08 Aug 2025 21:56:18 GMT","end":"Thu, 06 Nov 2025 21:56:17 GMT"},"fingerprint":{"sha1":"57:AB:C1:2A:94:4B:D1:B7:3F:B9:E2:25:D6:6C:A1:FE:87:79:5E:06","sha256":"45:20:67:6D:CB:DC:27:76:A1:38:40:DC:34:04:B4:D8:74:41:3A:A9:57:69:E6:92:F2:D4:D0:4F:FB:E3:6B:49"}}},"request":{"raw":"GET /static/logo/arculus.jpg HTTP/1.1\r\nHost: midnight-gd.com\r\nUser-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://midnight-gd.com/connect.html\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\ncache-control: public, max-age=31536000\r\nexpires: Wed, 19 Aug 2026 12:46:29 GMT\r\ncontent-type: image/jpeg\r\nlast-modified: Sat, 06 Jul 2024 19:34:48 GMT\r\naccept-ranges: bytes\r\ncontent-length: 1657\r\ndate: Tue, 19 Aug 2025 12:46:29 GMT\r\nserver: LiteSpeed\r\nx-content-type-options: nosniff\r\nx-xss-protection: 1; mode=block\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"LiteSpeed","description":"LiteSpeed is a high-scalability web server.","website":"https://litespeedtech.com","common_platform_enumeration":"cpe:2.3:a:litespeedtech:litespeed_web_server:*:*:*:*:*:*:*:*","icon":"LiteSpeed.svg","categories":["Web servers"]}],"data":{"size":1657,"size_decoded":0,"mime_type":"image/jpeg","magic":"PNG image data, 225 x 225, 8-bit colormap, non-interlaced","md5":"9cb6edaa7dd6a483341c596f704bbec9","sha1":"965e1322187935858906326534233bd96c1b5988","sha256":"bc0fc57bae0e4bbb81972e8a7a17b42589e2d55c2b160a00e07a3a3ba604b36b","sha512":"4ca5fcbcddbd0fb43371343ef6242631f6a34a21925ec258e2059363d0a97fccfe384a7b800b71ce44f138c7b27a1443c070e500df80c2794b7fc50464a05426","ssdeep":"","tlshash":"0631ca5efb344178a07939b4633d4164c43c54ee4a9a0acb578208bccf47b11e3a1a1f","first_seen":"2024-08-20T03:07:15.265834Z","last_seen":"2025-08-24T02:34:52.787848Z","times_seen":12,"resource_available":false,"data":null}},"time_used":465,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":450,"receive":15,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2025-08-19","alert":"Sinkholed","trigger":"midnight-gd.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"midnight-gd.com/static/connect-css/style.css","fqdn":"midnight-gd.com","domain":"midnight-gd.com","tld":"com"},"ip":{"addr":"192.3.141.250","port":443,"asn":36352,"as":"AS-COLOCROSSING","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://midnight-gd.com/connect.html","date":"2025-08-19T12:46:28.854Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"midnight-gd.com","organization":""},"issuer":{"commonName":"R10","organization":"Let's Encrypt"},"validity":{"start":"Fri, 08 Aug 2025 21:56:18 GMT","end":"Thu, 06 Nov 2025 21:56:17 GMT"},"fingerprint":{"sha1":"57:AB:C1:2A:94:4B:D1:B7:3F:B9:E2:25:D6:6C:A1:FE:87:79:5E:06","sha256":"45:20:67:6D:CB:DC:27:76:A1:38:40:DC:34:04:B4:D8:74:41:3A:A9:57:69:E6:92:F2:D4:D0:4F:FB:E3:6B:49"}}},"request":{"raw":"GET /static/connect-css/style.css HTTP/1.1\r\nHost: midnight-gd.com\r\nUser-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://midnight-gd.com/connect.html\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\ncache-control: public, max-age=2592000\r\nexpires: Thu, 18 Sep 2025 12:46:28 GMT\r\ncontent-type: text/css\r\nlast-modified: Wed, 23 Jul 2025 16:53:29 GMT\r\naccept-ranges: bytes\r\ncontent-encoding: br\r\nvary: Accept-Encoding\r\ncontent-length: 10870\r\ndate: Tue, 19 Aug 2025 12:46:28 GMT\r\nserver: LiteSpeed\r\nx-content-type-options: nosniff\r\nx-xss-protection: 1; mode=block\r\nalt-svc: h3=\":443\"; ma=2592000, h3-29=\":443\"; ma=2592000, h3-Q050=\":443\"; ma=2592000, h3-Q046=\":443\"; ma=2592000, h3-Q043=\":443\"; ma=2592000, quic=\":443\"; ma=2592000; v=\"43,46\"\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"LiteSpeed","description":"LiteSpeed is a high-scalability web server.","website":"https://litespeedtech.com","common_platform_enumeration":"cpe:2.3:a:litespeedtech:litespeed_web_server:*:*:*:*:*:*:*:*","icon":"LiteSpeed.svg","categories":["Web servers"]}],"data":{"size":69323,"size_decoded":0,"mime_type":"text/css","magic":"ASCII text, with CRLF line terminators","md5":"d7a9815aa6ca7e0241b6a468ff369179","sha1":"f6904ef09f134bfdd760de6ff0952b589875b93e","sha256":"4e23d75746a85889fd1cf494d40078d6d772c5d21609c8aae6fc5181e6109bfe","sha512":"2996e6cb2f47f3622460bcc21de3fac2f68734f3637a4fb492ed6141e0bd77d92e61ad76de2bf51924851377e49cc2573d9af1fb6455a2148b00ff868aa5c62e","ssdeep":"384:wMCyqhHjaCpxsBTa+S2i5VJpFsiyLwNpXxoNihv5s9zTIcUntt/SGWUYb+eM:wBjlpH5voAXF","tlshash":"e163966ccd8211432237cb3463e15635fa7444638e0226ad7ece65458ff35bca269fae","first_seen":"2025-08-18T11:46:15.45184Z","last_seen":"2025-08-19T12:46:52.398901Z","times_seen":2,"resource_available":false,"data":null}},"time_used":220,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":109,"receive":111,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2025-08-19","alert":"Sinkholed","trigger":"midnight-gd.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"midnight-gd.com/static/logo/celo_wallet.jpg","fqdn":"midnight-gd.com","domain":"midnight-gd.com","tld":"com"},"ip":{"addr":"192.3.141.250","port":443,"asn":36352,"as":"AS-COLOCROSSING","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://midnight-gd.com/connect.html","date":"2025-08-19T12:46:28.947Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"midnight-gd.com","organization":""},"issuer":{"commonName":"R10","organization":"Let's Encrypt"},"validity":{"start":"Fri, 08 Aug 2025 21:56:18 GMT","end":"Thu, 06 Nov 2025 21:56:17 GMT"},"fingerprint":{"sha1":"57:AB:C1:2A:94:4B:D1:B7:3F:B9:E2:25:D6:6C:A1:FE:87:79:5E:06","sha256":"45:20:67:6D:CB:DC:27:76:A1:38:40:DC:34:04:B4:D8:74:41:3A:A9:57:69:E6:92:F2:D4:D0:4F:FB:E3:6B:49"}}},"request":{"raw":"GET /static/logo/celo_wallet.jpg HTTP/1.1\r\nHost: midnight-gd.com\r\nUser-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://midnight-gd.com/connect.html\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\ncache-control: public, max-age=31536000\r\nexpires: Wed, 19 Aug 2026 12:46:28 GMT\r\ncontent-type: image/jpeg\r\nlast-modified: Wed, 30 Aug 2023 02:32:10 GMT\r\naccept-ranges: bytes\r\ncontent-length: 9324\r\ndate: Tue, 19 Aug 2025 12:46:28 GMT\r\nserver: LiteSpeed\r\nx-content-type-options: nosniff\r\nx-xss-protection: 1; mode=block\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"LiteSpeed","description":"LiteSpeed is a high-scalability web server.","website":"https://litespeedtech.com","common_platform_enumeration":"cpe:2.3:a:litespeedtech:litespeed_web_server:*:*:*:*:*:*:*:*","icon":"LiteSpeed.svg","categories":["Web servers"]}],"data":{"size":9324,"size_decoded":0,"mime_type":"image/jpeg","magic":"JPEG image data, baseline, precision 8, 400x400, components 3","md5":"ee24937d0fd4a42ccb2e5703b6e37859","sha1":"8609f00b7eb2d79e25c171cd1a36ca584b9a9d01","sha256":"6f726bd08ff78133042fef503af0929c63f136737cb6af3a5cb02e2682bdcbb4","sha512":"6302ddf1c5ef25b329040a809ac1e864200827d54453937b7d9ba26bec170bfea4db8586f97f825419aff07df1ff6e2754f1b5f26d1a03937155274d10890353","ssdeep":"192:kG89vyOrFZwkel7g6ZR0Upi4VnBqsLZqbjM2TbaPm+k336bMEDsI:18lzwk67gkKZ2BXZcjM2TGPo3KbJn","tlshash":"65129e91b2928938d574cbb39c9a4c47229cfdc0b018ee8ddeb1143a0b5a7503db6f88","first_seen":"2023-05-09T01:47:42Z","last_seen":"2026-06-25T01:06:10.363014Z","times_seen":236,"resource_available":false,"data":null}},"time_used":443,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":438,"receive":5,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2025-08-19","alert":"Sinkholed","trigger":"midnight-gd.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":[{"sensor_name":"urlquery","alert":"Phishing - Generic Crypto/Wallet","verdict":"phishing","severity":"medium","comment":"Asset commenly seen with Generic Crypto/Wallet phishing","tags":["crypto","phishing"],"meta":null}]}},{"url":{"schema":"https","addr":"midnight-gd.com/static/logo/valora.jpg","fqdn":"midnight-gd.com","domain":"midnight-gd.com","tld":"com"},"ip":{"addr":"192.3.141.250","port":443,"asn":36352,"as":"AS-COLOCROSSING","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://midnight-gd.com/connect.html","date":"2025-08-19T12:46:28.949Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"midnight-gd.com","organization":""},"issuer":{"commonName":"R10","organization":"Let's Encrypt"},"validity":{"start":"Fri, 08 Aug 2025 21:56:18 GMT","end":"Thu, 06 Nov 2025 21:56:17 GMT"},"fingerprint":{"sha1":"57:AB:C1:2A:94:4B:D1:B7:3F:B9:E2:25:D6:6C:A1:FE:87:79:5E:06","sha256":"45:20:67:6D:CB:DC:27:76:A1:38:40:DC:34:04:B4:D8:74:41:3A:A9:57:69:E6:92:F2:D4:D0:4F:FB:E3:6B:49"}}},"request":{"raw":"GET /static/logo/valora.jpg HTTP/1.1\r\nHost: midnight-gd.com\r\nUser-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://midnight-gd.com/connect.html\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\ncache-control: public, max-age=31536000\r\nexpires: Wed, 19 Aug 2026 12:46:28 GMT\r\ncontent-type: image/jpeg\r\nlast-modified: Wed, 30 Aug 2023 02:32:10 GMT\r\naccept-ranges: bytes\r\ncontent-length: 10609\r\ndate: Tue, 19 Aug 2025 12:46:28 GMT\r\nserver: LiteSpeed\r\nx-content-type-options: nosniff\r\nx-xss-protection: 1; mode=block\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"LiteSpeed","description":"LiteSpeed is a high-scalability web server.","website":"https://litespeedtech.com","common_platform_enumeration":"cpe:2.3:a:litespeedtech:litespeed_web_server:*:*:*:*:*:*:*:*","icon":"LiteSpeed.svg","categories":["Web servers"]}],"data":{"size":10609,"size_decoded":0,"mime_type":"image/jpeg","magic":"JPEG image data, baseline, precision 8, 400x400, components 3","md5":"c57a301ca7c3047d549f5209e6d8c95d","sha1":"7e6f2b7c04b84d37d12183894921faeea878f29d","sha256":"b23c73a3e1ed446e7cbd862b49c352aa3a4a0e0dc6d67e7a2da52f981a93d304","sha512":"c97a18d8124a8348d03e9e77751139dfdba339f986d88fa60b88a3171dfb6fa88d9f339d7601be88377edf541b15ab6067e47b8dc7e2c7ffd002b879b2283517","ssdeep":"192:NfDC6AKMlx330763Xu2/niiN2QSy0lbupc7WLCGlOhvxg7qdL/rpXe:Nf26qY6O2645m7GC1hvx6ML/rU","tlshash":"ce229f6afb809512e9a7ef73d01b628f9beee076582742cd14a2301719c40a12fd5947","first_seen":"2023-05-09T01:47:42Z","last_seen":"2026-06-25T01:06:10.203778Z","times_seen":235,"resource_available":false,"data":null}},"time_used":446,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":441,"receive":5,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2025-08-19","alert":"Sinkholed","trigger":"midnight-gd.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":[{"sensor_name":"urlquery","alert":"Phishing - Generic Crypto/Wallet","verdict":"phishing","severity":"medium","comment":"Asset commenly seen with Generic Crypto/Wallet phishing","tags":["crypto","phishing"],"meta":null}]}},{"url":{"schema":"https","addr":"midnight-gd.com/static/logo/midas_wallet.jpg","fqdn":"midnight-gd.com","domain":"midnight-gd.com","tld":"com"},"ip":{"addr":"192.3.141.250","port":443,"asn":36352,"as":"AS-COLOCROSSING","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://midnight-gd.com/connect.html","date":"2025-08-19T12:46:29.023Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"midnight-gd.com","organization":""},"issuer":{"commonName":"R10","organization":"Let's Encrypt"},"validity":{"start":"Fri, 08 Aug 2025 21:56:18 GMT","end":"Thu, 06 Nov 2025 21:56:17 GMT"},"fingerprint":{"sha1":"57:AB:C1:2A:94:4B:D1:B7:3F:B9:E2:25:D6:6C:A1:FE:87:79:5E:06","sha256":"45:20:67:6D:CB:DC:27:76:A1:38:40:DC:34:04:B4:D8:74:41:3A:A9:57:69:E6:92:F2:D4:D0:4F:FB:E3:6B:49"}}},"request":{"raw":"GET /static/logo/midas_wallet.jpg HTTP/1.1\r\nHost: midnight-gd.com\r\nUser-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://midnight-gd.com/connect.html\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\ncache-control: public, max-age=31536000\r\nexpires: Wed, 19 Aug 2026 12:46:28 GMT\r\ncontent-type: image/jpeg\r\nlast-modified: Wed, 30 Aug 2023 02:32:10 GMT\r\naccept-ranges: bytes\r\ncontent-length: 13710\r\ndate: Tue, 19 Aug 2025 12:46:28 GMT\r\nserver: LiteSpeed\r\nx-content-type-options: nosniff\r\nx-xss-protection: 1; mode=block\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"LiteSpeed","description":"LiteSpeed is a high-scalability web server.","website":"https://litespeedtech.com","common_platform_enumeration":"cpe:2.3:a:litespeedtech:litespeed_web_server:*:*:*:*:*:*:*:*","icon":"LiteSpeed.svg","categories":["Web servers"]}],"data":{"size":13710,"size_decoded":0,"mime_type":"image/jpeg","magic":"JPEG image data, baseline, precision 8, 400x352, components 3","md5":"4440d86c7acad101dee957c63301559a","sha1":"fdefd83f9815393ccad764cc611ba2e6bd9eadae","sha256":"e37965ee219a033ebf6e6957e008b212d56bf60e8ba9cbe64760cbfa15460c2c","sha512":"bcd988aa24c9c52edffb8b34c735596e22ce9ec5035d0601429ce583a2d8bea1f770b4b1f095cb9b3aa4f12d0a9683db9cea7b9fb5bff51be68f05f20c3170e7","ssdeep":"384:xxqNzgedRIpUPkx568Q2zml9C5BmGc6hMMWHHDF:bqNzgWhMsX2il6BruHDF","tlshash":"88525ba8f09f97049d81db3b53272930462bb4a9ef6605de8d33677134ae900e9f4f60","first_seen":"2023-05-01T21:31:16Z","last_seen":"2026-07-21T05:16:19.660144Z","times_seen":711,"resource_available":false,"data":null}},"time_used":460,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":457,"receive":3,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2025-08-19","alert":"Sinkholed","trigger":"midnight-gd.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":[{"sensor_name":"urlquery","alert":"Phishing - Generic Crypto/Wallet","verdict":"phishing","severity":"medium","comment":"Asset commenly seen with Generic Crypto/Wallet phishing","tags":["crypto","phishing"],"meta":null}]}},{"url":{"schema":"https","addr":"midnight-gd.com/static/logo/enjin.jpg","fqdn":"midnight-gd.com","domain":"midnight-gd.com","tld":"com"},"ip":{"addr":"192.3.141.250","port":443,"asn":36352,"as":"AS-COLOCROSSING","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://midnight-gd.com/connect.html","date":"2025-08-19T12:46:29.026Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"midnight-gd.com","organization":""},"issuer":{"commonName":"R10","organization":"Let's Encrypt"},"validity":{"start":"Fri, 08 Aug 2025 21:56:18 GMT","end":"Thu, 06 Nov 2025 21:56:17 GMT"},"fingerprint":{"sha1":"57:AB:C1:2A:94:4B:D1:B7:3F:B9:E2:25:D6:6C:A1:FE:87:79:5E:06","sha256":"45:20:67:6D:CB:DC:27:76:A1:38:40:DC:34:04:B4:D8:74:41:3A:A9:57:69:E6:92:F2:D4:D0:4F:FB:E3:6B:49"}}},"request":{"raw":"GET /static/logo/enjin.jpg HTTP/1.1\r\nHost: midnight-gd.com\r\nUser-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://midnight-gd.com/connect.html\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\ncache-control: public, max-age=31536000\r\nexpires: Wed, 19 Aug 2026 12:46:28 GMT\r\ncontent-type: image/jpeg\r\nlast-modified: Sat, 06 Jul 2024 19:34:48 GMT\r\naccept-ranges: bytes\r\ncontent-length: 3619\r\ndate: Tue, 19 Aug 2025 12:46:28 GMT\r\nserver: LiteSpeed\r\nx-content-type-options: nosniff\r\nx-xss-protection: 1; mode=block\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"LiteSpeed","description":"LiteSpeed is a high-scalability web server.","website":"https://litespeedtech.com","common_platform_enumeration":"cpe:2.3:a:litespeedtech:litespeed_web_server:*:*:*:*:*:*:*:*","icon":"LiteSpeed.svg","categories":["Web servers"]}],"data":{"size":3619,"size_decoded":0,"mime_type":"image/jpeg","magic":"JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, baseline, precision 8, 100x100, components 3","md5":"739211380cf4b15c58129f5070f72dda","sha1":"76ccd6356a654a71bd5f3c7d420aad93d356bcb8","sha256":"4ea3f09554c02709560c534775e2b766ac2680b5991e95affff26668ced48ef3","sha512":"76bd0cc5f4e840da040c7e111573dfa34342df0083a9836eb3e0697cbb1a84bf0e042f84a88e70580a0bcc491599bbba8683d13e75b93f6deedecae4809ef94d","ssdeep":"","tlshash":"72714d8b47583129dfcbba3d75947790f42a1cb22494e68f216022e527e7930ce587c8","first_seen":"2024-08-20T03:07:15.300708Z","last_seen":"2025-08-24T02:34:52.851125Z","times_seen":12,"resource_available":false,"data":null}},"time_used":168,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":162,"receive":6,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2025-08-19","alert":"Sinkholed","trigger":"midnight-gd.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"midnight-gd.com/static/logo/token_pocket.jpg","fqdn":"midnight-gd.com","domain":"midnight-gd.com","tld":"com"},"ip":{"addr":"192.3.141.250","port":443,"asn":36352,"as":"AS-COLOCROSSING","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://midnight-gd.com/connect.html","date":"2025-08-19T12:46:28.924Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"midnight-gd.com","organization":""},"issuer":{"commonName":"R10","organization":"Let's Encrypt"},"validity":{"start":"Fri, 08 Aug 2025 21:56:18 GMT","end":"Thu, 06 Nov 2025 21:56:17 GMT"},"fingerprint":{"sha1":"57:AB:C1:2A:94:4B:D1:B7:3F:B9:E2:25:D6:6C:A1:FE:87:79:5E:06","sha256":"45:20:67:6D:CB:DC:27:76:A1:38:40:DC:34:04:B4:D8:74:41:3A:A9:57:69:E6:92:F2:D4:D0:4F:FB:E3:6B:49"}}},"request":{"raw":"GET /static/logo/token_pocket.jpg HTTP/1.1\r\nHost: midnight-gd.com\r\nUser-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://midnight-gd.com/connect.html\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\ncache-control: public, max-age=31536000\r\nexpires: Wed, 19 Aug 2026 12:46:28 GMT\r\ncontent-type: image/jpeg\r\nlast-modified: Wed, 30 Aug 2023 02:32:10 GMT\r\naccept-ranges: bytes\r\ncontent-length: 6087\r\ndate: Tue, 19 Aug 2025 12:46:28 GMT\r\nserver: LiteSpeed\r\nx-content-type-options: nosniff\r\nx-xss-protection: 1; mode=block\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"LiteSpeed","description":"LiteSpeed is a high-scalability web server.","website":"https://litespeedtech.com","common_platform_enumeration":"cpe:2.3:a:litespeedtech:litespeed_web_server:*:*:*:*:*:*:*:*","icon":"LiteSpeed.svg","categories":["Web servers"]}],"data":{"size":6087,"size_decoded":0,"mime_type":"image/jpeg","magic":"JPEG image data, baseline, precision 8, 400x400, components 3","md5":"0243d07353ca763d43281cfdfa2f07a7","sha1":"e3d6c6c00d8eb3932a9d4c99226fb04c4f53275e","sha256":"6e449e2d7c14d33985572a5bda124b89e5bb76aac56ed94f5c31678248b24309","sha512":"525abede557dac3100d34bb5a24f05e12de4007b63d0879db4703a9198d92fee4150536f0ee04d5810446977c7dbf61883a7ceb035854d62c9b14283a5b1d068","ssdeep":"96:vAkJ3viYLSpjkFgZe9sTOPCaGjW6GXVnCPOjkCdIs8Nk6k6kIv:vt3aYZuQ+gCaQ5upCEkC6LNlljv","tlshash":"dac139c378226323c81efa3cb4a20511ef216d5fe018bdce18209a7e43cea74a427601","first_seen":"2023-05-01T21:31:16Z","last_seen":"2026-07-15T15:42:59.01566Z","times_seen":471,"resource_available":false,"data":null}},"time_used":369,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":362,"receive":7,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2025-08-19","alert":"Sinkholed","trigger":"midnight-gd.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":[{"sensor_name":"urlquery","alert":"Phishing - Generic Crypto/Wallet","verdict":"phishing","severity":"medium","comment":"Asset commenly seen with Generic Crypto/Wallet phishing","tags":["crypto","phishing"],"meta":null}]}},{"url":{"schema":"https","addr":"midnight-gd.com/static/logo/compound.jpg","fqdn":"midnight-gd.com","domain":"midnight-gd.com","tld":"com"},"ip":{"addr":"192.3.141.250","port":443,"asn":36352,"as":"AS-COLOCROSSING","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://midnight-gd.com/connect.html","date":"2025-08-19T12:46:28.919Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"midnight-gd.com","organization":""},"issuer":{"commonName":"R10","organization":"Let's Encrypt"},"validity":{"start":"Fri, 08 Aug 2025 21:56:18 GMT","end":"Thu, 06 Nov 2025 21:56:17 GMT"},"fingerprint":{"sha1":"57:AB:C1:2A:94:4B:D1:B7:3F:B9:E2:25:D6:6C:A1:FE:87:79:5E:06","sha256":"45:20:67:6D:CB:DC:27:76:A1:38:40:DC:34:04:B4:D8:74:41:3A:A9:57:69:E6:92:F2:D4:D0:4F:FB:E3:6B:49"}}},"request":{"raw":"GET /static/logo/compound.jpg HTTP/1.1\r\nHost: midnight-gd.com\r\nUser-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://midnight-gd.com/connect.html\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\ncache-control: public, max-age=31536000\r\nexpires: Wed, 19 Aug 2026 12:46:28 GMT\r\ncontent-type: image/jpeg\r\nlast-modified: Wed, 30 Aug 2023 02:32:10 GMT\r\naccept-ranges: bytes\r\ncontent-length: 4481\r\ndate: Tue, 19 Aug 2025 12:46:28 GMT\r\nserver: LiteSpeed\r\nx-content-type-options: nosniff\r\nx-xss-protection: 1; mode=block\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"LiteSpeed","description":"LiteSpeed is a high-scalability web server.","website":"https://litespeedtech.com","common_platform_enumeration":"cpe:2.3:a:litespeedtech:litespeed_web_server:*:*:*:*:*:*:*:*","icon":"LiteSpeed.svg","categories":["Web servers"]}],"data":{"size":4481,"size_decoded":0,"mime_type":"image/jpeg","magic":"JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, baseline, precision 8, 225x225, components 3","md5":"23ff239ad1d464afc2ad1dbb20868b4b","sha1":"678a65bca79857f84e9e57f5d026c8d82c46f043","sha256":"3d123029f25bd3d57d65da1e43dad34fecbfa434200be816cff84d8fb8cd392f","sha512":"b6fe985b76dac6dbd179b0a810a9768e93774270296d32cd594cd4399eab4ea4941a3de89e54c37257e74902fdc566203957e18b170595547e756a1f83fcc9a7","ssdeep":"96:sbTEzfVbc1rEe020Ho9p9rJ7LG0lvrU7XsB82jWCIk7Rq:aEzfK14e0qnlJdlvrUbs+Aw","tlshash":"f6916da22ff02452d6b27d3884b70f0e18fb275785fe8e11d39ad559e36e61c0c0d685","first_seen":"2023-05-18T08:37:01Z","last_seen":"2026-06-25T01:06:10.283611Z","times_seen":197,"resource_available":false,"data":null}},"time_used":326,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":322,"receive":4,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2025-08-19","alert":"Sinkholed","trigger":"midnight-gd.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":[{"sensor_name":"urlquery","alert":"Phishing - Generic Crypto/Wallet","verdict":"phishing","severity":"medium","comment":"Asset commenly seen with Generic Crypto/Wallet phishing","tags":["crypto","phishing"],"meta":null}]}},{"url":{"schema":"https","addr":"midnight-gd.com/static/logo/imtoken.jpg","fqdn":"midnight-gd.com","domain":"midnight-gd.com","tld":"com"},"ip":{"addr":"192.3.141.250","port":443,"asn":36352,"as":"AS-COLOCROSSING","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://midnight-gd.com/connect.html","date":"2025-08-19T12:46:29.024Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"midnight-gd.com","organization":""},"issuer":{"commonName":"R10","organization":"Let's Encrypt"},"validity":{"start":"Fri, 08 Aug 2025 21:56:18 GMT","end":"Thu, 06 Nov 2025 21:56:17 GMT"},"fingerprint":{"sha1":"57:AB:C1:2A:94:4B:D1:B7:3F:B9:E2:25:D6:6C:A1:FE:87:79:5E:06","sha256":"45:20:67:6D:CB:DC:27:76:A1:38:40:DC:34:04:B4:D8:74:41:3A:A9:57:69:E6:92:F2:D4:D0:4F:FB:E3:6B:49"}}},"request":{"raw":"GET /static/logo/imtoken.jpg HTTP/1.1\r\nHost: midnight-gd.com\r\nUser-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://midnight-gd.com/connect.html\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\ncache-control: public, max-age=31536000\r\nexpires: Wed, 19 Aug 2026 12:46:28 GMT\r\ncontent-type: image/jpeg\r\nlast-modified: Wed, 30 Aug 2023 02:32:10 GMT\r\naccept-ranges: bytes\r\ncontent-length: 7423\r\ndate: Tue, 19 Aug 2025 12:46:28 GMT\r\nserver: LiteSpeed\r\nx-content-type-options: nosniff\r\nx-xss-protection: 1; mode=block\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"LiteSpeed","description":"LiteSpeed is a high-scalability web server.","website":"https://litespeedtech.com","common_platform_enumeration":"cpe:2.3:a:litespeedtech:litespeed_web_server:*:*:*:*:*:*:*:*","icon":"LiteSpeed.svg","categories":["Web servers"]}],"data":{"size":7423,"size_decoded":0,"mime_type":"image/jpeg","magic":"JPEG image data, baseline, precision 8, 400x400, components 3","md5":"e178ae94e21e6f38e4ee29a0778822e1","sha1":"1a1ce5a9bb337522c7e67a8761c2ea6bbf79a652","sha256":"b2b3f3d4557f701560a3d6039a5c6401d05fe9dec68c71a0ba699606b565f5df","sha512":"2d52db69f05b7628b36b037f8e2c89a49b7c136dc2350bf45d935eec03f23c3d00f5f23359e8750ae13d59fa10b80bcf66edbd2981b8c70af0122c06a5a7e800","ssdeep":"192:oRKLceCfVl2dCb6Y8lrZEKWN0e+11+sFYEKqYeoYT:Tcj2d9SpiA+KqDT","tlshash":"f8e18e497d952b39c281e37815f84b636b6f49a7b278916ef70570880124eb24b4304e","first_seen":"2023-04-30T19:28:18Z","last_seen":"2026-07-23T15:04:36.501673Z","times_seen":748,"resource_available":false,"data":null}},"time_used":461,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":458,"receive":3,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2025-08-19","alert":"Sinkholed","trigger":"midnight-gd.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":[{"sensor_name":"urlquery","alert":"Phishing - Generic Crypto/Wallet","verdict":"phishing","severity":"medium","comment":"Asset commenly seen with Generic Crypto/Wallet phishing","tags":["crypto","phishing"],"meta":null}]}},{"url":{"schema":"https","addr":"midnight-gd.com/static/connect-css/animate.css","fqdn":"midnight-gd.com","domain":"midnight-gd.com","tld":"com"},"ip":{"addr":"192.3.141.250","port":443,"asn":36352,"as":"AS-COLOCROSSING","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://midnight-gd.com/connect.html","date":"2025-08-19T12:46:29.133Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"midnight-gd.com","organization":""},"issuer":{"commonName":"R10","organization":"Let's Encrypt"},"validity":{"start":"Fri, 08 Aug 2025 21:56:18 GMT","end":"Thu, 06 Nov 2025 21:56:17 GMT"},"fingerprint":{"sha1":"57:AB:C1:2A:94:4B:D1:B7:3F:B9:E2:25:D6:6C:A1:FE:87:79:5E:06","sha256":"45:20:67:6D:CB:DC:27:76:A1:38:40:DC:34:04:B4:D8:74:41:3A:A9:57:69:E6:92:F2:D4:D0:4F:FB:E3:6B:49"}}},"request":{"raw":"GET /static/connect-css/animate.css HTTP/1.1\r\nHost: midnight-gd.com\r\nUser-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://midnight-gd.com/static/connect-css/style.css\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\ncache-control: public, max-age=2592000\r\nexpires: Thu, 18 Sep 2025 12:46:29 GMT\r\ncontent-type: text/css\r\nlast-modified: Wed, 30 Aug 2023 02:32:10 GMT\r\naccept-ranges: bytes\r\ncontent-encoding: br\r\nvary: Accept-Encoding\r\ncontent-length: 3032\r\ndate: Tue, 19 Aug 2025 12:46:29 GMT\r\nserver: LiteSpeed\r\nx-content-type-options: nosniff\r\nx-xss-protection: 1; mode=block\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"LiteSpeed","description":"LiteSpeed is a high-scalability web server.","website":"https://litespeedtech.com","common_platform_enumeration":"cpe:2.3:a:litespeedtech:litespeed_web_server:*:*:*:*:*:*:*:*","icon":"LiteSpeed.svg","categories":["Web servers"]}],"data":{"size":27785,"size_decoded":0,"mime_type":"text/css","magic":"ASCII text, with CRLF line terminators","md5":"47ad56e855fedf7bf2c4e2a43dcd08bc","sha1":"c09e4221858342606161462e9496c79c52f40926","sha256":"d82f5b458ef0a72af4524baa831b4e81df665e92ed01bcdf397ad81c8d7d7b41","sha512":"b6a3ae9d13b478b92d651ab7bda364ed737a2b96d2c4ebf482245681eb9afd3d6f0e20713e83bb73c5fb22576314bd660038360994aeb7643d9beed5751c1491","ssdeep":"192:uNavX0fZdAXf4j3GQ20de0te8H9nlNApz81cV+DVa/ndCJZZPd3WKmj4CYPyNpul:uff4qGclQsFtdk0j3qOkk","tlshash":"e1c248492d41144487b24779d7eb8f1cef2a54771c230abeb3c1058b5fa46b8638ee8b","first_seen":"2023-05-06T12:41:05Z","last_seen":"2026-07-27T10:26:52.845234Z","times_seen":318,"resource_available":false,"data":null}},"time_used":122,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":121,"receive":1,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2025-08-19","alert":"Sinkholed","trigger":"midnight-gd.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"midnight-gd.com/stackpath.bootstrapcdn.com/bootstrap/4.5.2/js/bootstrap.min.js","fqdn":"midnight-gd.com","domain":"midnight-gd.com","tld":"com"},"ip":{"addr":"192.3.141.250","port":443,"asn":36352,"as":"AS-COLOCROSSING","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://midnight-gd.com/connect.html","date":"2025-08-19T12:46:28.878Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"midnight-gd.com","organization":""},"issuer":{"commonName":"R10","organization":"Let's Encrypt"},"validity":{"start":"Fri, 08 Aug 2025 21:56:18 GMT","end":"Thu, 06 Nov 2025 21:56:17 GMT"},"fingerprint":{"sha1":"57:AB:C1:2A:94:4B:D1:B7:3F:B9:E2:25:D6:6C:A1:FE:87:79:5E:06","sha256":"45:20:67:6D:CB:DC:27:76:A1:38:40:DC:34:04:B4:D8:74:41:3A:A9:57:69:E6:92:F2:D4:D0:4F:FB:E3:6B:49"}}},"request":{"raw":"GET /stackpath.bootstrapcdn.com/bootstrap/4.5.2/js/bootstrap.min.js HTTP/1.1\r\nHost: midnight-gd.com\r\nUser-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://midnight-gd.com/connect.html\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\ncache-control: public, max-age=2592000\r\nexpires: Thu, 18 Sep 2025 12:46:28 GMT\r\ncontent-type: text/javascript\r\nlast-modified: Tue, 26 Jan 2021 03:04:10 GMT\r\naccept-ranges: bytes\r\ncontent-encoding: br\r\nvary: Accept-Encoding\r\ncontent-length: 14195\r\ndate: Tue, 19 Aug 2025 12:46:28 GMT\r\nserver: LiteSpeed\r\nx-content-type-options: nosniff\r\nx-xss-protection: 1; mode=block\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"LiteSpeed","description":"LiteSpeed is a high-scalability web server.","website":"https://litespeedtech.com","common_platform_enumeration":"cpe:2.3:a:litespeedtech:litespeed_web_server:*:*:*:*:*:*:*:*","icon":"LiteSpeed.svg","categories":["Web servers"]}],"data":{"size":60044,"size_decoded":0,"mime_type":"text/javascript","magic":"JavaScript source, ASCII text, with very long lines (59765)","md5":"02d223393e00c273efdcb1ade8f4f8b1","sha1":"0cc93b8421d89c24a889642428b363cb831de78a","sha256":"79c599dd760cec0c1621a1af49d9a2a49da5d45e1b37d4575bace0a5e0226582","sha512":"339296df3b6e2080a65488634aa5ded35a15d9ba5edb8f203b1aa695c62b13302fc2cecfc37cfa04ad2219baf0bddad4414862dde5e0b71a7923c3c3a3d61f8d","ssdeep":"768:wfAnnayQIk8HVheIE8Dg76TXQI4vPKMEK6viTlCDFm4n6xOp6Pxg3/wCVaAk2:wfUnTcWCw6xJxg7aAz","tlshash":"0343a54a7254787206df747a817b060bb3366c99a50a816cb8699ced2f7cd483277f3c","first_seen":"2023-03-07T01:06:50Z","last_seen":"2026-08-04T17:05:17.049693Z","times_seen":14809,"resource_available":true,"data":null}},"time_used":232,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":140,"receive":92,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2025-08-19","alert":"Sinkholed","trigger":"midnight-gd.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"midnight-gd.com/static/logo/o3_wallet.jpg","fqdn":"midnight-gd.com","domain":"midnight-gd.com","tld":"com"},"ip":{"addr":"192.3.141.250","port":443,"asn":36352,"as":"AS-COLOCROSSING","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://midnight-gd.com/connect.html","date":"2025-08-19T12:46:28.994Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"midnight-gd.com","organization":""},"issuer":{"commonName":"R10","organization":"Let's Encrypt"},"validity":{"start":"Fri, 08 Aug 2025 21:56:18 GMT","end":"Thu, 06 Nov 2025 21:56:17 GMT"},"fingerprint":{"sha1":"57:AB:C1:2A:94:4B:D1:B7:3F:B9:E2:25:D6:6C:A1:FE:87:79:5E:06","sha256":"45:20:67:6D:CB:DC:27:76:A1:38:40:DC:34:04:B4:D8:74:41:3A:A9:57:69:E6:92:F2:D4:D0:4F:FB:E3:6B:49"}}},"request":{"raw":"GET /static/logo/o3_wallet.jpg HTTP/1.1\r\nHost: midnight-gd.com\r\nUser-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://midnight-gd.com/connect.html\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\ncache-control: public, max-age=31536000\r\nexpires: Wed, 19 Aug 2026 12:46:28 GMT\r\ncontent-type: image/jpeg\r\nlast-modified: Wed, 30 Aug 2023 02:32:10 GMT\r\naccept-ranges: bytes\r\ncontent-length: 9058\r\ndate: Tue, 19 Aug 2025 12:46:28 GMT\r\nserver: LiteSpeed\r\nx-content-type-options: nosniff\r\nx-xss-protection: 1; mode=block\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"LiteSpeed","description":"LiteSpeed is a high-scalability web server.","website":"https://litespeedtech.com","common_platform_enumeration":"cpe:2.3:a:litespeedtech:litespeed_web_server:*:*:*:*:*:*:*:*","icon":"LiteSpeed.svg","categories":["Web servers"]}],"data":{"size":9058,"size_decoded":0,"mime_type":"image/jpeg","magic":"JPEG image data, baseline, precision 8, 400x400, components 3","md5":"c68bcc627461911030befc3d290f7342","sha1":"58e37e3584323f974b8c07f30c5dc1ae2e21b4ac","sha256":"9692fb2e6ea236083a898403714cbacf006d60f62b21a470d0bf99a96f8937ed","sha512":"9dffd9e3d409fad8538925609fd6d881a1c72df7428660d589049abb116b8f4eae58a005b4d4aa36993af97412461d477fcd7c00f2e123314e2e43f89227a04b","ssdeep":"192:0eFOTveSn/SJzoiCKNzr0d0joeSOrWefrynMBtHS3:0j2Sn/aUoprS4oeSJfMBtHQ","tlshash":"8b129f47ba444d87c863effc40516cf36a5626e95a37629e390a01ef1ff8d0a9a03155","first_seen":"2023-05-01T21:31:16Z","last_seen":"2026-07-14T20:14:06.7421Z","times_seen":574,"resource_available":false,"data":null}},"time_used":452,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":449,"receive":3,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2025-08-19","alert":"Sinkholed","trigger":"midnight-gd.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":[{"sensor_name":"urlquery","alert":"Phishing - Generic Crypto/Wallet","verdict":"phishing","severity":"medium","comment":"Asset commenly seen with Generic Crypto/Wallet phishing","tags":["crypto","phishing"],"meta":null}]}},{"url":{"schema":"https","addr":"midnight-gd.com/static/logo/tradestation.jpg","fqdn":"midnight-gd.com","domain":"midnight-gd.com","tld":"com"},"ip":{"addr":"192.3.141.250","port":443,"asn":36352,"as":"AS-COLOCROSSING","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://midnight-gd.com/connect.html","date":"2025-08-19T12:46:29.031Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"midnight-gd.com","organization":""},"issuer":{"commonName":"R10","organization":"Let's Encrypt"},"validity":{"start":"Fri, 08 Aug 2025 21:56:18 GMT","end":"Thu, 06 Nov 2025 21:56:17 GMT"},"fingerprint":{"sha1":"57:AB:C1:2A:94:4B:D1:B7:3F:B9:E2:25:D6:6C:A1:FE:87:79:5E:06","sha256":"45:20:67:6D:CB:DC:27:76:A1:38:40:DC:34:04:B4:D8:74:41:3A:A9:57:69:E6:92:F2:D4:D0:4F:FB:E3:6B:49"}}},"request":{"raw":"GET /static/logo/tradestation.jpg HTTP/1.1\r\nHost: midnight-gd.com\r\nUser-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://midnight-gd.com/connect.html\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\ncache-control: public, max-age=31536000\r\nexpires: Wed, 19 Aug 2026 12:46:29 GMT\r\ncontent-type: image/jpeg\r\nlast-modified: Sat, 06 Jul 2024 19:34:48 GMT\r\naccept-ranges: bytes\r\ncontent-length: 1179\r\ndate: Tue, 19 Aug 2025 12:46:29 GMT\r\nserver: LiteSpeed\r\nx-content-type-options: nosniff\r\nx-xss-protection: 1; mode=block\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"LiteSpeed","description":"LiteSpeed is a high-scalability web server.","website":"https://litespeedtech.com","common_platform_enumeration":"cpe:2.3:a:litespeedtech:litespeed_web_server:*:*:*:*:*:*:*:*","icon":"LiteSpeed.svg","categories":["Web servers"]}],"data":{"size":1179,"size_decoded":0,"mime_type":"image/jpeg","magic":"PNG image data, 100 x 100, 8-bit colormap, non-interlaced","md5":"03765ed713562960496b628dcee0be88","sha1":"64b8bb9eecb5f5f82885112ebac06dae9b4c9c31","sha256":"9f843c47ca9b01c1d38df841fc4d28f8848cd8ac986fc45f195308687cd8bda5","sha512":"26f4804363624dd53897a6cc28741db5cc5e63a3e5fed3189d9c81ae7e63b87bd182dc27d0413b023cb5a8efb351e88f46cdc09629ee62373818a9c1fac52232","ssdeep":"","tlshash":"4c21d752e44aa70da9dc672f116bce3d6972d13086f3d2225809aeb0c4f5e44ccdb05d","first_seen":"2024-08-20T03:07:15.304031Z","last_seen":"2025-08-24T02:34:52.846621Z","times_seen":12,"resource_available":false,"data":null}},"time_used":457,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":456,"receive":1,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2025-08-19","alert":"Sinkholed","trigger":"midnight-gd.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"midnight-gd.com/static/logo/ellipal.jpg","fqdn":"midnight-gd.com","domain":"midnight-gd.com","tld":"com"},"ip":{"addr":"192.3.141.250","port":443,"asn":36352,"as":"AS-COLOCROSSING","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://midnight-gd.com/connect.html","date":"2025-08-19T12:46:29.034Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"midnight-gd.com","organization":""},"issuer":{"commonName":"R10","organization":"Let's Encrypt"},"validity":{"start":"Fri, 08 Aug 2025 21:56:18 GMT","end":"Thu, 06 Nov 2025 21:56:17 GMT"},"fingerprint":{"sha1":"57:AB:C1:2A:94:4B:D1:B7:3F:B9:E2:25:D6:6C:A1:FE:87:79:5E:06","sha256":"45:20:67:6D:CB:DC:27:76:A1:38:40:DC:34:04:B4:D8:74:41:3A:A9:57:69:E6:92:F2:D4:D0:4F:FB:E3:6B:49"}}},"request":{"raw":"GET /static/logo/ellipal.jpg HTTP/1.1\r\nHost: midnight-gd.com\r\nUser-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://midnight-gd.com/connect.html\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\ncache-control: public, max-age=31536000\r\nexpires: Wed, 19 Aug 2026 12:46:29 GMT\r\ncontent-type: image/jpeg\r\nlast-modified: Sat, 06 Jul 2024 19:34:48 GMT\r\naccept-ranges: bytes\r\ncontent-length: 3457\r\ndate: Tue, 19 Aug 2025 12:46:29 GMT\r\nserver: LiteSpeed\r\nx-content-type-options: nosniff\r\nx-xss-protection: 1; mode=block\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"LiteSpeed","description":"LiteSpeed is a high-scalability web server.","website":"https://litespeedtech.com","common_platform_enumeration":"cpe:2.3:a:litespeedtech:litespeed_web_server:*:*:*:*:*:*:*:*","icon":"LiteSpeed.svg","categories":["Web servers"]}],"data":{"size":3457,"size_decoded":0,"mime_type":"image/jpeg","magic":"PNG image data, 225 x 225, 8-bit colormap, non-interlaced","md5":"21d8245d5821994f1a7e7d0cc69eacd4","sha1":"a32b44f419a61e309de428b869486773c28f2e84","sha256":"46e49a12a8c9d32998f65f7db5e097b43f5e101f0306e5d5230b91cad5721aba","sha512":"ce847796150b7a2fc50764b0aacbd575fdc81834320dee6eb97eca0723ba3d929c368340e1317ebd17116310fce026639f7749c336336e6ce077bf44cb015b3a","ssdeep":"","tlshash":"43616bb207c49c2594e0b03bc97b243e1e3b61efaedca683792d24b59b751a400912a2","first_seen":"2023-07-01T21:11:21Z","last_seen":"2026-07-01T03:16:04.949775Z","times_seen":74,"resource_available":false,"data":null}},"time_used":470,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":455,"receive":15,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2025-08-19","alert":"Sinkholed","trigger":"midnight-gd.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":[{"sensor_name":"urlquery","alert":"Phishing - Generic Crypto/Wallet","verdict":"phishing","severity":"medium","comment":"Asset commenly seen with Generic Crypto/Wallet phishing","tags":["crypto","phishing"],"meta":null}]}},{"url":{"schema":"https","addr":"midnight-gd.com/static/connect-css/ntfs.css","fqdn":"midnight-gd.com","domain":"midnight-gd.com","tld":"com"},"ip":{"addr":"192.3.141.250","port":443,"asn":36352,"as":"AS-COLOCROSSING","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://midnight-gd.com/connect.html","date":"2025-08-19T12:46:29.131Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"midnight-gd.com","organization":""},"issuer":{"commonName":"R10","organization":"Let's Encrypt"},"validity":{"start":"Fri, 08 Aug 2025 21:56:18 GMT","end":"Thu, 06 Nov 2025 21:56:17 GMT"},"fingerprint":{"sha1":"57:AB:C1:2A:94:4B:D1:B7:3F:B9:E2:25:D6:6C:A1:FE:87:79:5E:06","sha256":"45:20:67:6D:CB:DC:27:76:A1:38:40:DC:34:04:B4:D8:74:41:3A:A9:57:69:E6:92:F2:D4:D0:4F:FB:E3:6B:49"}}},"request":{"raw":"GET /static/connect-css/ntfs.css HTTP/1.1\r\nHost: midnight-gd.com\r\nUser-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://midnight-gd.com/static/connect-css/style.css\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\ncache-control: public, max-age=2592000\r\nexpires: Thu, 18 Sep 2025 12:46:29 GMT\r\ncontent-type: text/css\r\nlast-modified: Wed, 30 Aug 2023 02:32:10 GMT\r\naccept-ranges: bytes\r\ncontent-encoding: br\r\nvary: Accept-Encoding\r\ncontent-length: 850\r\ndate: Tue, 19 Aug 2025 12:46:29 GMT\r\nserver: LiteSpeed\r\nx-content-type-options: nosniff\r\nx-xss-protection: 1; mode=block\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"LiteSpeed","description":"LiteSpeed is a high-scalability web server.","website":"https://litespeedtech.com","common_platform_enumeration":"cpe:2.3:a:litespeedtech:litespeed_web_server:*:*:*:*:*:*:*:*","icon":"LiteSpeed.svg","categories":["Web servers"]}],"data":{"size":5142,"size_decoded":0,"mime_type":"text/css","magic":"ASCII text, with CRLF line terminators","md5":"fc1a71bfec00da780f38a16535a84e9e","sha1":"311c153837492515bd361ec84dbf731425a95df0","sha256":"262599fdc5c00188ce82010549f66ffa8b299a49ebc1aa489f862f31eba26d57","sha512":"7ca7e64fd8c1182ba3e8a5a51bd59fa5d6652dab360de69c8cdd2a603c04b47172dd158aa1202aef918b73fd6f8d83f8338efcdd4a34662bc6bd130082748448","ssdeep":"96:rV69K1VPQKitJgzrpzwejVwuwr2w3XzxtEGtYJ8w3yOXm3KTnZ6ivUaVEm3uGzd0:rs9KzPZ326qWg5eu/v","tlshash":"e1b174b98dbc01410b71dad0ab4155267fa852a4cf832dcef203249ce6ef6459193eec","first_seen":"2024-04-18T22:29:23Z","last_seen":"2026-06-25T13:54:59.112963Z","times_seen":38,"resource_available":false,"data":null}},"time_used":109,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":109,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2025-08-19","alert":"Sinkholed","trigger":"midnight-gd.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"midnight-gd.com/assets/css2","fqdn":"midnight-gd.com","domain":"midnight-gd.com","tld":"com"},"ip":{"addr":"192.3.141.250","port":443,"asn":36352,"as":"AS-COLOCROSSING","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://midnight-gd.com/connect.html","date":"2025-08-19T12:46:28.899Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"midnight-gd.com","organization":""},"issuer":{"commonName":"R10","organization":"Let's Encrypt"},"validity":{"start":"Fri, 08 Aug 2025 21:56:18 GMT","end":"Thu, 06 Nov 2025 21:56:17 GMT"},"fingerprint":{"sha1":"57:AB:C1:2A:94:4B:D1:B7:3F:B9:E2:25:D6:6C:A1:FE:87:79:5E:06","sha256":"45:20:67:6D:CB:DC:27:76:A1:38:40:DC:34:04:B4:D8:74:41:3A:A9:57:69:E6:92:F2:D4:D0:4F:FB:E3:6B:49"}}},"request":{"raw":"GET /assets/css2 HTTP/1.1\r\nHost: midnight-gd.com\r\nUser-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://midnight-gd.com/connect.html\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\ncache-control: public, max-age=2592000\r\nexpires: Thu, 18 Sep 2025 12:46:28 GMT\r\nlast-modified: Sat, 02 Aug 2025 07:25:58 GMT\r\naccept-ranges: bytes\r\ncontent-length: 839\r\ndate: Tue, 19 Aug 2025 12:46:28 GMT\r\nserver: LiteSpeed\r\nx-content-type-options: nosniff\r\nx-xss-protection: 1; mode=block\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"LiteSpeed","description":"LiteSpeed is a high-scalability web server.","website":"https://litespeedtech.com","common_platform_enumeration":"cpe:2.3:a:litespeedtech:litespeed_web_server:*:*:*:*:*:*:*:*","icon":"LiteSpeed.svg","categories":["Web servers"]}],"data":{"size":0,"size_decoded":0,"mime_type":"application/x-unknown-content-type","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-08-04T18:58:17.234169Z","times_seen":17712185,"resource_available":true,"data":null}},"time_used":215,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":215,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2025-08-19","alert":"Sinkholed","trigger":"midnight-gd.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"midnight-gd.com/static/logo/ownbit.jpg","fqdn":"midnight-gd.com","domain":"midnight-gd.com","tld":"com"},"ip":{"addr":"192.3.141.250","port":443,"asn":36352,"as":"AS-COLOCROSSING","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://midnight-gd.com/connect.html","date":"2025-08-19T12:46:28.940Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"midnight-gd.com","organization":""},"issuer":{"commonName":"R10","organization":"Let's Encrypt"},"validity":{"start":"Fri, 08 Aug 2025 21:56:18 GMT","end":"Thu, 06 Nov 2025 21:56:17 GMT"},"fingerprint":{"sha1":"57:AB:C1:2A:94:4B:D1:B7:3F:B9:E2:25:D6:6C:A1:FE:87:79:5E:06","sha256":"45:20:67:6D:CB:DC:27:76:A1:38:40:DC:34:04:B4:D8:74:41:3A:A9:57:69:E6:92:F2:D4:D0:4F:FB:E3:6B:49"}}},"request":{"raw":"GET /static/logo/ownbit.jpg HTTP/1.1\r\nHost: midnight-gd.com\r\nUser-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://midnight-gd.com/connect.html\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\ncache-control: public, max-age=31536000\r\nexpires: Wed, 19 Aug 2026 12:46:28 GMT\r\ncontent-type: image/jpeg\r\nlast-modified: Wed, 30 Aug 2023 02:32:10 GMT\r\naccept-ranges: bytes\r\ncontent-length: 9959\r\ndate: Tue, 19 Aug 2025 12:46:28 GMT\r\nserver: LiteSpeed\r\nx-content-type-options: nosniff\r\nx-xss-protection: 1; mode=block\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"LiteSpeed","description":"LiteSpeed is a high-scalability web server.","website":"https://litespeedtech.com","common_platform_enumeration":"cpe:2.3:a:litespeedtech:litespeed_web_server:*:*:*:*:*:*:*:*","icon":"LiteSpeed.svg","categories":["Web servers"]}],"data":{"size":9959,"size_decoded":0,"mime_type":"image/jpeg","magic":"JPEG image data, baseline, precision 8, 400x400, components 3","md5":"541bb2e5e029df0653025ebe623f30d2","sha1":"651cc837b8f896bf73a4306e1b0151ed077c622b","sha256":"0773eeb40c38eca3d0c636bccb0bae0ab94f213fe0b76bc29c0eb5eab1792e8e","sha512":"0eccdfa002330242cdd0aaaed51f889bff918d0adc1715bfcc0e585010df50d25c62243391c4c336e92e050e989413c8241f31db3b317d65768fdfc19bf3fae3","ssdeep":"192:Us89TlzqT/hd/jo83HbbRz9JluVGfr9q2ZBbJxIxeSda:Us8PGT/z/j53PR57uV8q6JOeSda","tlshash":"07229e4f3a39660cc931e87d189f147f34961fad498246ac6433c7d2e85a0ea8985a1e","first_seen":"2023-04-30T19:28:18Z","last_seen":"2026-07-23T15:04:36.56725Z","times_seen":670,"resource_available":false,"data":null}},"time_used":431,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":428,"receive":3,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2025-08-19","alert":"Sinkholed","trigger":"midnight-gd.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":[{"sensor_name":"urlquery","alert":"Phishing - Generic Crypto/Wallet","verdict":"phishing","severity":"medium","comment":"Asset commenly seen with Generic Crypto/Wallet phishing","tags":["crypto","phishing"],"meta":null}]}},{"url":{"schema":"https","addr":"midnight-gd.com/static/logo/huobi.jpg","fqdn":"midnight-gd.com","domain":"midnight-gd.com","tld":"com"},"ip":{"addr":"192.3.141.250","port":443,"asn":36352,"as":"AS-COLOCROSSING","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://midnight-gd.com/connect.html","date":"2025-08-19T12:46:28.916Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"midnight-gd.com","organization":""},"issuer":{"commonName":"R10","organization":"Let's Encrypt"},"validity":{"start":"Fri, 08 Aug 2025 21:56:18 GMT","end":"Thu, 06 Nov 2025 21:56:17 GMT"},"fingerprint":{"sha1":"57:AB:C1:2A:94:4B:D1:B7:3F:B9:E2:25:D6:6C:A1:FE:87:79:5E:06","sha256":"45:20:67:6D:CB:DC:27:76:A1:38:40:DC:34:04:B4:D8:74:41:3A:A9:57:69:E6:92:F2:D4:D0:4F:FB:E3:6B:49"}}},"request":{"raw":"GET /static/logo/huobi.jpg HTTP/1.1\r\nHost: midnight-gd.com\r\nUser-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://midnight-gd.com/connect.html\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\ncache-control: public, max-age=31536000\r\nexpires: Wed, 19 Aug 2026 12:46:28 GMT\r\ncontent-type: image/jpeg\r\nlast-modified: Wed, 30 Aug 2023 02:32:10 GMT\r\naccept-ranges: bytes\r\ncontent-length: 8163\r\ndate: Tue, 19 Aug 2025 12:46:28 GMT\r\nserver: LiteSpeed\r\nx-content-type-options: nosniff\r\nx-xss-protection: 1; mode=block\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"LiteSpeed","description":"LiteSpeed is a high-scalability web server.","website":"https://litespeedtech.com","common_platform_enumeration":"cpe:2.3:a:litespeedtech:litespeed_web_server:*:*:*:*:*:*:*:*","icon":"LiteSpeed.svg","categories":["Web servers"]}],"data":{"size":8163,"size_decoded":0,"mime_type":"image/jpeg","magic":"JPEG image data, baseline, precision 8, 400x400, components 3","md5":"8889adc3b016ba70946e7f291c6828b2","sha1":"0181da136b5229d07374501217be5d7e3faadf15","sha256":"e52893600547ae340a528bfa7400e5b94536e5153f66a2f966898a3a441ced47","sha512":"bb3c28d2d8f99edf068d9494329fc119bd15b20688980f6ff44d6a39122b65e195a7002a5c7f41f8e491619ea16921bddaa87f0360b4c77fc36e540d83142d48","ssdeep":"192:FBJsqB5Ib6H408BAthFUg34I/mzvePO9SxfmY4GUJxK:FBJsqbYbBtg3jdu1HK","tlshash":"b0f1ae3e7ba4bf02d156fd304eb193aef53d006ab725732e905450b651b613e604fe98","first_seen":"2023-05-01T21:31:16Z","last_seen":"2026-07-21T05:16:19.686343Z","times_seen":649,"resource_available":false,"data":null}},"time_used":310,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":302,"receive":8,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2025-08-19","alert":"Sinkholed","trigger":"midnight-gd.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":[{"sensor_name":"urlquery","alert":"Phishing - Generic Crypto/Wallet","verdict":"phishing","severity":"medium","comment":"Asset commenly seen with Generic Crypto/Wallet phishing","tags":["crypto","phishing"],"meta":null}]}},{"url":{"schema":"https","addr":"midnight-gd.com/static/logo/polkadot.jpg","fqdn":"midnight-gd.com","domain":"midnight-gd.com","tld":"com"},"ip":{"addr":"192.3.141.250","port":443,"asn":36352,"as":"AS-COLOCROSSING","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://midnight-gd.com/connect.html","date":"2025-08-19T12:46:28.920Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"midnight-gd.com","organization":""},"issuer":{"commonName":"R10","organization":"Let's Encrypt"},"validity":{"start":"Fri, 08 Aug 2025 21:56:18 GMT","end":"Thu, 06 Nov 2025 21:56:17 GMT"},"fingerprint":{"sha1":"57:AB:C1:2A:94:4B:D1:B7:3F:B9:E2:25:D6:6C:A1:FE:87:79:5E:06","sha256":"45:20:67:6D:CB:DC:27:76:A1:38:40:DC:34:04:B4:D8:74:41:3A:A9:57:69:E6:92:F2:D4:D0:4F:FB:E3:6B:49"}}},"request":{"raw":"GET /static/logo/polkadot.jpg HTTP/1.1\r\nHost: midnight-gd.com\r\nUser-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://midnight-gd.com/connect.html\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\ncache-control: public, max-age=31536000\r\nexpires: Wed, 19 Aug 2026 12:46:28 GMT\r\ncontent-type: image/jpeg\r\nlast-modified: Wed, 30 Aug 2023 02:32:10 GMT\r\naccept-ranges: bytes\r\ncontent-length: 10853\r\ndate: Tue, 19 Aug 2025 12:46:28 GMT\r\nserver: LiteSpeed\r\nx-content-type-options: nosniff\r\nx-xss-protection: 1; mode=block\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"LiteSpeed","description":"LiteSpeed is a high-scalability web server.","website":"https://litespeedtech.com","common_platform_enumeration":"cpe:2.3:a:litespeedtech:litespeed_web_server:*:*:*:*:*:*:*:*","icon":"LiteSpeed.svg","categories":["Web servers"]}],"data":{"size":10853,"size_decoded":0,"mime_type":"image/jpeg","magic":"PNG image data, 300 x 300, 8-bit/color RGBA, non-interlaced","md5":"1049516a8e0ba7e46ea9ae5ecf44a765","sha1":"48bb71a1adeef9b6733dffa013388d8107644dda","sha256":"1412d9c2df9a008eab99865f6d513d269269c25e6c1e1d87cdd43c5e99fbca41","sha512":"b6b61aa27897f93c2f88c3e6598334d5fdde7fd51d74381aabcf70ac55ec55265610600ea5abfe19e1fa270c347177dfda3825a64c2abc83e0dac5d353d0ded1","ssdeep":"192:woJv0pyl4RrtkEHM1Dtt2bFOE3qRNvs1MgyWeEfQ+ImClFSUw6R+t:biRrtkVE3SmWWelv5w68","tlshash":"f822bfe9d86cc2874b11eadd4cb188fd92c187f6c0ef163848158eb6c652ca95a27a81","first_seen":"2023-05-02T15:15:30Z","last_seen":"2026-07-01T03:16:04.910105Z","times_seen":365,"resource_available":false,"data":null}},"time_used":336,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":325,"receive":11,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2025-08-19","alert":"Sinkholed","trigger":"midnight-gd.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":[{"sensor_name":"urlquery","alert":"Phishing - Generic Crypto/Wallet","verdict":"phishing","severity":"medium","comment":"Asset commenly seen with Generic Crypto/Wallet phishing","tags":["crypto","phishing"],"meta":null}]}},{"url":{"schema":"https","addr":"midnight-gd.com/static/logo/gridplus.jpg","fqdn":"midnight-gd.com","domain":"midnight-gd.com","tld":"com"},"ip":{"addr":"192.3.141.250","port":443,"asn":36352,"as":"AS-COLOCROSSING","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://midnight-gd.com/connect.html","date":"2025-08-19T12:46:28.934Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"midnight-gd.com","organization":""},"issuer":{"commonName":"R10","organization":"Let's Encrypt"},"validity":{"start":"Fri, 08 Aug 2025 21:56:18 GMT","end":"Thu, 06 Nov 2025 21:56:17 GMT"},"fingerprint":{"sha1":"57:AB:C1:2A:94:4B:D1:B7:3F:B9:E2:25:D6:6C:A1:FE:87:79:5E:06","sha256":"45:20:67:6D:CB:DC:27:76:A1:38:40:DC:34:04:B4:D8:74:41:3A:A9:57:69:E6:92:F2:D4:D0:4F:FB:E3:6B:49"}}},"request":{"raw":"GET /static/logo/gridplus.jpg HTTP/1.1\r\nHost: midnight-gd.com\r\nUser-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://midnight-gd.com/connect.html\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\ncache-control: public, max-age=31536000\r\nexpires: Wed, 19 Aug 2026 12:46:28 GMT\r\ncontent-type: image/jpeg\r\nlast-modified: Wed, 30 Aug 2023 02:32:10 GMT\r\naccept-ranges: bytes\r\ncontent-length: 12007\r\ndate: Tue, 19 Aug 2025 12:46:28 GMT\r\nserver: LiteSpeed\r\nx-content-type-options: nosniff\r\nx-xss-protection: 1; mode=block\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"LiteSpeed","description":"LiteSpeed is a high-scalability web server.","website":"https://litespeedtech.com","common_platform_enumeration":"cpe:2.3:a:litespeedtech:litespeed_web_server:*:*:*:*:*:*:*:*","icon":"LiteSpeed.svg","categories":["Web servers"]}],"data":{"size":12007,"size_decoded":0,"mime_type":"image/jpeg","magic":"JPEG image data, baseline, precision 8, 400x400, components 3","md5":"b370860671d254fa45fd1fb36ea88257","sha1":"7a638f30aff95cf63c8e61733112087712f79a22","sha256":"4853dd9d590e22630ff3b98a8c5a544cb7a27235676c6557b9a3134bc5eda6ef","sha512":"08e83af12f96d71e02f61ffe5121799c81315f71250ee0f2449f78402143a4eed0c62c47bf66bb92eefb5fe6c1610d031d6f2c58c1d93d8befe8a172e3d49a18","ssdeep":"192:0bbgXObk0URlbqiTdzV94C9uXRZdPSU6s1eM8LwxVL+D83HIoWf7i/ktNv3TTbsh:3yk0Ul1V9lGZdPgwbwwjLnXIoWf7i/kY","tlshash":"f2427b8b7293a033a1abd4314c967558264796a101e31b2c796d7f7fb33e98f1e83c25","first_seen":"2023-04-30T19:28:18Z","last_seen":"2026-07-23T15:04:36.568197Z","times_seen":863,"resource_available":false,"data":null}},"time_used":421,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":416,"receive":5,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2025-08-19","alert":"Sinkholed","trigger":"midnight-gd.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":[{"sensor_name":"urlquery","alert":"Phishing - Generic Crypto/Wallet","verdict":"phishing","severity":"medium","comment":"Asset commenly seen with Generic Crypto/Wallet phishing","tags":["crypto","phishing"],"meta":null}]}},{"url":{"schema":"https","addr":"midnight-gd.com/static/logo/safepal.jpg","fqdn":"midnight-gd.com","domain":"midnight-gd.com","tld":"com"},"ip":{"addr":"192.3.141.250","port":443,"asn":36352,"as":"AS-COLOCROSSING","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://midnight-gd.com/connect.html","date":"2025-08-19T12:46:28.937Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"midnight-gd.com","organization":""},"issuer":{"commonName":"R10","organization":"Let's Encrypt"},"validity":{"start":"Fri, 08 Aug 2025 21:56:18 GMT","end":"Thu, 06 Nov 2025 21:56:17 GMT"},"fingerprint":{"sha1":"57:AB:C1:2A:94:4B:D1:B7:3F:B9:E2:25:D6:6C:A1:FE:87:79:5E:06","sha256":"45:20:67:6D:CB:DC:27:76:A1:38:40:DC:34:04:B4:D8:74:41:3A:A9:57:69:E6:92:F2:D4:D0:4F:FB:E3:6B:49"}}},"request":{"raw":"GET /static/logo/safepal.jpg HTTP/1.1\r\nHost: midnight-gd.com\r\nUser-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://midnight-gd.com/connect.html\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\ncache-control: public, max-age=31536000\r\nexpires: Wed, 19 Aug 2026 12:46:28 GMT\r\ncontent-type: image/jpeg\r\nlast-modified: Wed, 30 Aug 2023 02:32:10 GMT\r\naccept-ranges: bytes\r\ncontent-length: 9532\r\ndate: Tue, 19 Aug 2025 12:46:28 GMT\r\nserver: LiteSpeed\r\nx-content-type-options: nosniff\r\nx-xss-protection: 1; mode=block\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"LiteSpeed","description":"LiteSpeed is a high-scalability web server.","website":"https://litespeedtech.com","common_platform_enumeration":"cpe:2.3:a:litespeedtech:litespeed_web_server:*:*:*:*:*:*:*:*","icon":"LiteSpeed.svg","categories":["Web servers"]}],"data":{"size":9532,"size_decoded":0,"mime_type":"image/jpeg","magic":"JPEG image data, baseline, precision 8, 400x400, components 3","md5":"a72d311b189775eb7dd380a6009f7e79","sha1":"8040476622c565f354ea858a41124ef1f02a7835","sha256":"fd649b8ba5a3d4ec37b1feb668f78b8f6794abaf4f9a9fbef5f4694335e4181d","sha512":"6d8f2b3d99b1064132a9c4d75b7dc65f030d621b611c3be12ecad9be37107ab911099e84955b75078940c5ae3566e4372583c9ce31ab98b647e8c0cdc2f04e12","ssdeep":"192:UT7SPFKMK8KkOfexEpDJKA3ZABxQOopnlDC+iEDKxg3/1d:Y2P4krGKArhq+DKg/z","tlshash":"4412bffdf2f28195e5d4d73b7537c2c2cbeda996c496424f450d51938288a833fc84a1","first_seen":"2023-05-01T21:31:16Z","last_seen":"2026-07-21T05:16:19.664505Z","times_seen":551,"resource_available":false,"data":null}},"time_used":423,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":419,"receive":4,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2025-08-19","alert":"Sinkholed","trigger":"midnight-gd.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":[{"sensor_name":"urlquery","alert":"Phishing - Generic Crypto/Wallet","verdict":"phishing","severity":"medium","comment":"Asset commenly seen with Generic Crypto/Wallet phishing","tags":["crypto","phishing"],"meta":null}]}},{"url":{"schema":"https","addr":"midnight-gd.com/static/logo/kyberswap.jpg","fqdn":"midnight-gd.com","domain":"midnight-gd.com","tld":"com"},"ip":{"addr":"192.3.141.250","port":443,"asn":36352,"as":"AS-COLOCROSSING","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://midnight-gd.com/connect.html","date":"2025-08-19T12:46:29.017Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"midnight-gd.com","organization":""},"issuer":{"commonName":"R10","organization":"Let's Encrypt"},"validity":{"start":"Fri, 08 Aug 2025 21:56:18 GMT","end":"Thu, 06 Nov 2025 21:56:17 GMT"},"fingerprint":{"sha1":"57:AB:C1:2A:94:4B:D1:B7:3F:B9:E2:25:D6:6C:A1:FE:87:79:5E:06","sha256":"45:20:67:6D:CB:DC:27:76:A1:38:40:DC:34:04:B4:D8:74:41:3A:A9:57:69:E6:92:F2:D4:D0:4F:FB:E3:6B:49"}}},"request":{"raw":"GET /static/logo/kyberswap.jpg HTTP/1.1\r\nHost: midnight-gd.com\r\nUser-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://midnight-gd.com/connect.html\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\ncache-control: public, max-age=31536000\r\nexpires: Wed, 19 Aug 2026 12:46:28 GMT\r\ncontent-type: image/jpeg\r\nlast-modified: Wed, 30 Aug 2023 02:32:10 GMT\r\naccept-ranges: bytes\r\ncontent-length: 9463\r\ndate: Tue, 19 Aug 2025 12:46:28 GMT\r\nserver: LiteSpeed\r\nx-content-type-options: nosniff\r\nx-xss-protection: 1; mode=block\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"LiteSpeed","description":"LiteSpeed is a high-scalability web server.","website":"https://litespeedtech.com","common_platform_enumeration":"cpe:2.3:a:litespeedtech:litespeed_web_server:*:*:*:*:*:*:*:*","icon":"LiteSpeed.svg","categories":["Web servers"]}],"data":{"size":9463,"size_decoded":0,"mime_type":"image/jpeg","magic":"JPEG image data, baseline, precision 8, 400x400, components 3","md5":"84d8feebe781731aa6e08cdbdd7308a8","sha1":"4f38c77471524f83bae8137726c6d75f36b223fa","sha256":"5bba75448c46b95dffb78394b2e3597c94fa6e546d2eda6d8a81546ac77aebf6","sha512":"cb9e23f8d712bf6bd06726efb33b91ab03a751e5cf97bf2f440b11621e0ad749c12b5803bb0afe8bfc3b59516711372de0f700d4b86f48babbe9af212c2a6866","ssdeep":"192:vNvMPUwwVnAgDUb+5SboY9pm8myGZuyG+hDD9dfIP:hJwwSgD++wboY9p9D86KdC","tlshash":"2712afbeb703899eeb1cd1fc98b73016e3c3dd1b439c678f0da390298422a17561d995","first_seen":"2023-05-01T21:31:16Z","last_seen":"2026-07-21T05:16:19.658983Z","times_seen":565,"resource_available":false,"data":null}},"time_used":461,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":454,"receive":7,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2025-08-19","alert":"Sinkholed","trigger":"midnight-gd.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":[{"sensor_name":"urlquery","alert":"Phishing - Generic Crypto/Wallet","verdict":"phishing","severity":"medium","comment":"Asset commenly seen with Generic Crypto/Wallet phishing","tags":["crypto","phishing"],"meta":null}]}},{"url":{"schema":"https","addr":"play-lh.googleusercontent.com/UlhGKCVtUuXjDDF_fFdDQaF7mdUpMpsKvfQNNQHuwzbNEvvN-sYRNLk308wpWmLQkR4","fqdn":"play-lh.googleusercontent.com","domain":"googleusercontent.com","tld":"com"},"ip":{"addr":"142.250.178.86","port":443,"asn":15169,"as":"GOOGLE","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://midnight-gd.com/connect.html","date":"2025-08-19T12:46:29.823Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"edgestatic.com","organization":""},"issuer":{"commonName":"WR2","organization":"Google Trust Services"},"validity":{"start":"Mon, 07 Jul 2025 08:34:02 GMT","end":"Mon, 29 Sep 2025 08:34:01 GMT"},"fingerprint":{"sha1":"70:9A:A8:F3:87:95:3F:23:2E:C5:AC:05:21:0A:30:1F:2B:07:70:3D","sha256":"1E:33:C7:99:EB:7F:84:FF:FB:CE:C1:0D:61:84:8D:A7:82:17:51:19:57:AD:89:11:98:C9:67:58:4C:8C:A3:05"}}},"request":{"raw":"GET /UlhGKCVtUuXjDDF_fFdDQaF7mdUpMpsKvfQNNQHuwzbNEvvN-sYRNLk308wpWmLQkR4 HTTP/1.1\r\nHost: play-lh.googleusercontent.com\r\nUser-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://midnight-gd.com/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\naccess-control-allow-origin: *\r\ntiming-allow-origin: *\r\naccess-control-expose-headers: Content-Length\r\ncontent-disposition: inline;filename=\"unnamed.png\"\r\nx-content-type-options: nosniff\r\nserver: fife\r\ncontent-length: 42690\r\nx-xss-protection: 0\r\ndate: Tue, 19 Aug 2025 12:46:29 GMT\r\nexpires: Wed, 20 Aug 2025 12:46:29 GMT\r\ncache-control: public, max-age=86400, no-transform\r\netag: \"v1\"\r\ncontent-type: image/png\r\nvary: Origin\r\nage: 0\r\nalt-svc: h3=\":443\"; ma=2592000,h3-29=\":443\"; ma=2592000\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":null,"data":{"size":42690,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 512 x 512, 8-bit/color RGBA, non-interlaced","md5":"08b7ec4fe32162a5c437ffb0dce3ab33","sha1":"f49a919ab3baf303a01f8bf30010184404beac29","sha256":"c8538ed326b8f1f0dabbcf326a254af62fd895d8e9ae5f47e024af8d32c96bea","sha512":"62ea7800bf735741658aa9a364fac29c7964d7a9244da16a70d890549fe6f22c23a4ec313fdb1bb4abc3b177f3bdd67234ee19d73d2fc8d014cbac201ee1fedd","ssdeep":"768:sRGbPWJndL8KQGsPa6VshjFwm6zF0vAor23v76D0kxaAsmci:s6PILb4Pa6uJFwm6gu2TarK","tlshash":"1013f2cc5004a5037548da61847afa66b04ff2b5df59ccfba107829f2ed5822bf690f6","first_seen":"2023-05-27T03:32:48Z","last_seen":"2026-06-02T15:16:02.610383Z","times_seen":80,"resource_available":false,"data":null}},"time_used":291,"timings":{"blocked":76,"dns":74,"connect":29,"send":0,"wait":41,"receive":17,"ssl":51},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"midnight-gd.com/static/logo/walleth.jpg","fqdn":"midnight-gd.com","domain":"midnight-gd.com","tld":"com"},"ip":{"addr":"192.3.141.250","port":443,"asn":36352,"as":"AS-COLOCROSSING","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://midnight-gd.com/connect.html","date":"2025-08-19T12:46:28.913Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"midnight-gd.com","organization":""},"issuer":{"commonName":"R10","organization":"Let's Encrypt"},"validity":{"start":"Fri, 08 Aug 2025 21:56:18 GMT","end":"Thu, 06 Nov 2025 21:56:17 GMT"},"fingerprint":{"sha1":"57:AB:C1:2A:94:4B:D1:B7:3F:B9:E2:25:D6:6C:A1:FE:87:79:5E:06","sha256":"45:20:67:6D:CB:DC:27:76:A1:38:40:DC:34:04:B4:D8:74:41:3A:A9:57:69:E6:92:F2:D4:D0:4F:FB:E3:6B:49"}}},"request":{"raw":"GET /static/logo/walleth.jpg HTTP/1.1\r\nHost: midnight-gd.com\r\nUser-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://midnight-gd.com/connect.html\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\ncache-control: public, max-age=31536000\r\nexpires: Wed, 19 Aug 2026 12:46:28 GMT\r\ncontent-type: image/jpeg\r\nlast-modified: Wed, 30 Aug 2023 02:32:10 GMT\r\naccept-ranges: bytes\r\ncontent-length: 7225\r\ndate: Tue, 19 Aug 2025 12:46:28 GMT\r\nserver: LiteSpeed\r\nx-content-type-options: nosniff\r\nx-xss-protection: 1; mode=block\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"LiteSpeed","description":"LiteSpeed is a high-scalability web server.","website":"https://litespeedtech.com","common_platform_enumeration":"cpe:2.3:a:litespeedtech:litespeed_web_server:*:*:*:*:*:*:*:*","icon":"LiteSpeed.svg","categories":["Web servers"]}],"data":{"size":7225,"size_decoded":0,"mime_type":"image/jpeg","magic":"JPEG image data, baseline, precision 8, 400x400, components 3","md5":"eb31718dfcaa184c92939eeb80409f0c","sha1":"abc5e316aada45ab95fd22320588031aa5b7083c","sha256":"5b17b2831da88db4aba84e58cd502092d778a6cce1eebfaf508096fcbd58b1ab","sha512":"d6dc3751424e3eb3372cad73fd34d090e4c7791885210e4eee7d0f69c45b8f81f8c3b3c572307405360bea92eef25bb50d033b2b63ec15f9b5ab14324c2c0457","ssdeep":"96:XXypRMGsaaguUYpsNxKDqehtmBEeeEV2/SGOvCEdKPh6rdoUHT4WON+MscXK:HuG5ZiSD1vBee82/SpaYmgoUH5OY","tlshash":"90e18e0abe0eab15c65dc6f06d902f74bff1062a40f48f1d0f14ed7461b92e64a608d7","first_seen":"2023-04-30T19:28:18Z","last_seen":"2026-07-23T15:04:36.508557Z","times_seen":718,"resource_available":false,"data":null}},"time_used":305,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":296,"receive":9,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2025-08-19","alert":"Sinkholed","trigger":"midnight-gd.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":[{"sensor_name":"urlquery","alert":"Phishing - Generic Crypto/Wallet","verdict":"phishing","severity":"medium","comment":"Asset commenly seen with Generic Crypto/Wallet phishing","tags":["crypto","phishing"],"meta":null}]}},{"url":{"schema":"https","addr":"midnight-gd.com/static/logo/ledger_live.jpg","fqdn":"midnight-gd.com","domain":"midnight-gd.com","tld":"com"},"ip":{"addr":"192.3.141.250","port":443,"asn":36352,"as":"AS-COLOCROSSING","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://midnight-gd.com/connect.html","date":"2025-08-19T12:46:28.926Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"midnight-gd.com","organization":""},"issuer":{"commonName":"R10","organization":"Let's Encrypt"},"validity":{"start":"Fri, 08 Aug 2025 21:56:18 GMT","end":"Thu, 06 Nov 2025 21:56:17 GMT"},"fingerprint":{"sha1":"57:AB:C1:2A:94:4B:D1:B7:3F:B9:E2:25:D6:6C:A1:FE:87:79:5E:06","sha256":"45:20:67:6D:CB:DC:27:76:A1:38:40:DC:34:04:B4:D8:74:41:3A:A9:57:69:E6:92:F2:D4:D0:4F:FB:E3:6B:49"}}},"request":{"raw":"GET /static/logo/ledger_live.jpg HTTP/1.1\r\nHost: midnight-gd.com\r\nUser-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://midnight-gd.com/connect.html\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\ncache-control: public, max-age=31536000\r\nexpires: Wed, 19 Aug 2026 12:46:28 GMT\r\ncontent-type: image/jpeg\r\nlast-modified: Wed, 30 Aug 2023 02:32:10 GMT\r\naccept-ranges: bytes\r\ncontent-length: 7139\r\ndate: Tue, 19 Aug 2025 12:46:28 GMT\r\nserver: LiteSpeed\r\nx-content-type-options: nosniff\r\nx-xss-protection: 1; mode=block\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"LiteSpeed","description":"LiteSpeed is a high-scalability web server.","website":"https://litespeedtech.com","common_platform_enumeration":"cpe:2.3:a:litespeedtech:litespeed_web_server:*:*:*:*:*:*:*:*","icon":"LiteSpeed.svg","categories":["Web servers"]}],"data":{"size":7139,"size_decoded":0,"mime_type":"image/jpeg","magic":"JPEG image data, baseline, precision 8, 400x400, components 3","md5":"b96662aeff8b0fbdd1df05fb5276377d","sha1":"35bdb7f067da2d79f4e074c07a4c75ade5c06f52","sha256":"af750da80779c66ecab4952241e392b6b14db8b684111ed5a045bf684415dad6","sha512":"133d1c1a6ab1e711ee648fa6dfeb13363b03b867ef8ada5d53f1a914b3cd6261462b449c514d043f5b7f84f195c4522b0636bd5c23b0ecbd8fb884e1189a2963","ssdeep":"96:uoIpihulYiHxGDscvm20W+iAX7NprniPnYn188HYk9cCHtvq5js5UJMh9u:faY8G4cvm25+iAZpD2aYuTHtyqUJS9u","tlshash":"88e16c222178a857f82aca7868330346ff51845de305cfcd9ac39e9fd47725a5958b0b","first_seen":"2023-05-01T21:31:16Z","last_seen":"2026-07-14T08:40:56.157717Z","times_seen":408,"resource_available":false,"data":null}},"time_used":393,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":369,"receive":24,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2025-08-19","alert":"Sinkholed","trigger":"midnight-gd.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":[{"sensor_name":"urlquery","alert":"Phishing - Generic Crypto/Wallet","verdict":"phishing","severity":"medium","comment":"Asset commenly seen with Generic Crypto/Wallet phishing","tags":["crypto","phishing"],"meta":null}]}},{"url":{"schema":"https","addr":"midnight-gd.com/static/logo/keyring_pro.jpg","fqdn":"midnight-gd.com","domain":"midnight-gd.com","tld":"com"},"ip":{"addr":"192.3.141.250","port":443,"asn":36352,"as":"AS-COLOCROSSING","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://midnight-gd.com/connect.html","date":"2025-08-19T12:46:29.022Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"midnight-gd.com","organization":""},"issuer":{"commonName":"R10","organization":"Let's Encrypt"},"validity":{"start":"Fri, 08 Aug 2025 21:56:18 GMT","end":"Thu, 06 Nov 2025 21:56:17 GMT"},"fingerprint":{"sha1":"57:AB:C1:2A:94:4B:D1:B7:3F:B9:E2:25:D6:6C:A1:FE:87:79:5E:06","sha256":"45:20:67:6D:CB:DC:27:76:A1:38:40:DC:34:04:B4:D8:74:41:3A:A9:57:69:E6:92:F2:D4:D0:4F:FB:E3:6B:49"}}},"request":{"raw":"GET /static/logo/keyring_pro.jpg HTTP/1.1\r\nHost: midnight-gd.com\r\nUser-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://midnight-gd.com/connect.html\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\ncache-control: public, max-age=31536000\r\nexpires: Wed, 19 Aug 2026 12:46:28 GMT\r\ncontent-type: image/jpeg\r\nlast-modified: Wed, 30 Aug 2023 02:32:10 GMT\r\naccept-ranges: bytes\r\ncontent-length: 9425\r\ndate: Tue, 19 Aug 2025 12:46:28 GMT\r\nserver: LiteSpeed\r\nx-content-type-options: nosniff\r\nx-xss-protection: 1; mode=block\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"LiteSpeed","description":"LiteSpeed is a high-scalability web server.","website":"https://litespeedtech.com","common_platform_enumeration":"cpe:2.3:a:litespeedtech:litespeed_web_server:*:*:*:*:*:*:*:*","icon":"LiteSpeed.svg","categories":["Web servers"]}],"data":{"size":9425,"size_decoded":0,"mime_type":"image/jpeg","magic":"JPEG image data, baseline, precision 8, 400x400, components 3","md5":"5f3cf20d5755aaaf8c7001986b7742da","sha1":"8c60c012bfe373c8ed5cddaeaae6a61a85b16a99","sha256":"504c9a359cc43d40ec0096c5f64aa51440a31389684e7d80436f64edc1deda6c","sha512":"d14b7f15b8c3ce81c65aa9125f9e1f94d46cb1d5312123a6451aededb8000b588ebcc7ab932b5d264c31b5dc7dffba8f961fb8f140928852336375e5fca98655","ssdeep":"192:gI5VpjXFj1FKvLrHS6fdpDM0gAQULSqMc8:g+dDkPHS6fdBM0GULSb5","tlshash":"0c129e213c34c2cee1b6d97a4e9750e18eceed24b60f7bae516935d686393224ece440","first_seen":"2023-05-01T21:31:16Z","last_seen":"2026-07-01T03:16:04.908648Z","times_seen":428,"resource_available":false,"data":null}},"time_used":459,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":457,"receive":2,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2025-08-19","alert":"Sinkholed","trigger":"midnight-gd.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":[{"sensor_name":"urlquery","alert":"Phishing - Generic Crypto/Wallet","verdict":"phishing","severity":"medium","comment":"Asset commenly seen with Generic Crypto/Wallet phishing","tags":["crypto","phishing"],"meta":null}]}},{"url":{"schema":"https","addr":"midnight-gd.com/static/logo/images.png","fqdn":"midnight-gd.com","domain":"midnight-gd.com","tld":"com"},"ip":{"addr":"192.3.141.250","port":443,"asn":36352,"as":"AS-COLOCROSSING","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://midnight-gd.com/connect.html","date":"2025-08-19T12:46:28.901Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"midnight-gd.com","organization":""},"issuer":{"commonName":"R10","organization":"Let's Encrypt"},"validity":{"start":"Fri, 08 Aug 2025 21:56:18 GMT","end":"Thu, 06 Nov 2025 21:56:17 GMT"},"fingerprint":{"sha1":"57:AB:C1:2A:94:4B:D1:B7:3F:B9:E2:25:D6:6C:A1:FE:87:79:5E:06","sha256":"45:20:67:6D:CB:DC:27:76:A1:38:40:DC:34:04:B4:D8:74:41:3A:A9:57:69:E6:92:F2:D4:D0:4F:FB:E3:6B:49"}}},"request":{"raw":"GET /static/logo/images.png HTTP/1.1\r\nHost: midnight-gd.com\r\nUser-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://midnight-gd.com/connect.html\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\ncache-control: public, max-age=31536000\r\nexpires: Wed, 19 Aug 2026 12:46:28 GMT\r\ncontent-type: image/png\r\nlast-modified: Wed, 30 Aug 2023 02:32:10 GMT\r\naccept-ranges: bytes\r\ncontent-length: 927\r\ndate: Tue, 19 Aug 2025 12:46:28 GMT\r\nserver: LiteSpeed\r\nx-content-type-options: nosniff\r\nx-xss-protection: 1; mode=block\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"LiteSpeed","description":"LiteSpeed is a high-scalability web server.","website":"https://litespeedtech.com","common_platform_enumeration":"cpe:2.3:a:litespeedtech:litespeed_web_server:*:*:*:*:*:*:*:*","icon":"LiteSpeed.svg","categories":["Web servers"]}],"data":{"size":927,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 225 x 225, 8-bit colormap, non-interlaced","md5":"87abb928cdfbf39e42e60aa41fe230ec","sha1":"3f25e8641aa99e44f5f9e4eec552fbcf64324d56","sha256":"55521462c2a16b88926585b9d03ee05d4246ec3bfe21b16bc11f5bda8dfc6c88","sha512":"10df1403cdaf1cbf803f67465af5b98529b9ea56d873cfa286ed922082d59730507dfdf9127f394b086e38746857e999be32ef0ece161533db334cfcbc640880","ssdeep":"","tlshash":"1f118483d9020969b1ccbf54507afd965323892aa970a605e18009681e2af05ebdc387","first_seen":"2024-08-20T03:07:15.307708Z","last_seen":"2025-12-11T00:27:22.997213Z","times_seen":43,"resource_available":false,"data":null}},"time_used":220,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":214,"receive":6,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2025-08-19","alert":"Sinkholed","trigger":"midnight-gd.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"midnight-gd.com/static/logo/bitpay.jpg","fqdn":"midnight-gd.com","domain":"midnight-gd.com","tld":"com"},"ip":{"addr":"192.3.141.250","port":443,"asn":36352,"as":"AS-COLOCROSSING","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://midnight-gd.com/connect.html","date":"2025-08-19T12:46:28.911Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"midnight-gd.com","organization":""},"issuer":{"commonName":"R10","organization":"Let's Encrypt"},"validity":{"start":"Fri, 08 Aug 2025 21:56:18 GMT","end":"Thu, 06 Nov 2025 21:56:17 GMT"},"fingerprint":{"sha1":"57:AB:C1:2A:94:4B:D1:B7:3F:B9:E2:25:D6:6C:A1:FE:87:79:5E:06","sha256":"45:20:67:6D:CB:DC:27:76:A1:38:40:DC:34:04:B4:D8:74:41:3A:A9:57:69:E6:92:F2:D4:D0:4F:FB:E3:6B:49"}}},"request":{"raw":"GET /static/logo/bitpay.jpg HTTP/1.1\r\nHost: midnight-gd.com\r\nUser-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://midnight-gd.com/connect.html\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\ncache-control: public, max-age=31536000\r\nexpires: Wed, 19 Aug 2026 12:46:28 GMT\r\ncontent-type: image/jpeg\r\nlast-modified: Wed, 30 Aug 2023 02:32:10 GMT\r\naccept-ranges: bytes\r\ncontent-length: 9881\r\ndate: Tue, 19 Aug 2025 12:46:28 GMT\r\nserver: LiteSpeed\r\nx-content-type-options: nosniff\r\nx-xss-protection: 1; mode=block\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"LiteSpeed","description":"LiteSpeed is a high-scalability web server.","website":"https://litespeedtech.com","common_platform_enumeration":"cpe:2.3:a:litespeedtech:litespeed_web_server:*:*:*:*:*:*:*:*","icon":"LiteSpeed.svg","categories":["Web servers"]}],"data":{"size":9881,"size_decoded":0,"mime_type":"image/jpeg","magic":"JPEG image data, baseline, precision 8, 400x400, components 3","md5":"88d61453f2e52906f883152a427a347a","sha1":"76968e9244016ea6dce500f7bb2cbca9716626c7","sha256":"f0940359bc638a7aea636ae706611c0b3a5b80ec360c2bb9421b5f7b351151b1","sha512":"738bae1af9f36d4077178cb5f7b315dbdfefd7f641afca59d920dd718c5b95e433bd03092d66df3e5f7ff8ef3a50b6789a9ac9f6435be52b27f2d2e6e01e6516","ssdeep":"192:A/+cJuCZHFludGFrUvedGjQctRK+abLDPH0LAB7w77w29a11f:MzJu+FQhvwZctIzPDsLAB7wBi","tlshash":"36128e1d333942c6cf18dfb088e909f1fbb6396cad269f5d4eca84865e9c26443c909d","first_seen":"2023-04-30T19:28:18Z","last_seen":"2026-07-23T15:04:36.514019Z","times_seen":833,"resource_available":false,"data":null}},"time_used":299,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":268,"receive":31,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2025-08-19","alert":"Sinkholed","trigger":"midnight-gd.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":[{"sensor_name":"urlquery","alert":"Phishing - Generic Crypto/Wallet","verdict":"phishing","severity":"medium","comment":"Asset commenly seen with Generic Crypto/Wallet phishing","tags":["crypto","phishing"],"meta":null}]}},{"url":{"schema":"https","addr":"midnight-gd.com/static/logo/xumm.jpg","fqdn":"midnight-gd.com","domain":"midnight-gd.com","tld":"com"},"ip":{"addr":"192.3.141.250","port":443,"asn":36352,"as":"AS-COLOCROSSING","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://midnight-gd.com/connect.html","date":"2025-08-19T12:46:28.912Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"midnight-gd.com","organization":""},"issuer":{"commonName":"R10","organization":"Let's Encrypt"},"validity":{"start":"Fri, 08 Aug 2025 21:56:18 GMT","end":"Thu, 06 Nov 2025 21:56:17 GMT"},"fingerprint":{"sha1":"57:AB:C1:2A:94:4B:D1:B7:3F:B9:E2:25:D6:6C:A1:FE:87:79:5E:06","sha256":"45:20:67:6D:CB:DC:27:76:A1:38:40:DC:34:04:B4:D8:74:41:3A:A9:57:69:E6:92:F2:D4:D0:4F:FB:E3:6B:49"}}},"request":{"raw":"GET /static/logo/xumm.jpg HTTP/1.1\r\nHost: midnight-gd.com\r\nUser-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://midnight-gd.com/connect.html\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\ncache-control: public, max-age=31536000\r\nexpires: Wed, 19 Aug 2026 12:46:28 GMT\r\ncontent-type: image/jpeg\r\nlast-modified: Sat, 06 Jul 2024 19:34:48 GMT\r\naccept-ranges: bytes\r\ncontent-length: 4142\r\ndate: Tue, 19 Aug 2025 12:46:28 GMT\r\nserver: LiteSpeed\r\nx-content-type-options: nosniff\r\nx-xss-protection: 1; mode=block\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"LiteSpeed","description":"LiteSpeed is a high-scalability web server.","website":"https://litespeedtech.com","common_platform_enumeration":"cpe:2.3:a:litespeedtech:litespeed_web_server:*:*:*:*:*:*:*:*","icon":"LiteSpeed.svg","categories":["Web servers"]}],"data":{"size":4142,"size_decoded":0,"mime_type":"image/jpeg","magic":"JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, baseline, precision 8, 128x128, components 3","md5":"414845b7876ab18c20b3d12683842fff","sha1":"3cb527ba09b98ad0d2bb34359dd767d323f77fcf","sha256":"8001adb1607b29025454d71d1b23b765a50611e1baee623afcd1a736fd829fd3","sha512":"a6db4c098d77541d032c32ba4561d67d8a2408bd4dd832fd3fc3ede6361719fb3ba77015f01189e6455b1a2311f5f25290ae038e09d8a88fcf161dbafa81c916","ssdeep":"96:+W04DkKV+TgEsMkqxcFRy2rGc7+Bk5ifi0VZVLLq2n41PCZiw:I4DkIEs3qxcjKc7ck5l8JLq2Wkiw","tlshash":"59819fdadb8be498d18c787434b08e039b4f1686dadc29d03d6c80c818d4ded98746f8","first_seen":"2024-08-20T03:07:15.263084Z","last_seen":"2025-12-11T00:27:23.106381Z","times_seen":21,"resource_available":false,"data":null}},"time_used":300,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":296,"receive":4,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2025-08-19","alert":"Sinkholed","trigger":"midnight-gd.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"midnight-gd.com/static/logo/encrypted_ink.jpg","fqdn":"midnight-gd.com","domain":"midnight-gd.com","tld":"com"},"ip":{"addr":"192.3.141.250","port":443,"asn":36352,"as":"AS-COLOCROSSING","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://midnight-gd.com/connect.html","date":"2025-08-19T12:46:28.917Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"midnight-gd.com","organization":""},"issuer":{"commonName":"R10","organization":"Let's Encrypt"},"validity":{"start":"Fri, 08 Aug 2025 21:56:18 GMT","end":"Thu, 06 Nov 2025 21:56:17 GMT"},"fingerprint":{"sha1":"57:AB:C1:2A:94:4B:D1:B7:3F:B9:E2:25:D6:6C:A1:FE:87:79:5E:06","sha256":"45:20:67:6D:CB:DC:27:76:A1:38:40:DC:34:04:B4:D8:74:41:3A:A9:57:69:E6:92:F2:D4:D0:4F:FB:E3:6B:49"}}},"request":{"raw":"GET /static/logo/encrypted_ink.jpg HTTP/1.1\r\nHost: midnight-gd.com\r\nUser-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://midnight-gd.com/connect.html\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\ncache-control: public, max-age=31536000\r\nexpires: Wed, 19 Aug 2026 12:46:28 GMT\r\ncontent-type: image/jpeg\r\nlast-modified: Wed, 30 Aug 2023 02:32:10 GMT\r\naccept-ranges: bytes\r\ncontent-length: 25204\r\ndate: Tue, 19 Aug 2025 12:46:28 GMT\r\nserver: LiteSpeed\r\nx-content-type-options: nosniff\r\nx-xss-protection: 1; mode=block\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"LiteSpeed","description":"LiteSpeed is a high-scalability web server.","website":"https://litespeedtech.com","common_platform_enumeration":"cpe:2.3:a:litespeedtech:litespeed_web_server:*:*:*:*:*:*:*:*","icon":"LiteSpeed.svg","categories":["Web servers"]}],"data":{"size":25204,"size_decoded":0,"mime_type":"image/jpeg","magic":"JPEG image data, JFIF standard 1.01, aspect ratio, density 72x72, segment length 16, Exif Standard: [TIFF image data, big-endian, direntries=4, xresolution=62, yresolution=70, resolutionunit=2], baseline, precision 8, 400x400, components 3","md5":"b6944dce49bda64a1cfa7bb1e0c52a5c","sha1":"c58a843bc94d86d9678f12957b98a42713083cd0","sha256":"735a256038fa8782f3c38188fb588a870580162208649ad5bcbb3152c9b45854","sha512":"4582ec1276a3cca6e3d02a16db7fe367a92dd6f4453d3aaba59bf0c1c7b0ce27dfc418aa524011bfbe725532419dc7a302f3d2478404e8667811ec90bd5a7ce6","ssdeep":"384:bL7YOOWvP4or670greoKcnk+C5YOOPNPNMBMBc0apQKYtj0Wbp:bL7YOH5270gTNkdYOOFPNMCa+KYttbp","tlshash":"01b2d130ff1712c0e8e4cd7119d43d45b32f97d8ee5a7e2a3c5cc56a9b420e6901ae96","first_seen":"2023-05-09T01:47:42Z","last_seen":"2026-06-25T01:06:10.369382Z","times_seen":215,"resource_available":false,"data":null}},"time_used":326,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":308,"receive":18,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2025-08-19","alert":"Sinkholed","trigger":"midnight-gd.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":[{"sensor_name":"urlquery","alert":"Phishing - Generic Crypto/Wallet","verdict":"phishing","severity":"medium","comment":"Asset commenly seen with Generic Crypto/Wallet phishing","tags":["crypto","phishing"],"meta":null}]}},{"url":{"schema":"https","addr":"midnight-gd.com/static/connect-css/responsive.css","fqdn":"midnight-gd.com","domain":"midnight-gd.com","tld":"com"},"ip":{"addr":"192.3.141.250","port":443,"asn":36352,"as":"AS-COLOCROSSING","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://midnight-gd.com/connect.html","date":"2025-08-19T12:46:29.133Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"midnight-gd.com","organization":""},"issuer":{"commonName":"R10","organization":"Let's Encrypt"},"validity":{"start":"Fri, 08 Aug 2025 21:56:18 GMT","end":"Thu, 06 Nov 2025 21:56:17 GMT"},"fingerprint":{"sha1":"57:AB:C1:2A:94:4B:D1:B7:3F:B9:E2:25:D6:6C:A1:FE:87:79:5E:06","sha256":"45:20:67:6D:CB:DC:27:76:A1:38:40:DC:34:04:B4:D8:74:41:3A:A9:57:69:E6:92:F2:D4:D0:4F:FB:E3:6B:49"}}},"request":{"raw":"GET /static/connect-css/responsive.css HTTP/1.1\r\nHost: midnight-gd.com\r\nUser-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://midnight-gd.com/static/connect-css/style.css\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\ncache-control: public, max-age=2592000\r\nexpires: Thu, 18 Sep 2025 12:46:29 GMT\r\ncontent-type: text/css\r\nlast-modified: Wed, 30 Aug 2023 02:32:10 GMT\r\naccept-ranges: bytes\r\ncontent-encoding: br\r\nvary: Accept-Encoding\r\ncontent-length: 4890\r\ndate: Tue, 19 Aug 2025 12:46:29 GMT\r\nserver: LiteSpeed\r\nx-content-type-options: nosniff\r\nx-xss-protection: 1; mode=block\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"LiteSpeed","description":"LiteSpeed is a high-scalability web server.","website":"https://litespeedtech.com","common_platform_enumeration":"cpe:2.3:a:litespeedtech:litespeed_web_server:*:*:*:*:*:*:*:*","icon":"LiteSpeed.svg","categories":["Web servers"]}],"data":{"size":27897,"size_decoded":0,"mime_type":"text/css","magic":"ASCII text, with CRLF line terminators","md5":"722a0184ddb599d14ba83cbe8cde82ca","sha1":"bc46bdc425842a5703f88fa55a55db4084cafc12","sha256":"bed3ebe95141be53d3f47782193ced6a0e86098c1f6769ea5b5c0a9f4587cc53","sha512":"6e1c5606ea3a9e74c992d9610ba3c4788774accf3540bbe8e508d82ae9bd5ca2ef1b0fcab31d375b1e73263590b50f4541c31dbec67b76ede2c1688434ce617e","ssdeep":"384:cxk1QEPI5GrIFg6G8qf/DhYRxfsFDJuRRWZFluCuX72Dslmrmb:cx8PHrMC8qJF8WM2w","tlshash":"5dc21094e4122c5e31b5b725cfab726effa61167e38510b138f0d2598ff825480a8edd","first_seen":"2023-05-06T12:41:05Z","last_seen":"2026-07-27T10:26:52.858698Z","times_seen":316,"resource_available":false,"data":null}},"time_used":283,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":121,"receive":162,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2025-08-19","alert":"Sinkholed","trigger":"midnight-gd.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"midnight-gd.com/ajax.googleapis.com/ajax/libs/jquery/3.5.1/jquery.min.js","fqdn":"midnight-gd.com","domain":"midnight-gd.com","tld":"com"},"ip":{"addr":"192.3.141.250","port":443,"asn":36352,"as":"AS-COLOCROSSING","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://midnight-gd.com/connect.html","date":"2025-08-19T12:46:28.861Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"midnight-gd.com","organization":""},"issuer":{"commonName":"R10","organization":"Let's Encrypt"},"validity":{"start":"Fri, 08 Aug 2025 21:56:18 GMT","end":"Thu, 06 Nov 2025 21:56:17 GMT"},"fingerprint":{"sha1":"57:AB:C1:2A:94:4B:D1:B7:3F:B9:E2:25:D6:6C:A1:FE:87:79:5E:06","sha256":"45:20:67:6D:CB:DC:27:76:A1:38:40:DC:34:04:B4:D8:74:41:3A:A9:57:69:E6:92:F2:D4:D0:4F:FB:E3:6B:49"}}},"request":{"raw":"GET /ajax.googleapis.com/ajax/libs/jquery/3.5.1/jquery.min.js HTTP/1.1\r\nHost: midnight-gd.com\r\nUser-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://midnight-gd.com/connect.html\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\ncache-control: public, max-age=2592000\r\nexpires: Thu, 18 Sep 2025 12:46:28 GMT\r\ncontent-type: text/javascript\r\nlast-modified: Fri, 08 May 2020 11:05:02 GMT\r\naccept-ranges: bytes\r\ncontent-encoding: br\r\nvary: Accept-Encoding\r\ncontent-length: 30280\r\ndate: Tue, 19 Aug 2025 12:46:28 GMT\r\nserver: LiteSpeed\r\nx-content-type-options: nosniff\r\nx-xss-protection: 1; mode=block\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"LiteSpeed","description":"LiteSpeed is a high-scalability web server.","website":"https://litespeedtech.com","common_platform_enumeration":"cpe:2.3:a:litespeedtech:litespeed_web_server:*:*:*:*:*:*:*:*","icon":"LiteSpeed.svg","categories":["Web servers"]}],"data":{"size":89476,"size_decoded":0,"mime_type":"text/javascript","magic":"JavaScript source, ASCII text, with very long lines (65451)","md5":"dc5e7f18c8d36ac1d3d4753a87c98d0a","sha1":"c8e1c8b386dc5b7a9184c763c88d19a346eb3342","sha256":"f7f6a5894f1d19ddad6fa392b2ece2c5e578cbf7da4ea805b6885eb6985b6e3d","sha512":"6cb4f4426f559c06190df97229c05a436820d21498350ac9f118a5625758435171418a022ed523bae46e668f9f8ea871feab6aff58ad2740b67a30f196d65516","ssdeep":"1536:AjExXUqrnxDjoXEZxkMV4SYSt0zvDD6ip3h8cApwEjOPrBeU6QLiTFbc0QlQvakF:AYh8eip3huuf6IidlrvakdtQ47GK1","tlshash":"a993f9ddb2c6702257a720ba007f510bf236199d6c4d8450f265d8e9bcb8a4e827bf7d","first_seen":"2023-03-07T01:02:01Z","last_seen":"2026-08-04T18:33:53.264329Z","times_seen":265159,"resource_available":true,"data":null}},"time_used":216,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":120,"receive":96,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2025-08-19","alert":"Sinkholed","trigger":"midnight-gd.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":[{"sensor_name":"urlquery","alert":"Phishing - Generic Crypto/Wallet","verdict":"phishing","severity":"medium","comment":"Asset commenly seen with Generic Crypto/Wallet phishing","tags":["crypto","phishing"],"meta":null}]}},{"url":{"schema":"https","addr":"midnight-gd.com/static/logo/trust_vault.jpg","fqdn":"midnight-gd.com","domain":"midnight-gd.com","tld":"com"},"ip":{"addr":"192.3.141.250","port":443,"asn":36352,"as":"AS-COLOCROSSING","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://midnight-gd.com/connect.html","date":"2025-08-19T12:46:28.929Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"midnight-gd.com","organization":""},"issuer":{"commonName":"R10","organization":"Let's Encrypt"},"validity":{"start":"Fri, 08 Aug 2025 21:56:18 GMT","end":"Thu, 06 Nov 2025 21:56:17 GMT"},"fingerprint":{"sha1":"57:AB:C1:2A:94:4B:D1:B7:3F:B9:E2:25:D6:6C:A1:FE:87:79:5E:06","sha256":"45:20:67:6D:CB:DC:27:76:A1:38:40:DC:34:04:B4:D8:74:41:3A:A9:57:69:E6:92:F2:D4:D0:4F:FB:E3:6B:49"}}},"request":{"raw":"GET /static/logo/trust_vault.jpg HTTP/1.1\r\nHost: midnight-gd.com\r\nUser-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://midnight-gd.com/connect.html\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\ncache-control: public, max-age=31536000\r\nexpires: Wed, 19 Aug 2026 12:46:28 GMT\r\ncontent-type: image/jpeg\r\nlast-modified: Wed, 30 Aug 2023 02:32:10 GMT\r\naccept-ranges: bytes\r\ncontent-length: 13502\r\ndate: Tue, 19 Aug 2025 12:46:28 GMT\r\nserver: LiteSpeed\r\nx-content-type-options: nosniff\r\nx-xss-protection: 1; mode=block\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"LiteSpeed","description":"LiteSpeed is a high-scalability web server.","website":"https://litespeedtech.com","common_platform_enumeration":"cpe:2.3:a:litespeedtech:litespeed_web_server:*:*:*:*:*:*:*:*","icon":"LiteSpeed.svg","categories":["Web servers"]}],"data":{"size":13502,"size_decoded":0,"mime_type":"image/jpeg","magic":"JPEG image data, baseline, precision 8, 400x400, components 3","md5":"2c59b7c0c81a6c33598ca9574fe92c8c","sha1":"12262f0f730af892aca76e1e61343a21689f1e92","sha256":"d57de5ef07bf01fd1a0ceae790861ce5ecbf29bc076e03ef7e948e207b8b05db","sha512":"3e79ede6dc88160a95aeba45b21f0289489a40f2eed8ff379c4d0a7f4a6b4ad57b7c1aa2f7cf00c9705c3c9a23128a883678061b626704c9051ed4448c1aadb9","ssdeep":"384:YiDLmh/PA6vmD6FdDp5Pl4PsKHNHq3ps/Kk:5+h/PAcmWFdVosCNHq3ux","tlshash":"7c52ce25f46c77ccdb51e23a9188825142e60ffaa05c39bd538370b901af73ca84f96d","first_seen":"2023-04-30T19:28:18Z","last_seen":"2026-07-23T15:04:36.550866Z","times_seen":861,"resource_available":false,"data":null}},"time_used":406,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":399,"receive":7,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2025-08-19","alert":"Sinkholed","trigger":"midnight-gd.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":[{"sensor_name":"urlquery","alert":"Phishing - Generic Crypto/Wallet","verdict":"phishing","severity":"medium","comment":"Asset commenly seen with Generic Crypto/Wallet phishing","tags":["crypto","phishing"],"meta":null}]}},{"url":{"schema":"https","addr":"play-lh.googleusercontent.com/HmXjCZa048la55QfEg_6CJo8Qt7NN0HVUR2cu8uk5gm5BoNhEXulPrgT0Qbnoaf3tHfl","fqdn":"play-lh.googleusercontent.com","domain":"googleusercontent.com","tld":"com"},"ip":{"addr":"142.250.178.86","port":443,"asn":15169,"as":"GOOGLE","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://midnight-gd.com/connect.html","date":"2025-08-19T12:46:29.820Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"edgestatic.com","organization":""},"issuer":{"commonName":"WR2","organization":"Google Trust Services"},"validity":{"start":"Mon, 07 Jul 2025 08:34:02 GMT","end":"Mon, 29 Sep 2025 08:34:01 GMT"},"fingerprint":{"sha1":"70:9A:A8:F3:87:95:3F:23:2E:C5:AC:05:21:0A:30:1F:2B:07:70:3D","sha256":"1E:33:C7:99:EB:7F:84:FF:FB:CE:C1:0D:61:84:8D:A7:82:17:51:19:57:AD:89:11:98:C9:67:58:4C:8C:A3:05"}}},"request":{"raw":"GET /HmXjCZa048la55QfEg_6CJo8Qt7NN0HVUR2cu8uk5gm5BoNhEXulPrgT0Qbnoaf3tHfl HTTP/1.1\r\nHost: play-lh.googleusercontent.com\r\nUser-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://midnight-gd.com/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\naccess-control-allow-origin: *\r\ntiming-allow-origin: *\r\naccess-control-expose-headers: Content-Length\r\ncontent-disposition: inline;filename=\"unnamed.png\"\r\nx-content-type-options: nosniff\r\nserver: fife\r\ncontent-length: 73767\r\nx-xss-protection: 0\r\ndate: Tue, 19 Aug 2025 12:46:30 GMT\r\nexpires: Wed, 20 Aug 2025 12:46:30 GMT\r\ncache-control: public, max-age=86400, no-transform\r\netag: \"v1\"\r\ncontent-type: image/png\r\nvary: Origin\r\nage: 0\r\nalt-svc: h3=\":443\"; ma=2592000,h3-29=\":443\"; ma=2592000\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":null,"data":{"size":73767,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 512 x 512, 8-bit/color RGBA, non-interlaced","md5":"8627f96f683abec1dbf3b2f71d04afb1","sha1":"3af1f48f98e16e7c5dbcc8d0b89171140260fcc9","sha256":"056c97cb6b1ed9d01a0e52da2e17b681fffafa68f2e24a3c0c5376e40e7ca382","sha512":"6d4bbbf95239ab7057b306e90c5569d1b313a6151ab20bebd4c6fda0ab85c4a6f3abfa12fa03394aa95062b233edacd38afa1d078e88bba84b5249ad0d448df8","ssdeep":"768:nSEAfRDsRZtFlLJlYPlnoRw5on7WirpZpzJQy+4Mkw/5RbtwBiTZ5364bkjfdXUD:nfV0lnob7WQjpzCy+4ARhw+4jjZfaNvD","tlshash":"5b7302f6b3606770a66ac1f6d423df3ad4d9d9d2afa0c5461b6986bd83e50cb32c0c41","first_seen":"2023-04-30T19:28:18Z","last_seen":"2026-08-03T03:06:07.335533Z","times_seen":425,"resource_available":false,"data":null}},"time_used":390,"timings":{"blocked":90,"dns":72,"connect":19,"send":0,"wait":116,"receive":16,"ssl":73},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"midnight-gd.com/static/logo/argent.jpg","fqdn":"midnight-gd.com","domain":"midnight-gd.com","tld":"com"},"ip":{"addr":"192.3.141.250","port":443,"asn":36352,"as":"AS-COLOCROSSING","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://midnight-gd.com/connect.html","date":"2025-08-19T12:46:28.914Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"midnight-gd.com","organization":""},"issuer":{"commonName":"R10","organization":"Let's Encrypt"},"validity":{"start":"Fri, 08 Aug 2025 21:56:18 GMT","end":"Thu, 06 Nov 2025 21:56:17 GMT"},"fingerprint":{"sha1":"57:AB:C1:2A:94:4B:D1:B7:3F:B9:E2:25:D6:6C:A1:FE:87:79:5E:06","sha256":"45:20:67:6D:CB:DC:27:76:A1:38:40:DC:34:04:B4:D8:74:41:3A:A9:57:69:E6:92:F2:D4:D0:4F:FB:E3:6B:49"}}},"request":{"raw":"GET /static/logo/argent.jpg HTTP/1.1\r\nHost: midnight-gd.com\r\nUser-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://midnight-gd.com/connect.html\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\ncache-control: public, max-age=31536000\r\nexpires: Wed, 19 Aug 2026 12:46:28 GMT\r\ncontent-type: image/jpeg\r\nlast-modified: Wed, 30 Aug 2023 02:32:10 GMT\r\naccept-ranges: bytes\r\ncontent-length: 4799\r\ndate: Tue, 19 Aug 2025 12:46:28 GMT\r\nserver: LiteSpeed\r\nx-content-type-options: nosniff\r\nx-xss-protection: 1; mode=block\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"LiteSpeed","description":"LiteSpeed is a high-scalability web server.","website":"https://litespeedtech.com","common_platform_enumeration":"cpe:2.3:a:litespeedtech:litespeed_web_server:*:*:*:*:*:*:*:*","icon":"LiteSpeed.svg","categories":["Web servers"]}],"data":{"size":4799,"size_decoded":0,"mime_type":"image/jpeg","magic":"JPEG image data, baseline, precision 8, 400x400, components 3","md5":"ba14456aaa8918f10ec0f0406cfab704","sha1":"821df4dbf546ec0cbf0e0638b3607435d280c6c9","sha256":"2f1cc7a575e26a18f4c7903434a91dcf10761445254808b636567087fc8f5d5e","sha512":"5745593deca450974fad33c7718c292576a1be8bae48fc3b47ddfb2e5fcff58ef1b9c1adef74311b81a3e78e3ae1541a8bbb394a1d88a6c3d6ec5d3075f06cf9","ssdeep":"96:4BHKB7E4zhgPFB0T6N942Y1L34rJ/JTIowjBezyQafsFldb1:wO7bzhy0W94l1LgGowGyQJldJ","tlshash":"eca16d2b35e1db27dc05ef32006301209ba2ce9ebc09af6cdae826484ae91c0cb4d5d4","first_seen":"2023-05-01T21:31:16Z","last_seen":"2026-07-23T15:04:36.549695Z","times_seen":566,"resource_available":false,"data":null}},"time_used":307,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":190,"receive":117,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2025-08-19","alert":"Sinkholed","trigger":"midnight-gd.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":[{"sensor_name":"urlquery","alert":"Phishing - Generic Crypto/Wallet","verdict":"phishing","severity":"medium","comment":"Asset commenly seen with Generic Crypto/Wallet phishing","tags":["crypto","phishing"],"meta":null}]}},{"url":{"schema":"https","addr":"midnight-gd.com/static/logo/1inch.jpg","fqdn":"midnight-gd.com","domain":"midnight-gd.com","tld":"com"},"ip":{"addr":"192.3.141.250","port":443,"asn":36352,"as":"AS-COLOCROSSING","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://midnight-gd.com/connect.html","date":"2025-08-19T12:46:28.927Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"midnight-gd.com","organization":""},"issuer":{"commonName":"R10","organization":"Let's Encrypt"},"validity":{"start":"Fri, 08 Aug 2025 21:56:18 GMT","end":"Thu, 06 Nov 2025 21:56:17 GMT"},"fingerprint":{"sha1":"57:AB:C1:2A:94:4B:D1:B7:3F:B9:E2:25:D6:6C:A1:FE:87:79:5E:06","sha256":"45:20:67:6D:CB:DC:27:76:A1:38:40:DC:34:04:B4:D8:74:41:3A:A9:57:69:E6:92:F2:D4:D0:4F:FB:E3:6B:49"}}},"request":{"raw":"GET /static/logo/1inch.jpg HTTP/1.1\r\nHost: midnight-gd.com\r\nUser-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://midnight-gd.com/connect.html\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\ncache-control: public, max-age=31536000\r\nexpires: Wed, 19 Aug 2026 12:46:28 GMT\r\ncontent-type: image/jpeg\r\nlast-modified: Wed, 30 Aug 2023 02:32:10 GMT\r\naccept-ranges: bytes\r\ncontent-length: 17962\r\ndate: Tue, 19 Aug 2025 12:46:28 GMT\r\nserver: LiteSpeed\r\nx-content-type-options: nosniff\r\nx-xss-protection: 1; mode=block\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"LiteSpeed","description":"LiteSpeed is a high-scalability web server.","website":"https://litespeedtech.com","common_platform_enumeration":"cpe:2.3:a:litespeedtech:litespeed_web_server:*:*:*:*:*:*:*:*","icon":"LiteSpeed.svg","categories":["Web servers"]}],"data":{"size":17962,"size_decoded":0,"mime_type":"image/jpeg","magic":"JPEG image data, baseline, precision 8, 400x400, components 3","md5":"33980d05709d80b3caa512c95943cdc6","sha1":"243d8d4f8c578e16df5192cfe512664e864da473","sha256":"b494e732168825a8daae0c748a215053c536842ee7a9b0b7aba94067a757289e","sha512":"1357faac77af996c6dbd63842276e78f6fc7816ce3441e940a88dd374a517364bd6f00d331d935f0787d79536c383e3cc4d2c0bde3a996014f04641b9d6f1b8d","ssdeep":"384:0BpkSgIpA5O770veolRsxVa66crZl5FqjGkPNQB6ai:wpkK+xlExVr6cLGxPqri","tlshash":"ff82bfcafc4828d96e9ec1b7008350066ae985356fbbfa2c1957fed9f138e4c8584748","first_seen":"2023-05-01T21:31:16Z","last_seen":"2026-07-21T05:16:19.656823Z","times_seen":843,"resource_available":false,"data":null}},"time_used":402,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":392,"receive":10,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2025-08-19","alert":"Sinkholed","trigger":"midnight-gd.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":[{"sensor_name":"urlquery","alert":"Phishing - Generic Crypto/Wallet","verdict":"phishing","severity":"medium","comment":"Asset commenly seen with Generic Crypto/Wallet phishing","tags":["crypto","phishing"],"meta":null}]}},{"url":{"schema":"https","addr":"midnight-gd.com/static/logo/dok_wallet.jpg","fqdn":"midnight-gd.com","domain":"midnight-gd.com","tld":"com"},"ip":{"addr":"192.3.141.250","port":443,"asn":36352,"as":"AS-COLOCROSSING","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://midnight-gd.com/connect.html","date":"2025-08-19T12:46:28.946Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"midnight-gd.com","organization":""},"issuer":{"commonName":"R10","organization":"Let's Encrypt"},"validity":{"start":"Fri, 08 Aug 2025 21:56:18 GMT","end":"Thu, 06 Nov 2025 21:56:17 GMT"},"fingerprint":{"sha1":"57:AB:C1:2A:94:4B:D1:B7:3F:B9:E2:25:D6:6C:A1:FE:87:79:5E:06","sha256":"45:20:67:6D:CB:DC:27:76:A1:38:40:DC:34:04:B4:D8:74:41:3A:A9:57:69:E6:92:F2:D4:D0:4F:FB:E3:6B:49"}}},"request":{"raw":"GET /static/logo/dok_wallet.jpg HTTP/1.1\r\nHost: midnight-gd.com\r\nUser-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://midnight-gd.com/connect.html\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\ncache-control: public, max-age=31536000\r\nexpires: Wed, 19 Aug 2026 12:46:28 GMT\r\ncontent-type: image/jpeg\r\nlast-modified: Wed, 30 Aug 2023 02:32:10 GMT\r\naccept-ranges: bytes\r\ncontent-length: 7738\r\ndate: Tue, 19 Aug 2025 12:46:28 GMT\r\nserver: LiteSpeed\r\nx-content-type-options: nosniff\r\nx-xss-protection: 1; mode=block\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"LiteSpeed","description":"LiteSpeed is a high-scalability web server.","website":"https://litespeedtech.com","common_platform_enumeration":"cpe:2.3:a:litespeedtech:litespeed_web_server:*:*:*:*:*:*:*:*","icon":"LiteSpeed.svg","categories":["Web servers"]}],"data":{"size":7738,"size_decoded":0,"mime_type":"image/jpeg","magic":"JPEG image data, baseline, precision 8, 400x400, components 3","md5":"228691a2d60656d05507fb1b3b033494","sha1":"c2162d22f053049a5a22eda04c2118f5fb8542d2","sha256":"2c43d50ce18477d5b45372d1122854882e74220a8fdd4dacb38a198fb30accc1","sha512":"7e3b2bd8f78a419a7dc48819d324b5825ddae140b33e77931b4c3c6b06b192ef3c23c96776d4ae7b6cfaaa607f18b6af81a823e6a434555b260510a16e39c76e","ssdeep":"192:q/72YjtcBBqfE6K3DCz5X5vKkniikL0+1kPlknPs14x:qTmqfE3DCurib7Plu","tlshash":"4ef18d6b7d00ae11c92dc27e122d6f8aae68a520c8d765ef42de1b87048c90bbd44e52","first_seen":"2023-04-30T19:28:18Z","last_seen":"2026-07-23T15:04:36.553736Z","times_seen":672,"resource_available":false,"data":null}},"time_used":439,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":437,"receive":2,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2025-08-19","alert":"Sinkholed","trigger":"midnight-gd.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":[{"sensor_name":"urlquery","alert":"Phishing - Generic Crypto/Wallet","verdict":"phishing","severity":"medium","comment":"Asset commenly seen with Generic Crypto/Wallet phishing","tags":["crypto","phishing"],"meta":null}]}},{"url":{"schema":"https","addr":"midnight-gd.com/static/logo/torus.jpg","fqdn":"midnight-gd.com","domain":"midnight-gd.com","tld":"com"},"ip":{"addr":"192.3.141.250","port":443,"asn":36352,"as":"AS-COLOCROSSING","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://midnight-gd.com/connect.html","date":"2025-08-19T12:46:29.030Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"midnight-gd.com","organization":""},"issuer":{"commonName":"R10","organization":"Let's Encrypt"},"validity":{"start":"Fri, 08 Aug 2025 21:56:18 GMT","end":"Thu, 06 Nov 2025 21:56:17 GMT"},"fingerprint":{"sha1":"57:AB:C1:2A:94:4B:D1:B7:3F:B9:E2:25:D6:6C:A1:FE:87:79:5E:06","sha256":"45:20:67:6D:CB:DC:27:76:A1:38:40:DC:34:04:B4:D8:74:41:3A:A9:57:69:E6:92:F2:D4:D0:4F:FB:E3:6B:49"}}},"request":{"raw":"GET /static/logo/torus.jpg HTTP/1.1\r\nHost: midnight-gd.com\r\nUser-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://midnight-gd.com/connect.html\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\ncache-control: public, max-age=31536000\r\nexpires: Wed, 19 Aug 2026 12:46:29 GMT\r\ncontent-type: image/jpeg\r\nlast-modified: Sat, 06 Jul 2024 19:34:48 GMT\r\naccept-ranges: bytes\r\ncontent-length: 4892\r\ndate: Tue, 19 Aug 2025 12:46:29 GMT\r\nserver: LiteSpeed\r\nx-content-type-options: nosniff\r\nx-xss-protection: 1; mode=block\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"LiteSpeed","description":"LiteSpeed is a high-scalability web server.","website":"https://litespeedtech.com","common_platform_enumeration":"cpe:2.3:a:litespeedtech:litespeed_web_server:*:*:*:*:*:*:*:*","icon":"LiteSpeed.svg","categories":["Web servers"]}],"data":{"size":4892,"size_decoded":0,"mime_type":"image/jpeg","magic":"JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, baseline, precision 8, 225x225, components 3","md5":"805c615db26545753ea160ab817bad2c","sha1":"fcd0a4e01ee8c479f77c10b174b806721a1e7f1c","sha256":"378b2840fca898e03e73f93c2d35b1668dbe12f819dabed768b8d39fd3d96003","sha512":"76000519c73c450adfe80029c59ba85023ba38d676d20813b701ca6d561bcb9aa2754d5443b1214fa73bc20d4747d4422dc92a57c863abae5999a0c7eafcf62c","ssdeep":"96:meCz7P58J0xJQ4uyINR3GN02kNgVtgk6DS+rs3okgWuYuTpke:mBvBJLINxe74SgTSJ3oRZYske","tlshash":"25a16debb26c0f9ac4649fb8aa28471ec30665523b212b786d83c756d10f60d9c4b18f","first_seen":"2024-03-12T05:24:20Z","last_seen":"2026-06-09T14:27:02.992352Z","times_seen":32,"resource_available":false,"data":null}},"time_used":457,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":171,"receive":286,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2025-08-19","alert":"Sinkholed","trigger":"midnight-gd.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"midnight-gd.com/static/logo/math_wallet.jpg","fqdn":"midnight-gd.com","domain":"midnight-gd.com","tld":"com"},"ip":{"addr":"192.3.141.250","port":443,"asn":36352,"as":"AS-COLOCROSSING","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://midnight-gd.com/connect.html","date":"2025-08-19T12:46:28.925Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"midnight-gd.com","organization":""},"issuer":{"commonName":"R10","organization":"Let's Encrypt"},"validity":{"start":"Fri, 08 Aug 2025 21:56:18 GMT","end":"Thu, 06 Nov 2025 21:56:17 GMT"},"fingerprint":{"sha1":"57:AB:C1:2A:94:4B:D1:B7:3F:B9:E2:25:D6:6C:A1:FE:87:79:5E:06","sha256":"45:20:67:6D:CB:DC:27:76:A1:38:40:DC:34:04:B4:D8:74:41:3A:A9:57:69:E6:92:F2:D4:D0:4F:FB:E3:6B:49"}}},"request":{"raw":"GET /static/logo/math_wallet.jpg HTTP/1.1\r\nHost: midnight-gd.com\r\nUser-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://midnight-gd.com/connect.html\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\ncache-control: public, max-age=31536000\r\nexpires: Wed, 19 Aug 2026 12:46:28 GMT\r\ncontent-type: image/jpeg\r\nlast-modified: Wed, 30 Aug 2023 02:32:10 GMT\r\naccept-ranges: bytes\r\ncontent-length: 13353\r\ndate: Tue, 19 Aug 2025 12:46:28 GMT\r\nserver: LiteSpeed\r\nx-content-type-options: nosniff\r\nx-xss-protection: 1; mode=block\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"LiteSpeed","description":"LiteSpeed is a high-scalability web server.","website":"https://litespeedtech.com","common_platform_enumeration":"cpe:2.3:a:litespeedtech:litespeed_web_server:*:*:*:*:*:*:*:*","icon":"LiteSpeed.svg","categories":["Web servers"]}],"data":{"size":13353,"size_decoded":0,"mime_type":"image/jpeg","magic":"JPEG image data, baseline, precision 8, 400x400, components 3","md5":"60f4289459b9326996863cfa52422fe5","sha1":"e057d71ca36992fb6f62dd7c1b84b9d39f921ac8","sha256":"43cfdb39a637087c1c4c055c40b0db772977310a32c6b84b7650cfb3871265ad","sha512":"cc3dc03690c183c48520000c46ec3c203be0a65f538a5e1151367824e66894f7cd759eb80e7c64faddca7e2e7cfe163d16cb724497af628edc2401d92e109d8a","ssdeep":"384:RGR5q7FLLGEyEZEc+85dFYjD2hJKmFb7j6zI92M:+uFAMdFYjD3mhOM","tlshash":"9552cfde7d1401f0e46bc7b16f1c18aaab8de72b92827d4fa8bd40515ef44221de29d1","first_seen":"2023-04-30T19:28:18Z","last_seen":"2026-07-30T05:48:28.375842Z","times_seen":1056,"resource_available":false,"data":null}},"time_used":385,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":365,"receive":20,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2025-08-19","alert":"Sinkholed","trigger":"midnight-gd.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":[{"sensor_name":"urlquery","alert":"Phishing - Generic Crypto/Wallet","verdict":"phishing","severity":"medium","comment":"Asset commenly seen with Generic Crypto/Wallet phishing","tags":["crypto","phishing"],"meta":null}]}},{"url":{"schema":"https","addr":"midnight-gd.com/static/logo/crypto.jpg","fqdn":"midnight-gd.com","domain":"midnight-gd.com","tld":"com"},"ip":{"addr":"192.3.141.250","port":443,"asn":36352,"as":"AS-COLOCROSSING","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://midnight-gd.com/connect.html","date":"2025-08-19T12:46:28.923Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"midnight-gd.com","organization":""},"issuer":{"commonName":"R10","organization":"Let's Encrypt"},"validity":{"start":"Fri, 08 Aug 2025 21:56:18 GMT","end":"Thu, 06 Nov 2025 21:56:17 GMT"},"fingerprint":{"sha1":"57:AB:C1:2A:94:4B:D1:B7:3F:B9:E2:25:D6:6C:A1:FE:87:79:5E:06","sha256":"45:20:67:6D:CB:DC:27:76:A1:38:40:DC:34:04:B4:D8:74:41:3A:A9:57:69:E6:92:F2:D4:D0:4F:FB:E3:6B:49"}}},"request":{"raw":"GET /static/logo/crypto.jpg HTTP/1.1\r\nHost: midnight-gd.com\r\nUser-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://midnight-gd.com/connect.html\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\ncache-control: public, max-age=31536000\r\nexpires: Wed, 19 Aug 2026 12:46:28 GMT\r\ncontent-type: image/jpeg\r\nlast-modified: Wed, 30 Aug 2023 02:32:10 GMT\r\naccept-ranges: bytes\r\ncontent-length: 10892\r\ndate: Tue, 19 Aug 2025 12:46:28 GMT\r\nserver: LiteSpeed\r\nx-content-type-options: nosniff\r\nx-xss-protection: 1; mode=block\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"LiteSpeed","description":"LiteSpeed is a high-scalability web server.","website":"https://litespeedtech.com","common_platform_enumeration":"cpe:2.3:a:litespeedtech:litespeed_web_server:*:*:*:*:*:*:*:*","icon":"LiteSpeed.svg","categories":["Web servers"]}],"data":{"size":10892,"size_decoded":0,"mime_type":"image/jpeg","magic":"JPEG image data, baseline, precision 8, 400x400, components 3","md5":"af51356c02ac29ff62a6f193926d5284","sha1":"578c72abc285cc31f3f53995894dbd33b2798180","sha256":"78ac04d45d90c6b9861b6ccba310ed30d7d797fd962babefd4bb024d487284d5","sha512":"7bb6b88cb6e6326341102c4db2173cf0d241b65e7076f4d11021e119a8ee296271a615a6849c6a53e5896a3df59db065b891c80e689a3f3e173487fa98187be5","ssdeep":"192:Talqi4iMvB3A55tAdnGYR0QZAVuxD4M89DBmXhF0jq1FNqAmPZUB:ulj45v65tAXAVM4MuBmXYyePCB","tlshash":"8122aff3b93e2564f5d4ee72d5857a36463e4330389f148e95f323e15aa1d2888478d2","first_seen":"2023-04-30T19:28:18Z","last_seen":"2026-07-30T05:48:28.423136Z","times_seen":815,"resource_available":false,"data":null}},"time_used":368,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":359,"receive":9,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2025-08-19","alert":"Sinkholed","trigger":"midnight-gd.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":[{"sensor_name":"urlquery","alert":"Phishing - Generic Crypto/Wallet","verdict":"phishing","severity":"medium","comment":"Asset commenly seen with Generic Crypto/Wallet phishing","tags":["crypto","phishing"],"meta":null}]}},{"url":{"schema":"https","addr":"midnight-gd.com/static/logo/etoro.jpg","fqdn":"midnight-gd.com","domain":"midnight-gd.com","tld":"com"},"ip":{"addr":"192.3.141.250","port":443,"asn":36352,"as":"AS-COLOCROSSING","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://midnight-gd.com/connect.html","date":"2025-08-19T12:46:29.027Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"midnight-gd.com","organization":""},"issuer":{"commonName":"R10","organization":"Let's Encrypt"},"validity":{"start":"Fri, 08 Aug 2025 21:56:18 GMT","end":"Thu, 06 Nov 2025 21:56:17 GMT"},"fingerprint":{"sha1":"57:AB:C1:2A:94:4B:D1:B7:3F:B9:E2:25:D6:6C:A1:FE:87:79:5E:06","sha256":"45:20:67:6D:CB:DC:27:76:A1:38:40:DC:34:04:B4:D8:74:41:3A:A9:57:69:E6:92:F2:D4:D0:4F:FB:E3:6B:49"}}},"request":{"raw":"GET /static/logo/etoro.jpg HTTP/1.1\r\nHost: midnight-gd.com\r\nUser-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://midnight-gd.com/connect.html\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\ncache-control: public, max-age=31536000\r\nexpires: Wed, 19 Aug 2026 12:46:28 GMT\r\ncontent-type: image/jpeg\r\nlast-modified: Sat, 06 Jul 2024 19:34:48 GMT\r\naccept-ranges: bytes\r\ncontent-length: 3263\r\ndate: Tue, 19 Aug 2025 12:46:28 GMT\r\nserver: LiteSpeed\r\nx-content-type-options: nosniff\r\nx-xss-protection: 1; mode=block\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"LiteSpeed","description":"LiteSpeed is a high-scalability web server.","website":"https://litespeedtech.com","common_platform_enumeration":"cpe:2.3:a:litespeedtech:litespeed_web_server:*:*:*:*:*:*:*:*","icon":"LiteSpeed.svg","categories":["Web servers"]}],"data":{"size":3263,"size_decoded":0,"mime_type":"image/jpeg","magic":"PNG image data, 360 x 120, 8-bit colormap, non-interlaced","md5":"0f12570506626d40710f2130be2ec193","sha1":"74a71f027c7dd4d8888589d5a0040016820ea23f","sha256":"2e22d4d71b7b81f0d56e17e560dc2419afed5e6dfe1a3c9b7b4fd906f2053b94","sha512":"d8929eb162bed550c0515aa95b698312df82289381c7cdd0ee7a340c8855f49205200eb92bb57f037f04e8a49a126a00b49b7aeb9a1ddfea08c54b5907b92804","ssdeep":"","tlshash":"47616dfe5edc623883a05288c14cad665dd620b4d1f7244052e3a6c79743274fe75122","first_seen":"2024-08-20T03:07:15.301357Z","last_seen":"2025-08-24T02:34:52.795101Z","times_seen":12,"resource_available":false,"data":null}},"time_used":169,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":166,"receive":3,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2025-08-19","alert":"Sinkholed","trigger":"midnight-gd.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"midnight-gd.com/static/logo/polygon.jpg","fqdn":"midnight-gd.com","domain":"midnight-gd.com","tld":"com"},"ip":{"addr":"192.3.141.250","port":443,"asn":36352,"as":"AS-COLOCROSSING","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://midnight-gd.com/connect.html","date":"2025-08-19T12:46:28.909Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"midnight-gd.com","organization":""},"issuer":{"commonName":"R10","organization":"Let's Encrypt"},"validity":{"start":"Fri, 08 Aug 2025 21:56:18 GMT","end":"Thu, 06 Nov 2025 21:56:17 GMT"},"fingerprint":{"sha1":"57:AB:C1:2A:94:4B:D1:B7:3F:B9:E2:25:D6:6C:A1:FE:87:79:5E:06","sha256":"45:20:67:6D:CB:DC:27:76:A1:38:40:DC:34:04:B4:D8:74:41:3A:A9:57:69:E6:92:F2:D4:D0:4F:FB:E3:6B:49"}}},"request":{"raw":"GET /static/logo/polygon.jpg HTTP/1.1\r\nHost: midnight-gd.com\r\nUser-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://midnight-gd.com/connect.html\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\ncache-control: public, max-age=31536000\r\nexpires: Wed, 19 Aug 2026 12:46:28 GMT\r\ncontent-type: image/jpeg\r\nlast-modified: Wed, 30 Aug 2023 02:32:10 GMT\r\naccept-ranges: bytes\r\ncontent-length: 5034\r\ndate: Tue, 19 Aug 2025 12:46:28 GMT\r\nserver: LiteSpeed\r\nx-content-type-options: nosniff\r\nx-xss-protection: 1; mode=block\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"LiteSpeed","description":"LiteSpeed is a high-scalability web server.","website":"https://litespeedtech.com","common_platform_enumeration":"cpe:2.3:a:litespeedtech:litespeed_web_server:*:*:*:*:*:*:*:*","icon":"LiteSpeed.svg","categories":["Web servers"]}],"data":{"size":5034,"size_decoded":0,"mime_type":"image/jpeg","magic":"JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, baseline, precision 8, 225x225, components 3","md5":"fd94329c78deac6b68e263f5f1b349b0","sha1":"fbbc73dec803d8ebbc77ba4b98907855aad40d14","sha256":"9a2b584e3dfd7e3953e9078e835bc389a69ce68687fc82bb65fb786b93e1ce39","sha512":"4e3e11e05ab7c7b01ccfa476cdc9954b0c01612d869e48bc05678356190ec92bfbe1a69bcabef91423e31f6722427ae037c43501811f300b9fab10c26c3fcee5","ssdeep":"96:jThv0UjiChXU6UXuvsOBREmyWrqH64tV4Y4zyME0:HLjzXWXuEVqq7tV4zzRE0","tlshash":"86a17e6bc8041880d41c9eb46c97733773a51094bea3be519d543c7cf053fae67427a9","first_seen":"2023-05-18T08:37:00Z","last_seen":"2026-06-25T01:06:10.312762Z","times_seen":252,"resource_available":false,"data":null}},"time_used":267,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":261,"receive":6,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2025-08-19","alert":"Sinkholed","trigger":"midnight-gd.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":[{"sensor_name":"urlquery","alert":"Phishing - Generic Crypto/Wallet","verdict":"phishing","severity":"medium","comment":"Asset commenly seen with Generic Crypto/Wallet phishing","tags":["crypto","phishing"],"meta":null}]}},{"url":{"schema":"https","addr":"midnight-gd.com/static/logo/coin98.jpg","fqdn":"midnight-gd.com","domain":"midnight-gd.com","tld":"com"},"ip":{"addr":"192.3.141.250","port":443,"asn":36352,"as":"AS-COLOCROSSING","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://midnight-gd.com/connect.html","date":"2025-08-19T12:46:28.921Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"midnight-gd.com","organization":""},"issuer":{"commonName":"R10","organization":"Let's Encrypt"},"validity":{"start":"Fri, 08 Aug 2025 21:56:18 GMT","end":"Thu, 06 Nov 2025 21:56:17 GMT"},"fingerprint":{"sha1":"57:AB:C1:2A:94:4B:D1:B7:3F:B9:E2:25:D6:6C:A1:FE:87:79:5E:06","sha256":"45:20:67:6D:CB:DC:27:76:A1:38:40:DC:34:04:B4:D8:74:41:3A:A9:57:69:E6:92:F2:D4:D0:4F:FB:E3:6B:49"}}},"request":{"raw":"GET /static/logo/coin98.jpg HTTP/1.1\r\nHost: midnight-gd.com\r\nUser-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://midnight-gd.com/connect.html\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\ncache-control: public, max-age=31536000\r\nexpires: Wed, 19 Aug 2026 12:46:28 GMT\r\ncontent-type: image/jpeg\r\nlast-modified: Wed, 30 Aug 2023 02:32:10 GMT\r\naccept-ranges: bytes\r\ncontent-length: 12620\r\ndate: Tue, 19 Aug 2025 12:46:28 GMT\r\nserver: LiteSpeed\r\nx-content-type-options: nosniff\r\nx-xss-protection: 1; mode=block\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"LiteSpeed","description":"LiteSpeed is a high-scalability web server.","website":"https://litespeedtech.com","common_platform_enumeration":"cpe:2.3:a:litespeedtech:litespeed_web_server:*:*:*:*:*:*:*:*","icon":"LiteSpeed.svg","categories":["Web servers"]}],"data":{"size":12620,"size_decoded":0,"mime_type":"image/jpeg","magic":"JPEG image data, baseline, precision 8, 400x399, components 3","md5":"c853c7334cb327be4e6d8d0ba7e56a63","sha1":"ff376e955dc008c41798d8bb003d6cbb7659ffbb","sha256":"4d20fa8823a9797faa93a7e0c9a61cf0fc1bacdc0549146acdfbde783284c4a8","sha512":"14330d10467faf1e6aa82381a14e98df96614e4c9650b79f15bf0c6db782ec5125c1fc4fb1564924df97e813bc6aa6ab38c9a71a800586400a45c1dc3e443492","ssdeep":"384:1bHN53JAsIxffcI120ayqieFgX8dyoO7k5:V73KrZZ2lyteFgT7e","tlshash":"b0429f07f90bb119fd58dbf3c8cb15bd3ba940395a024558a38726948be6006dc4eb9b","first_seen":"2023-05-01T21:31:16Z","last_seen":"2026-07-21T05:16:19.704573Z","times_seen":783,"resource_available":false,"data":null}},"time_used":356,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":186,"receive":170,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2025-08-19","alert":"Sinkholed","trigger":"midnight-gd.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":[{"sensor_name":"urlquery","alert":"Phishing - Generic Crypto/Wallet","verdict":"phishing","severity":"medium","comment":"Asset commenly seen with Generic Crypto/Wallet phishing","tags":["crypto","phishing"],"meta":null}]}},{"url":{"schema":"https","addr":"midnight-gd.com/static/logo/mykey.jpg","fqdn":"midnight-gd.com","domain":"midnight-gd.com","tld":"com"},"ip":{"addr":"192.3.141.250","port":443,"asn":36352,"as":"AS-COLOCROSSING","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://midnight-gd.com/connect.html","date":"2025-08-19T12:46:28.930Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"midnight-gd.com","organization":""},"issuer":{"commonName":"R10","organization":"Let's Encrypt"},"validity":{"start":"Fri, 08 Aug 2025 21:56:18 GMT","end":"Thu, 06 Nov 2025 21:56:17 GMT"},"fingerprint":{"sha1":"57:AB:C1:2A:94:4B:D1:B7:3F:B9:E2:25:D6:6C:A1:FE:87:79:5E:06","sha256":"45:20:67:6D:CB:DC:27:76:A1:38:40:DC:34:04:B4:D8:74:41:3A:A9:57:69:E6:92:F2:D4:D0:4F:FB:E3:6B:49"}}},"request":{"raw":"GET /static/logo/mykey.jpg HTTP/1.1\r\nHost: midnight-gd.com\r\nUser-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://midnight-gd.com/connect.html\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\ncache-control: public, max-age=31536000\r\nexpires: Wed, 19 Aug 2026 12:46:28 GMT\r\ncontent-type: image/jpeg\r\nlast-modified: Wed, 30 Aug 2023 02:32:10 GMT\r\naccept-ranges: bytes\r\ncontent-length: 9261\r\ndate: Tue, 19 Aug 2025 12:46:28 GMT\r\nserver: LiteSpeed\r\nx-content-type-options: nosniff\r\nx-xss-protection: 1; mode=block\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"LiteSpeed","description":"LiteSpeed is a high-scalability web server.","website":"https://litespeedtech.com","common_platform_enumeration":"cpe:2.3:a:litespeedtech:litespeed_web_server:*:*:*:*:*:*:*:*","icon":"LiteSpeed.svg","categories":["Web servers"]}],"data":{"size":9261,"size_decoded":0,"mime_type":"image/jpeg","magic":"JPEG image data, baseline, precision 8, 400x400, components 3","md5":"c2353b70342893978beccfa3cdafd816","sha1":"a8ed10fb8f871d606a0e340f7c2a274f2eed916c","sha256":"65a2e3a384d8412917b5b2917eb222577222ed747ba05538178741a9b6ca928d","sha512":"e74a2c66bacaf5141a88ddb718ef074fbb3cae253507b09179e0f69af6ed043edb41d58b6cf4842fd920e599dade1a88569f5ccd850c881586f3b51112bbeb9a","ssdeep":"192:EMYhdl0dK1Mx/vjKdB7xvnBNECglMpR5bK7QIW5f+swJjs1Xr:ExXSK1GDKdznBO1Bc+LB2r","tlshash":"ac127df03d814663e646f83045fe0a183766a99aeb9bcf1e5851f163412fbe81a25a04","first_seen":"2023-04-30T19:28:18Z","last_seen":"2026-07-21T05:16:19.670607Z","times_seen":733,"resource_available":false,"data":null}},"time_used":407,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":403,"receive":4,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2025-08-19","alert":"Sinkholed","trigger":"midnight-gd.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":[{"sensor_name":"urlquery","alert":"Phishing - Generic Crypto/Wallet","verdict":"phishing","severity":"medium","comment":"Asset commenly seen with Generic Crypto/Wallet phishing","tags":["crypto","phishing"],"meta":null}]}},{"url":{"schema":"https","addr":"cdn.jsdelivr.net/npm/bootstrap@5.3.3/dist/js/bootstrap.bundle.min.js","fqdn":"cdn.jsdelivr.net","domain":"jsdelivr.net","tld":"net"},"ip":{"addr":"104.16.175.226","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://midnight-gd.com/connect.html","date":"2025-08-19T12:46:28.889Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.jsdelivr.net","organization":""},"issuer":{"commonName":"Sectigo RSA Domain Validation Secure Server CA","organization":"Sectigo Limited"},"validity":{"start":"Fri, 25 Apr 2025 00:00:00 GMT","end":"Mon, 04 May 2026 23:59:59 GMT"},"fingerprint":{"sha1":"A6:DD:A1:61:65:41:D0:8F:18:9A:2F:B3:5C:A4:20:AA:B2:8C:AD:1F","sha256":"20:CE:80:8C:8A:B7:48:3B:0B:A0:F2:AC:61:42:83:EC:54:84:A8:FA:4C:2D:98:10:FF:8B:FA:A5:1D:F5:21:28"}}},"request":{"raw":"GET /npm/bootstrap@5.3.3/dist/js/bootstrap.bundle.min.js HTTP/1.1\r\nHost: cdn.jsdelivr.net\r\nUser-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://midnight-gd.com/\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ndate: Tue, 19 Aug 2025 12:46:28 GMT\r\ncontent-type: application/javascript; charset=utf-8\r\ncontent-length: 22790\r\ncf-ray: 9719c1066fd62dbd-ARN\r\naccess-control-allow-origin: *\r\naccess-control-expose-headers: *\r\ntiming-allow-origin: *\r\ncache-control: public, max-age=31536000, s-maxage=31536000, immutable\r\ncross-origin-resource-policy: cross-origin\r\nx-content-type-options: nosniff\r\nstrict-transport-security: max-age=31536000; includeSubDomains; preload\r\nx-jsd-version: 5.3.3\r\nx-jsd-version-type: version\r\netag: W/\"13b51-3cbp6tbRaukjc5nOQejBYgzFnDY\"\r\ncontent-encoding: br\r\nx-served-by: cache-fra-eddf8230062-FRA, cache-lga21993-LGA\r\nx-cache: HIT, HIT\r\nvary: Accept-Encoding\r\nalt-svc: h3=\":443\"; ma=86400\r\ncf-cache-status: HIT\r\nage: 904689\r\naccept-ranges: bytes\r\nreport-to: {\"endpoints\":[{\"url\":\"https:\\/\\/a.nel.cloudflare.com\\/report\\/v4?s=mx23J4EzP1hIP7InHZCplf9yErN9tR7nzCBIFtgcXlg1l3sK%2B%2FWP7X9WlW%2FpDCVRd4Jw6POxBqMe24C6QkxKx8y4MgBYIvPnG0qvimhURKFXt2EHtT37vPvQHGGmiazjUbA%3D\"}],\"group\":\"cf-nel\",\"max_age\":604800}\r\nnel: {\"success_fraction\":0.01,\"report_to\":\"cf-nel\",\"max_age\":604800}\r\nserver: cloudflare\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":80721,"size_decoded":0,"mime_type":"application/javascript; charset=utf-8","magic":"JavaScript source, ASCII text, with very long lines (65299)","md5":"2e477967e482f32e65d4ea9b2fd8e106","sha1":"ddc6e9ead6d16ae9237399ce41e8c1620cc59c36","sha256":"0833b2e9c3a26c258476c46266e6877fc75218625162e0460be9a3a098a61c6c","sha512":"ecf8bfa2d7656db091f8b9d6f85ecfc057120c93ae5090773b1b441db838bd232fcef26375ee0fa35bf8051f4675cf5a5cd50d155518f922b9d70593f161741a","ssdeep":"1536:WmwIiEEO+TBR2t4J9RirWDKsVA5y7fy3YJtC/r/45wZbfbXZTb0WU078:HwORx3YCD45wZbDZTb0g8","tlshash":"ce73c5593244b4730ade85b68037430bf2265998b24b812cb57cadde2a7dcc67277f78","first_seen":"2024-02-25T11:27:02Z","last_seen":"2026-08-04T19:09:59.9542Z","times_seen":30443,"resource_available":true,"data":null}},"time_used":47,"timings":{"blocked":-1,"dns":0,"connect":9,"send":0,"wait":17,"receive":2,"ssl":15},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"midnight-gd.com/error.png","fqdn":"midnight-gd.com","domain":"midnight-gd.com","tld":"com"},"ip":{"addr":"192.3.141.250","port":443,"asn":36352,"as":"AS-COLOCROSSING","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://midnight-gd.com/connect.html","date":"2025-08-19T12:46:29.041Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"midnight-gd.com","organization":""},"issuer":{"commonName":"R10","organization":"Let's Encrypt"},"validity":{"start":"Fri, 08 Aug 2025 21:56:18 GMT","end":"Thu, 06 Nov 2025 21:56:17 GMT"},"fingerprint":{"sha1":"57:AB:C1:2A:94:4B:D1:B7:3F:B9:E2:25:D6:6C:A1:FE:87:79:5E:06","sha256":"45:20:67:6D:CB:DC:27:76:A1:38:40:DC:34:04:B4:D8:74:41:3A:A9:57:69:E6:92:F2:D4:D0:4F:FB:E3:6B:49"}}},"request":{"raw":"GET /error.png HTTP/1.1\r\nHost: midnight-gd.com\r\nUser-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://midnight-gd.com/connect.html\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 404 Not Found\r\ncache-control: private, no-cache, no-store, must-revalidate, max-age=0\r\npragma: no-cache\r\ncontent-type: text/html\r\ncontent-length: 1251\r\ndate: Tue, 19 Aug 2025 12:46:29 GMT\r\nserver: LiteSpeed\r\nx-content-type-options: nosniff\r\nx-xss-protection: 1; mode=block\r\n\r\n","headers":null,"cookies":null,"status_code":"404","status_text":"Not Found","fingerprints":[{"name":"LiteSpeed","description":"LiteSpeed is a high-scalability web server.","website":"https://litespeedtech.com","common_platform_enumeration":"cpe:2.3:a:litespeedtech:litespeed_web_server:*:*:*:*:*:*:*:*","icon":"LiteSpeed.svg","categories":["Web servers"]}],"data":{"size":1251,"size_decoded":0,"mime_type":"text/html","magic":"HTML document, ASCII text, with CRLF, LF line terminators","md5":"8150f458ed6fb9b1db4e5cfa57a1a281","sha1":"6e5726854d28687b560d7fdcb5c782c425c7dfb9","sha256":"4c13d452dd5d49671bd93ca32f2b4f85c78e39b6ab0ad1f38d98ed267f8fd896","sha512":"4cc6a112673aef8bb8bb8a385c26791b805d43bb707b509880e894f1c83bab4e16f13de187036c5f660c3bec1d286258396b7bde65c5d7945c5019665196818c","ssdeep":"","tlshash":"c021353ec1c1560ae0271164fbc1f7a86669825291970f703b9eb176f6cd0bb56a36c8","first_seen":"2024-02-08T16:48:55Z","last_seen":"2026-08-04T18:45:44.944985Z","times_seen":145750,"resource_available":true,"data":null}},"time_used":156,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":154,"receive":2,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2025-08-19","alert":"Sinkholed","trigger":"midnight-gd.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"cdn.jsdelivr.net/npm/bootstrap@5.3.3/dist/css/bootstrap.min.css","fqdn":"cdn.jsdelivr.net","domain":"jsdelivr.net","tld":"net"},"ip":{"addr":"104.16.175.226","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://midnight-gd.com/connect.html","date":"2025-08-19T12:46:28.884Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.jsdelivr.net","organization":""},"issuer":{"commonName":"Sectigo RSA Domain Validation Secure Server CA","organization":"Sectigo Limited"},"validity":{"start":"Fri, 25 Apr 2025 00:00:00 GMT","end":"Mon, 04 May 2026 23:59:59 GMT"},"fingerprint":{"sha1":"A6:DD:A1:61:65:41:D0:8F:18:9A:2F:B3:5C:A4:20:AA:B2:8C:AD:1F","sha256":"20:CE:80:8C:8A:B7:48:3B:0B:A0:F2:AC:61:42:83:EC:54:84:A8:FA:4C:2D:98:10:FF:8B:FA:A5:1D:F5:21:28"}}},"request":{"raw":"GET /npm/bootstrap@5.3.3/dist/css/bootstrap.min.css HTTP/1.1\r\nHost: cdn.jsdelivr.net\r\nUser-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://midnight-gd.com/\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ndate: Tue, 19 Aug 2025 12:46:28 GMT\r\ncontent-type: text/css; charset=utf-8\r\ncontent-length: 27432\r\ncf-ray: 9719c1066fd32dbd-ARN\r\naccess-control-allow-origin: *\r\naccess-control-expose-headers: *\r\ntiming-allow-origin: *\r\ncache-control: public, max-age=31536000, s-maxage=31536000, immutable\r\ncross-origin-resource-policy: cross-origin\r\nx-content-type-options: nosniff\r\nstrict-transport-security: max-age=31536000; includeSubDomains; preload\r\nx-jsd-version: 5.3.3\r\nx-jsd-version-type: version\r\netag: W/\"38d63-xawd7pYctZoEUlbsID9p4xeHL3w\"\r\ncontent-encoding: br\r\nx-served-by: cache-fra-eddf8230118-FRA, cache-lga21925-LGA\r\nx-cache: HIT, HIT\r\nvary: Accept-Encoding\r\nalt-svc: h3=\":443\"; ma=86400\r\ncf-cache-status: HIT\r\nage: 989964\r\naccept-ranges: bytes\r\nreport-to: {\"endpoints\":[{\"url\":\"https:\\/\\/a.nel.cloudflare.com\\/report\\/v4?s=GUcG9FdHfKF5zH17GKDNPAeniTjErhSpDoaVduiN57vQqUy6IC%2BFmjopS9TPDUCTtBW92Nmu91DOSBsKuYMQSYm1lwpQJ6peU1kp0cLjkjgOa9GcULCJoKZfNUTWu4%2B1Gvg%3D\"}],\"group\":\"cf-nel\",\"max_age\":604800}\r\nnel: {\"success_fraction\":0.01,\"report_to\":\"cf-nel\",\"max_age\":604800}\r\nserver: cloudflare\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":232803,"size_decoded":0,"mime_type":"text/css; charset=utf-8","magic":"Unicode text, UTF-8 text, with very long lines (65342)","md5":"a549af2a81cd9900ee897d8bc9c4b5e9","sha1":"c5ac1dee961cb59a045256ec203f69e317872f7c","sha256":"3c8f27e6009ccfd710a905e6dcf12d0ee3c6f2ac7da05b0572d3e0d12e736fc8","sha512":"8e74ae0384acd8f9248a448e2ed62cf0195821e7882b587df6dcb861fbd13c0973af7efbbebdc25c36fbb1bede1040588c3b5c623f808c11f714bbf9b9226e5e","ssdeep":"1536:O9YnIWbn98fdRfvO5wlP77k9P3EV98IsYRElV6V6pz600I41r:RnIw98fbV986I6V6pz600I41r","tlshash":"dc3482d6f590317d9ca7c1499681fefd896fa985cb120aa6f003776807cabd30962dcc","first_seen":"2024-02-25T11:27:02Z","last_seen":"2026-08-04T19:09:59.944791Z","times_seen":26015,"resource_available":false,"data":null}},"time_used":56,"timings":{"blocked":-1,"dns":0,"connect":8,"send":0,"wait":20,"receive":7,"ssl":18},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"midnight-gd.com/static/logo/zelcore.jpg","fqdn":"midnight-gd.com","domain":"midnight-gd.com","tld":"com"},"ip":{"addr":"192.3.141.250","port":443,"asn":36352,"as":"AS-COLOCROSSING","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://midnight-gd.com/connect.html","date":"2025-08-19T12:46:29.032Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"midnight-gd.com","organization":""},"issuer":{"commonName":"R10","organization":"Let's Encrypt"},"validity":{"start":"Fri, 08 Aug 2025 21:56:18 GMT","end":"Thu, 06 Nov 2025 21:56:17 GMT"},"fingerprint":{"sha1":"57:AB:C1:2A:94:4B:D1:B7:3F:B9:E2:25:D6:6C:A1:FE:87:79:5E:06","sha256":"45:20:67:6D:CB:DC:27:76:A1:38:40:DC:34:04:B4:D8:74:41:3A:A9:57:69:E6:92:F2:D4:D0:4F:FB:E3:6B:49"}}},"request":{"raw":"GET /static/logo/zelcore.jpg HTTP/1.1\r\nHost: midnight-gd.com\r\nUser-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://midnight-gd.com/connect.html\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\ncache-control: public, max-age=31536000\r\nexpires: Wed, 19 Aug 2026 12:46:29 GMT\r\ncontent-type: image/jpeg\r\nlast-modified: Sat, 06 Jul 2024 19:34:48 GMT\r\naccept-ranges: bytes\r\ncontent-length: 3368\r\ndate: Tue, 19 Aug 2025 12:46:29 GMT\r\nserver: LiteSpeed\r\nx-content-type-options: nosniff\r\nx-xss-protection: 1; mode=block\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"LiteSpeed","description":"LiteSpeed is a high-scalability web server.","website":"https://litespeedtech.com","common_platform_enumeration":"cpe:2.3:a:litespeedtech:litespeed_web_server:*:*:*:*:*:*:*:*","icon":"LiteSpeed.svg","categories":["Web servers"]}],"data":{"size":3368,"size_decoded":0,"mime_type":"image/jpeg","magic":"JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, baseline, precision 8, 225x225, components 3","md5":"72e4f8b0a9cf72cdab995625eca33f41","sha1":"a5db2f22b5b95942635c8fb605e273dbd8c8701d","sha256":"b2be2a8178839f0635108556f735c6f98faa91d6b20ea57520d27574cab4d49f","sha512":"f54bf1b1a034415740caa1299a6335bb39f825e4c5843d5c424b7598be3dad060f4f089635a28850cf124064f3b4f8caf8eb5536b22e8e159fbe5ccd52ac6566","ssdeep":"","tlshash":"07615bee4e5543e1d352faf90153c762d50b6ffb6f605964d540648388b69c10f2eaa0","first_seen":"2024-03-12T05:24:20Z","last_seen":"2026-06-09T14:27:02.939879Z","times_seen":31,"resource_available":false,"data":null}},"time_used":460,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":457,"receive":3,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2025-08-19","alert":"Sinkholed","trigger":"midnight-gd.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"play-lh.googleusercontent.com/YM7h-nnxtDs9WROvE0GUzreNFua0eIm2N2m181BuiLgAqOeByqYZahsnbKos2xSGdAmv=w240-h480-rw","fqdn":"play-lh.googleusercontent.com","domain":"googleusercontent.com","tld":"com"},"ip":{"addr":"142.250.178.86","port":443,"asn":15169,"as":"GOOGLE","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://midnight-gd.com/connect.html","date":"2025-08-19T12:46:29.821Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"edgestatic.com","organization":""},"issuer":{"commonName":"WR2","organization":"Google Trust Services"},"validity":{"start":"Mon, 07 Jul 2025 08:34:02 GMT","end":"Mon, 29 Sep 2025 08:34:01 GMT"},"fingerprint":{"sha1":"70:9A:A8:F3:87:95:3F:23:2E:C5:AC:05:21:0A:30:1F:2B:07:70:3D","sha256":"1E:33:C7:99:EB:7F:84:FF:FB:CE:C1:0D:61:84:8D:A7:82:17:51:19:57:AD:89:11:98:C9:67:58:4C:8C:A3:05"}}},"request":{"raw":"GET /YM7h-nnxtDs9WROvE0GUzreNFua0eIm2N2m181BuiLgAqOeByqYZahsnbKos2xSGdAmv=w240-h480-rw HTTP/1.1\r\nHost: play-lh.googleusercontent.com\r\nUser-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://midnight-gd.com/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\naccess-control-allow-origin: *\r\ntiming-allow-origin: *\r\naccess-control-expose-headers: Content-Length\r\ncontent-disposition: inline;filename=\"unnamed.webp\"\r\nx-content-type-options: nosniff\r\nserver: fife\r\ncontent-length: 22770\r\nx-xss-protection: 0\r\ndate: Tue, 19 Aug 2025 12:46:30 GMT\r\nexpires: Wed, 20 Aug 2025 12:46:30 GMT\r\ncache-control: public, max-age=86400, no-transform\r\netag: \"v1\"\r\ncontent-type: image/webp\r\nvary: Origin\r\nage: 0\r\nalt-svc: h3=\":443\"; ma=2592000,h3-29=\":443\"; ma=2592000\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":null,"data":{"size":22770,"size_decoded":0,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image","md5":"eacb8b9aa9b4896836b2e96d9a540509","sha1":"e5efbddb51f9d0ceaa2e5794b8d53b6820bb35ae","sha256":"2f6c5045738f8e8a2709cfb991c9665bb95d88d757efed3eeecdd8e0f582ff64","sha512":"876b0cea2c2c5842b4a8d821a955ab697e0c0a393b5a848233af4d886b9a8fdb5ea1121badd9735a19a37feef63cd449562ff382107bbc39866e2c885ca59277","ssdeep":"384:4gKRxoB3jj4l8Lc/OIYdvC+gaoDPLUryGNxt9kDIHi9qw3u6391Uva:4FR+pw/m5C+ga+/8wACN1Uy","tlshash":"e7a2f1ef2e96ec0f8a7d4d9428ce38b6a1187348847c4be561c0167cd511a9fe93ad61","first_seen":"2025-04-05T12:09:03.635386Z","last_seen":"2025-09-27T12:41:18.272911Z","times_seen":32,"resource_available":false,"data":null}},"time_used":486,"timings":{"blocked":111,"dns":71,"connect":18,"send":0,"wait":185,"receive":2,"ssl":91},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"midnight-gd.com/static/font/fa-regular-402.html","fqdn":"midnight-gd.com","domain":"midnight-gd.com","tld":"com"},"ip":{"addr":"192.3.141.250","port":443,"asn":36352,"as":"AS-COLOCROSSING","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"font","requested_by":"https://midnight-gd.com/connect.html","date":"2025-08-19T12:46:29.912Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"midnight-gd.com","organization":""},"issuer":{"commonName":"R10","organization":"Let's Encrypt"},"validity":{"start":"Fri, 08 Aug 2025 21:56:18 GMT","end":"Thu, 06 Nov 2025 21:56:17 GMT"},"fingerprint":{"sha1":"57:AB:C1:2A:94:4B:D1:B7:3F:B9:E2:25:D6:6C:A1:FE:87:79:5E:06","sha256":"45:20:67:6D:CB:DC:27:76:A1:38:40:DC:34:04:B4:D8:74:41:3A:A9:57:69:E6:92:F2:D4:D0:4F:FB:E3:6B:49"}}},"request":{"raw":"GET /static/font/fa-regular-402.html HTTP/1.1\r\nHost: midnight-gd.com\r\nUser-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0\r\nAccept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: identity\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://midnight-gd.com/static/connect-css/font-awesome.css\r\nSec-Fetch-Dest: font\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\ncache-control: public, max-age=2592000\r\nexpires: Thu, 18 Sep 2025 12:46:29 GMT\r\ncontent-type: text/html\r\nlast-modified: Wed, 30 Aug 2023 02:32:10 GMT\r\naccept-ranges: bytes\r\ncontent-length: 207\r\ndate: Tue, 19 Aug 2025 12:46:29 GMT\r\nserver: LiteSpeed\r\nx-content-type-options: nosniff\r\nx-xss-protection: 1; mode=block\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"LiteSpeed","description":"LiteSpeed is a high-scalability web server.","website":"https://litespeedtech.com","common_platform_enumeration":"cpe:2.3:a:litespeedtech:litespeed_web_server:*:*:*:*:*:*:*:*","icon":"LiteSpeed.svg","categories":["Web servers"]}],"data":{"size":207,"size_decoded":0,"mime_type":"text/html","magic":"HTML document, ASCII text","md5":"e46c4e5e1fbc64b1bae9ebd9bcef7fcf","sha1":"d767b3cb0ad66544c649e4165fc4b37e3c17e370","sha256":"e9639e3c4681ce85f852fbac48e2eeee5ba51296dbfec57c200d59b76237ab80","sha512":"d82048fdcff225197a7e9f0b7f22d470518420a4b10ea3327d604804d04d0d97efadafc84a0aaa23650146f59d94373438dc18bb822e26fd60283c384940ddb9","ssdeep":"","tlshash":"dad0224ed30a032b0a20071035c11beb998f1322757612398f42583e6185b2d81e23c8","first_seen":"2023-04-05T03:09:50Z","last_seen":"2026-08-04T19:11:49.662451Z","times_seen":17198,"resource_available":true,"data":null}},"time_used":107,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":107,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2025-08-19","alert":"Sinkholed","trigger":"midnight-gd.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"midnight-gd.com/static/logo/tongue_wallet.jpg","fqdn":"midnight-gd.com","domain":"midnight-gd.com","tld":"com"},"ip":{"addr":"192.3.141.250","port":443,"asn":36352,"as":"AS-COLOCROSSING","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://midnight-gd.com/connect.html","date":"2025-08-19T12:46:29.019Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"midnight-gd.com","organization":""},"issuer":{"commonName":"R10","organization":"Let's Encrypt"},"validity":{"start":"Fri, 08 Aug 2025 21:56:18 GMT","end":"Thu, 06 Nov 2025 21:56:17 GMT"},"fingerprint":{"sha1":"57:AB:C1:2A:94:4B:D1:B7:3F:B9:E2:25:D6:6C:A1:FE:87:79:5E:06","sha256":"45:20:67:6D:CB:DC:27:76:A1:38:40:DC:34:04:B4:D8:74:41:3A:A9:57:69:E6:92:F2:D4:D0:4F:FB:E3:6B:49"}}},"request":{"raw":"GET /static/logo/tongue_wallet.jpg HTTP/1.1\r\nHost: midnight-gd.com\r\nUser-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://midnight-gd.com/connect.html\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\ncache-control: public, max-age=31536000\r\nexpires: Wed, 19 Aug 2026 12:46:28 GMT\r\ncontent-type: image/jpeg\r\nlast-modified: Wed, 30 Aug 2023 02:32:10 GMT\r\naccept-ranges: bytes\r\ncontent-length: 4793\r\ndate: Tue, 19 Aug 2025 12:46:28 GMT\r\nserver: LiteSpeed\r\nx-content-type-options: nosniff\r\nx-xss-protection: 1; mode=block\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"LiteSpeed","description":"LiteSpeed is a high-scalability web server.","website":"https://litespeedtech.com","common_platform_enumeration":"cpe:2.3:a:litespeedtech:litespeed_web_server:*:*:*:*:*:*:*:*","icon":"LiteSpeed.svg","categories":["Web servers"]}],"data":{"size":4793,"size_decoded":0,"mime_type":"image/jpeg","magic":"JPEG image data, baseline, precision 8, 400x400, components 3","md5":"343792786b18339d16d0dd92fb91e6eb","sha1":"bdee6426ac6a6206e15680af46af67376e1701fa","sha256":"5a8304f37ebe014cf58d37de067afcd1ee6da645395dff8c47f277477e64a86d","sha512":"faa030fcb0c1e292f4bc856543bf441d60953fb62bcc703e3405e4fe04b8e606886bb111c90867936d1db22a8f61060fedd59aeb8b6ac3f97bd57cf44a4bba33","ssdeep":"96:fiRi9nj8zm+RO0A/neYYgXA5jypLOKJTFg:KRaIzZRPSeYYgejypVXg","tlshash":"29a17c51322a6b23f44ff6b25c959fcd6bd10ac85c4e523c95af705cc286e8da9054ec","first_seen":"2023-05-01T21:31:16Z","last_seen":"2026-07-21T05:16:19.641947Z","times_seen":593,"resource_available":false,"data":null}},"time_used":456,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":159,"receive":297,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2025-08-19","alert":"Sinkholed","trigger":"midnight-gd.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":[{"sensor_name":"urlquery","alert":"Phishing - Generic Crypto/Wallet","verdict":"phishing","severity":"medium","comment":"Asset commenly seen with Generic Crypto/Wallet phishing","tags":["crypto","phishing"],"meta":null}]}},{"url":{"schema":"https","addr":"midnight-gd.com/static/logo/dharma.jpg","fqdn":"midnight-gd.com","domain":"midnight-gd.com","tld":"com"},"ip":{"addr":"192.3.141.250","port":443,"asn":36352,"as":"AS-COLOCROSSING","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://midnight-gd.com/connect.html","date":"2025-08-19T12:46:28.928Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"midnight-gd.com","organization":""},"issuer":{"commonName":"R10","organization":"Let's Encrypt"},"validity":{"start":"Fri, 08 Aug 2025 21:56:18 GMT","end":"Thu, 06 Nov 2025 21:56:17 GMT"},"fingerprint":{"sha1":"57:AB:C1:2A:94:4B:D1:B7:3F:B9:E2:25:D6:6C:A1:FE:87:79:5E:06","sha256":"45:20:67:6D:CB:DC:27:76:A1:38:40:DC:34:04:B4:D8:74:41:3A:A9:57:69:E6:92:F2:D4:D0:4F:FB:E3:6B:49"}}},"request":{"raw":"GET /static/logo/dharma.jpg HTTP/1.1\r\nHost: midnight-gd.com\r\nUser-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://midnight-gd.com/connect.html\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\ncache-control: public, max-age=31536000\r\nexpires: Wed, 19 Aug 2026 12:46:28 GMT\r\ncontent-type: image/jpeg\r\nlast-modified: Wed, 30 Aug 2023 02:32:10 GMT\r\naccept-ranges: bytes\r\ncontent-length: 9289\r\ndate: Tue, 19 Aug 2025 12:46:28 GMT\r\nserver: LiteSpeed\r\nx-content-type-options: nosniff\r\nx-xss-protection: 1; mode=block\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"LiteSpeed","description":"LiteSpeed is a high-scalability web server.","website":"https://litespeedtech.com","common_platform_enumeration":"cpe:2.3:a:litespeedtech:litespeed_web_server:*:*:*:*:*:*:*:*","icon":"LiteSpeed.svg","categories":["Web servers"]}],"data":{"size":9289,"size_decoded":0,"mime_type":"image/jpeg","magic":"JPEG image data, baseline, precision 8, 400x400, components 3","md5":"2ba13682688e9661fb00bba1532a79b0","sha1":"d4f19a59aa974dc8929cda52640f98d8609b4fd8","sha256":"61a6c2e2f76f17b486ccb727517f45f106325ad7102683d223d3ad984f7b55d5","sha512":"c66f5b0f5171dc9e98473ed22a1e9c541b56f3de437555e138d41f67bf7f8e5d426830fd2de2a4a44b3341e1df5dca83cc89b6578177c096db3f207ec0dd5eb5","ssdeep":"192:P+Kc+tkDKRwgrafW1XZ2hwPkcDLtpMCDVjwb0DVnj5AX8jAS:Dz+8rv1XjLL8CDdwoDVn1AX8j/","tlshash":"6412bfd97ba3b25fc082873f3035b221a4a3d815a5f87bad9a6df0c7ca181b9447d449","first_seen":"2023-05-01T21:31:16Z","last_seen":"2026-07-21T05:16:19.618413Z","times_seen":765,"resource_available":false,"data":null}},"time_used":402,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":396,"receive":6,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2025-08-19","alert":"Sinkholed","trigger":"midnight-gd.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":[{"sensor_name":"urlquery","alert":"Phishing - Generic Crypto/Wallet","verdict":"phishing","severity":"medium","comment":"Asset commenly seen with Generic Crypto/Wallet phishing","tags":["crypto","phishing"],"meta":null}]}},{"url":{"schema":"https","addr":"midnight-gd.com/static/logo/bridge_wallet.jpg","fqdn":"midnight-gd.com","domain":"midnight-gd.com","tld":"com"},"ip":{"addr":"192.3.141.250","port":443,"asn":36352,"as":"AS-COLOCROSSING","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://midnight-gd.com/connect.html","date":"2025-08-19T12:46:28.942Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"midnight-gd.com","organization":""},"issuer":{"commonName":"R10","organization":"Let's Encrypt"},"validity":{"start":"Fri, 08 Aug 2025 21:56:18 GMT","end":"Thu, 06 Nov 2025 21:56:17 GMT"},"fingerprint":{"sha1":"57:AB:C1:2A:94:4B:D1:B7:3F:B9:E2:25:D6:6C:A1:FE:87:79:5E:06","sha256":"45:20:67:6D:CB:DC:27:76:A1:38:40:DC:34:04:B4:D8:74:41:3A:A9:57:69:E6:92:F2:D4:D0:4F:FB:E3:6B:49"}}},"request":{"raw":"GET /static/logo/bridge_wallet.jpg HTTP/1.1\r\nHost: midnight-gd.com\r\nUser-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://midnight-gd.com/connect.html\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\ncache-control: public, max-age=31536000\r\nexpires: Wed, 19 Aug 2026 12:46:28 GMT\r\ncontent-type: image/jpeg\r\nlast-modified: Wed, 30 Aug 2023 02:32:10 GMT\r\naccept-ranges: bytes\r\ncontent-length: 7723\r\ndate: Tue, 19 Aug 2025 12:46:28 GMT\r\nserver: LiteSpeed\r\nx-content-type-options: nosniff\r\nx-xss-protection: 1; mode=block\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"LiteSpeed","description":"LiteSpeed is a high-scalability web server.","website":"https://litespeedtech.com","common_platform_enumeration":"cpe:2.3:a:litespeedtech:litespeed_web_server:*:*:*:*:*:*:*:*","icon":"LiteSpeed.svg","categories":["Web servers"]}],"data":{"size":7723,"size_decoded":0,"mime_type":"image/jpeg","magic":"JPEG image data, baseline, precision 8, 400x400, components 3","md5":"347c362cb102ada4b7d16da1f70d0951","sha1":"31a1f70768f1d78241e39406402f87130b8e2a2d","sha256":"6b803609b44c6c285f680931c98248ba3e089f93c1d32d8278006c42c7dc9493","sha512":"c152cd518aaa5ff3699cb59b00dcb1ffa175e1e704a43204562d36bf5b5104173038b92bc51ebbc0f95b36924077597399881a7b6b77bec8dc1e88738c2eccce","ssdeep":"192:V0sJHQXmCiwH3bngT0TEtC+lRZITAZhpFKOem6xrYEibGLdo1H:ZsmCbgyEtR3mADrpIw6Ldop","tlshash":"f1f18e737bbd2302d89ad73114ad4bbc0b2271719dd252fc3a9771935826b10ef271a9","first_seen":"2023-04-30T19:28:18Z","last_seen":"2026-07-23T15:04:36.580885Z","times_seen":665,"resource_available":false,"data":null}},"time_used":432,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":429,"receive":3,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2025-08-19","alert":"Sinkholed","trigger":"midnight-gd.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":[{"sensor_name":"urlquery","alert":"Phishing - Generic Crypto/Wallet","verdict":"phishing","severity":"medium","comment":"Asset commenly seen with Generic Crypto/Wallet phishing","tags":["crypto","phishing"],"meta":null}]}},{"url":{"schema":"https","addr":"midnight-gd.com/static/connect-css/swiper-bundle.min.css","fqdn":"midnight-gd.com","domain":"midnight-gd.com","tld":"com"},"ip":{"addr":"192.3.141.250","port":443,"asn":36352,"as":"AS-COLOCROSSING","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://midnight-gd.com/connect.html","date":"2025-08-19T12:46:29.137Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"midnight-gd.com","organization":""},"issuer":{"commonName":"R10","organization":"Let's Encrypt"},"validity":{"start":"Fri, 08 Aug 2025 21:56:18 GMT","end":"Thu, 06 Nov 2025 21:56:17 GMT"},"fingerprint":{"sha1":"57:AB:C1:2A:94:4B:D1:B7:3F:B9:E2:25:D6:6C:A1:FE:87:79:5E:06","sha256":"45:20:67:6D:CB:DC:27:76:A1:38:40:DC:34:04:B4:D8:74:41:3A:A9:57:69:E6:92:F2:D4:D0:4F:FB:E3:6B:49"}}},"request":{"raw":"GET /static/connect-css/swiper-bundle.min.css HTTP/1.1\r\nHost: midnight-gd.com\r\nUser-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://midnight-gd.com/static/connect-css/style.css\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\ncache-control: public, max-age=2592000\r\nexpires: Thu, 18 Sep 2025 12:46:29 GMT\r\ncontent-type: text/css\r\nlast-modified: Wed, 30 Aug 2023 02:32:10 GMT\r\naccept-ranges: bytes\r\ncontent-encoding: br\r\nvary: Accept-Encoding\r\ncontent-length: 3879\r\ndate: Tue, 19 Aug 2025 12:46:29 GMT\r\nserver: LiteSpeed\r\nx-content-type-options: nosniff\r\nx-xss-protection: 1; mode=block\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"LiteSpeed","description":"LiteSpeed is a high-scalability web server.","website":"https://litespeedtech.com","common_platform_enumeration":"cpe:2.3:a:litespeedtech:litespeed_web_server:*:*:*:*:*:*:*:*","icon":"LiteSpeed.svg","categories":["Web servers"]}],"data":{"size":13972,"size_decoded":0,"mime_type":"text/css","magic":"ASCII text, with very long lines (13706), with CRLF line terminators","md5":"d18548d82ce7d1299a77a6e668c3212a","sha1":"8c004862251bed5ef670997aa687b215ec94c4f8","sha256":"d384c4ded2409eca218b3c4db87ce0acc1057be4e5655bc1d8028de62a4b6087","sha512":"99b7f21b10fb05fac9c98e0eb0fcec28f8dc4eed67574774eab15d41ee8427acb0d058f5f426e64bf78b0b5c2d4e4dcd913b5b4d9c53f3818a70f7525cd2316d","ssdeep":"384:qwUbeo7zOqgx9BUsc/XCPif65W/1mXA82FHyx:qZbr7zOlbDc/Xcif65W/1mXA82F6","tlshash":"4f52246417003837f3774f6e4661e6b59f60cc838a934d9db2c0dd44d6fa8b9122eb95","first_seen":"2023-05-06T12:41:05Z","last_seen":"2026-07-27T11:59:25.511504Z","times_seen":357,"resource_available":false,"data":null}},"time_used":285,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":284,"receive":1,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2025-08-19","alert":"Sinkholed","trigger":"midnight-gd.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"midnight-gd.com/static/logo/coinbase.png","fqdn":"midnight-gd.com","domain":"midnight-gd.com","tld":"com"},"ip":{"addr":"192.3.141.250","port":443,"asn":36352,"as":"AS-COLOCROSSING","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://midnight-gd.com/connect.html","date":"2025-08-19T12:46:28.922Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"midnight-gd.com","organization":""},"issuer":{"commonName":"R10","organization":"Let's Encrypt"},"validity":{"start":"Fri, 08 Aug 2025 21:56:18 GMT","end":"Thu, 06 Nov 2025 21:56:17 GMT"},"fingerprint":{"sha1":"57:AB:C1:2A:94:4B:D1:B7:3F:B9:E2:25:D6:6C:A1:FE:87:79:5E:06","sha256":"45:20:67:6D:CB:DC:27:76:A1:38:40:DC:34:04:B4:D8:74:41:3A:A9:57:69:E6:92:F2:D4:D0:4F:FB:E3:6B:49"}}},"request":{"raw":"GET /static/logo/coinbase.png HTTP/1.1\r\nHost: midnight-gd.com\r\nUser-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://midnight-gd.com/connect.html\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\ncache-control: public, max-age=31536000\r\nexpires: Wed, 19 Aug 2026 12:46:28 GMT\r\ncontent-type: image/png\r\nlast-modified: Wed, 30 Aug 2023 02:32:10 GMT\r\naccept-ranges: bytes\r\ncontent-length: 11139\r\ndate: Tue, 19 Aug 2025 12:46:28 GMT\r\nserver: LiteSpeed\r\nx-content-type-options: nosniff\r\nx-xss-protection: 1; mode=block\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"LiteSpeed","description":"LiteSpeed is a high-scalability web server.","website":"https://litespeedtech.com","common_platform_enumeration":"cpe:2.3:a:litespeedtech:litespeed_web_server:*:*:*:*:*:*:*:*","icon":"LiteSpeed.svg","categories":["Web servers"]}],"data":{"size":11139,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 250 x 250, 8-bit/color RGBA, non-interlaced","md5":"7774bb57b27c817e15ec7d9212aac06b","sha1":"46f00d4eb0d3d0c91c3aa3908c0ef24f8866c762","sha256":"11b144fe3230a877aa99ffc5ec3e20d6c2df6d41f8d31eefe017b9c184a87f24","sha512":"9a2c397b9915738c2dbeb69a61df774723373373eb1805371745fd7813fce94de18e051dccf668aa96cffc8b4756f8dfe2df24f354fdc5b9ffde2eb70fe18bb6","ssdeep":"192:kmNctlv0SFSQY2d5tHT4kg4FZ7ROId+82iW34SXg6dKoPoadx+/T17+fqEUXARpS:km+tlv/Fq239T4ezY8KXfd9oadE/J7Br","tlshash":"6a328e41b385f7131bbf6a0cbd16a6a09e3f598d130bc9f8361490c4ec6db79819d399","first_seen":"2023-05-18T08:37:01Z","last_seen":"2026-06-26T01:27:54.614676Z","times_seen":261,"resource_available":false,"data":null}},"time_used":361,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":355,"receive":6,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2025-08-19","alert":"Sinkholed","trigger":"midnight-gd.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":[{"sensor_name":"urlquery","alert":"Phishing - Generic Crypto/Wallet","verdict":"phishing","severity":"medium","comment":"Asset commenly seen with Generic Crypto/Wallet phishing","tags":["crypto","phishing"],"meta":null}]}},{"url":{"schema":"https","addr":"midnight-gd.com/static/logo/rwallet.jpg","fqdn":"midnight-gd.com","domain":"midnight-gd.com","tld":"com"},"ip":{"addr":"192.3.141.250","port":443,"asn":36352,"as":"AS-COLOCROSSING","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://midnight-gd.com/connect.html","date":"2025-08-19T12:46:29.015Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"midnight-gd.com","organization":""},"issuer":{"commonName":"R10","organization":"Let's Encrypt"},"validity":{"start":"Fri, 08 Aug 2025 21:56:18 GMT","end":"Thu, 06 Nov 2025 21:56:17 GMT"},"fingerprint":{"sha1":"57:AB:C1:2A:94:4B:D1:B7:3F:B9:E2:25:D6:6C:A1:FE:87:79:5E:06","sha256":"45:20:67:6D:CB:DC:27:76:A1:38:40:DC:34:04:B4:D8:74:41:3A:A9:57:69:E6:92:F2:D4:D0:4F:FB:E3:6B:49"}}},"request":{"raw":"GET /static/logo/rwallet.jpg HTTP/1.1\r\nHost: midnight-gd.com\r\nUser-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://midnight-gd.com/connect.html\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\ncache-control: public, max-age=31536000\r\nexpires: Wed, 19 Aug 2026 12:46:28 GMT\r\ncontent-type: image/jpeg\r\nlast-modified: Wed, 30 Aug 2023 02:32:10 GMT\r\naccept-ranges: bytes\r\ncontent-length: 9909\r\ndate: Tue, 19 Aug 2025 12:46:28 GMT\r\nserver: LiteSpeed\r\nx-content-type-options: nosniff\r\nx-xss-protection: 1; mode=block\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"LiteSpeed","description":"LiteSpeed is a high-scalability web server.","website":"https://litespeedtech.com","common_platform_enumeration":"cpe:2.3:a:litespeedtech:litespeed_web_server:*:*:*:*:*:*:*:*","icon":"LiteSpeed.svg","categories":["Web servers"]}],"data":{"size":9909,"size_decoded":0,"mime_type":"image/jpeg","magic":"JPEG image data, baseline, precision 8, 400x400, components 3","md5":"334d2db9a560f966534d8a297cfbca74","sha1":"1107fab8ea68030a2de08516e28ba185d37445b1","sha256":"35cb4eb66e9b789c8ed54c150fae469d2844703d18288a0e50a7e1375ef863b8","sha512":"68a65ec29f090634649d6fe3abf6239aed2a8d5e745718dec73759d3fbd9974190e8af8d737bfecda84f315608ef1d05862a0336b47403f19dffcd921c9277a2","ssdeep":"192:hLA5D9p7cIfWdYnvYSm7JVFXFdgo6TYZkGX8NMT8vDqVXyY3g3xgUnF7s:hLA5RpfKYnvYSmNVFXFdgLTYZkZMTm2v","tlshash":"88129e583181800cdd0fe737c4881c2ab6ae8c726b0db9cd0695c2daa0774bbef43876","first_seen":"2023-04-30T19:28:18Z","last_seen":"2026-07-23T15:04:36.564041Z","times_seen":698,"resource_available":false,"data":null}},"time_used":458,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":453,"receive":5,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2025-08-19","alert":"Sinkholed","trigger":"midnight-gd.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":[{"sensor_name":"urlquery","alert":"Phishing - Generic Crypto/Wallet","verdict":"phishing","severity":"medium","comment":"Asset commenly seen with Generic Crypto/Wallet phishing","tags":["crypto","phishing"],"meta":null}]}},{"url":{"schema":"https","addr":"midnight-gd.com/static/logo/flare_wallet.jpg","fqdn":"midnight-gd.com","domain":"midnight-gd.com","tld":"com"},"ip":{"addr":"192.3.141.250","port":443,"asn":36352,"as":"AS-COLOCROSSING","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://midnight-gd.com/connect.html","date":"2025-08-19T12:46:29.016Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"midnight-gd.com","organization":""},"issuer":{"commonName":"R10","organization":"Let's Encrypt"},"validity":{"start":"Fri, 08 Aug 2025 21:56:18 GMT","end":"Thu, 06 Nov 2025 21:56:17 GMT"},"fingerprint":{"sha1":"57:AB:C1:2A:94:4B:D1:B7:3F:B9:E2:25:D6:6C:A1:FE:87:79:5E:06","sha256":"45:20:67:6D:CB:DC:27:76:A1:38:40:DC:34:04:B4:D8:74:41:3A:A9:57:69:E6:92:F2:D4:D0:4F:FB:E3:6B:49"}}},"request":{"raw":"GET /static/logo/flare_wallet.jpg HTTP/1.1\r\nHost: midnight-gd.com\r\nUser-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://midnight-gd.com/connect.html\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\ncache-control: public, max-age=31536000\r\nexpires: Wed, 19 Aug 2026 12:46:28 GMT\r\ncontent-type: image/jpeg\r\nlast-modified: Wed, 30 Aug 2023 02:32:10 GMT\r\naccept-ranges: bytes\r\ncontent-length: 6667\r\ndate: Tue, 19 Aug 2025 12:46:28 GMT\r\nserver: LiteSpeed\r\nx-content-type-options: nosniff\r\nx-xss-protection: 1; mode=block\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"LiteSpeed","description":"LiteSpeed is a high-scalability web server.","website":"https://litespeedtech.com","common_platform_enumeration":"cpe:2.3:a:litespeedtech:litespeed_web_server:*:*:*:*:*:*:*:*","icon":"LiteSpeed.svg","categories":["Web servers"]}],"data":{"size":6667,"size_decoded":0,"mime_type":"image/jpeg","magic":"JPEG image data, baseline, precision 8, 400x400, components 3","md5":"8628295c6cfcbe2c37bab42b69ee414e","sha1":"2f24dea38389734f56eda191707ad6c62a026f8e","sha256":"6fa0b252dce3014cae4d9043162c934d76492b2b76ae283877aafc411d939c5c","sha512":"078430e084c9b4752963d6374ba226804f2d5838c59c8bf9872f3badd78915db3f6fd346df918a9c3351b5ca1c6df1b9512202757d6ca7169c4d61a0191c307a","ssdeep":"96:bRRqBqQCV+nbwKSpMi7Ho5HBvRXTJnTVssyDHwfm54WztuTgMwmQOCXxHBCO7c:b+LrTSzH4HBvRs5QfmjB5mvCBF7c","tlshash":"c1d19eff37982211d098f9324a48649a3f33032c519133ec2063612f6e6bc1c4a84f9d","first_seen":"2023-04-30T19:28:18Z","last_seen":"2026-07-21T05:16:19.708474Z","times_seen":606,"resource_available":false,"data":null}},"time_used":457,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":454,"receive":3,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2025-08-19","alert":"Sinkholed","trigger":"midnight-gd.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":[{"sensor_name":"urlquery","alert":"Phishing - Generic Crypto/Wallet","verdict":"phishing","severity":"medium","comment":"Asset commenly seen with Generic Crypto/Wallet phishing","tags":["crypto","phishing"],"meta":null}]}},{"url":{"schema":"https","addr":"play-lh.googleusercontent.com/6HApraB-7MgzDiGH_xxxI5aBmBWo3PFScYS1MwS2Sf64d8e5K1mZ44DJLYT-AtQsFg","fqdn":"play-lh.googleusercontent.com","domain":"googleusercontent.com","tld":"com"},"ip":{"addr":"142.250.178.86","port":443,"asn":15169,"as":"GOOGLE","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://midnight-gd.com/connect.html","date":"2025-08-19T12:46:29.822Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"edgestatic.com","organization":""},"issuer":{"commonName":"WR2","organization":"Google Trust Services"},"validity":{"start":"Mon, 07 Jul 2025 08:34:02 GMT","end":"Mon, 29 Sep 2025 08:34:01 GMT"},"fingerprint":{"sha1":"70:9A:A8:F3:87:95:3F:23:2E:C5:AC:05:21:0A:30:1F:2B:07:70:3D","sha256":"1E:33:C7:99:EB:7F:84:FF:FB:CE:C1:0D:61:84:8D:A7:82:17:51:19:57:AD:89:11:98:C9:67:58:4C:8C:A3:05"}}},"request":{"raw":"GET /6HApraB-7MgzDiGH_xxxI5aBmBWo3PFScYS1MwS2Sf64d8e5K1mZ44DJLYT-AtQsFg HTTP/1.1\r\nHost: play-lh.googleusercontent.com\r\nUser-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://midnight-gd.com/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\naccess-control-allow-origin: *\r\ntiming-allow-origin: *\r\naccess-control-expose-headers: Content-Length\r\ncontent-disposition: inline;filename=\"unnamed.png\"\r\nx-content-type-options: nosniff\r\nserver: fife\r\ncontent-length: 68402\r\nx-xss-protection: 0\r\ndate: Tue, 19 Aug 2025 12:46:30 GMT\r\nexpires: Wed, 20 Aug 2025 12:46:30 GMT\r\ncache-control: public, max-age=86400, no-transform\r\netag: \"v1\"\r\ncontent-type: image/png\r\nvary: Origin\r\nage: 0\r\nalt-svc: h3=\":443\"; ma=2592000,h3-29=\":443\"; ma=2592000\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":null,"data":{"size":68402,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 512 x 512, 8-bit/color RGBA, non-interlaced","md5":"cacb21d95b342a82978bcf1a8282c0b9","sha1":"07e934232028281c3f44cab23c39ebd2e19331c3","sha256":"5810dfc7e9e2420d11a600ecab90fc68e38a92f6840b2f7b5335136d3aa226d1","sha512":"ade2b1f436b42db3529f46b9185f1dc0df4dd76668b8bd4e66f82ad83bd29d1a23547ae1101f0aacb7d1d9c43ae4a6465ab439a7c95b0a086402ed1652d53267","ssdeep":"1536:uuwKcLHVivcMIXcfDvQL1nGCO1PoHggsXffCL02kpM:uuxuUvJfDvQL1GCM24fPdm","tlshash":"8a63f1e6c34d37ad40eec5ed42d2822da6b8c76781a14c2f3a95c61b0f7536e7d81628","first_seen":"2024-12-30T16:17:04.251153Z","last_seen":"2025-08-24T02:34:52.799419Z","times_seen":7,"resource_available":false,"data":null}},"time_used":532,"timings":{"blocked":106,"dns":70,"connect":18,"send":0,"wait":238,"receive":6,"ssl":82},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"midnight-gd.com/static/logo/via_wallet.jpg","fqdn":"midnight-gd.com","domain":"midnight-gd.com","tld":"com"},"ip":{"addr":"192.3.141.250","port":443,"asn":36352,"as":"AS-COLOCROSSING","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://midnight-gd.com/connect.html","date":"2025-08-19T12:46:28.942Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"midnight-gd.com","organization":""},"issuer":{"commonName":"R10","organization":"Let's Encrypt"},"validity":{"start":"Fri, 08 Aug 2025 21:56:18 GMT","end":"Thu, 06 Nov 2025 21:56:17 GMT"},"fingerprint":{"sha1":"57:AB:C1:2A:94:4B:D1:B7:3F:B9:E2:25:D6:6C:A1:FE:87:79:5E:06","sha256":"45:20:67:6D:CB:DC:27:76:A1:38:40:DC:34:04:B4:D8:74:41:3A:A9:57:69:E6:92:F2:D4:D0:4F:FB:E3:6B:49"}}},"request":{"raw":"GET /static/logo/via_wallet.jpg HTTP/1.1\r\nHost: midnight-gd.com\r\nUser-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://midnight-gd.com/connect.html\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\ncache-control: public, max-age=31536000\r\nexpires: Wed, 19 Aug 2026 12:46:28 GMT\r\ncontent-type: image/jpeg\r\nlast-modified: Wed, 30 Aug 2023 02:32:10 GMT\r\naccept-ranges: bytes\r\ncontent-length: 8024\r\ndate: Tue, 19 Aug 2025 12:46:28 GMT\r\nserver: LiteSpeed\r\nx-content-type-options: nosniff\r\nx-xss-protection: 1; mode=block\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"LiteSpeed","description":"LiteSpeed is a high-scalability web server.","website":"https://litespeedtech.com","common_platform_enumeration":"cpe:2.3:a:litespeedtech:litespeed_web_server:*:*:*:*:*:*:*:*","icon":"LiteSpeed.svg","categories":["Web servers"]}],"data":{"size":8024,"size_decoded":0,"mime_type":"image/jpeg","magic":"JPEG image data, baseline, precision 8, 400x400, components 3","md5":"1b3b4abf57877c3b029aa9bd3c7f9c77","sha1":"a726fb89d2b09b7c1a1d7c3b3bc716ad73a11280","sha256":"ca134a16673ab82b382968b51004d66e636b6794d60195e8dd8f38d222a34bfc","sha512":"ea6dc5c1681a89c80e4db2377e8fcaf4c42bb9ba1ac4266d566ea5e66f841ac86084de8224882905cedb2013b8aca74e608b10bb310649e55b7b2ab1692ba1bf","ssdeep":"192:cgS1bypHHrUUz83y/5bmg877GRW9F8M1UjslUkoGpF:cghpHLKoIg8PG6CM1+sVb","tlshash":"82f17e3ff246aae9e269e87045c72ae4c5ff21d5ec35c79c9e05ae0c0c17809645263d","first_seen":"2023-04-30T19:28:18Z","last_seen":"2026-07-23T15:04:36.539544Z","times_seen":791,"resource_available":false,"data":null}},"time_used":435,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":431,"receive":4,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2025-08-19","alert":"Sinkholed","trigger":"midnight-gd.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":[{"sensor_name":"urlquery","alert":"Phishing - Generic Crypto/Wallet","verdict":"phishing","severity":"medium","comment":"Asset commenly seen with Generic Crypto/Wallet phishing","tags":["crypto","phishing"],"meta":null}]}},{"url":{"schema":"https","addr":"midnight-gd.com/static/logo/tokenary.jpg","fqdn":"midnight-gd.com","domain":"midnight-gd.com","tld":"com"},"ip":{"addr":"192.3.141.250","port":443,"asn":36352,"as":"AS-COLOCROSSING","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://midnight-gd.com/connect.html","date":"2025-08-19T12:46:28.936Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"midnight-gd.com","organization":""},"issuer":{"commonName":"R10","organization":"Let's Encrypt"},"validity":{"start":"Fri, 08 Aug 2025 21:56:18 GMT","end":"Thu, 06 Nov 2025 21:56:17 GMT"},"fingerprint":{"sha1":"57:AB:C1:2A:94:4B:D1:B7:3F:B9:E2:25:D6:6C:A1:FE:87:79:5E:06","sha256":"45:20:67:6D:CB:DC:27:76:A1:38:40:DC:34:04:B4:D8:74:41:3A:A9:57:69:E6:92:F2:D4:D0:4F:FB:E3:6B:49"}}},"request":{"raw":"GET /static/logo/tokenary.jpg HTTP/1.1\r\nHost: midnight-gd.com\r\nUser-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://midnight-gd.com/connect.html\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\ncache-control: public, max-age=31536000\r\nexpires: Wed, 19 Aug 2026 12:46:28 GMT\r\ncontent-type: image/jpeg\r\nlast-modified: Wed, 30 Aug 2023 02:32:10 GMT\r\naccept-ranges: bytes\r\ncontent-length: 4838\r\ndate: Tue, 19 Aug 2025 12:46:28 GMT\r\nserver: LiteSpeed\r\nx-content-type-options: nosniff\r\nx-xss-protection: 1; mode=block\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"LiteSpeed","description":"LiteSpeed is a high-scalability web server.","website":"https://litespeedtech.com","common_platform_enumeration":"cpe:2.3:a:litespeedtech:litespeed_web_server:*:*:*:*:*:*:*:*","icon":"LiteSpeed.svg","categories":["Web servers"]}],"data":{"size":4838,"size_decoded":0,"mime_type":"image/jpeg","magic":"JPEG image data, baseline, precision 8, 400x400, components 3","md5":"3fd4369bbf41aa2eb083896e8523baba","sha1":"45d7fec158b7b33ea20a7aaef8443241c52a4a7c","sha256":"9a2afe96a1e23c9792c8e2a17307a3f79943abe4dbe3937f1d40ed3cd9158a24","sha512":"691d6ade2fa8970e3134db3447359f1e7993e7d1e59a4841eccb64363013d4ea39c966b31ae87aceda61b8511068bb9403eef0395a39a22888b198de06726b88","ssdeep":"96:KndUeVZ0u6pdehwApVnJVdkYdXDuFhlG+zn:KnP76pde2ApVnJ0YdXSblZb","tlshash":"f0a14b5e32afe128cc23df35044db16ebe2838b40625eb2c5d7c9591442b52a35ecd1d","first_seen":"2023-04-30T19:28:18Z","last_seen":"2026-07-23T15:04:36.57485Z","times_seen":844,"resource_available":false,"data":null}},"time_used":421,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":418,"receive":3,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2025-08-19","alert":"Sinkholed","trigger":"midnight-gd.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":[{"sensor_name":"urlquery","alert":"Phishing - Generic Crypto/Wallet","verdict":"phishing","severity":"medium","comment":"Asset commenly seen with Generic Crypto/Wallet phishing","tags":["crypto","phishing"],"meta":null}]}},{"url":{"schema":"https","addr":"midnight-gd.com/static/logo/coinus.jpg","fqdn":"midnight-gd.com","domain":"midnight-gd.com","tld":"com"},"ip":{"addr":"192.3.141.250","port":443,"asn":36352,"as":"AS-COLOCROSSING","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://midnight-gd.com/connect.html","date":"2025-08-19T12:46:28.948Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"midnight-gd.com","organization":""},"issuer":{"commonName":"R10","organization":"Let's Encrypt"},"validity":{"start":"Fri, 08 Aug 2025 21:56:18 GMT","end":"Thu, 06 Nov 2025 21:56:17 GMT"},"fingerprint":{"sha1":"57:AB:C1:2A:94:4B:D1:B7:3F:B9:E2:25:D6:6C:A1:FE:87:79:5E:06","sha256":"45:20:67:6D:CB:DC:27:76:A1:38:40:DC:34:04:B4:D8:74:41:3A:A9:57:69:E6:92:F2:D4:D0:4F:FB:E3:6B:49"}}},"request":{"raw":"GET /static/logo/coinus.jpg HTTP/1.1\r\nHost: midnight-gd.com\r\nUser-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://midnight-gd.com/connect.html\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\ncache-control: public, max-age=31536000\r\nexpires: Wed, 19 Aug 2026 12:46:28 GMT\r\ncontent-type: image/jpeg\r\nlast-modified: Wed, 30 Aug 2023 02:32:10 GMT\r\naccept-ranges: bytes\r\ncontent-length: 8389\r\ndate: Tue, 19 Aug 2025 12:46:28 GMT\r\nserver: LiteSpeed\r\nx-content-type-options: nosniff\r\nx-xss-protection: 1; mode=block\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"LiteSpeed","description":"LiteSpeed is a high-scalability web server.","website":"https://litespeedtech.com","common_platform_enumeration":"cpe:2.3:a:litespeedtech:litespeed_web_server:*:*:*:*:*:*:*:*","icon":"LiteSpeed.svg","categories":["Web servers"]}],"data":{"size":8389,"size_decoded":0,"mime_type":"image/jpeg","magic":"JPEG image data, baseline, precision 8, 400x400, components 3","md5":"4ec234cc3ea40eab22fbd7e160135d21","sha1":"206403657d09a02e55080f12a395e80d3b5d8654","sha256":"e4618b1223a9b7e381764e878b7c650099381850d73b8af78416a275ac636679","sha512":"2bcc58a7e43c207bc5fb745ddefd738e7b5e9091373be180dcdfa8594c37c30a94cec1e73bbdac1de133d638df33dcd3c53a433c454035301748157105543d3a","ssdeep":"192:+jpvYISMCbKbVJpB+rAUWFlsBw3QJ9AvfOlZwNTHz:+x1ShbKbVJpB+r/WFls3ivWZcz","tlshash":"41027e5af7eb53a5d47df131881680347e1a0e203970b41f96d03b5a62b43fa1cbb9b2","first_seen":"2023-05-09T01:47:42Z","last_seen":"2026-06-25T01:06:10.302079Z","times_seen":235,"resource_available":false,"data":null}},"time_used":442,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":440,"receive":2,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2025-08-19","alert":"Sinkholed","trigger":"midnight-gd.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":[{"sensor_name":"urlquery","alert":"Phishing - Generic Crypto/Wallet","verdict":"phishing","severity":"medium","comment":"Asset commenly seen with Generic Crypto/Wallet phishing","tags":["crypto","phishing"],"meta":null}]}},{"url":{"schema":"https","addr":"lh3.googleusercontent.com/dXvdD2VjLS-imsW8WG2oB3y7sBHhL9gFlv7KZnqZSA9_MU1VROSHRpJidav8-a77uQT1-8X_zK5ibsAC39IFn5tn=s120","fqdn":"lh3.googleusercontent.com","domain":"googleusercontent.com","tld":"com"},"ip":{"addr":"142.250.74.33","port":443,"asn":15169,"as":"GOOGLE","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://midnight-gd.com/connect.html","date":"2025-08-19T12:46:29.823Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.googleusercontent.com","organization":""},"issuer":{"commonName":"WR2","organization":"Google Trust Services"},"validity":{"start":"Mon, 07 Jul 2025 08:35:06 GMT","end":"Mon, 29 Sep 2025 08:35:05 GMT"},"fingerprint":{"sha1":"63:78:72:6F:FA:74:62:BB:8E:62:97:12:1D:27:37:96:37:81:92:E4","sha256":"F3:9B:D5:68:46:33:18:76:62:06:0D:55:5C:13:48:C7:C0:46:24:43:7E:C5:8D:9A:8B:DA:47:44:DA:33:B0:A2"}}},"request":{"raw":"GET /dXvdD2VjLS-imsW8WG2oB3y7sBHhL9gFlv7KZnqZSA9_MU1VROSHRpJidav8-a77uQT1-8X_zK5ibsAC39IFn5tn=s120 HTTP/1.1\r\nHost: lh3.googleusercontent.com\r\nUser-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://midnight-gd.com/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\naccess-control-allow-origin: *\r\ntiming-allow-origin: *\r\naccess-control-expose-headers: Content-Length\r\ncontent-disposition: inline;filename=\"unnamed.png\"\r\nx-content-type-options: nosniff\r\nserver: fife\r\ncontent-length: 3829\r\nx-xss-protection: 0\r\ndate: Tue, 19 Aug 2025 09:52:08 GMT\r\nexpires: Wed, 20 Aug 2025 09:52:08 GMT\r\ncache-control: public, max-age=86400, no-transform\r\nage: 10461\r\netag: \"v1\"\r\ncontent-type: image/png\r\nvary: Origin\r\nalt-svc: h3=\":443\"; ma=2592000,h3-29=\":443\"; ma=2592000\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":null,"data":{"size":3829,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 120 x 120, 8-bit/color RGBA, non-interlaced","md5":"1f0f8878ce2a08b1218871d3c99533bd","sha1":"6049a5c3b3f2fe4e1f5b47e89f83cf7676dc4d81","sha256":"1deb1fc8a464e1a285e45a6d48e1b98b722b67897c499e141c4622cf4bd15c21","sha512":"6b50fa8ec6e654914fa1afb7aec2f7ba8ad9d8aaa5f23d4d5a3654e85013073f87c878b297b3a1d59ee5d8fbce84ddb8cc24db38187c5e8f7f1f8e5d4a921d7b","ssdeep":"","tlshash":"6b816d7d1c65bc683284b9a5ab600c59f8fc8c25c25893ed92778a6aaec1505b1c232f","first_seen":"2024-12-30T16:17:04.246645Z","last_seen":"2025-08-19T12:46:52.449926Z","times_seen":5,"resource_available":false,"data":null}},"time_used":316,"timings":{"blocked":107,"dns":73,"connect":29,"send":0,"wait":21,"receive":1,"ssl":80},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"midnight-gd.com/static/logo/wc.png","fqdn":"midnight-gd.com","domain":"midnight-gd.com","tld":"com"},"ip":{"addr":"192.3.141.250","port":443,"asn":36352,"as":"AS-COLOCROSSING","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://midnight-gd.com/connect.html","date":"2025-08-19T12:46:29.826Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"midnight-gd.com","organization":""},"issuer":{"commonName":"R10","organization":"Let's Encrypt"},"validity":{"start":"Fri, 08 Aug 2025 21:56:18 GMT","end":"Thu, 06 Nov 2025 21:56:17 GMT"},"fingerprint":{"sha1":"57:AB:C1:2A:94:4B:D1:B7:3F:B9:E2:25:D6:6C:A1:FE:87:79:5E:06","sha256":"45:20:67:6D:CB:DC:27:76:A1:38:40:DC:34:04:B4:D8:74:41:3A:A9:57:69:E6:92:F2:D4:D0:4F:FB:E3:6B:49"}}},"request":{"raw":"GET /static/logo/wc.png HTTP/1.1\r\nHost: midnight-gd.com\r\nUser-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://midnight-gd.com/connect.html\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\ncache-control: public, max-age=31536000\r\nexpires: Wed, 19 Aug 2026 12:46:29 GMT\r\ncontent-type: image/png\r\nlast-modified: Wed, 30 Aug 2023 02:32:10 GMT\r\naccept-ranges: bytes\r\ncontent-length: 7577\r\ndate: Tue, 19 Aug 2025 12:46:29 GMT\r\nserver: LiteSpeed\r\nx-content-type-options: nosniff\r\nx-xss-protection: 1; mode=block\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"LiteSpeed","description":"LiteSpeed is a high-scalability web server.","website":"https://litespeedtech.com","common_platform_enumeration":"cpe:2.3:a:litespeedtech:litespeed_web_server:*:*:*:*:*:*:*:*","icon":"LiteSpeed.svg","categories":["Web servers"]}],"data":{"size":7577,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 512 x 512, 8-bit/color RGBA, non-interlaced","md5":"a0d0b29c181d120219ebe9aa0b807279","sha1":"293039410e29bb89fa57377518362d5ba08e8356","sha256":"c908a7e1ecb17606c724bd63e259de6d20418466b3eba9ad57cbc135b86f0e05","sha512":"5c209580345b139dbfbdc9322c5040f6d6a1e53b0b25079ff751b87755f3f8a645dfbbf6056bd7712eaad1f871b812cb4df4dd00bb328212c97a0b14ec6fa945","ssdeep":"192:UjDJbqi4wcT6kuNMdQ1hicCuYIpqC/ZCE7h:+DkBT6kuFimeEV","tlshash":"43f15ba85641758ed872837594d37c2a3ec224f2827f2d4817e867bc0832f55278b7eb","first_seen":"2023-12-08T20:11:18Z","last_seen":"2026-08-01T19:57:57.473982Z","times_seen":162,"resource_available":false,"data":null}},"time_used":109,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":108,"receive":1,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2025-08-19","alert":"Sinkholed","trigger":"midnight-gd.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":[{"sensor_name":"urlquery","alert":"Phishing - Generic Crypto/Wallet","verdict":"phishing","severity":"medium","comment":"Asset commenly seen with Generic Crypto/Wallet phishing","tags":["crypto","phishing"],"meta":null}]}},{"url":{"schema":"https","addr":"midnight-gd.com/static/logo/trust_wallet.jpg","fqdn":"midnight-gd.com","domain":"midnight-gd.com","tld":"com"},"ip":{"addr":"192.3.141.250","port":443,"asn":36352,"as":"AS-COLOCROSSING","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://midnight-gd.com/connect.html","date":"2025-08-19T12:46:28.904Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"midnight-gd.com","organization":""},"issuer":{"commonName":"R10","organization":"Let's Encrypt"},"validity":{"start":"Fri, 08 Aug 2025 21:56:18 GMT","end":"Thu, 06 Nov 2025 21:56:17 GMT"},"fingerprint":{"sha1":"57:AB:C1:2A:94:4B:D1:B7:3F:B9:E2:25:D6:6C:A1:FE:87:79:5E:06","sha256":"45:20:67:6D:CB:DC:27:76:A1:38:40:DC:34:04:B4:D8:74:41:3A:A9:57:69:E6:92:F2:D4:D0:4F:FB:E3:6B:49"}}},"request":{"raw":"GET /static/logo/trust_wallet.jpg HTTP/1.1\r\nHost: midnight-gd.com\r\nUser-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://midnight-gd.com/connect.html\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\ncache-control: public, max-age=31536000\r\nexpires: Wed, 19 Aug 2026 12:46:28 GMT\r\ncontent-type: image/jpeg\r\nlast-modified: Wed, 30 Aug 2023 02:32:10 GMT\r\naccept-ranges: bytes\r\ncontent-length: 6633\r\ndate: Tue, 19 Aug 2025 12:46:28 GMT\r\nserver: LiteSpeed\r\nx-content-type-options: nosniff\r\nx-xss-protection: 1; mode=block\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"LiteSpeed","description":"LiteSpeed is a high-scalability web server.","website":"https://litespeedtech.com","common_platform_enumeration":"cpe:2.3:a:litespeedtech:litespeed_web_server:*:*:*:*:*:*:*:*","icon":"LiteSpeed.svg","categories":["Web servers"]}],"data":{"size":6633,"size_decoded":0,"mime_type":"image/jpeg","magic":"JPEG image data, baseline, precision 8, 400x400, components 3","md5":"f15670e2fa664790560becb05302a51c","sha1":"836d223713db4da5ef9ac8b6caec385f06353e89","sha256":"521f3ca5ed42fce36af921fb2764ad5c75760b434563d11d960270a8bef55c6f","sha512":"8c075bcce1435d37d89a091faa4e1633f6c5d2fff6161e5ce530d71b10a837473ee04a2f39d0414c7d59c0b9f72d8df8fc5d2cfffb30244c3eb91c72ad7f994e","ssdeep":"96:KdRNpQK9Icf5SJRiL8ylpJq1eRuGTQhlLCFuP+QzIwPMFMbEIp:Kd3pQK9IchSJYL8ylLqQ/TCOgPCo","tlshash":"dbd18db43f431800c9e6fa705d6750672d9ba78894da689fe16d16af362ca11be3c831","first_seen":"2023-04-30T19:28:18Z","last_seen":"2026-07-26T00:52:50.218849Z","times_seen":717,"resource_available":false,"data":null}},"time_used":243,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":193,"receive":50,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2025-08-19","alert":"Sinkholed","trigger":"midnight-gd.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":[{"sensor_name":"urlquery","alert":"Phishing - Generic Crypto/Wallet","verdict":"phishing","severity":"medium","comment":"Asset commenly seen with Generic Crypto/Wallet phishing","tags":["crypto","phishing"],"meta":null}]}},{"url":{"schema":"https","addr":"midnight-gd.com/favicon.svg","fqdn":"midnight-gd.com","domain":"midnight-gd.com","tld":"com"},"ip":{"addr":"192.3.141.250","port":443,"asn":36352,"as":"AS-COLOCROSSING","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://midnight-gd.com/connect.html","date":"2025-08-19T12:46:29.834Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"midnight-gd.com","organization":""},"issuer":{"commonName":"R10","organization":"Let's Encrypt"},"validity":{"start":"Fri, 08 Aug 2025 21:56:18 GMT","end":"Thu, 06 Nov 2025 21:56:17 GMT"},"fingerprint":{"sha1":"57:AB:C1:2A:94:4B:D1:B7:3F:B9:E2:25:D6:6C:A1:FE:87:79:5E:06","sha256":"45:20:67:6D:CB:DC:27:76:A1:38:40:DC:34:04:B4:D8:74:41:3A:A9:57:69:E6:92:F2:D4:D0:4F:FB:E3:6B:49"}}},"request":{"raw":"GET /favicon.svg HTTP/1.1\r\nHost: midnight-gd.com\r\nUser-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://midnight-gd.com/connect.html\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\ncache-control: public, max-age=604800\r\nexpires: Tue, 26 Aug 2025 12:46:29 GMT\r\ncontent-type: image/svg+xml\r\nlast-modified: Sun, 20 Jul 2025 13:47:46 GMT\r\naccept-ranges: bytes\r\ncontent-encoding: br\r\nvary: Accept-Encoding\r\ncontent-length: 416\r\ndate: Tue, 19 Aug 2025 12:46:29 GMT\r\nserver: LiteSpeed\r\nx-content-type-options: nosniff\r\nx-xss-protection: 1; mode=block\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"LiteSpeed","description":"LiteSpeed is a high-scalability web server.","website":"https://litespeedtech.com","common_platform_enumeration":"cpe:2.3:a:litespeedtech:litespeed_web_server:*:*:*:*:*:*:*:*","icon":"LiteSpeed.svg","categories":["Web servers"]}],"data":{"size":1265,"size_decoded":0,"mime_type":"image/svg+xml","magic":"SVG Scalable Vector Graphics image","md5":"6d51d14616d8707aa800de383eb4b7a1","sha1":"47918cb0a0b2b7e515cabe7903e93ec73528bd19","sha256":"464bb84c88155d5fcaa4477e6ed0a238df10cfc4d5e76058b8ef4ac7b3a517fc","sha512":"94ada7af9360f2409dcde5c36b429e36bcafa4c017be74bce4c02106a07d254c2af2183ef0d38515bae24b6f3220484b436a0bf5bbdd1a4b978ddb25044951a9","ssdeep":"","tlshash":"a4210229d6d95423e448c299e640f42b311d45c36a85c214b9e97b3c7ba38e32b8b36c","first_seen":"2025-08-18T11:46:15.464467Z","last_seen":"2026-03-23T16:23:34.842262Z","times_seen":5,"resource_available":false,"data":null}},"time_used":109,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":109,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2025-08-19","alert":"Sinkholed","trigger":"midnight-gd.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"midnight-gd.com/static/logo/rainbow.jpg","fqdn":"midnight-gd.com","domain":"midnight-gd.com","tld":"com"},"ip":{"addr":"192.3.141.250","port":443,"asn":36352,"as":"AS-COLOCROSSING","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://midnight-gd.com/connect.html","date":"2025-08-19T12:46:28.910Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"midnight-gd.com","organization":""},"issuer":{"commonName":"R10","organization":"Let's Encrypt"},"validity":{"start":"Fri, 08 Aug 2025 21:56:18 GMT","end":"Thu, 06 Nov 2025 21:56:17 GMT"},"fingerprint":{"sha1":"57:AB:C1:2A:94:4B:D1:B7:3F:B9:E2:25:D6:6C:A1:FE:87:79:5E:06","sha256":"45:20:67:6D:CB:DC:27:76:A1:38:40:DC:34:04:B4:D8:74:41:3A:A9:57:69:E6:92:F2:D4:D0:4F:FB:E3:6B:49"}}},"request":{"raw":"GET /static/logo/rainbow.jpg HTTP/1.1\r\nHost: midnight-gd.com\r\nUser-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://midnight-gd.com/connect.html\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\ncache-control: public, max-age=31536000\r\nexpires: Wed, 19 Aug 2026 12:46:28 GMT\r\ncontent-type: image/jpeg\r\nlast-modified: Wed, 30 Aug 2023 02:32:10 GMT\r\naccept-ranges: bytes\r\ncontent-length: 11047\r\ndate: Tue, 19 Aug 2025 12:46:28 GMT\r\nserver: LiteSpeed\r\nx-content-type-options: nosniff\r\nx-xss-protection: 1; mode=block\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"LiteSpeed","description":"LiteSpeed is a high-scalability web server.","website":"https://litespeedtech.com","common_platform_enumeration":"cpe:2.3:a:litespeedtech:litespeed_web_server:*:*:*:*:*:*:*:*","icon":"LiteSpeed.svg","categories":["Web servers"]}],"data":{"size":11047,"size_decoded":0,"mime_type":"image/jpeg","magic":"JPEG image data, baseline, precision 8, 400x400, components 3","md5":"6d76ead5b79aa76658cdd1845fc42d04","sha1":"0faa072f36879a7d1c26a5e655942c47dd468803","sha256":"85900214a912e9987e82575686a8e2f4cb705802c768ea6d9ea88b845224d451","sha512":"22fe17f984dc5b4d91f3bb35ce06bbeb09c7ee80dd2c918bcd8d576789815a904975aca528d74374e3cd6f0806d6f00de7991e2eb0e63f1d594605b1c44eee8c","ssdeep":"192:cINLESg7lIt0EPcjZo9++CxEF/eu1c3zMvMgluc6Xp5M7yNQgZgU+mw28D5AEr9s:cINLEt7lnqw+o4/O3Afup5M7yGxU+puf","tlshash":"3c32be70fbee4b82de6eed38a9906a0934a7db7dea50400df101864e90b73b80d0d815","first_seen":"2023-05-01T21:31:16Z","last_seen":"2026-07-15T15:42:59.022508Z","times_seen":587,"resource_available":false,"data":null}},"time_used":294,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":265,"receive":29,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2025-08-19","alert":"Sinkholed","trigger":"midnight-gd.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":[{"sensor_name":"urlquery","alert":"Phishing - Generic Crypto/Wallet","verdict":"phishing","severity":"medium","comment":"Asset commenly seen with Generic Crypto/Wallet phishing","tags":["crypto","phishing"],"meta":null}]}},{"url":{"schema":"https","addr":"midnight-gd.com/static/logo/atomic.jpg","fqdn":"midnight-gd.com","domain":"midnight-gd.com","tld":"com"},"ip":{"addr":"192.3.141.250","port":443,"asn":36352,"as":"AS-COLOCROSSING","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://midnight-gd.com/connect.html","date":"2025-08-19T12:46:28.931Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"midnight-gd.com","organization":""},"issuer":{"commonName":"R10","organization":"Let's Encrypt"},"validity":{"start":"Fri, 08 Aug 2025 21:56:18 GMT","end":"Thu, 06 Nov 2025 21:56:17 GMT"},"fingerprint":{"sha1":"57:AB:C1:2A:94:4B:D1:B7:3F:B9:E2:25:D6:6C:A1:FE:87:79:5E:06","sha256":"45:20:67:6D:CB:DC:27:76:A1:38:40:DC:34:04:B4:D8:74:41:3A:A9:57:69:E6:92:F2:D4:D0:4F:FB:E3:6B:49"}}},"request":{"raw":"GET /static/logo/atomic.jpg HTTP/1.1\r\nHost: midnight-gd.com\r\nUser-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://midnight-gd.com/connect.html\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\ncache-control: public, max-age=31536000\r\nexpires: Wed, 19 Aug 2026 12:46:28 GMT\r\ncontent-type: image/jpeg\r\nlast-modified: Wed, 30 Aug 2023 02:32:10 GMT\r\naccept-ranges: bytes\r\ncontent-length: 12526\r\ndate: Tue, 19 Aug 2025 12:46:28 GMT\r\nserver: LiteSpeed\r\nx-content-type-options: nosniff\r\nx-xss-protection: 1; mode=block\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"LiteSpeed","description":"LiteSpeed is a high-scalability web server.","website":"https://litespeedtech.com","common_platform_enumeration":"cpe:2.3:a:litespeedtech:litespeed_web_server:*:*:*:*:*:*:*:*","icon":"LiteSpeed.svg","categories":["Web servers"]}],"data":{"size":12526,"size_decoded":0,"mime_type":"image/jpeg","magic":"JPEG image data, baseline, precision 8, 400x400, components 3","md5":"480248df94d2b0e11d18d8c2c594d695","sha1":"f7247cd551510a4661a04fc21bc4ff792397791f","sha256":"e3a1988e50124aef7c65a07ce80c3fb8327a94274c026c0b47b978c5f6f9d4da","sha512":"dcae5e86f125775e3b5ccdced2a54d4d7e9e514175400104920c5b797d76a024363c65a494625fa173302ae0e2f64606350e39a5de4ed3679103ccdb62c7ef2f","ssdeep":"192:xEsvzGFQE5XauHNUXR9mMLj1wTY+K7rQi32Q5TCSimRgZh6POZB5UfDhEO1cjk/:xYrHQfj1wTnGrQc1iogZh0EUfyO6C","tlshash":"7442bff6744e6be2d61ef4b7c1f40909ac9c1f70aa029b6cf6231189cd77b66369c019","first_seen":"2023-04-30T19:28:18Z","last_seen":"2026-07-23T15:04:36.557594Z","times_seen":866,"resource_available":false,"data":null}},"time_used":410,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":404,"receive":6,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2025-08-19","alert":"Sinkholed","trigger":"midnight-gd.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":[{"sensor_name":"urlquery","alert":"Phishing - Generic Crypto/Wallet","verdict":"phishing","severity":"medium","comment":"Asset commenly seen with Generic Crypto/Wallet phishing","tags":["crypto","phishing"],"meta":null}]}},{"url":{"schema":"https","addr":"midnight-gd.com/static/logo/nash.jpg","fqdn":"midnight-gd.com","domain":"midnight-gd.com","tld":"com"},"ip":{"addr":"192.3.141.250","port":443,"asn":36352,"as":"AS-COLOCROSSING","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://midnight-gd.com/connect.html","date":"2025-08-19T12:46:28.933Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"midnight-gd.com","organization":""},"issuer":{"commonName":"R10","organization":"Let's Encrypt"},"validity":{"start":"Fri, 08 Aug 2025 21:56:18 GMT","end":"Thu, 06 Nov 2025 21:56:17 GMT"},"fingerprint":{"sha1":"57:AB:C1:2A:94:4B:D1:B7:3F:B9:E2:25:D6:6C:A1:FE:87:79:5E:06","sha256":"45:20:67:6D:CB:DC:27:76:A1:38:40:DC:34:04:B4:D8:74:41:3A:A9:57:69:E6:92:F2:D4:D0:4F:FB:E3:6B:49"}}},"request":{"raw":"GET /static/logo/nash.jpg HTTP/1.1\r\nHost: midnight-gd.com\r\nUser-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://midnight-gd.com/connect.html\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\ncache-control: public, max-age=31536000\r\nexpires: Wed, 19 Aug 2026 12:46:28 GMT\r\ncontent-type: image/jpeg\r\nlast-modified: Wed, 30 Aug 2023 02:32:10 GMT\r\naccept-ranges: bytes\r\ncontent-length: 8155\r\ndate: Tue, 19 Aug 2025 12:46:28 GMT\r\nserver: LiteSpeed\r\nx-content-type-options: nosniff\r\nx-xss-protection: 1; mode=block\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"LiteSpeed","description":"LiteSpeed is a high-scalability web server.","website":"https://litespeedtech.com","common_platform_enumeration":"cpe:2.3:a:litespeedtech:litespeed_web_server:*:*:*:*:*:*:*:*","icon":"LiteSpeed.svg","categories":["Web servers"]}],"data":{"size":8155,"size_decoded":0,"mime_type":"image/jpeg","magic":"JPEG image data, baseline, precision 8, 400x400, components 3","md5":"104461e7e4dce9afb135eac0a215b19a","sha1":"9d71d53d7eae917ebb2409cfb50c00ec7b301cd8","sha256":"89d1383830e1a334458a6acb31e44b2eb2fd8162328533e2e4fbe44322011c7b","sha512":"1d6c9d2120851e790d1b62b62fbb9db1e3d459c5970d86b7d3c8f6bc46fab08e950cfee3b3d29236c0f85d2ba963dfd23fd9fa95f255f5b7f61d2327323f2eb6","ssdeep":"96:3wVnYPA7qTFA0FjCQAATa/Dis/wb3cqUSHOT1W2mj6DSOxQ5V3hX:AFY47qxA0F5Q+ywUSuTCj6mOxa3B","tlshash":"21f1af0c3db86064c1e8d9feec3a075082fc21d2a619ee3d7296946843ddd56b9d4ed2","first_seen":"2023-05-01T21:31:16Z","last_seen":"2026-07-21T05:16:19.583744Z","times_seen":671,"resource_available":false,"data":null}},"time_used":413,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":409,"receive":4,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2025-08-19","alert":"Sinkholed","trigger":"midnight-gd.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":[{"sensor_name":"urlquery","alert":"Phishing - Generic Crypto/Wallet","verdict":"phishing","severity":"medium","comment":"Asset commenly seen with Generic Crypto/Wallet phishing","tags":["crypto","phishing"],"meta":null}]}},{"url":{"schema":"https","addr":"midnight-gd.com/static/logo/guarda_wallet.jpg","fqdn":"midnight-gd.com","domain":"midnight-gd.com","tld":"com"},"ip":{"addr":"192.3.141.250","port":443,"asn":36352,"as":"AS-COLOCROSSING","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://midnight-gd.com/connect.html","date":"2025-08-19T12:46:28.951Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"midnight-gd.com","organization":""},"issuer":{"commonName":"R10","organization":"Let's Encrypt"},"validity":{"start":"Fri, 08 Aug 2025 21:56:18 GMT","end":"Thu, 06 Nov 2025 21:56:17 GMT"},"fingerprint":{"sha1":"57:AB:C1:2A:94:4B:D1:B7:3F:B9:E2:25:D6:6C:A1:FE:87:79:5E:06","sha256":"45:20:67:6D:CB:DC:27:76:A1:38:40:DC:34:04:B4:D8:74:41:3A:A9:57:69:E6:92:F2:D4:D0:4F:FB:E3:6B:49"}}},"request":{"raw":"GET /static/logo/guarda_wallet.jpg HTTP/1.1\r\nHost: midnight-gd.com\r\nUser-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://midnight-gd.com/connect.html\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\ncache-control: public, max-age=31536000\r\nexpires: Wed, 19 Aug 2026 12:46:28 GMT\r\ncontent-type: image/jpeg\r\nlast-modified: Wed, 30 Aug 2023 02:32:10 GMT\r\naccept-ranges: bytes\r\ncontent-length: 8032\r\ndate: Tue, 19 Aug 2025 12:46:28 GMT\r\nserver: LiteSpeed\r\nx-content-type-options: nosniff\r\nx-xss-protection: 1; mode=block\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"LiteSpeed","description":"LiteSpeed is a high-scalability web server.","website":"https://litespeedtech.com","common_platform_enumeration":"cpe:2.3:a:litespeedtech:litespeed_web_server:*:*:*:*:*:*:*:*","icon":"LiteSpeed.svg","categories":["Web servers"]}],"data":{"size":8032,"size_decoded":0,"mime_type":"image/jpeg","magic":"JPEG image data, baseline, precision 8, 400x400, components 3","md5":"521d0a27dff013b0b9313ed91121b20f","sha1":"8d4a2cb408105f8b87fd1cb852ab813913227ea0","sha256":"eefc338f4a2058461b6800c0fc41481ad508984f3ac5cd2c49c14dcab80eff06","sha512":"41da961f1b7f73aa69b1cf2cdef84eeb71692ad1d4367f92f7f62ece82db3355368ecf728d9136453385418fec0b051d8152b868e3f164e793e73dffe22a94ec","ssdeep":"192:MuTHUGc+/wV6jZFdkGFTQdAwjmIBONupxJL4jB+:M6HUb+/wVAFd/T0jnosg+","tlshash":"31f1be3db92b88a4da51d2bfe0169d5123977656fc200f4cb34585d987bae6e11c30cc","first_seen":"2023-05-01T21:31:16Z","last_seen":"2026-07-21T05:16:19.677014Z","times_seen":665,"resource_available":false,"data":null}},"time_used":448,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":445,"receive":3,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2025-08-19","alert":"Sinkholed","trigger":"midnight-gd.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":[{"sensor_name":"urlquery","alert":"Phishing - Generic Crypto/Wallet","verdict":"phishing","severity":"medium","comment":"Asset commenly seen with Generic Crypto/Wallet phishing","tags":["crypto","phishing"],"meta":null}]}},{"url":{"schema":"https","addr":"midnight-gd.com/static/logo/talken_wallet.jpg","fqdn":"midnight-gd.com","domain":"midnight-gd.com","tld":"com"},"ip":{"addr":"192.3.141.250","port":443,"asn":36352,"as":"AS-COLOCROSSING","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://midnight-gd.com/connect.html","date":"2025-08-19T12:46:29.021Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"midnight-gd.com","organization":""},"issuer":{"commonName":"R10","organization":"Let's Encrypt"},"validity":{"start":"Fri, 08 Aug 2025 21:56:18 GMT","end":"Thu, 06 Nov 2025 21:56:17 GMT"},"fingerprint":{"sha1":"57:AB:C1:2A:94:4B:D1:B7:3F:B9:E2:25:D6:6C:A1:FE:87:79:5E:06","sha256":"45:20:67:6D:CB:DC:27:76:A1:38:40:DC:34:04:B4:D8:74:41:3A:A9:57:69:E6:92:F2:D4:D0:4F:FB:E3:6B:49"}}},"request":{"raw":"GET /static/logo/talken_wallet.jpg HTTP/1.1\r\nHost: midnight-gd.com\r\nUser-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://midnight-gd.com/connect.html\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\ncache-control: public, max-age=31536000\r\nexpires: Wed, 19 Aug 2026 12:46:28 GMT\r\ncontent-type: image/jpeg\r\nlast-modified: Wed, 30 Aug 2023 02:32:10 GMT\r\naccept-ranges: bytes\r\ncontent-length: 7091\r\ndate: Tue, 19 Aug 2025 12:46:28 GMT\r\nserver: LiteSpeed\r\nx-content-type-options: nosniff\r\nx-xss-protection: 1; mode=block\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"LiteSpeed","description":"LiteSpeed is a high-scalability web server.","website":"https://litespeedtech.com","common_platform_enumeration":"cpe:2.3:a:litespeedtech:litespeed_web_server:*:*:*:*:*:*:*:*","icon":"LiteSpeed.svg","categories":["Web servers"]}],"data":{"size":7091,"size_decoded":0,"mime_type":"image/jpeg","magic":"JPEG image data, baseline, precision 8, 400x400, components 3","md5":"8d18e470b85fcdacd479aed6c7cdb16b","sha1":"7ba69fb3a9de45c015502158bd12ef6e956a500e","sha256":"dc5c2220234d9d9b75d41400daa8619b4b248f08586d9c04858d43f5c81b2e8f","sha512":"b3b4dca612bbeff4f66e2b2dba378d623ab80f4737d570d73b4472a5ef5867f79abc8a86b4d4ef7d1723b2c2a18b524e8a993a4d08da9a7913cf7514cf3dd443","ssdeep":"192:zILJKEz0FaZ65bU02jrZZkpuABROEwlZMjCul75:yKE/Z6IXgERMjJ75","tlshash":"9be18e38b58f3827d954c6310663ccd6ab726c3350a2f50d9672181fbd772a47a4617a","first_seen":"2023-04-30T19:28:18Z","last_seen":"2026-07-23T15:04:36.558855Z","times_seen":699,"resource_available":false,"data":null}},"time_used":458,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":455,"receive":3,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2025-08-19","alert":"Sinkholed","trigger":"midnight-gd.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":[{"sensor_name":"urlquery","alert":"Phishing - Generic Crypto/Wallet","verdict":"phishing","severity":"medium","comment":"Asset commenly seen with Generic Crypto/Wallet phishing","tags":["crypto","phishing"],"meta":null}]}},{"url":{"schema":"https","addr":"midnight-gd.com/static/logo/at_wallet.jpg","fqdn":"midnight-gd.com","domain":"midnight-gd.com","tld":"com"},"ip":{"addr":"192.3.141.250","port":443,"asn":36352,"as":"AS-COLOCROSSING","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://midnight-gd.com/connect.html","date":"2025-08-19T12:46:29.024Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"midnight-gd.com","organization":""},"issuer":{"commonName":"R10","organization":"Let's Encrypt"},"validity":{"start":"Fri, 08 Aug 2025 21:56:18 GMT","end":"Thu, 06 Nov 2025 21:56:17 GMT"},"fingerprint":{"sha1":"57:AB:C1:2A:94:4B:D1:B7:3F:B9:E2:25:D6:6C:A1:FE:87:79:5E:06","sha256":"45:20:67:6D:CB:DC:27:76:A1:38:40:DC:34:04:B4:D8:74:41:3A:A9:57:69:E6:92:F2:D4:D0:4F:FB:E3:6B:49"}}},"request":{"raw":"GET /static/logo/at_wallet.jpg HTTP/1.1\r\nHost: midnight-gd.com\r\nUser-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://midnight-gd.com/connect.html\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\ncache-control: public, max-age=31536000\r\nexpires: Wed, 19 Aug 2026 12:46:28 GMT\r\ncontent-type: image/jpeg\r\nlast-modified: Wed, 30 Aug 2023 02:32:10 GMT\r\naccept-ranges: bytes\r\ncontent-length: 13243\r\ndate: Tue, 19 Aug 2025 12:46:28 GMT\r\nserver: LiteSpeed\r\nx-content-type-options: nosniff\r\nx-xss-protection: 1; mode=block\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"LiteSpeed","description":"LiteSpeed is a high-scalability web server.","website":"https://litespeedtech.com","common_platform_enumeration":"cpe:2.3:a:litespeedtech:litespeed_web_server:*:*:*:*:*:*:*:*","icon":"LiteSpeed.svg","categories":["Web servers"]}],"data":{"size":13243,"size_decoded":0,"mime_type":"image/jpeg","magic":"JPEG image data, baseline, precision 8, 400x400, components 3","md5":"567f617068dcd5ea372ad03e10991514","sha1":"3953be697875e808423c3268b68c7de0f3833b5e","sha256":"0f0cfb848a47be7fae86c813dca0b15fbb0b7377ab28613abc2515948543fffe","sha512":"dfd09fb6c342ba4cc00a882deebbce09659cf97aff52aa72140f15eaa9ee1d019d7ab16fc39d8858b9c1d315dec9f00690fd001cc0284315c8b87e84be4dfd2e","ssdeep":"384:tIXK62b3o9bxBTzpzYAZqMueR5d2r+RdHoo:tIXKt3o9b38M5R5HL","tlshash":"d152b0217908debbc074da72151aa4a4869ddfca3dfb1cce60685425073c1e7aa489e6","first_seen":"2023-04-30T19:28:18Z","last_seen":"2026-07-23T15:04:36.505992Z","times_seen":800,"resource_available":false,"data":null}},"time_used":460,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":155,"receive":305,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2025-08-19","alert":"Sinkholed","trigger":"midnight-gd.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":[{"sensor_name":"urlquery","alert":"Phishing - Generic Crypto/Wallet","verdict":"phishing","severity":"medium","comment":"Asset commenly seen with Generic Crypto/Wallet phishing","tags":["crypto","phishing"],"meta":null}]}},{"url":{"schema":"https","addr":"midnight-gd.com/static/logo/exodus.jpg","fqdn":"midnight-gd.com","domain":"midnight-gd.com","tld":"com"},"ip":{"addr":"192.3.141.250","port":443,"asn":36352,"as":"AS-COLOCROSSING","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://midnight-gd.com/connect.html","date":"2025-08-19T12:46:29.033Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"midnight-gd.com","organization":""},"issuer":{"commonName":"R10","organization":"Let's Encrypt"},"validity":{"start":"Fri, 08 Aug 2025 21:56:18 GMT","end":"Thu, 06 Nov 2025 21:56:17 GMT"},"fingerprint":{"sha1":"57:AB:C1:2A:94:4B:D1:B7:3F:B9:E2:25:D6:6C:A1:FE:87:79:5E:06","sha256":"45:20:67:6D:CB:DC:27:76:A1:38:40:DC:34:04:B4:D8:74:41:3A:A9:57:69:E6:92:F2:D4:D0:4F:FB:E3:6B:49"}}},"request":{"raw":"GET /static/logo/exodus.jpg HTTP/1.1\r\nHost: midnight-gd.com\r\nUser-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://midnight-gd.com/connect.html\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\ncache-control: public, max-age=31536000\r\nexpires: Wed, 19 Aug 2026 12:46:29 GMT\r\ncontent-type: image/jpeg\r\nlast-modified: Sat, 06 Jul 2024 19:34:48 GMT\r\naccept-ranges: bytes\r\ncontent-length: 4195\r\ndate: Tue, 19 Aug 2025 12:46:29 GMT\r\nserver: LiteSpeed\r\nx-content-type-options: nosniff\r\nx-xss-protection: 1; mode=block\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"LiteSpeed","description":"LiteSpeed is a high-scalability web server.","website":"https://litespeedtech.com","common_platform_enumeration":"cpe:2.3:a:litespeedtech:litespeed_web_server:*:*:*:*:*:*:*:*","icon":"LiteSpeed.svg","categories":["Web servers"]}],"data":{"size":4195,"size_decoded":0,"mime_type":"image/jpeg","magic":"JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, baseline, precision 8, 225x225, components 3","md5":"a612725efb37f0eef0ed7afe2f6b5498","sha1":"c81d4b8b7264057f31170f6afacc28c21ade4cc4","sha256":"0e10ca44696090a523473e7f7cbecae68cc58177a38f407969dfb5d33ba71d3e","sha512":"dc7ba8dfa8315c41291a2d97c77a795c1676a18efb5ec31a250d9619a1019598fcf5baa91d9d1c396d7cab245eeb5eb88c433fdad34ff3b47fe449b4383b6a5f","ssdeep":"96:Hls4W9AAvh+pHBdtmv4gCVgfc/zMAXvvaGQg3Pbk72jdxVP9:H2TAyhcB+IVgqMIvdPj/VP9","tlshash":"4c815b06c21b9ce57ee4bb3112cb2b507f4a1865dae4891b03b4d500bc9b34a2f5615d","first_seen":"2024-04-24T00:40:31Z","last_seen":"2026-06-26T01:27:54.629404Z","times_seen":23,"resource_available":false,"data":null}},"time_used":472,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":172,"receive":300,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2025-08-19","alert":"Sinkholed","trigger":"midnight-gd.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":[{"sensor_name":"urlquery","alert":"Phishing - Generic Crypto/Wallet","verdict":"phishing","severity":"medium","comment":"Asset commenly seen with Generic Crypto/Wallet phishing","tags":["crypto","phishing"],"meta":null}]}},{"url":{"schema":"https","addr":"midnight-gd.com/connect.html","fqdn":"midnight-gd.com","domain":"midnight-gd.com","tld":"com"},"ip":{"addr":"192.3.141.250","port":443,"asn":36352,"as":"AS-COLOCROSSING","country":"United States","country_code":"US"},"is_navigation_request":true,"resource_type":"document","requested_by":"","date":"2025-08-19T12:46:28.277Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"midnight-gd.com","organization":""},"issuer":{"commonName":"R10","organization":"Let's Encrypt"},"validity":{"start":"Fri, 08 Aug 2025 21:56:18 GMT","end":"Thu, 06 Nov 2025 21:56:17 GMT"},"fingerprint":{"sha1":"57:AB:C1:2A:94:4B:D1:B7:3F:B9:E2:25:D6:6C:A1:FE:87:79:5E:06","sha256":"45:20:67:6D:CB:DC:27:76:A1:38:40:DC:34:04:B4:D8:74:41:3A:A9:57:69:E6:92:F2:D4:D0:4F:FB:E3:6B:49"}}},"request":{"raw":"GET /connect.html HTTP/1.1\r\nHost: midnight-gd.com\r\nUser-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0\r\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nUpgrade-Insecure-Requests: 1\r\nSec-Fetch-Dest: document\r\nSec-Fetch-Mode: navigate\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ncache-control: public, max-age=2592000\r\nexpires: Thu, 18 Sep 2025 12:46:28 GMT\r\ncontent-type: text/html\r\nlast-modified: Sun, 03 Aug 2025 23:26:45 GMT\r\naccept-ranges: bytes\r\ncontent-encoding: br\r\nvary: Accept-Encoding\r\ncontent-length: 9853\r\ndate: Tue, 19 Aug 2025 12:46:28 GMT\r\nserver: LiteSpeed\r\nx-content-type-options: nosniff\r\nx-xss-protection: 1; mode=block\r\nalt-svc: h3=\":443\"; ma=2592000, h3-29=\":443\"; ma=2592000, h3-Q050=\":443\"; ma=2592000, h3-Q046=\":443\"; ma=2592000, h3-Q043=\":443\"; ma=2592000, quic=\":443\"; ma=2592000; v=\"43,46\"\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Bootstrap:5.3.3","description":"Bootstrap is a free and open-source CSS framework directed at responsive, mobile-first front-end web development. It contains CSS and JavaScript-based design templates for typography, forms, buttons, navigation, and other interface components.","website":"https://getbootstrap.com","common_platform_enumeration":"cpe:2.3:a:getbootstrap:bootstrap:*:*:*:*:*:*:*:*","icon":"Bootstrap.svg","categories":["UI frameworks"]},{"name":"jQuery:3.5.1","description":"jQuery is a JavaScript library which is a free, open-source software designed to simplify HTML DOM tree traversal and manipulation, as well as event handling, CSS animation, and Ajax.","website":"https://jquery.com","common_platform_enumeration":"cpe:2.3:a:jquery:jquery:*:*:*:*:*:*:*:*","icon":"jQuery.svg","categories":["JavaScript libraries"]},{"name":"Google Hosted Libraries","description":"Google Hosted Libraries is a stable, reliable, high-speed, globally available content distribution network for the most popular, open-source JavaScript libraries.","website":"https://developers.google.com/speed/libraries","common_platform_enumeration":"","icon":"Google Developers.svg","categories":["CDN"]},{"name":"BootstrapCDN:4.5.2","description":"BootstrapCDN is a powerful and reliable Content Delivery Network (CDN) that delivers static resources, including CSS, JavaScript, and font files, for the widely-used Bootstrap framework. By leveraging multiple server locations worldwide, BootstrapCDN accelerates website loading times, ensuring a smooth and visually appealing user experience. Additionally, it ensures website compatibility with various devices and browsers. The service reduces bandwidth usage and server load, improving web performance for developers and end-users alike.","website":"https://www.bootstrapcdn.com/","common_platform_enumeration":"","icon":"BootstrapCDN.png","categories":["CDN"]},{"name":"jsDelivr","description":"JSDelivr is a free public CDN for open-source projects. It can serve web files directly from the npm registry and GitHub repositories without any configuration.","website":"https://www.jsdelivr.com/","common_platform_enumeration":"","icon":"jsdelivr-icon.svg","categories":["CDN"]},{"name":"LiteSpeed","description":"LiteSpeed is a high-scalability web server.","website":"https://litespeedtech.com","common_platform_enumeration":"cpe:2.3:a:litespeedtech:litespeed_web_server:*:*:*:*:*:*:*:*","icon":"LiteSpeed.svg","categories":["Web servers"]}],"data":{"size":111510,"size_decoded":0,"mime_type":"text/html","magic":"HTML document, ASCII text","md5":"12299803444647e6656be3c21f46934d","sha1":"e43c1cb65b5fb3604cb312d1d5b8523432427e94","sha256":"ca28404a3adde5250f29163012f6cca7974129c7db0aecd7c98dab4562d254cc","sha512":"63b42052f95b89a86ad90f62ad9cd56f19e8b7b3f88916babd5f8041012cdf89f2a2b9bb88161d0aa7a87c63772113241f3879411aac98684206bcfd17d90dff","ssdeep":"384:8JfbqDWSZU7svFI68y8hXERIwOl2ro5qzvpkK2xssIoTcIr3h7gI0vgYM3B:8JfbqiSZU7svehhXERIjlazvpzMFtT","tlshash":"acb32f6496f6571361b392c46ea26baf6f80e617c6264e643bfc0bf10f93c61dd13218","first_seen":"2025-08-18T11:46:15.419062Z","last_seen":"2025-08-19T12:46:52.460391Z","times_seen":2,"resource_available":false,"data":null}},"time_used":616,"timings":{"blocked":251,"dns":35,"connect":107,"send":0,"wait":107,"receive":1,"ssl":113},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2025-08-19","alert":"Sinkholed","trigger":"midnight-gd.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"phishtank","sensor_type":"Blocklist","title":"PhishTank","description":"PhishTank","scan_date":"2025-08-16","alert":"Phishing - Other","trigger":"midnight-gd.com/connect.html","verdict":"phishing","severity":"medium","comment":"Other","link":"http://phishtank.com","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"midnight-gd.com/error.png","fqdn":"midnight-gd.com","domain":"midnight-gd.com","tld":"com"},"ip":{"addr":"192.3.141.250","port":443,"asn":36352,"as":"AS-COLOCROSSING","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://midnight-gd.com/connect.html","date":"2025-08-19T12:46:29.607Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"midnight-gd.com","organization":""},"issuer":{"commonName":"R10","organization":"Let's Encrypt"},"validity":{"start":"Fri, 08 Aug 2025 21:56:18 GMT","end":"Thu, 06 Nov 2025 21:56:17 GMT"},"fingerprint":{"sha1":"57:AB:C1:2A:94:4B:D1:B7:3F:B9:E2:25:D6:6C:A1:FE:87:79:5E:06","sha256":"45:20:67:6D:CB:DC:27:76:A1:38:40:DC:34:04:B4:D8:74:41:3A:A9:57:69:E6:92:F2:D4:D0:4F:FB:E3:6B:49"}}},"request":{"raw":"GET /error.png HTTP/1.1\r\nHost: midnight-gd.com\r\nUser-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://midnight-gd.com/connect.html\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 404 Not Found\r\ncache-control: private, no-cache, no-store, must-revalidate, max-age=0\r\npragma: no-cache\r\ncontent-type: text/html\r\ncontent-length: 1251\r\ndate: Tue, 19 Aug 2025 12:46:29 GMT\r\nserver: LiteSpeed\r\nx-content-type-options: nosniff\r\nx-xss-protection: 1; mode=block\r\n\r\n","headers":null,"cookies":null,"status_code":"404","status_text":"Not Found","fingerprints":[{"name":"LiteSpeed","description":"LiteSpeed is a high-scalability web server.","website":"https://litespeedtech.com","common_platform_enumeration":"cpe:2.3:a:litespeedtech:litespeed_web_server:*:*:*:*:*:*:*:*","icon":"LiteSpeed.svg","categories":["Web servers"]}],"data":{"size":1251,"size_decoded":0,"mime_type":"text/html","magic":"HTML document, ASCII text, with CRLF, LF line terminators","md5":"8150f458ed6fb9b1db4e5cfa57a1a281","sha1":"6e5726854d28687b560d7fdcb5c782c425c7dfb9","sha256":"4c13d452dd5d49671bd93ca32f2b4f85c78e39b6ab0ad1f38d98ed267f8fd896","sha512":"4cc6a112673aef8bb8bb8a385c26791b805d43bb707b509880e894f1c83bab4e16f13de187036c5f660c3bec1d286258396b7bde65c5d7945c5019665196818c","ssdeep":"","tlshash":"c021353ec1c1560ae0271164fbc1f7a86669825291970f703b9eb176f6cd0bb56a36c8","first_seen":"2024-02-08T16:48:55Z","last_seen":"2026-08-04T18:45:44.944985Z","times_seen":145750,"resource_available":true,"data":null}},"time_used":108,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":107,"receive":1,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2025-08-19","alert":"Sinkholed","trigger":"midnight-gd.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}}]}