{"report_id":"1b2f9003-fd29-47eb-b447-6cc01206b077","version":6,"status":"done","tags":[],"date":"2026-01-10T21:08:29Z","url":{"schema":"http","addr":"darkmedik.top/","fqdn":"darkmedik.top","domain":"darkmedik.top","tld":"top"},"ip":{"addr":"35.214.249.142","port":0,"asn":15169,"as":"GOOGLE","country":"The Netherlands","country_code":"NL"},"final":{"url":{"schema":"https","addr":"darkchange.io/","fqdn":"darkchange.io","domain":"darkchange.io","tld":"io"},"title":"DarkChange | Anonymous No-KYC Crypto Exchange","dom":{"size":0,"mime_type":"text/plain; charset=utf-8","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","dom_hash":"domhash1f07f384c75181c66badb60ab1ec770b","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-08-12T15:40:42.100018Z","times_seen":17857324,"resource_available":false,"data":null}},"submit":{"url":{"schema":"http","addr":"darkmedik.top/","fqdn":"darkmedik.top","domain":"darkmedik.top","tld":"top"},"ip":{"addr":"35.214.249.142","port":0,"asn":15169,"as":"GOOGLE","country":"The Netherlands","country_code":"NL"},"tags":null,"meta":null},"settings":{"access":"public","device_type":"desktop","expires_at":"2027-02-14T21:08:29Z","useragent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0","referer":"","cookies":null,"exit_node":"z0yflva4pidy47h"},"stats":{"alert_count":{"ids":0,"urlquery":0,"analyzer":2}},"detection":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-01-10","alert":"Sinkholed","trigger":"darkchange.io","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2026-01-10","alert":"Sinkholed","trigger":"darkmedik.top","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null},"summary":[{"fqdn":"fonts.googleapis.com","ip":{"addr":"216.58.211.10","port":443,"asn":15169,"as":"GOOGLE","country":"United States","country_code":"US"},"domain_registered":"2005-01-25","domain_rank":313,"first_seen":"2012-05-23T12:41:44Z","last_seen":"2026-01-04T22:17:15.216142Z","alert_count":0,"request_count":2,"received_data":23484,"sent_data":979,"comment":"","tags":null,"fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}]},{"fqdn":"darkchange.io","ip":{"addr":"188.114.97.1","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"domain_registered":"unknown","domain_rank":0,"first_seen":"No data","last_seen":"No data","alert_count":35,"request_count":35,"received_data":5463634,"sent_data":15791,"comment":"","tags":null,"fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}]},{"fqdn":"fonts.gstatic.com","ip":{"addr":"142.250.74.3","port":443,"asn":15169,"as":"GOOGLE","country":"United States","country_code":"US"},"domain_registered":"2008-02-11","domain_rank":0,"first_seen":"2014-04-02T10:51:04Z","last_seen":"2026-01-04T22:14:09.841371Z","alert_count":0,"request_count":2,"received_data":61852,"sent_data":1134,"comment":"","tags":null,"fingerprints":null},{"fqdn":"darkmedik.top","ip":{"addr":"35.214.249.142","port":443,"asn":15169,"as":"GOOGLE","country":"The Netherlands","country_code":"NL"},"domain_registered":"2025-12-10","domain_rank":0,"first_seen":"2026-01-10T21:08:30.774829Z","last_seen":"2026-01-10T21:08:30.774829Z","alert_count":1,"request_count":1,"received_data":6204,"sent_data":482,"comment":"","tags":null,"fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}]}],"files":null,"artifacts":{"windows_shortcuts":null,"files":null,"telegram":null,"pdfs":null,"clipboard":null},"sensors":{"ids":null,"analyzer":null,"urlquery":null},"javascript":{"script":[{"url":{"schema":"https","addr":"darkchange.io/assets/index-CjBsp-NA.js","fqdn":"darkchange.io","domain":"darkchange.io","tld":"io"},"ip":{"addr":"188.114.97.1","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"scriptElement","is_inline":false,"md5":"a59c698990dfcd544b4ebe49092f9418","sha1":"f7e19d615ed34a34f4ed056d007eee24236840a2","sha256":"00889a47e4c4455bae116fdb029bee5c4a27a674303264de68aacd0a3ab63cb5","sha512":"a98dab05cd5c051eb3fbd7017e09a6bfc13ea09f47ee706b8d5563ee9e46b8df4d63289412164185f7822a337e9d52d80cf46cf1900acc658fcf591ca4de256e","ssdeep":"12288:FBMbZLUk1FUakPil+Axmvt4Oncspg0GsIrPfhfFjRB5IW5Rf7TrjOyfGkBXmsi/:FsfDUakPil+AxY2Oncspg0GsIrPfhfFQ","tlshash":"3fa43bd872a9b1255be345e4407f0203b2392966740c88a4f13dedeb3a7544a51bbffe","size":469986,"data":"","first_seen":"2026-01-10T21:08:37.483545Z","last_seen":"2026-01-10T21:11:27.894906Z","times_seen":2,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"darkchange.io/assets/index-DvjNr9xF.js","fqdn":"darkchange.io","domain":"darkchange.io","tld":"io"},"ip":{"addr":"188.114.97.1","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"scriptElement","is_inline":false,"md5":"f27216d745d0acc1866a9c6b0d1c6ada","sha1":"7bcc3ecb0f468568f23b02b93f4e111437924f79","sha256":"c949e5d675d1287c9ab52b87129491c86743dbef18d94e506d0f1d4fa6b5176a","sha512":"8e3385509e42ee867abac64355967fb29f83007f7a093439f99b99ec663e218c591ad117d9bfff697670915d37669e36b39e0ba7281e0cb76c29cf208c8e3d31","ssdeep":"1536:mUuCKlolLoM32F6kj40NbiY2UKkKsKLFqlt86gkLINkHVuN02MYYoyr8nLjND1M5:/lId8XY8nLjNDWMaH","tlshash":"a3842294c3922a6bf844cade8fd6180c3c9e17ba9ab2cce5964d473640f84cd365f365","size":403260,"data":"","first_seen":"2026-01-10T21:08:37.465208Z","last_seen":"2026-01-10T21:11:27.88505Z","times_seen":2,"alerts":{"ids":null,"analyzer":null,"urlquery":null}}],"eval":null,"write":null,"console":null},"http":[{"url":{"schema":"https","addr":"fonts.googleapis.com/css2?family=Instrument+Sans:wght@400;500;600;700\u0026display=swap","fqdn":"fonts.googleapis.com","domain":"fonts.googleapis.com","tld":"googleapis.com"},"ip":{"addr":"216.58.211.10","port":443,"asn":15169,"as":"GOOGLE","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://darkchange.io/","date":"2026-01-10T21:08:07.863Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"upload.video.google.com","organization":""},"issuer":{"commonName":"WR2","organization":"Google Trust Services"},"validity":{"start":"Wed, 03 Dec 2025 15:53:13 GMT","end":"Wed, 25 Feb 2026 15:53:12 GMT"},"fingerprint":{"sha1":"A8:BA:6B:80:7C:EC:B1:6F:C1:C2:03:D7:C9:27:6E:75:DE:4B:AA:47","sha256":"4E:2C:B9:C5:81:56:5E:97:93:07:22:12:66:E2:52:C6:0A:2E:17:72:FF:9B:5F:2A:B9:E1:21:80:05:6D:8B:3D"}}},"request":{"raw":"GET /css2?family=Instrument+Sans:wght@400;500;600;700\u0026display=swap HTTP/1.1\r\nHost: fonts.googleapis.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://darkchange.io/\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ncontent-type: text/css; charset=utf-8\r\nvary: Sec-Fetch-Dest, Sec-Fetch-Mode, Sec-Fetch-Site\r\naccess-control-allow-origin: *\r\ntiming-allow-origin: *\r\nlink: \u003chttps://fonts.gstatic.com\u003e; rel=preconnect; crossorigin\r\nstrict-transport-security: max-age=31536000\r\nexpires: Sat, 10 Jan 2026 21:08:08 GMT\r\ndate: Sat, 10 Jan 2026 21:08:08 GMT\r\ncache-control: private, max-age=86400\r\ncross-origin-resource-policy: cross-origin\r\ncross-origin-opener-policy: same-origin-allow-popups\r\ncontent-encoding: gzip\r\nserver: ESF\r\nx-xss-protection: 0\r\nx-frame-options: SAMEORIGIN\r\nx-content-type-options: nosniff\r\nalt-svc: h3=\":443\"; ma=2592000,h3-29=\":443\"; ma=2592000\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":3864,"size_decoded":0,"mime_type":"text/css; charset=utf-8","magic":"ASCII text","md5":"dca43b277460c23e27a9a14c5096cf81","sha1":"dd378607f32336115432eea3c36284f5672ac5ea","sha256":"107a699c736cfab5d0c7232b782bea6c67a51d69d0b9ee6edfee559d0ab5133c","sha512":"f91060a7721fc81e286cad521858489ca7e1dc89e55f9cd874a88854697b28c528ccb651e40add13996449f23bca3843ea8cdd2d48cf043291a836984259dd2f","ssdeep":"","tlshash":"a581eda0042fa1149b839dc2239e7f36ae1ea1603441dc259ffa24a8fc5ed794372b4c","first_seen":"2025-09-19T14:45:38.484925Z","last_seen":"2026-08-10T22:58:47.101944Z","times_seen":225,"resource_available":false,"data":null}},"time_used":452,"timings":{"blocked":206,"dns":1,"connect":20,"send":0,"wait":32,"receive":0,"ssl":190},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"darkchange.io/illustrations/planet-exchange.svg","fqdn":"darkchange.io","domain":"darkchange.io","tld":"io"},"ip":{"addr":"188.114.97.1","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://darkchange.io/","date":"2026-01-10T21:08:08.511Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"darkchange.io","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Thu, 20 Nov 2025 02:05:49 GMT","end":"Wed, 18 Feb 2026 03:03:26 GMT"},"fingerprint":{"sha1":"D9:05:E0:7A:C5:10:1D:91:FE:1C:0E:8E:3B:5A:C6:2E:53:6E:71:26","sha256":"77:91:00:F2:25:D2:53:58:51:3C:40:EE:E6:DD:C1:A6:D3:EE:B5:16:F1:6E:C2:19:CF:54:27:61:9E:46:C7:AF"}}},"request":{"raw":"GET /illustrations/planet-exchange.svg HTTP/1.1\r\nHost: darkchange.io\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://darkchange.io/\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\ndate: Sat, 10 Jan 2026 21:08:08 GMT\r\ncontent-type: image/svg+xml\r\nvary: Origin, accept-encoding\r\naccess-control-allow-credentials: true\r\naccess-control-expose-headers: Content-Length,X-Total-Count\r\nx-frame-options: DENY\r\nx-content-type-options: nosniff\r\nx-xss-protection: 1; mode=block\r\nreferrer-policy: strict-origin-when-cross-origin\r\nstrict-transport-security: max-age=31536000; includeSubDomains\r\ncontent-security-policy: default-src 'self'; script-src 'self'; style-src 'self' https://fonts.googleapis.com; font-src 'self' https://fonts.gstatic.com; img-src 'self' data: https:; connect-src 'self' https:; frame-ancestors 'none';\r\npermissions-policy: geolocation=(), microphone=(), camera=()\r\ncache-control: max-age=14400\r\ncf-cache-status: EXPIRED\r\nlast-modified: Sat, 10 Jan 2026 21:08:08 GMT\r\npriority: u=4,i=?0\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=0CEynqw0f4VjU4X1XoG31JzggL%2FDGjDepvCIoPDenrmS2sXEZPbUucY86fBPugAfvrxfsu7%2BmI8rpSQvzIZOyWW%2FAWu0MbbS8bjfsZA%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncontent-encoding: br\r\nserver: cloudflare\r\ncf-ray: 9bbf25e14ba3a0f0-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":25117,"size_decoded":0,"mime_type":"image/svg+xml","magic":"SVG Scalable Vector Graphics image","md5":"c9a0df7edba2e41113eac5480b22034f","sha1":"1d2e39df073e7197c43d1a796dd47880fec229be","sha256":"842537925bbbc84f2bd8ad4e76aea408d97941bebdb77ac1d63d07b7fc4832e9","sha512":"74b3dec52f555020ae25e6bdc034353ae5f407e428ee1bb893e5b69eb29f01918469828fa6cfa6c699b7b98e4365b84fbfdcb03c351875a9d7fcdf4d9f96c3f1","ssdeep":"384:ISXJ/bJeUL3VW20CFmkmKmAmMmcmsmpmb:IQ/bJeU7d","tlshash":"e3b2f46ab31dec36e254c68cdf96c4a4114943e7d981c1e582a67f5fa2388c7192f3f1","first_seen":"2025-11-20T12:33:07.00015Z","last_seen":"2026-02-14T00:24:47.920336Z","times_seen":7,"resource_available":false,"data":null}},"time_used":94,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":68,"receive":26,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-01-10","alert":"Sinkholed","trigger":"darkchange.io","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"darkchange.io/fonts/Gilroy-Medium.ttf","fqdn":"darkchange.io","domain":"darkchange.io","tld":"io"},"ip":{"addr":"188.114.97.1","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"font","requested_by":"https://darkchange.io/","date":"2026-01-10T21:08:08.711Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"darkchange.io","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Thu, 20 Nov 2025 02:05:49 GMT","end":"Wed, 18 Feb 2026 03:03:26 GMT"},"fingerprint":{"sha1":"D9:05:E0:7A:C5:10:1D:91:FE:1C:0E:8E:3B:5A:C6:2E:53:6E:71:26","sha256":"77:91:00:F2:25:D2:53:58:51:3C:40:EE:E6:DD:C1:A6:D3:EE:B5:16:F1:6E:C2:19:CF:54:27:61:9E:46:C7:AF"}}},"request":{"raw":"GET /fonts/Gilroy-Medium.ttf HTTP/1.1\r\nHost: darkchange.io\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://darkchange.io/assets/index-DKSPX2TN.css\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: font\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\ndate: Sat, 10 Jan 2026 21:08:08 GMT\r\ncontent-type: font/ttf\r\nvary: Origin, accept-encoding\r\naccess-control-allow-credentials: true\r\naccess-control-expose-headers: Content-Length,X-Total-Count\r\nx-frame-options: DENY\r\nx-content-type-options: nosniff\r\nx-xss-protection: 1; mode=block\r\nreferrer-policy: strict-origin-when-cross-origin\r\nstrict-transport-security: max-age=31536000; includeSubDomains\r\ncontent-security-policy: default-src 'self'; script-src 'self'; style-src 'self' https://fonts.googleapis.com; font-src 'self' https://fonts.gstatic.com; img-src 'self' data: https:; connect-src 'self' https:; frame-ancestors 'none';\r\npermissions-policy: geolocation=(), microphone=(), camera=()\r\ncache-control: max-age=14400\r\ncf-cache-status: MISS\r\nlast-modified: Sat, 10 Jan 2026 21:08:08 GMT\r\npriority: u=4,i=?0\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=V%2F77GkFec6voiXcgfFy62%2FjX2AKS1QiJeG0D%2FDRsr5VLN23S%2BgAk9iljMyCbN2FuI1ar6IAsXrqckSogOu8SmpktG1wpY6o4bghNrMY%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncontent-encoding: br\r\nserver: cloudflare\r\ncf-ray: 9bbf25e28efba0f0-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":143724,"size_decoded":0,"mime_type":"font/ttf","magic":"TrueType Font data, 18 tables, 1st \"FFTM\", 22 names, Macintosh","md5":"c83281ae1ca703d0741a770ee7e7c091","sha1":"d7f893124bd4fff78805e69df31385ae113368be","sha256":"7b3c84352c6a0d8a3479b528b8d8336ddb1cef0da8b81dea0e41a930d56523fe","sha512":"11223ee72a122c347c1d2864676e8a05cff295c8739133aa3cccfc0cd64d73b7730b33eb94ea83bc32feb57b041ed5cba78eb8c65545f4f1e8983115eb087fa0","ssdeep":"1536:vYERginzY4PwU0Wll/wDLufOG89gTjtlqaIgjzpe74nf4wk5bzovhlUmDRXxMQnj:qinzYrUvyPuf49ytcjwktYwnnIdbRd","tlshash":"d8e33892f645735dcf535c358961d2acdfa19d3fedc807f7ae823a6201404b88aa1e8d","first_seen":"2023-05-08T14:08:29Z","last_seen":"2026-08-12T09:25:43.788673Z","times_seen":597,"resource_available":false,"data":null}},"time_used":156,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":70,"receive":86,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-01-10","alert":"Sinkholed","trigger":"darkchange.io","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"fonts.gstatic.com/s/instrumentsans/v4/pxiTypc9vsFDm051Uf6KVwgkfoSxQ0GsQv8ToedPibnr0SZe1Q.woff2","fqdn":"fonts.gstatic.com","domain":"gstatic.com","tld":"com"},"ip":{"addr":"142.250.74.3","port":443,"asn":15169,"as":"GOOGLE","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"font","requested_by":"https://darkchange.io/","date":"2026-01-10T21:08:08.723Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.gstatic.com","organization":""},"issuer":{"commonName":"WR2","organization":"Google Trust Services"},"validity":{"start":"Wed, 03 Dec 2025 15:53:13 GMT","end":"Wed, 25 Feb 2026 15:53:12 GMT"},"fingerprint":{"sha1":"5A:E3:E3:B6:18:F9:10:0B:5B:11:FA:CB:BF:0C:9B:5C:0E:34:70:78","sha256":"FC:46:B0:C1:1E:B2:21:60:D9:7E:6A:ED:42:56:B2:CF:2A:E4:D2:F1:1C:63:63:98:2B:A3:0F:6C:4A:98:74:D6"}}},"request":{"raw":"GET /s/instrumentsans/v4/pxiTypc9vsFDm051Uf6KVwgkfoSxQ0GsQv8ToedPibnr0SZe1Q.woff2 HTTP/1.1\r\nHost: fonts.gstatic.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: identity\r\nOrigin: https://darkchange.io\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://fonts.googleapis.com/\r\nSec-Fetch-Dest: font\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\naccept-ranges: bytes\r\naccess-control-allow-origin: *\r\ncontent-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes\r\ncross-origin-resource-policy: cross-origin\r\ncross-origin-opener-policy: same-origin; report-to=\"apps-themes\"\r\nreport-to: {\"group\":\"apps-themes\",\"max_age\":2592000,\"endpoints\":[{\"url\":\"https://csp.withgoogle.com/csp/report-to/apps-themes\"}]}\r\ntiming-allow-origin: *\r\ncontent-length: 30092\r\nx-content-type-options: nosniff\r\nserver: sffe\r\nx-xss-protection: 0\r\ndate: Sat, 10 Jan 2026 10:57:43 GMT\r\nexpires: Sun, 10 Jan 2027 10:57:43 GMT\r\ncache-control: public, max-age=31536000\r\nage: 36625\r\nlast-modified: Thu, 04 Sep 2025 17:26:18 GMT\r\ncontent-type: font/woff2\r\nalt-svc: h3=\":443\"; ma=2592000,h3-29=\":443\"; ma=2592000\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":null,"data":{"size":30092,"size_decoded":0,"mime_type":"font/woff2","magic":"Web Open Font Format (Version 2), TrueType, length 30092, version 1.0","md5":"fa41c43a3d8e68fafc0ec15acca8b6fd","sha1":"adbdfd9a78699a96a9705fbeb3470c2c653dedf0","sha256":"2ee17598a98d8a59e4df8152d015bec9ab8e4d5672cc0ab42bef806b568e3971","sha512":"936da7cff6f59919a72f564c6f1d3b78e1a3be000fb1ca712abea3266687846d53c25dcf1d1b78221c985d4e96dda91ced26a221d85e4521e3d661c71affa216","ssdeep":"768:eHpJRc2xEL2BUo6ulIYw1wXomue+I4oOf8oSY6fg:gp62Uo6kuOYmuTaOfwYmg","tlshash":"ccd2f18a71f9a1f874695de0b8ee9b54bf8ee3221ae7745610d10781d6e13083bbcc35","first_seen":"2025-06-04T20:20:25.58114Z","last_seen":"2026-08-12T15:36:36.713319Z","times_seen":3052,"resource_available":false,"data":null}},"time_used":266,"timings":{"blocked":127,"dns":1,"connect":10,"send":0,"wait":8,"receive":3,"ssl":112},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"darkchange.io/fonts/CircularStd-Book.woff2","fqdn":"darkchange.io","domain":"darkchange.io","tld":"io"},"ip":{"addr":"188.114.97.1","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"font","requested_by":"https://darkchange.io/","date":"2026-01-10T21:08:08.730Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"darkchange.io","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Thu, 20 Nov 2025 02:05:49 GMT","end":"Wed, 18 Feb 2026 03:03:26 GMT"},"fingerprint":{"sha1":"D9:05:E0:7A:C5:10:1D:91:FE:1C:0E:8E:3B:5A:C6:2E:53:6E:71:26","sha256":"77:91:00:F2:25:D2:53:58:51:3C:40:EE:E6:DD:C1:A6:D3:EE:B5:16:F1:6E:C2:19:CF:54:27:61:9E:46:C7:AF"}}},"request":{"raw":"GET /fonts/CircularStd-Book.woff2 HTTP/1.1\r\nHost: darkchange.io\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: identity\r\nReferer: https://darkchange.io/assets/index-DKSPX2TN.css\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: font\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\ndate: Sat, 10 Jan 2026 21:08:08 GMT\r\ncontent-type: text/html; charset=utf-8\r\nvary: Origin, accept-encoding\r\naccess-control-allow-credentials: true\r\naccess-control-expose-headers: Content-Length,X-Total-Count\r\nx-frame-options: DENY\r\nx-content-type-options: nosniff\r\nx-xss-protection: 1; mode=block\r\nreferrer-policy: strict-origin-when-cross-origin\r\nstrict-transport-security: max-age=31536000; includeSubDomains\r\ncontent-security-policy: default-src 'self'; script-src 'self'; style-src 'self' https://fonts.googleapis.com; font-src 'self' https://fonts.gstatic.com; img-src 'self' data: https:; connect-src 'self' https:; frame-ancestors 'none';\r\npermissions-policy: geolocation=(), microphone=(), camera=()\r\ncache-control: max-age=14400\r\ncf-cache-status: EXPIRED\r\nlast-modified: Sat, 10 Jan 2026 21:08:08 GMT\r\npriority: u=4,i=?0\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=h7UE7GveoNVnqvH942VAoiPhILcFgZcXf%2B2YNsOL8jI%2FQk4IBfA6%2FxXahgK522rAOA3W39WhRl3cxgZBz6TPB4qJcK3brt2kP8wl6CY%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nserver: cloudflare\r\ncf-ray: 9bbf25e2af48a0f0-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":5947,"size_decoded":0,"mime_type":"text/html; charset=utf-8","magic":"HTML document, ASCII text","md5":"9b39c5299b40dd917288471c4f8aaba8","sha1":"077b77f285a2e311e76882b46c058c3cedef2a32","sha256":"fec1d5df3a37026bdeea4467fc534a1716957c96dccf30dd41bbcc646ed603a1","sha512":"56645f8d0913e7abac03711a569e8a12994fe0ff0c7f67caaffc3e6e5540bc4b05d3c944f23ea17922b1acbef5067177d82b3557250ac5ef308829f0d5123045","ssdeep":"96:bkJvttM7IslGKv5M7Is8L+u2eM7IsURB+D+XZQ38Iy389ay38KCq8Cbg3Zg:bkJvtwlGysQ2zs+ausIys9aysKCq8Cbr","tlshash":"a2c1f1a3a5e0dc2652e5406819f2b448993d40c7c7187e0bb39c51de0fc9ee886fb79d","first_seen":"2026-01-10T21:08:37.460022Z","last_seen":"2026-01-10T21:11:27.898902Z","times_seen":2,"resource_available":false,"data":null}},"time_used":40,"timings":{"blocked":3,"dns":0,"connect":0,"send":0,"wait":37,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-01-10","alert":"Sinkholed","trigger":"darkchange.io","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"darkchange.io/crypto-logos/monero.svg","fqdn":"darkchange.io","domain":"darkchange.io","tld":"io"},"ip":{"addr":"188.114.97.1","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"lazy-img","requested_by":"https://darkchange.io/","date":"2026-01-10T21:08:08.868Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"darkchange.io","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Thu, 20 Nov 2025 02:05:49 GMT","end":"Wed, 18 Feb 2026 03:03:26 GMT"},"fingerprint":{"sha1":"D9:05:E0:7A:C5:10:1D:91:FE:1C:0E:8E:3B:5A:C6:2E:53:6E:71:26","sha256":"77:91:00:F2:25:D2:53:58:51:3C:40:EE:E6:DD:C1:A6:D3:EE:B5:16:F1:6E:C2:19:CF:54:27:61:9E:46:C7:AF"}}},"request":{"raw":"GET /crypto-logos/monero.svg HTTP/1.1\r\nHost: darkchange.io\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://darkchange.io/\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\ndate: Sat, 10 Jan 2026 21:08:08 GMT\r\ncontent-type: image/svg+xml\r\nvary: Origin, accept-encoding\r\naccess-control-allow-credentials: true\r\naccess-control-expose-headers: Content-Length,X-Total-Count\r\nx-frame-options: DENY\r\nx-content-type-options: nosniff\r\nx-xss-protection: 1; mode=block\r\nreferrer-policy: strict-origin-when-cross-origin\r\nstrict-transport-security: max-age=31536000; includeSubDomains\r\ncontent-security-policy: default-src 'self'; script-src 'self'; style-src 'self' https://fonts.googleapis.com; font-src 'self' https://fonts.gstatic.com; img-src 'self' data: https:; connect-src 'self' https:; frame-ancestors 'none';\r\npermissions-policy: geolocation=(), microphone=(), camera=()\r\ncache-control: max-age=14400\r\ncf-cache-status: EXPIRED\r\nlast-modified: Sat, 10 Jan 2026 21:08:08 GMT\r\npriority: u=4,i=?0\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=r5%2Bva0nTA0Rbjw7zoXteCnELEASvOMyUcdOCaVWgTrFoGPRT3HgbUBoa%2Bl42AEXzd%2B1zaWM80cWd7paDTdqeFqsUn3C3XCRRZ21XXxE%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncontent-encoding: br\r\nserver: cloudflare\r\ncf-ray: 9bbf25e3694ca0f0-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":3562,"size_decoded":0,"mime_type":"image/svg+xml","magic":"SVG Scalable Vector Graphics image","md5":"f2ca19ff8f70bdb98f8a23295c6554c1","sha1":"a92bedf94c89c359648204c82bbb969522c9844f","sha256":"9dc52b168b3878f38917328243b9df5715446b989a406257dae21d893063d2a9","sha512":"6b5265fe0b74b33ba788979a6563cc444f974e54da072107bc6aff6dc0f5505960378284b2fa58ab70e71f68d9414e479d5526c7addfd53cc1d4cc04b7922f6b","ssdeep":"","tlshash":"4f7195f99b5441e0a48adbbafc38d92b312f34f67dd58dd0c295fb05a4820af8d458c0","first_seen":"2025-11-20T12:33:07.027055Z","last_seen":"2026-02-14T00:24:47.915178Z","times_seen":7,"resource_available":false,"data":null}},"time_used":73,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":73,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-01-10","alert":"Sinkholed","trigger":"darkchange.io","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"darkchange.io/crypto-logos/litecoin.svg","fqdn":"darkchange.io","domain":"darkchange.io","tld":"io"},"ip":{"addr":"188.114.97.1","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"lazy-img","requested_by":"https://darkchange.io/","date":"2026-01-10T21:08:08.871Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"darkchange.io","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Thu, 20 Nov 2025 02:05:49 GMT","end":"Wed, 18 Feb 2026 03:03:26 GMT"},"fingerprint":{"sha1":"D9:05:E0:7A:C5:10:1D:91:FE:1C:0E:8E:3B:5A:C6:2E:53:6E:71:26","sha256":"77:91:00:F2:25:D2:53:58:51:3C:40:EE:E6:DD:C1:A6:D3:EE:B5:16:F1:6E:C2:19:CF:54:27:61:9E:46:C7:AF"}}},"request":{"raw":"GET /crypto-logos/litecoin.svg HTTP/1.1\r\nHost: darkchange.io\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://darkchange.io/\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\ndate: Sat, 10 Jan 2026 21:08:08 GMT\r\ncontent-type: image/svg+xml\r\nvary: Origin, accept-encoding\r\naccess-control-allow-credentials: true\r\naccess-control-expose-headers: Content-Length,X-Total-Count\r\nx-frame-options: DENY\r\nx-content-type-options: nosniff\r\nx-xss-protection: 1; mode=block\r\nreferrer-policy: strict-origin-when-cross-origin\r\nstrict-transport-security: max-age=31536000; includeSubDomains\r\ncontent-security-policy: default-src 'self'; script-src 'self'; style-src 'self' https://fonts.googleapis.com; font-src 'self' https://fonts.gstatic.com; img-src 'self' data: https:; connect-src 'self' https:; frame-ancestors 'none';\r\npermissions-policy: geolocation=(), microphone=(), camera=()\r\ncache-control: max-age=14400\r\ncf-cache-status: EXPIRED\r\nlast-modified: Sat, 10 Jan 2026 21:08:08 GMT\r\npriority: u=4,i=?0\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=HVGBvDkEq1jRZ23WlzPH7E0rY1JjTJXhATAkRYs4SC%2BblgxlQ6w2KzLTikQwk5%2FCSRVzq%2BCdZO5g7%2Fy%2BTwRpGe2e4GYC0%2FJm2dCFSsI%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncontent-encoding: br\r\nserver: cloudflare\r\ncf-ray: 9bbf25e3795fa0f0-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":4819,"size_decoded":0,"mime_type":"image/svg+xml","magic":"SVG Scalable Vector Graphics image","md5":"77825e6b48e1aa0efdd6258b271c17cf","sha1":"156ed22cbc742ce08b21e358466b95f7eab3084d","sha256":"69bc6aa46f2bd505fa719611d811a1a96c721d8bdbd296d3f2034332cc1c8f15","sha512":"99f1ff5cdd396ade45ca737792e2cf9e4aadf1499f1164563d6078b51279ef85459f55c63eb40df0f6898247d6c0a24efd51601dace2e4fbc5ae653a7b8561ff","ssdeep":"96:jgLevluwiIJoRsnysUajHBpIGbfF5E/zQHa5B5m7y/rYAhfvKCBLjHCd:TvfmRsnTjHBpXg7QHaD5m74DEoGd","tlshash":"50a181e64fe4b9d8a801d3f0e82880b23e5f20fa7a51ddf5c391ef49b61549d4c88c85","first_seen":"2025-11-20T12:33:06.993273Z","last_seen":"2026-02-14T00:24:47.925152Z","times_seen":7,"resource_available":false,"data":null}},"time_used":71,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":71,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-01-10","alert":"Sinkholed","trigger":"darkchange.io","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"darkchange.io/exchange/estimate","fqdn":"darkchange.io","domain":"darkchange.io","tld":"io"},"ip":{"addr":"188.114.97.1","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"fetch","requested_by":"https://darkchange.io/","date":"2026-01-10T21:08:09.176Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"darkchange.io","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Thu, 20 Nov 2025 02:05:49 GMT","end":"Wed, 18 Feb 2026 03:03:26 GMT"},"fingerprint":{"sha1":"D9:05:E0:7A:C5:10:1D:91:FE:1C:0E:8E:3B:5A:C6:2E:53:6E:71:26","sha256":"77:91:00:F2:25:D2:53:58:51:3C:40:EE:E6:DD:C1:A6:D3:EE:B5:16:F1:6E:C2:19:CF:54:27:61:9E:46:C7:AF"}}},"request":{"raw":"POST /exchange/estimate HTTP/1.1\r\nHost: darkchange.io\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://darkchange.io/\r\nContent-Type: application/json\r\nContent-Length: 75\r\nOrigin: https://darkchange.io\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"POST","post_data":{"size":75,"data":"{\"fromCoin\":\"xmr\",\"toCoin\":\"btc\",\"amount\":\"127.43\",\"provider\":\"darkchange\"}"}},"response":{"raw":"HTTP/3 200 OK\r\ndate: Sat, 10 Jan 2026 21:08:09 GMT\r\ncontent-type: application/json\r\naccess-control-allow-origin: https://darkchange.io\r\nvary: Origin\r\naccess-control-allow-credentials: true\r\naccess-control-expose-headers: Content-Length,X-Total-Count\r\nx-frame-options: DENY\r\nx-content-type-options: nosniff\r\nx-xss-protection: 1; mode=block\r\nreferrer-policy: strict-origin-when-cross-origin\r\nstrict-transport-security: max-age=31536000; includeSubDomains\r\ncontent-security-policy: default-src 'self'; script-src 'self'; style-src 'self' https://fonts.googleapis.com; font-src 'self' https://fonts.gstatic.com; img-src 'self' data: https:; connect-src 'self' https:; frame-ancestors 'none';\r\npermissions-policy: geolocation=(), microphone=(), camera=()\r\ncf-cache-status: DYNAMIC\r\npriority: u=4,i=?0\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=zfUn8MjxkQGc8zwaDIVybBy36P6wy6DbA3D0NAvgpOTRoutv0u9M4lDZohJ0Z7bUzrRFl0JM7oL0t6RS2W8pQ6vAFJtNYx1IqNepymk%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncontent-encoding: br\r\nserver: cloudflare\r\ncf-ray: 9bbf25e56e75a0f0-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":187,"size_decoded":0,"mime_type":"application/json","magic":"JSON text data","md5":"3d494afdbf85ed3804e13f7b8f8ab6e2","sha1":"d506ecbca7efdaead8484c80032405d64e2217c7","sha256":"55773b9bf042917c63139a3207dd3fc21a1a1dc37fa7c0d82a7c86c0aa29a9e2","sha512":"72b119e8d6f6a183907a5a3cd3a0576c0a9c1bace756df4c20ad41deeeb9e2facdddc1dab7cde2576e0e8b058a162cf927a7dd2082757e3bb314ca65de834c15","ssdeep":"","tlshash":"34c0801d35156c32cd0d01d5e97f12343dd7523574ed5e98cc8a8df641d16d54b11d54","first_seen":"2026-01-10T21:08:37.464258Z","last_seen":"2026-01-10T21:08:37.464258Z","times_seen":1,"resource_available":false,"data":null}},"time_used":242,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":242,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-01-10","alert":"Sinkholed","trigger":"darkchange.io","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"darkchange.io/assets/index-DvjNr9xF.js","fqdn":"darkchange.io","domain":"darkchange.io","tld":"io"},"ip":{"addr":"188.114.97.1","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"fetch","requested_by":"https://darkchange.io/","date":"2026-01-10T21:08:08.240Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"darkchange.io","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Thu, 20 Nov 2025 02:05:49 GMT","end":"Wed, 18 Feb 2026 03:03:26 GMT"},"fingerprint":{"sha1":"D9:05:E0:7A:C5:10:1D:91:FE:1C:0E:8E:3B:5A:C6:2E:53:6E:71:26","sha256":"77:91:00:F2:25:D2:53:58:51:3C:40:EE:E6:DD:C1:A6:D3:EE:B5:16:F1:6E:C2:19:CF:54:27:61:9E:46:C7:AF"}}},"request":{"raw":"GET /assets/index-DvjNr9xF.js HTTP/1.1\r\nHost: darkchange.io\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://darkchange.io/\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\ndate: Sat, 10 Jan 2026 21:08:08 GMT\r\ncontent-type: text/javascript; charset=utf-8\r\nvary: Origin, accept-encoding\r\naccess-control-allow-credentials: true\r\naccess-control-expose-headers: Content-Length,X-Total-Count\r\nx-frame-options: DENY\r\nx-content-type-options: nosniff\r\nx-xss-protection: 1; mode=block\r\nreferrer-policy: strict-origin-when-cross-origin\r\nstrict-transport-security: max-age=31536000; includeSubDomains\r\ncontent-security-policy: default-src 'self'; script-src 'self'; style-src 'self' https://fonts.googleapis.com; font-src 'self' https://fonts.gstatic.com; img-src 'self' data: https:; connect-src 'self' https:; frame-ancestors 'none';\r\npermissions-policy: geolocation=(), microphone=(), camera=()\r\ncache-control: max-age=14400\r\ncf-cache-status: MISS\r\nlast-modified: Sat, 10 Jan 2026 21:08:08 GMT\r\npriority: u=4,i=?0\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=l9a%2FHv3sOVCTrHYRkwsNNQQZQunyjOvLfli3gVQAuX350dO%2Fz60ntBt%2F1qUdowbismmQvwYncu6SQG1rVx6CPey9QRX1R2gxGopwisM%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncontent-encoding: br\r\nserver: cloudflare\r\ncf-ray: 9bbf25df9e25a0f0-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":403260,"size_decoded":0,"mime_type":"text/javascript; charset=utf-8","magic":"JavaScript source, ASCII text, with very long lines (65536), with no line terminators","md5":"f27216d745d0acc1866a9c6b0d1c6ada","sha1":"7bcc3ecb0f468568f23b02b93f4e111437924f79","sha256":"c949e5d675d1287c9ab52b87129491c86743dbef18d94e506d0f1d4fa6b5176a","sha512":"8e3385509e42ee867abac64355967fb29f83007f7a093439f99b99ec663e218c591ad117d9bfff697670915d37669e36b39e0ba7281e0cb76c29cf208c8e3d31","ssdeep":"1536:mUuCKlolLoM32F6kj40NbiY2UKkKsKLFqlt86gkLINkHVuN02MYYoyr8nLjND1M5:/lId8XY8nLjNDWMaH","tlshash":"a3842294c3922a6bf844cade8fd6180c3c9e17ba9ab2cce5964d473640f84cd365f365","first_seen":"2026-01-10T21:08:37.465208Z","last_seen":"2026-01-10T21:11:27.88505Z","times_seen":2,"resource_available":true,"data":null}},"time_used":185,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":70,"receive":115,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-01-10","alert":"Sinkholed","trigger":"darkchange.io","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"darkchange.io/favicon.svg","fqdn":"darkchange.io","domain":"darkchange.io","tld":"io"},"ip":{"addr":"188.114.97.1","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://darkchange.io/","date":"2026-01-10T21:08:08.439Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"darkchange.io","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Thu, 20 Nov 2025 02:05:49 GMT","end":"Wed, 18 Feb 2026 03:03:26 GMT"},"fingerprint":{"sha1":"D9:05:E0:7A:C5:10:1D:91:FE:1C:0E:8E:3B:5A:C6:2E:53:6E:71:26","sha256":"77:91:00:F2:25:D2:53:58:51:3C:40:EE:E6:DD:C1:A6:D3:EE:B5:16:F1:6E:C2:19:CF:54:27:61:9E:46:C7:AF"}}},"request":{"raw":"GET /favicon.svg HTTP/1.1\r\nHost: darkchange.io\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://darkchange.io/\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\ndate: Sat, 10 Jan 2026 21:08:08 GMT\r\ncontent-type: image/svg+xml\r\nvary: Origin, accept-encoding\r\naccess-control-allow-credentials: true\r\naccess-control-expose-headers: Content-Length,X-Total-Count\r\nx-frame-options: DENY\r\nx-content-type-options: nosniff\r\nx-xss-protection: 1; mode=block\r\nreferrer-policy: strict-origin-when-cross-origin\r\nstrict-transport-security: max-age=31536000; includeSubDomains\r\ncontent-security-policy: default-src 'self'; script-src 'self'; style-src 'self' https://fonts.googleapis.com; font-src 'self' https://fonts.gstatic.com; img-src 'self' data: https:; connect-src 'self' https:; frame-ancestors 'none';\r\npermissions-policy: geolocation=(), microphone=(), camera=()\r\ncache-control: max-age=14400\r\ncf-cache-status: EXPIRED\r\nlast-modified: Sat, 10 Jan 2026 21:08:08 GMT\r\npriority: u=6,i=?0\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=Et97gid4fYjMA1mceXuP%2FVhLHRRuCwfbMCLiM2elxn%2FIiY9iHoKxRh2ob1%2BvDxgRUt9%2BK4mV5%2FZstMhD3%2BBfiNW6t4Kia4PvxtXA904%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncontent-encoding: br\r\nserver: cloudflare\r\ncf-ray: 9bbf25e0da7ea0f0-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":1858,"size_decoded":0,"mime_type":"image/svg+xml","magic":"SVG Scalable Vector Graphics image","md5":"d2335719348bb9c812b0b4f622787277","sha1":"b5f058f14768511b2c949d4f699069c96d6a87cc","sha256":"61218aca550c43131d3d086719e05a245199336154d09c80b182fa0c98d5dfb1","sha512":"15af176667eb411847d43e1db14bb747c96b289d951f5893c1b025b310e2fbb0f937cc450a0f31d6ccb4b9c48c037ae5747f27dc8cf33e1b9554c39fd0160cbf","ssdeep":"","tlshash":"de3144cd3f64954455dc8fe67f21e09c5d67e0a1498d0892c05c9f8c98c1c7e6a06912","first_seen":"2026-01-10T21:08:37.46614Z","last_seen":"2026-02-14T00:24:47.943935Z","times_seen":6,"resource_available":false,"data":null}},"time_used":68,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":68,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-01-10","alert":"Sinkholed","trigger":"darkchange.io","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"darkchange.io/illustrations/monero-exchange.png","fqdn":"darkchange.io","domain":"darkchange.io","tld":"io"},"ip":{"addr":"188.114.97.1","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://darkchange.io/","date":"2026-01-10T21:08:08.501Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"darkchange.io","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Thu, 20 Nov 2025 02:05:49 GMT","end":"Wed, 18 Feb 2026 03:03:26 GMT"},"fingerprint":{"sha1":"D9:05:E0:7A:C5:10:1D:91:FE:1C:0E:8E:3B:5A:C6:2E:53:6E:71:26","sha256":"77:91:00:F2:25:D2:53:58:51:3C:40:EE:E6:DD:C1:A6:D3:EE:B5:16:F1:6E:C2:19:CF:54:27:61:9E:46:C7:AF"}}},"request":{"raw":"GET /illustrations/monero-exchange.png HTTP/1.1\r\nHost: darkchange.io\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://darkchange.io/\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\ndate: Sat, 10 Jan 2026 21:08:08 GMT\r\ncontent-type: image/png\r\nvary: Origin, accept-encoding\r\naccess-control-allow-credentials: true\r\naccess-control-expose-headers: Content-Length,X-Total-Count\r\nx-frame-options: DENY\r\nx-content-type-options: nosniff\r\nx-xss-protection: 1; mode=block\r\nreferrer-policy: strict-origin-when-cross-origin\r\nstrict-transport-security: max-age=31536000; includeSubDomains\r\ncontent-security-policy: default-src 'self'; script-src 'self'; style-src 'self' https://fonts.googleapis.com; font-src 'self' https://fonts.gstatic.com; img-src 'self' data: https:; connect-src 'self' https:; frame-ancestors 'none';\r\npermissions-policy: geolocation=(), microphone=(), camera=()\r\ncache-control: max-age=14400\r\ncf-cache-status: EXPIRED\r\nlast-modified: Sat, 10 Jan 2026 21:08:08 GMT\r\npriority: u=4,i=?0\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=p7SdJpTEAS3M%2Bwu4gmYLU0MD77w7jugvZ9FUqtqu8wbPd2jJFM3bkdEN%2BNNknNYs1fnZO14H3rRL8vEM3abpuHd26BfXwiw7zjzFINw%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nserver: cloudflare\r\ncf-ray: 9bbf25e13b86a0f0-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":37612,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 530 x 250, 8-bit/color RGBA, non-interlaced","md5":"d6d7e1b64757f505c1a58e663f2226a2","sha1":"49148eb84cad4a2a335ab7b72b83b05004cc226b","sha256":"e6006143a59b59b4021b3f788d304e9142f70f929159b0422dcb318a06d94d48","sha512":"7ecc230ac0c6d3769dab9f1d5bdc2dceec744105e663122f5c51cd7895cff28b87a3fab82d806b1dd64748fa244f8ab0a141f308518c33097c46e8d05dd103eb","ssdeep":"768:vN4svRdiiKG2ChsW6y3puA6FmZDDZHm7fUQMTldqOWj9Fn6Q:vN4sDvKSOpy5YMNtHm7f7OWxF6Q","tlshash":"34f2f1a76d384837f882493116c00f4a266191e45b7ddc03d149c9bc3f9d27a7daa779","first_seen":"2026-01-10T21:08:37.467024Z","last_seen":"2026-01-10T21:08:37.467024Z","times_seen":1,"resource_available":false,"data":null}},"time_used":122,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":67,"receive":55,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-01-10","alert":"Sinkholed","trigger":"darkchange.io","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"darkchange.io/crypto-logos/solana.svg","fqdn":"darkchange.io","domain":"darkchange.io","tld":"io"},"ip":{"addr":"188.114.97.1","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"lazy-img","requested_by":"https://darkchange.io/","date":"2026-01-10T21:08:08.869Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"darkchange.io","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Thu, 20 Nov 2025 02:05:49 GMT","end":"Wed, 18 Feb 2026 03:03:26 GMT"},"fingerprint":{"sha1":"D9:05:E0:7A:C5:10:1D:91:FE:1C:0E:8E:3B:5A:C6:2E:53:6E:71:26","sha256":"77:91:00:F2:25:D2:53:58:51:3C:40:EE:E6:DD:C1:A6:D3:EE:B5:16:F1:6E:C2:19:CF:54:27:61:9E:46:C7:AF"}}},"request":{"raw":"GET /crypto-logos/solana.svg HTTP/1.1\r\nHost: darkchange.io\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://darkchange.io/\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\ndate: Sat, 10 Jan 2026 21:08:08 GMT\r\ncontent-type: image/svg+xml\r\nvary: Origin, accept-encoding\r\naccess-control-allow-credentials: true\r\naccess-control-expose-headers: Content-Length,X-Total-Count\r\nx-frame-options: DENY\r\nx-content-type-options: nosniff\r\nx-xss-protection: 1; mode=block\r\nreferrer-policy: strict-origin-when-cross-origin\r\nstrict-transport-security: max-age=31536000; includeSubDomains\r\ncontent-security-policy: default-src 'self'; script-src 'self'; style-src 'self' https://fonts.googleapis.com; font-src 'self' https://fonts.gstatic.com; img-src 'self' data: https:; connect-src 'self' https:; frame-ancestors 'none';\r\npermissions-policy: geolocation=(), microphone=(), camera=()\r\ncache-control: max-age=14400\r\ncf-cache-status: EXPIRED\r\nlast-modified: Sat, 10 Jan 2026 21:08:08 GMT\r\npriority: u=4,i=?0\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=4glGTRn29%2B08FafE3Trx%2BUtSb0VGEeZTcg8yDiKXar02tR%2FJJ7DAuMFNGRNB9hLZDuyY%2Fq8o0njndbyVPnf0b4%2FUlwiDKQH5wW64ZtQ%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncontent-encoding: br\r\nserver: cloudflare\r\ncf-ray: 9bbf25e36953a0f0-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":5991,"size_decoded":0,"mime_type":"image/svg+xml","magic":"SVG Scalable Vector Graphics image","md5":"416fc35cacf9a777fbbe7cd78d916289","sha1":"d13c9d2926450fb919ee86b6e8cad8ef483e8597","sha256":"181a3cbcc13de2a013f631adf6184cc935126e368c1ea1c2648abb45d9d2c19e","sha512":"e9b6a847d284183b6c0953af1ac0361745981dcaa416c2451b56172974efe9992d53071c2ed12dc4fad76fa58f138ecb4a70d648fdc6d37db4584f5e97e2c100","ssdeep":"96:etKqfj51GhuQt2MdDBTz5ZYrUxZ+DYydOYWLM48Nd/z/BYsHOoICXL:et7PMdDBTz5dxZQd5SMpbb/ruoIEL","tlshash":"4dc194d9774473f4a90be73ada2951b6f62b3cfe7f398e90c3049f166015109c464ca8","first_seen":"2025-11-20T12:33:07.017571Z","last_seen":"2026-02-14T00:24:47.917578Z","times_seen":7,"resource_available":false,"data":null}},"time_used":81,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":81,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-01-10","alert":"Sinkholed","trigger":"darkchange.io","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"darkchange.io/crypto-logos/ripple.svg","fqdn":"darkchange.io","domain":"darkchange.io","tld":"io"},"ip":{"addr":"188.114.97.1","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"lazy-img","requested_by":"https://darkchange.io/","date":"2026-01-10T21:08:08.877Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"darkchange.io","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Thu, 20 Nov 2025 02:05:49 GMT","end":"Wed, 18 Feb 2026 03:03:26 GMT"},"fingerprint":{"sha1":"D9:05:E0:7A:C5:10:1D:91:FE:1C:0E:8E:3B:5A:C6:2E:53:6E:71:26","sha256":"77:91:00:F2:25:D2:53:58:51:3C:40:EE:E6:DD:C1:A6:D3:EE:B5:16:F1:6E:C2:19:CF:54:27:61:9E:46:C7:AF"}}},"request":{"raw":"GET /crypto-logos/ripple.svg HTTP/1.1\r\nHost: darkchange.io\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://darkchange.io/\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\ndate: Sat, 10 Jan 2026 21:08:08 GMT\r\ncontent-type: image/svg+xml\r\nvary: Origin, accept-encoding\r\naccess-control-allow-credentials: true\r\naccess-control-expose-headers: Content-Length,X-Total-Count\r\nx-frame-options: DENY\r\nx-content-type-options: nosniff\r\nx-xss-protection: 1; mode=block\r\nreferrer-policy: strict-origin-when-cross-origin\r\nstrict-transport-security: max-age=31536000; includeSubDomains\r\ncontent-security-policy: default-src 'self'; script-src 'self'; style-src 'self' https://fonts.googleapis.com; font-src 'self' https://fonts.gstatic.com; img-src 'self' data: https:; connect-src 'self' https:; frame-ancestors 'none';\r\npermissions-policy: geolocation=(), microphone=(), camera=()\r\ncache-control: max-age=14400\r\ncf-cache-status: EXPIRED\r\nlast-modified: Sat, 10 Jan 2026 21:08:08 GMT\r\npriority: u=4,i=?0\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=Ee%2BGRd7VAivxi6HY8FIz%2FhpDVYU%2FtRq4RDWBI5D8SQ%2FLMh730dSUkwnSptwHBdSHhtAQPhRp8urn6cnBm5CPzdYqYc3Gb5OsxVgtog0%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncontent-encoding: br\r\nserver: cloudflare\r\ncf-ray: 9bbf25e37968a0f0-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":4270,"size_decoded":0,"mime_type":"image/svg+xml","magic":"SVG Scalable Vector Graphics image","md5":"c4e05bccf04ecd98be3a59326d103dbe","sha1":"e40759c1f0454a81273e624f0eab54b10205237a","sha256":"87c5676201090480e1bf438de5826015f16ada0769f4696fccad3c2ca383d0a4","sha512":"e958fc96d1e39c836f93af7da52d6ca97c437c2daefa75093bfef068ebf99f38338d0fe325c4919f43bc02ab5b47f4d77c4fdb9b9bb02a2ee22a267ffe472710","ssdeep":"96:C9sF5AfyV2MK2Pt8JAjjSkFEkK2Ct0DTR+NmwMPceTY:CenAfyVJt8SSkf9TmMNTY","tlshash":"5091a4f15388f3e0750bfb91d438112ab9af74f9af22cd958a76be49630c028099ccd0","first_seen":"2025-11-20T12:33:07.036288Z","last_seen":"2026-02-14T00:24:47.933431Z","times_seen":7,"resource_available":false,"data":null}},"time_used":71,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":71,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-01-10","alert":"Sinkholed","trigger":"darkchange.io","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"darkchange.io/","fqdn":"darkchange.io","domain":"darkchange.io","tld":"io"},"ip":{"addr":"188.114.97.1","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":true,"resource_type":"document","requested_by":"","date":"2026-01-10T21:08:07.519Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"darkchange.io","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Thu, 20 Nov 2025 02:05:49 GMT","end":"Wed, 18 Feb 2026 03:03:26 GMT"},"fingerprint":{"sha1":"D9:05:E0:7A:C5:10:1D:91:FE:1C:0E:8E:3B:5A:C6:2E:53:6E:71:26","sha256":"77:91:00:F2:25:D2:53:58:51:3C:40:EE:E6:DD:C1:A6:D3:EE:B5:16:F1:6E:C2:19:CF:54:27:61:9E:46:C7:AF"}}},"request":{"raw":"GET / HTTP/1.1\r\nHost: darkchange.io\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nUpgrade-Insecure-Requests: 1\r\nSec-Fetch-Dest: document\r\nSec-Fetch-Mode: navigate\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ndate: Sat, 10 Jan 2026 21:08:07 GMT\r\ncontent-type: text/html; charset=utf-8\r\nvary: Origin\r\naccess-control-allow-credentials: true\r\naccess-control-expose-headers: Content-Length,X-Total-Count\r\nx-frame-options: DENY\r\nx-content-type-options: nosniff\r\nx-xss-protection: 1; mode=block\r\nreferrer-policy: strict-origin-when-cross-origin\r\nstrict-transport-security: max-age=31536000; includeSubDomains\r\ncontent-security-policy: default-src 'self'; script-src 'self'; style-src 'self' https://fonts.googleapis.com; font-src 'self' https://fonts.gstatic.com; img-src 'self' data: https:; connect-src 'self' https:; frame-ancestors 'none';\r\npermissions-policy: geolocation=(), microphone=(), camera=()\r\ncf-cache-status: DYNAMIC\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=F8cXYtWEdktKxz9N3DVLj0WNMfLM%2BUczDbzmu9PbXHf8TS3V6dTGqfrpKdp9k1Szn0d9mOhACeiP1plKykTpPdpV4HJ%2BCbM4AWWg\"}]}\r\ncontent-encoding: br\r\nserver: cloudflare\r\ncf-ray: 9bbf25db5d1eb517-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":5947,"size_decoded":0,"mime_type":"text/html; charset=utf-8","magic":"HTML document, ASCII text","md5":"9b39c5299b40dd917288471c4f8aaba8","sha1":"077b77f285a2e311e76882b46c058c3cedef2a32","sha256":"fec1d5df3a37026bdeea4467fc534a1716957c96dccf30dd41bbcc646ed603a1","sha512":"56645f8d0913e7abac03711a569e8a12994fe0ff0c7f67caaffc3e6e5540bc4b05d3c944f23ea17922b1acbef5067177d82b3557250ac5ef308829f0d5123045","ssdeep":"96:bkJvttM7IslGKv5M7Is8L+u2eM7IsURB+D+XZQ38Iy389ay38KCq8Cbg3Zg:bkJvtwlGysQ2zs+ausIys9aysKCq8Cbr","tlshash":"a2c1f1a3a5e0dc2652e5406819f2b448993d40c7c7187e0bb39c51de0fc9ee886fb79d","first_seen":"2026-01-10T21:08:37.460022Z","last_seen":"2026-01-10T21:11:27.898902Z","times_seen":2,"resource_available":false,"data":null}},"time_used":162,"timings":{"blocked":45,"dns":27,"connect":1,"send":0,"wait":71,"receive":0,"ssl":15},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-01-10","alert":"Sinkholed","trigger":"darkchange.io","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"darkchange.io/illustrations/planet-exchange.svg","fqdn":"darkchange.io","domain":"darkchange.io","tld":"io"},"ip":{"addr":"188.114.97.1","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://darkchange.io/","date":"2026-01-10T21:08:08.640Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"darkchange.io","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Thu, 20 Nov 2025 02:05:49 GMT","end":"Wed, 18 Feb 2026 03:03:26 GMT"},"fingerprint":{"sha1":"D9:05:E0:7A:C5:10:1D:91:FE:1C:0E:8E:3B:5A:C6:2E:53:6E:71:26","sha256":"77:91:00:F2:25:D2:53:58:51:3C:40:EE:E6:DD:C1:A6:D3:EE:B5:16:F1:6E:C2:19:CF:54:27:61:9E:46:C7:AF"}}},"request":{"raw":"GET /illustrations/planet-exchange.svg HTTP/1.1\r\nHost: darkchange.io\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://darkchange.io/\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\ndate: Sat, 10 Jan 2026 21:08:08 GMT\r\ncontent-type: image/svg+xml\r\nvary: Origin, accept-encoding\r\naccess-control-allow-credentials: true\r\naccess-control-expose-headers: Content-Length,X-Total-Count\r\nx-frame-options: DENY\r\nx-content-type-options: nosniff\r\nx-xss-protection: 1; mode=block\r\nreferrer-policy: strict-origin-when-cross-origin\r\nstrict-transport-security: max-age=31536000; includeSubDomains\r\ncontent-security-policy: default-src 'self'; script-src 'self'; style-src 'self' https://fonts.googleapis.com; font-src 'self' https://fonts.gstatic.com; img-src 'self' data: https:; connect-src 'self' https:; frame-ancestors 'none';\r\npermissions-policy: geolocation=(), microphone=(), camera=()\r\nage: 0\r\ncache-control: max-age=14400\r\ncf-cache-status: HIT\r\nlast-modified: Sat, 10 Jan 2026 21:08:08 GMT\r\npriority: u=4,i=?0\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=CDHi5aKg587AE4OmU4krUxi5PiTQPYtbiaV0HjDMJsEYj4aX6VVppDkhxObrd7rkorz4Nl9C905FzuQrT2js3nqIUyvl7qaNVBkRgEQ%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncontent-encoding: br\r\nserver: cloudflare\r\ncf-ray: 9bbf25e20dd5a0f0-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":25117,"size_decoded":0,"mime_type":"image/svg+xml","magic":"SVG Scalable Vector Graphics image","md5":"c9a0df7edba2e41113eac5480b22034f","sha1":"1d2e39df073e7197c43d1a796dd47880fec229be","sha256":"842537925bbbc84f2bd8ad4e76aea408d97941bebdb77ac1d63d07b7fc4832e9","sha512":"74b3dec52f555020ae25e6bdc034353ae5f407e428ee1bb893e5b69eb29f01918469828fa6cfa6c699b7b98e4365b84fbfdcb03c351875a9d7fcdf4d9f96c3f1","ssdeep":"384:ISXJ/bJeUL3VW20CFmkmKmAmMmcmsmpmb:IQ/bJeU7d","tlshash":"e3b2f46ab31dec36e254c68cdf96c4a4114943e7d981c1e582a67f5fa2388c7192f3f1","first_seen":"2025-11-20T12:33:07.00015Z","last_seen":"2026-02-14T00:24:47.920336Z","times_seen":7,"resource_available":false,"data":null}},"time_used":6,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":6,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-01-10","alert":"Sinkholed","trigger":"darkchange.io","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"darkchange.io/crypto-logos/bitcoin.svg","fqdn":"darkchange.io","domain":"darkchange.io","tld":"io"},"ip":{"addr":"188.114.97.1","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"lazy-img","requested_by":"https://darkchange.io/","date":"2026-01-10T21:08:08.865Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"darkchange.io","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Thu, 20 Nov 2025 02:05:49 GMT","end":"Wed, 18 Feb 2026 03:03:26 GMT"},"fingerprint":{"sha1":"D9:05:E0:7A:C5:10:1D:91:FE:1C:0E:8E:3B:5A:C6:2E:53:6E:71:26","sha256":"77:91:00:F2:25:D2:53:58:51:3C:40:EE:E6:DD:C1:A6:D3:EE:B5:16:F1:6E:C2:19:CF:54:27:61:9E:46:C7:AF"}}},"request":{"raw":"GET /crypto-logos/bitcoin.svg HTTP/1.1\r\nHost: darkchange.io\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://darkchange.io/\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\ndate: Sat, 10 Jan 2026 21:08:08 GMT\r\ncontent-type: image/svg+xml\r\nvary: Origin, accept-encoding\r\naccess-control-allow-credentials: true\r\naccess-control-expose-headers: Content-Length,X-Total-Count\r\nx-frame-options: DENY\r\nx-content-type-options: nosniff\r\nx-xss-protection: 1; mode=block\r\nreferrer-policy: strict-origin-when-cross-origin\r\nstrict-transport-security: max-age=31536000; includeSubDomains\r\ncontent-security-policy: default-src 'self'; script-src 'self'; style-src 'self' https://fonts.googleapis.com; font-src 'self' https://fonts.gstatic.com; img-src 'self' data: https:; connect-src 'self' https:; frame-ancestors 'none';\r\npermissions-policy: geolocation=(), microphone=(), camera=()\r\ncache-control: max-age=14400\r\ncf-cache-status: EXPIRED\r\nlast-modified: Sat, 10 Jan 2026 21:08:08 GMT\r\npriority: u=4,i=?0\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=ZHqEXtZmThR9sdCBVh0lMXUUxqwyaIafnolbfXIItgO2pVyZjmXemkyRfknZG1YbtFrnS7ywx7KRVXWus2fKqoWc2%2FSdMNPBqCRSseg%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncontent-encoding: br\r\nserver: cloudflare\r\ncf-ray: 9bbf25e36943a0f0-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":8349,"size_decoded":0,"mime_type":"image/svg+xml","magic":"SVG Scalable Vector Graphics image","md5":"050fdc0a5ab78cf933e179e594dc59f1","sha1":"afe95b5ccdd7e4332452b89171bb3a88deaa6ce0","sha256":"bd0c7e456e93f58ba5c74eb81ab6a7a4cecf02312d18df49043238f72490193d","sha512":"2009e207bb237bd98d78850a48bbbac25cad7f177968478400decc01c1c392b16b388f0b1f2499cbbc4334c195029710d3c291c7345c24d34d1a5891a7c63b9c","ssdeep":"192:QHoe66M/u81vs6HbSVEyYP+u59xMb/IJKs2g3tsjVIxd:oWz/u0Mq9oMKs1iWn","tlshash":"c302b6f97796a3f4d402f3f5d8189415ba1f24fa6f65cae8c3576d8af0420ad9d88c80","first_seen":"2025-11-20T12:33:07.016233Z","last_seen":"2026-02-14T00:24:47.928057Z","times_seen":7,"resource_available":false,"data":null}},"time_used":74,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":74,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-01-10","alert":"Sinkholed","trigger":"darkchange.io","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"darkchange.io/crypto-logos/ethereum.svg","fqdn":"darkchange.io","domain":"darkchange.io","tld":"io"},"ip":{"addr":"188.114.97.1","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"lazy-img","requested_by":"https://darkchange.io/","date":"2026-01-10T21:08:08.866Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"darkchange.io","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Thu, 20 Nov 2025 02:05:49 GMT","end":"Wed, 18 Feb 2026 03:03:26 GMT"},"fingerprint":{"sha1":"D9:05:E0:7A:C5:10:1D:91:FE:1C:0E:8E:3B:5A:C6:2E:53:6E:71:26","sha256":"77:91:00:F2:25:D2:53:58:51:3C:40:EE:E6:DD:C1:A6:D3:EE:B5:16:F1:6E:C2:19:CF:54:27:61:9E:46:C7:AF"}}},"request":{"raw":"GET /crypto-logos/ethereum.svg HTTP/1.1\r\nHost: darkchange.io\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://darkchange.io/\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\ndate: Sat, 10 Jan 2026 21:08:08 GMT\r\ncontent-type: image/svg+xml\r\nvary: Origin, accept-encoding\r\naccess-control-allow-credentials: true\r\naccess-control-expose-headers: Content-Length,X-Total-Count\r\nx-frame-options: DENY\r\nx-content-type-options: nosniff\r\nx-xss-protection: 1; mode=block\r\nreferrer-policy: strict-origin-when-cross-origin\r\nstrict-transport-security: max-age=31536000; includeSubDomains\r\ncontent-security-policy: default-src 'self'; script-src 'self'; style-src 'self' https://fonts.googleapis.com; font-src 'self' https://fonts.gstatic.com; img-src 'self' data: https:; connect-src 'self' https:; frame-ancestors 'none';\r\npermissions-policy: geolocation=(), microphone=(), camera=()\r\ncache-control: max-age=14400\r\ncf-cache-status: EXPIRED\r\nlast-modified: Sat, 10 Jan 2026 21:08:08 GMT\r\npriority: u=4,i=?0\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=DA2Gu5hHM7owNez66%2BnGSIwOWV7A5QOOi7tk27bsg0x0Xvy460X3bmZgtus97FRhDHil%2F2BPDbjDoaM6K3%2BkWEg0jW87p%2FenVJwWw3I%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncontent-encoding: br\r\nserver: cloudflare\r\ncf-ray: 9bbf25e36947a0f0-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":11160,"size_decoded":0,"mime_type":"image/svg+xml","magic":"SVG Scalable Vector Graphics image","md5":"194c83272509ee55248bf772722da969","sha1":"b8e4eb50f1449f813e276e171d4ccf8b7ae25f31","sha256":"a438bfc96dccff9e92900df18ea93fbdf20fb7715f0f53c0e7f42e205031c9e8","sha512":"114e96c7ba0c62be2fac53119485facfa13138bf2c63d62aa22d27619b15efc04730dd0355bb09cccacd5c08f6810ca82ca3f7bb0e7e9fe641337d4aa2b75df8","ssdeep":"192:8j2pGCmkTOI8YwMm3izQs3wC5DgDTVlU99VO9BnT9NquStI6/F+nurqtJ2Jcz2d:8SpJOKw2Qs3wC5QlOVWP+3+GJ","tlshash":"0e32a5efb794e1e8b406f3f4e51684a57a6f34fd6a37cf60c3a52f59ea5204c9844880","first_seen":"2025-11-20T12:33:07.005366Z","last_seen":"2026-02-14T00:24:47.930845Z","times_seen":7,"resource_available":false,"data":null}},"time_used":76,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":75,"receive":1,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-01-10","alert":"Sinkholed","trigger":"darkchange.io","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"darkchange.io/crypto-logos/tether.svg","fqdn":"darkchange.io","domain":"darkchange.io","tld":"io"},"ip":{"addr":"188.114.97.1","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"lazy-img","requested_by":"https://darkchange.io/","date":"2026-01-10T21:08:08.870Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"darkchange.io","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Thu, 20 Nov 2025 02:05:49 GMT","end":"Wed, 18 Feb 2026 03:03:26 GMT"},"fingerprint":{"sha1":"D9:05:E0:7A:C5:10:1D:91:FE:1C:0E:8E:3B:5A:C6:2E:53:6E:71:26","sha256":"77:91:00:F2:25:D2:53:58:51:3C:40:EE:E6:DD:C1:A6:D3:EE:B5:16:F1:6E:C2:19:CF:54:27:61:9E:46:C7:AF"}}},"request":{"raw":"GET /crypto-logos/tether.svg HTTP/1.1\r\nHost: darkchange.io\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://darkchange.io/\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\ndate: Sat, 10 Jan 2026 21:08:08 GMT\r\ncontent-type: image/svg+xml\r\nvary: Origin, accept-encoding\r\naccess-control-allow-credentials: true\r\naccess-control-expose-headers: Content-Length,X-Total-Count\r\nx-frame-options: DENY\r\nx-content-type-options: nosniff\r\nx-xss-protection: 1; mode=block\r\nreferrer-policy: strict-origin-when-cross-origin\r\nstrict-transport-security: max-age=31536000; includeSubDomains\r\ncontent-security-policy: default-src 'self'; script-src 'self'; style-src 'self' https://fonts.googleapis.com; font-src 'self' https://fonts.gstatic.com; img-src 'self' data: https:; connect-src 'self' https:; frame-ancestors 'none';\r\npermissions-policy: geolocation=(), microphone=(), camera=()\r\ncache-control: max-age=14400\r\ncf-cache-status: EXPIRED\r\nlast-modified: Sat, 10 Jan 2026 21:08:08 GMT\r\npriority: u=4,i=?0\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=piCo2j0gdZRBWW5NgAkTQKYR81%2BjTiy9E24FAoA%2BWfG4SPD3oyiRSxyiqzSJbEuaW1%2BBo8surq5uO30bg3cV9pvSYcW09V0joxoSbQM%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncontent-encoding: br\r\nserver: cloudflare\r\ncf-ray: 9bbf25e36959a0f0-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":3420,"size_decoded":0,"mime_type":"image/svg+xml","magic":"SVG Scalable Vector Graphics image","md5":"b60f7fc09c30618d450cd0a206e22f34","sha1":"452f2af4562d1d084945b428ad654508711ae3da","sha256":"467f52b6fada63828bd64854b5efe930555a35110cf460fad57f083a7f16e106","sha512":"7de0358e8647124bed8c49f9e5168ccbad1ac0436d0beaa34656b9fb19d44713311ab40f885d090b66b009df457f1fd28a1ec6c6dc8fbc945bf9fec51d325311","ssdeep":"","tlshash":"da6152ca57d563d09907e3f4d49458f0792b24fb366b8ee48733af95b61605c4c8d8e0","first_seen":"2025-11-20T12:33:07.006575Z","last_seen":"2026-02-14T00:24:47.940733Z","times_seen":7,"resource_available":false,"data":null}},"time_used":58,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":58,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-01-10","alert":"Sinkholed","trigger":"darkchange.io","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"fonts.googleapis.com/css2?family=JetBrains+Mono:wght@100;200;300;400;500;600;700;800\u0026display=swap","fqdn":"fonts.googleapis.com","domain":"fonts.googleapis.com","tld":"googleapis.com"},"ip":{"addr":"216.58.211.10","port":443,"asn":15169,"as":"GOOGLE","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://darkchange.io/","date":"2026-01-10T21:08:08.193Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"upload.video.google.com","organization":""},"issuer":{"commonName":"WR2","organization":"Google Trust Services"},"validity":{"start":"Wed, 03 Dec 2025 15:53:13 GMT","end":"Wed, 25 Feb 2026 15:53:12 GMT"},"fingerprint":{"sha1":"A8:BA:6B:80:7C:EC:B1:6F:C1:C2:03:D7:C9:27:6E:75:DE:4B:AA:47","sha256":"4E:2C:B9:C5:81:56:5E:97:93:07:22:12:66:E2:52:C6:0A:2E:17:72:FF:9B:5F:2A:B9:E1:21:80:05:6D:8B:3D"}}},"request":{"raw":"GET /css2?family=JetBrains+Mono:wght@100;200;300;400;500;600;700;800\u0026display=swap HTTP/1.1\r\nHost: fonts.googleapis.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://darkchange.io/\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ncontent-type: text/css; charset=utf-8\r\nvary: Sec-Fetch-Dest, Sec-Fetch-Mode, Sec-Fetch-Site\r\naccess-control-allow-origin: *\r\ntiming-allow-origin: *\r\nlink: \u003chttps://fonts.gstatic.com\u003e; rel=preconnect; crossorigin\r\nstrict-transport-security: max-age=31536000\r\nexpires: Sat, 10 Jan 2026 21:08:08 GMT\r\ndate: Sat, 10 Jan 2026 21:08:08 GMT\r\ncache-control: private, max-age=86400\r\ncross-origin-opener-policy: same-origin-allow-popups\r\ncross-origin-resource-policy: cross-origin\r\ncontent-encoding: gzip\r\nserver: ESF\r\nx-xss-protection: 0\r\nx-frame-options: SAMEORIGIN\r\nx-content-type-options: nosniff\r\nalt-svc: h3=\":443\"; ma=2592000,h3-29=\":443\"; ma=2592000\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":18248,"size_decoded":0,"mime_type":"text/css; charset=utf-8","magic":"ASCII text","md5":"439fa0c3a18151951b917f4c066d4618","sha1":"6ad61049c20e54cfee23f8ad23b997432c6d49fb","sha256":"c0e8d4ce3bde4bf9a196d76cfde67bf9cec57b502fb9e79463f0471649e165c1","sha512":"6fe5619e74c58c8d79e94dac294052faeef911fb66bd92131aba3b4a7116b2470fdcfe09bb10f1c9f2708b6bcc117a6e2fcec2ec41be116e649163a54c1c03c8","ssdeep":"192:XpUnpWpI3SpVpWNp5UwXI3LOWmKUXwI3kNWFrU+9I3ZAWYEU9+I3qnWfNU0bI3HL:XWnE0SnGAb2vAHSrwjGvYnL","tlshash":"8882baa1042b9440ab472cd273cfbe355e5e61167081d6bacffe1898adabc360374b4d","first_seen":"2025-10-05T18:48:25.541997Z","last_seen":"2026-07-04T11:53:58.283429Z","times_seen":35,"resource_available":false,"data":null}},"time_used":31,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":31,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"darkchange.io/crypto-icons/monero.svg","fqdn":"darkchange.io","domain":"darkchange.io","tld":"io"},"ip":{"addr":"188.114.97.1","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://darkchange.io/","date":"2026-01-10T21:08:08.504Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"darkchange.io","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Thu, 20 Nov 2025 02:05:49 GMT","end":"Wed, 18 Feb 2026 03:03:26 GMT"},"fingerprint":{"sha1":"D9:05:E0:7A:C5:10:1D:91:FE:1C:0E:8E:3B:5A:C6:2E:53:6E:71:26","sha256":"77:91:00:F2:25:D2:53:58:51:3C:40:EE:E6:DD:C1:A6:D3:EE:B5:16:F1:6E:C2:19:CF:54:27:61:9E:46:C7:AF"}}},"request":{"raw":"GET /crypto-icons/monero.svg HTTP/1.1\r\nHost: darkchange.io\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://darkchange.io/\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\ndate: Sat, 10 Jan 2026 21:08:08 GMT\r\ncontent-type: image/svg+xml\r\nvary: Origin, accept-encoding\r\naccess-control-allow-credentials: true\r\naccess-control-expose-headers: Content-Length,X-Total-Count\r\nx-frame-options: DENY\r\nx-content-type-options: nosniff\r\nx-xss-protection: 1; mode=block\r\nreferrer-policy: strict-origin-when-cross-origin\r\nstrict-transport-security: max-age=31536000; includeSubDomains\r\ncontent-security-policy: default-src 'self'; script-src 'self'; style-src 'self' https://fonts.googleapis.com; font-src 'self' https://fonts.gstatic.com; img-src 'self' data: https:; connect-src 'self' https:; frame-ancestors 'none';\r\npermissions-policy: geolocation=(), microphone=(), camera=()\r\ncache-control: max-age=14400\r\ncf-cache-status: EXPIRED\r\nlast-modified: Sat, 10 Jan 2026 21:08:08 GMT\r\npriority: u=4,i=?0\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=RHEVKzeMnSbwNO8slKGtwNrIDnC4VOIFhJ68z9k7C8gwvrEyFZIOv3jOul82gQQwZHZUBadcC8Z4IYUdq2XLghzd0eXBQrZg1qNd5bM%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncontent-encoding: br\r\nserver: cloudflare\r\ncf-ray: 9bbf25e13b89a0f0-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":684,"size_decoded":0,"mime_type":"image/svg+xml","magic":"SVG Scalable Vector Graphics image","md5":"0464d3fc8854d5aac9aed51e4dd925ab","sha1":"4310eef588596e0c745868e6726795c055bc29a3","sha256":"01359ad46a5603d37dcb4c061717ee9e9d5bcbd56f86b21ce170f98d6531cdd3","sha512":"1a2648379029e852f88cef0ffd133ca87b89efa4ef0837381393241e08b407ed68de18b1d7e03c85a1ebe3927e89d48ffafb56380c72b2f092bf2b93f4afdc87","ssdeep":"","tlshash":"83019ee073980f1cc71647bd4f0c297957feb1efba6e5480b9493557a98c03ba8c9880","first_seen":"2025-11-20T12:33:07.007615Z","last_seen":"2026-02-14T00:24:47.926149Z","times_seen":7,"resource_available":false,"data":null}},"time_used":71,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":71,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-01-10","alert":"Sinkholed","trigger":"darkchange.io","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"darkchange.io/planet.webm","fqdn":"darkchange.io","domain":"darkchange.io","tld":"io"},"ip":{"addr":"188.114.97.1","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"media","requested_by":"https://darkchange.io/","date":"2026-01-10T21:08:08.863Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"darkchange.io","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Thu, 20 Nov 2025 02:05:49 GMT","end":"Wed, 18 Feb 2026 03:03:26 GMT"},"fingerprint":{"sha1":"D9:05:E0:7A:C5:10:1D:91:FE:1C:0E:8E:3B:5A:C6:2E:53:6E:71:26","sha256":"77:91:00:F2:25:D2:53:58:51:3C:40:EE:E6:DD:C1:A6:D3:EE:B5:16:F1:6E:C2:19:CF:54:27:61:9E:46:C7:AF"}}},"request":{"raw":"GET /planet.webm HTTP/1.1\r\nHost: darkchange.io\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: video/webm,video/ogg,video/*;q=0.9,application/ogg;q=0.7,audio/*;q=0.6,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.5\r\nReferer: https://darkchange.io/\r\nRange: bytes=0-\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: video\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nAccept-Encoding: identity\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\ndate: Sat, 10 Jan 2026 21:08:08 GMT\r\ncontent-type: video/webm\r\nvary: Origin, accept-encoding\r\naccess-control-allow-credentials: true\r\naccess-control-expose-headers: Content-Length,X-Total-Count\r\nx-frame-options: DENY\r\nx-content-type-options: nosniff\r\nx-xss-protection: 1; mode=block\r\nreferrer-policy: strict-origin-when-cross-origin\r\nstrict-transport-security: max-age=31536000; includeSubDomains\r\ncontent-security-policy: default-src 'self'; script-src 'self'; style-src 'self' https://fonts.googleapis.com; font-src 'self' https://fonts.gstatic.com; img-src 'self' data: https:; connect-src 'self' https:; frame-ancestors 'none';\r\npermissions-policy: geolocation=(), microphone=(), camera=()\r\ncache-control: max-age=14400\r\ncf-cache-status: EXPIRED\r\nlast-modified: Sat, 10 Jan 2026 21:08:08 GMT\r\npriority: u=4,i=?0\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=y7Cb14zc5Pc709gBStegudRXMJdXhYljcFl9LJwdl8Q9Cs4Vmb%2BOPlrxSABQ14kv7buyfdo9MyX42jsGOtn8hga9xceGFja8mABvMmA%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nserver: cloudflare\r\ncf-ray: 9bbf25e3693fa0f0-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":2197425,"size_decoded":0,"mime_type":"video/webm","magic":"WebM","md5":"782b38402bfd341b844d25748287fe53","sha1":"6dfb80dd7cc04209d4d73279949a964048066ee8","sha256":"eaee575046e7c8a145a65b5256dce7071b05860a7a9bdfcd853a539db5caf7c5","sha512":"125708ee7f7a8d428882b3d13336acd091acd55f079d61b0440e603e30875b9d4d337653806661cf928004fc3b790bb1a5808feb8fa8301933ec67272bf39f19","ssdeep":"24576:yIRCPkr0sjn1Gi1Gwd7iGkNO7CwH8KavtnkPFJvLwbLyglwRL1:yMCG/n5Gy7iGkNOmoaRk9lMbvlw11","tlshash":"ff252391ec2168d3d49226f4c33b4aa84015eebb1659e12f5d71f27eab70f4dd30a263","first_seen":"2025-11-20T12:33:07.040223Z","last_seen":"2026-02-14T00:24:47.927406Z","times_seen":7,"resource_available":false,"data":null}},"time_used":292,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":67,"receive":225,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-01-10","alert":"Sinkholed","trigger":"darkchange.io","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"darkchange.io/fonts/CircularStd-Book.woff","fqdn":"darkchange.io","domain":"darkchange.io","tld":"io"},"ip":{"addr":"188.114.97.1","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"font","requested_by":"https://darkchange.io/","date":"2026-01-10T21:08:08.897Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"darkchange.io","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Thu, 20 Nov 2025 02:05:49 GMT","end":"Wed, 18 Feb 2026 03:03:26 GMT"},"fingerprint":{"sha1":"D9:05:E0:7A:C5:10:1D:91:FE:1C:0E:8E:3B:5A:C6:2E:53:6E:71:26","sha256":"77:91:00:F2:25:D2:53:58:51:3C:40:EE:E6:DD:C1:A6:D3:EE:B5:16:F1:6E:C2:19:CF:54:27:61:9E:46:C7:AF"}}},"request":{"raw":"GET /fonts/CircularStd-Book.woff HTTP/1.1\r\nHost: darkchange.io\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: identity\r\nReferer: https://darkchange.io/assets/index-DKSPX2TN.css\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: font\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\ndate: Sat, 10 Jan 2026 21:08:08 GMT\r\ncontent-type: text/html; charset=utf-8\r\nvary: Origin, accept-encoding\r\naccess-control-allow-credentials: true\r\naccess-control-expose-headers: Content-Length,X-Total-Count\r\nx-frame-options: DENY\r\nx-content-type-options: nosniff\r\nx-xss-protection: 1; mode=block\r\nreferrer-policy: strict-origin-when-cross-origin\r\nstrict-transport-security: max-age=31536000; includeSubDomains\r\ncontent-security-policy: default-src 'self'; script-src 'self'; style-src 'self' https://fonts.googleapis.com; font-src 'self' https://fonts.gstatic.com; img-src 'self' data: https:; connect-src 'self' https:; frame-ancestors 'none';\r\npermissions-policy: geolocation=(), microphone=(), camera=()\r\ncache-control: max-age=14400\r\ncf-cache-status: EXPIRED\r\nlast-modified: Sat, 10 Jan 2026 21:08:08 GMT\r\npriority: u=4,i=?0\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=px6Nk8t3zaFuluzEyfY7ncxwozZXWdTgYY99aktvIClawZhyYFtjg7jzEiFvHUi9pvUSKfOiiWVqHSeOUmJAwB4xjek1t2mrFjCp2d8%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nserver: cloudflare\r\ncf-ray: 9bbf25e3aa09a0f0-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":5947,"size_decoded":0,"mime_type":"text/html; charset=utf-8","magic":"HTML document, ASCII text","md5":"9b39c5299b40dd917288471c4f8aaba8","sha1":"077b77f285a2e311e76882b46c058c3cedef2a32","sha256":"fec1d5df3a37026bdeea4467fc534a1716957c96dccf30dd41bbcc646ed603a1","sha512":"56645f8d0913e7abac03711a569e8a12994fe0ff0c7f67caaffc3e6e5540bc4b05d3c944f23ea17922b1acbef5067177d82b3557250ac5ef308829f0d5123045","ssdeep":"96:bkJvttM7IslGKv5M7Is8L+u2eM7IsURB+D+XZQ38Iy389ay38KCq8Cbg3Zg:bkJvtwlGysQ2zs+ausIys9aysKCq8Cbr","tlshash":"a2c1f1a3a5e0dc2652e5406819f2b448993d40c7c7187e0bb39c51de0fc9ee886fb79d","first_seen":"2026-01-10T21:08:37.460022Z","last_seen":"2026-01-10T21:11:27.898902Z","times_seen":2,"resource_available":false,"data":null}},"time_used":114,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":113,"receive":1,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-01-10","alert":"Sinkholed","trigger":"darkchange.io","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"darkchange.io/health","fqdn":"darkchange.io","domain":"darkchange.io","tld":"io"},"ip":{"addr":"188.114.97.1","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"fetch","requested_by":"https://darkchange.io/","date":"2026-01-10T21:08:08.745Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"darkchange.io","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Thu, 20 Nov 2025 02:05:49 GMT","end":"Wed, 18 Feb 2026 03:03:26 GMT"},"fingerprint":{"sha1":"D9:05:E0:7A:C5:10:1D:91:FE:1C:0E:8E:3B:5A:C6:2E:53:6E:71:26","sha256":"77:91:00:F2:25:D2:53:58:51:3C:40:EE:E6:DD:C1:A6:D3:EE:B5:16:F1:6E:C2:19:CF:54:27:61:9E:46:C7:AF"}}},"request":{"raw":"GET /health HTTP/1.1\r\nHost: darkchange.io\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://darkchange.io/\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\ndate: Sat, 10 Jan 2026 21:08:08 GMT\r\ncontent-type: application/json\r\nvary: Origin\r\naccess-control-allow-credentials: true\r\naccess-control-expose-headers: Content-Length,X-Total-Count\r\nx-frame-options: DENY\r\nx-content-type-options: nosniff\r\nx-xss-protection: 1; mode=block\r\nreferrer-policy: strict-origin-when-cross-origin\r\nstrict-transport-security: max-age=31536000; includeSubDomains\r\ncontent-security-policy: default-src 'self'; script-src 'self'; style-src 'self' https://fonts.googleapis.com; font-src 'self' https://fonts.gstatic.com; img-src 'self' data: https:; connect-src 'self' https:; frame-ancestors 'none';\r\npermissions-policy: geolocation=(), microphone=(), camera=()\r\ncf-cache-status: DYNAMIC\r\npriority: u=4,i=?0\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=AOqT4kEuSj82I6PnP4hGhgdycf1ZPH0bznSBynl7A9Iustcp1k%2FzwpXSra6B%2B2wzcSaDQHa7nwvbgve%2FeseUNFntYW%2Be%2Fs%2FYmFFVF4s%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncontent-encoding: br\r\nserver: cloudflare\r\ncf-ray: 9bbf25e2bf82a0f0-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":92,"size_decoded":0,"mime_type":"application/json","magic":"JSON text data","md5":"1e35f54a965c9179a663bbb635c4c6d8","sha1":"feeb9a4faf9b0e6b4ba3744b020bfe8b4e079a84","sha256":"928a770b73d9bb8076013f79c8e586e7e196564b2e63630bd627dce2b6e35dc3","sha512":"b6bf0c7ed30e73933bfba94c4066bed0d794e909cad7c6a45e309df707432d75f4700ffe7ac9783fc7bb80938f84435b3fb46ceac58c3f059ba42736185f1a3e","ssdeep":"","tlshash":"bcb0120112154cb5eba1812905013fb54d3d8133202610e4617ddb91003008a412f05b","first_seen":"2026-01-10T21:08:37.475516Z","last_seen":"2026-02-14T00:24:47.924403Z","times_seen":6,"resource_available":false,"data":null}},"time_used":63,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":63,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-01-10","alert":"Sinkholed","trigger":"darkchange.io","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"darkmedik.top/","fqdn":"darkmedik.top","domain":"darkmedik.top","tld":"top"},"ip":{"addr":"35.214.249.142","port":443,"asn":15169,"as":"GOOGLE","country":"The Netherlands","country_code":"NL"},"is_navigation_request":true,"resource_type":"document","requested_by":"","date":"2026-01-10T21:08:07.364Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"P384","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.darkmedik.top","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Thu, 11 Dec 2025 16:50:22 GMT","end":"Wed, 11 Mar 2026 16:50:21 GMT"},"fingerprint":{"sha1":"25:88:6A:73:6F:A7:E6:A6:80:C4:16:A8:5C:5F:74:97:A6:B0:2C:33","sha256":"B5:AD:CA:CD:03:15:28:8A:89:2B:9F:3B:42:85:84:F4:DA:B0:F9:51:3D:5B:63:C7:F3:23:A1:06:9A:E9:86:1C"}}},"request":{"raw":"GET / HTTP/1.1\r\nHost: darkmedik.top\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nUpgrade-Insecure-Requests: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: document\r\nSec-Fetch-Mode: navigate\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 301 Moved Permanently\r\nserver: nginx\r\ndate: Sat, 10 Jan 2026 21:08:07 GMT\r\ncontent-type: text/plain\r\ncontent-length: 24\r\nlocation: https://darkchange.io/\r\nhost-header: 8441280b0c35cbc1147f8ba998a563a7\r\nx-proxy-cache-info: DT:1\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"301","status_text":"Moved Permanently","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":5947,"size_decoded":0,"mime_type":"text/html; charset=utf-8","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-08-12T15:40:42.100018Z","times_seen":17857324,"resource_available":true,"data":null}},"time_used":281,"timings":{"blocked":131,"dns":60,"connect":18,"send":0,"wait":19,"receive":0,"ssl":48},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2026-01-10","alert":"Sinkholed","trigger":"darkmedik.top","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"darkchange.io/assets/index-DvjNr9xF.js","fqdn":"darkchange.io","domain":"darkchange.io","tld":"io"},"ip":{"addr":"188.114.97.1","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://darkchange.io/","date":"2026-01-10T21:08:08.303Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"darkchange.io","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Thu, 20 Nov 2025 02:05:49 GMT","end":"Wed, 18 Feb 2026 03:03:26 GMT"},"fingerprint":{"sha1":"D9:05:E0:7A:C5:10:1D:91:FE:1C:0E:8E:3B:5A:C6:2E:53:6E:71:26","sha256":"77:91:00:F2:25:D2:53:58:51:3C:40:EE:E6:DD:C1:A6:D3:EE:B5:16:F1:6E:C2:19:CF:54:27:61:9E:46:C7:AF"}}},"request":{"raw":"GET /assets/index-DvjNr9xF.js HTTP/1.1\r\nHost: darkchange.io\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://darkchange.io/assets/index-CjBsp-NA.js\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\ndate: Sat, 10 Jan 2026 21:08:08 GMT\r\ncontent-type: text/javascript; charset=utf-8\r\nvary: Origin, accept-encoding\r\naccess-control-allow-credentials: true\r\naccess-control-expose-headers: Content-Length,X-Total-Count\r\nx-frame-options: DENY\r\nx-content-type-options: nosniff\r\nx-xss-protection: 1; mode=block\r\nreferrer-policy: strict-origin-when-cross-origin\r\nstrict-transport-security: max-age=31536000; includeSubDomains\r\ncontent-security-policy: default-src 'self'; script-src 'self'; style-src 'self' https://fonts.googleapis.com; font-src 'self' https://fonts.gstatic.com; img-src 'self' data: https:; connect-src 'self' https:; frame-ancestors 'none';\r\npermissions-policy: geolocation=(), microphone=(), camera=()\r\nage: 0\r\ncache-control: max-age=14400\r\ncf-cache-status: HIT\r\nlast-modified: Sat, 10 Jan 2026 21:08:08 GMT\r\npriority: u=3,i=?0\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=cNJysNCevfXj%2BBFkNJ3%2FS7QDBdlXNAOO2Eml%2B8sAoglMl1soje4nu7mP8r%2BjMPelyYAv0LX9vWPHC7l2SDNPIGCpbYJq3N5i9oIrEHc%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncontent-encoding: br\r\nserver: cloudflare\r\ncf-ray: 9bbf25dfff3fa0f0-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":403260,"size_decoded":0,"mime_type":"text/javascript; charset=utf-8","magic":"JavaScript source, ASCII text, with very long lines (65536), with no line terminators","md5":"f27216d745d0acc1866a9c6b0d1c6ada","sha1":"7bcc3ecb0f468568f23b02b93f4e111437924f79","sha256":"c949e5d675d1287c9ab52b87129491c86743dbef18d94e506d0f1d4fa6b5176a","sha512":"8e3385509e42ee867abac64355967fb29f83007f7a093439f99b99ec663e218c591ad117d9bfff697670915d37669e36b39e0ba7281e0cb76c29cf208c8e3d31","ssdeep":"1536:mUuCKlolLoM32F6kj40NbiY2UKkKsKLFqlt86gkLINkHVuN02MYYoyr8nLjND1M5:/lId8XY8nLjNDWMaH","tlshash":"a3842294c3922a6bf844cade8fd6180c3c9e17ba9ab2cce5964d473640f84cd365f365","first_seen":"2026-01-10T21:08:37.465208Z","last_seen":"2026-01-10T21:11:27.88505Z","times_seen":2,"resource_available":true,"data":null}},"time_used":122,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":8,"receive":114,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-01-10","alert":"Sinkholed","trigger":"darkchange.io","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"darkchange.io/crypto-icons/bitcoin.svg","fqdn":"darkchange.io","domain":"darkchange.io","tld":"io"},"ip":{"addr":"188.114.97.1","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://darkchange.io/","date":"2026-01-10T21:08:08.508Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"darkchange.io","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Thu, 20 Nov 2025 02:05:49 GMT","end":"Wed, 18 Feb 2026 03:03:26 GMT"},"fingerprint":{"sha1":"D9:05:E0:7A:C5:10:1D:91:FE:1C:0E:8E:3B:5A:C6:2E:53:6E:71:26","sha256":"77:91:00:F2:25:D2:53:58:51:3C:40:EE:E6:DD:C1:A6:D3:EE:B5:16:F1:6E:C2:19:CF:54:27:61:9E:46:C7:AF"}}},"request":{"raw":"GET /crypto-icons/bitcoin.svg HTTP/1.1\r\nHost: darkchange.io\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://darkchange.io/\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\ndate: Sat, 10 Jan 2026 21:08:08 GMT\r\ncontent-type: image/svg+xml\r\nvary: Origin, accept-encoding\r\naccess-control-allow-credentials: true\r\naccess-control-expose-headers: Content-Length,X-Total-Count\r\nx-frame-options: DENY\r\nx-content-type-options: nosniff\r\nx-xss-protection: 1; mode=block\r\nreferrer-policy: strict-origin-when-cross-origin\r\nstrict-transport-security: max-age=31536000; includeSubDomains\r\ncontent-security-policy: default-src 'self'; script-src 'self'; style-src 'self' https://fonts.googleapis.com; font-src 'self' https://fonts.gstatic.com; img-src 'self' data: https:; connect-src 'self' https:; frame-ancestors 'none';\r\npermissions-policy: geolocation=(), microphone=(), camera=()\r\ncache-control: max-age=14400\r\ncf-cache-status: EXPIRED\r\nlast-modified: Sat, 10 Jan 2026 21:08:08 GMT\r\npriority: u=4,i=?0\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=TBncUHWcojuBicQg7wKy5hPS%2FsIoNwjsewEm1Q%2Fzv3psNdQ9wiKF%2Ffi6S6%2FR3PMtNrJZFMk66pRtX8FEaSZpoFlEw11pgFCfB84IFck%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncontent-encoding: br\r\nserver: cloudflare\r\ncf-ray: 9bbf25e13b9fa0f0-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":1860,"size_decoded":0,"mime_type":"image/svg+xml","magic":"SVG Scalable Vector Graphics image","md5":"8b8ebabff78fc0e1e27c86e0acd5689b","sha1":"362e6b1262d4bbf6804b7b20416f8defea0225c7","sha256":"2e74fab94b80eea9ac10b062442b5c050f1bf201d561eef1839cc37ff8b723b1","sha512":"a79ae1df58409deb5051280b378bad6edf5e3c6d3401f5c3c3e2db7c7b1728f801dbcbdae3669fd17482a1ae40623354265d4430dc091cce65495c8b7cfcda5f","ssdeep":"","tlshash":"aa3151ffe7c061f0d64ac378ee2684f8b84330792b6717da48906e9a63b115885cdcd0","first_seen":"2025-11-20T12:33:07.038409Z","last_seen":"2026-02-14T00:24:47.92679Z","times_seen":7,"resource_available":false,"data":null}},"time_used":68,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":68,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-01-10","alert":"Sinkholed","trigger":"darkchange.io","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"darkchange.io/illustrations/kyc-free.png","fqdn":"darkchange.io","domain":"darkchange.io","tld":"io"},"ip":{"addr":"188.114.97.1","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://darkchange.io/","date":"2026-01-10T21:08:08.633Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"darkchange.io","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Thu, 20 Nov 2025 02:05:49 GMT","end":"Wed, 18 Feb 2026 03:03:26 GMT"},"fingerprint":{"sha1":"D9:05:E0:7A:C5:10:1D:91:FE:1C:0E:8E:3B:5A:C6:2E:53:6E:71:26","sha256":"77:91:00:F2:25:D2:53:58:51:3C:40:EE:E6:DD:C1:A6:D3:EE:B5:16:F1:6E:C2:19:CF:54:27:61:9E:46:C7:AF"}}},"request":{"raw":"GET /illustrations/kyc-free.png HTTP/1.1\r\nHost: darkchange.io\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://darkchange.io/\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\ndate: Sat, 10 Jan 2026 21:08:08 GMT\r\ncontent-type: image/png\r\nvary: Origin, accept-encoding\r\naccess-control-allow-credentials: true\r\naccess-control-expose-headers: Content-Length,X-Total-Count\r\nx-frame-options: DENY\r\nx-content-type-options: nosniff\r\nx-xss-protection: 1; mode=block\r\nreferrer-policy: strict-origin-when-cross-origin\r\nstrict-transport-security: max-age=31536000; includeSubDomains\r\ncontent-security-policy: default-src 'self'; script-src 'self'; style-src 'self' https://fonts.googleapis.com; font-src 'self' https://fonts.gstatic.com; img-src 'self' data: https:; connect-src 'self' https:; frame-ancestors 'none';\r\npermissions-policy: geolocation=(), microphone=(), camera=()\r\nage: 0\r\ncache-control: max-age=14400\r\ncf-cache-status: HIT\r\nlast-modified: Sat, 10 Jan 2026 21:08:08 GMT\r\npriority: u=4,i=?0\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=iLwtHNC8I0gTN%2F9rJITT2fO1sZOqQ2n5f7TxXh%2BCZCNtdfvDdbfDbIGg%2BOM0Dl8ciC4Zm%2B6oQl3GpZY5N2JMY68odH2XPFZUJjZEMzg%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nserver: cloudflare\r\ncf-ray: 9bbf25e20dc3a0f0-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":39513,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 530 x 250, 8-bit/color RGBA, non-interlaced","md5":"0732b07759b2ce99b92292bf62a0e5dd","sha1":"79a5e9a75770778160fca3e7b2686c73d639494b","sha256":"686e3397d5e7ef040072386ea5f21bfe56da909b90ce6e8ff6572559560585a0","sha512":"4c3c94af79f3abc9fedf13658b111cb4ebd5cf775d8b517b29792ff0f8ae7303d47fddff25f79b21991fad88b5255245c675ea7088145309307712cd8be94923","ssdeep":"768:EqnAH3O900rYwY5zDZGubkEF/i4YyCINxG3n2kYyW1ZvhsWrcZNOm+K+psM:tnAH3Q/r1YTPwX9Iy27yoxhrraONK+pD","tlshash":"b803027113081caf6abf6f98cf935337b357109b51f42a9a387cc915ae40d6da6889c4","first_seen":"2025-11-20T12:33:06.986503Z","last_seen":"2026-02-14T00:24:47.938964Z","times_seen":7,"resource_available":false,"data":null}},"time_used":6,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":6,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-01-10","alert":"Sinkholed","trigger":"darkchange.io","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"darkchange.io/bg.png","fqdn":"darkchange.io","domain":"darkchange.io","tld":"io"},"ip":{"addr":"188.114.97.1","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://darkchange.io/","date":"2026-01-10T21:08:08.695Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"darkchange.io","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Thu, 20 Nov 2025 02:05:49 GMT","end":"Wed, 18 Feb 2026 03:03:26 GMT"},"fingerprint":{"sha1":"D9:05:E0:7A:C5:10:1D:91:FE:1C:0E:8E:3B:5A:C6:2E:53:6E:71:26","sha256":"77:91:00:F2:25:D2:53:58:51:3C:40:EE:E6:DD:C1:A6:D3:EE:B5:16:F1:6E:C2:19:CF:54:27:61:9E:46:C7:AF"}}},"request":{"raw":"GET /bg.png HTTP/1.1\r\nHost: darkchange.io\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://darkchange.io/\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\ndate: Sat, 10 Jan 2026 21:08:08 GMT\r\ncontent-type: image/png\r\nvary: Origin, accept-encoding\r\naccess-control-allow-credentials: true\r\naccess-control-expose-headers: Content-Length,X-Total-Count\r\nx-frame-options: DENY\r\nx-content-type-options: nosniff\r\nx-xss-protection: 1; mode=block\r\nreferrer-policy: strict-origin-when-cross-origin\r\nstrict-transport-security: max-age=31536000; includeSubDomains\r\ncontent-security-policy: default-src 'self'; script-src 'self'; style-src 'self' https://fonts.googleapis.com; font-src 'self' https://fonts.gstatic.com; img-src 'self' data: https:; connect-src 'self' https:; frame-ancestors 'none';\r\npermissions-policy: geolocation=(), microphone=(), camera=()\r\ncache-control: max-age=14400\r\ncf-cache-status: EXPIRED\r\nlast-modified: Sat, 10 Jan 2026 21:08:08 GMT\r\npriority: u=4,i=?0\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=uL%2B0YcRjFP6FO8O87%2FNMhzxuQbk20Vf9tBixggbwTuCqNRG4KFNnmiI4xX2GyTGAv9O9U1mwaarJaFRdxZupEYvWK47qLC4OU3%2F7JGI%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nserver: cloudflare\r\ncf-ray: 9bbf25e26ec9a0f0-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":1279669,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 1920 x 1080, 8-bit/color RGBA, non-interlaced","md5":"8dd0a57d41112e0aedb0f3ff9254a7ee","sha1":"40f2e7e2bb886eff989c72b738dbecfc3e51c680","sha256":"8521677e417954ffdc67682cc6b2178b918da4c9fa477a7a7c34cedea8c18962","sha512":"aa4691282399ff0e815f53e381e77597faddb4efefb67843805f8f91d34d697bdd0b5145dfae001d83f2b55455aaef81a30888027688c1f3450f858ab84772d3","ssdeep":"24576:HQVUUnx4DaGYHJxZiARoiHkSmqa+NCisalCELNdXe:HQVUUnqZYHDZRnHkSmzKC1rsLe","tlshash":"772533acec06977f7c638b2c767840b28e7d495fac50de17068606e4963a4245ff48be","first_seen":"2026-01-10T21:08:37.478969Z","last_seen":"2026-02-14T00:24:47.922324Z","times_seen":6,"resource_available":false,"data":null}},"time_used":217,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":39,"receive":178,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-01-10","alert":"Sinkholed","trigger":"darkchange.io","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"darkchange.io/assets/index-2b9-Tkam.css","fqdn":"darkchange.io","domain":"darkchange.io","tld":"io"},"ip":{"addr":"188.114.97.1","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://darkchange.io/","date":"2026-01-10T21:08:08.225Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"darkchange.io","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Thu, 20 Nov 2025 02:05:49 GMT","end":"Wed, 18 Feb 2026 03:03:26 GMT"},"fingerprint":{"sha1":"D9:05:E0:7A:C5:10:1D:91:FE:1C:0E:8E:3B:5A:C6:2E:53:6E:71:26","sha256":"77:91:00:F2:25:D2:53:58:51:3C:40:EE:E6:DD:C1:A6:D3:EE:B5:16:F1:6E:C2:19:CF:54:27:61:9E:46:C7:AF"}}},"request":{"raw":"GET /assets/index-2b9-Tkam.css HTTP/1.1\r\nHost: darkchange.io\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://darkchange.io/\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\ndate: Sat, 10 Jan 2026 21:08:08 GMT\r\ncontent-type: text/css; charset=utf-8\r\nvary: Origin, accept-encoding\r\naccess-control-allow-credentials: true\r\naccess-control-expose-headers: Content-Length,X-Total-Count\r\nx-frame-options: DENY\r\nx-content-type-options: nosniff\r\nx-xss-protection: 1; mode=block\r\nreferrer-policy: strict-origin-when-cross-origin\r\nstrict-transport-security: max-age=31536000; includeSubDomains\r\ncontent-security-policy: default-src 'self'; script-src 'self'; style-src 'self' https://fonts.googleapis.com; font-src 'self' https://fonts.gstatic.com; img-src 'self' data: https:; connect-src 'self' https:; frame-ancestors 'none';\r\npermissions-policy: geolocation=(), microphone=(), camera=()\r\ncache-control: max-age=14400\r\ncf-cache-status: EXPIRED\r\nlast-modified: Sat, 10 Jan 2026 21:08:08 GMT\r\npriority: u=2,i=?0\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=JTdN6ATzU%2FUMu9Ybl4sK8igYfRauBp8dA%2FBHyv2OtZOY0LazImtOVbf54i8G%2BMU6FdVqhn4yKgw1lA4MZA5GiXVhZtUXbeKGp9AZPaU%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncontent-encoding: br\r\nserver: cloudflare\r\ncf-ray: 9bbf25df7de1a0f0-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":3181,"size_decoded":0,"mime_type":"text/css; charset=utf-8","magic":"ASCII text, with very long lines (3180)","md5":"4d1d6a3c5e53a9faa397fde719a038a9","sha1":"b53005c37f44ff8eac7267b253cddce7a95b2524","sha256":"ef23ae16e9454304b622b839e4f47868208f4dcd684ec219f4f86ff81760e286","sha512":"94cceeff62bcac7eba062ae6b9d81b1f87fa5892adc8ffdd972edb1fa35cafae479239669c351ff44d3e9cbd92ab55510af65a0449f2d207e7cdd465472886f7","ssdeep":"","tlshash":"d761712d890e2cedb533e55ea5dba558c124d183985e073673b2523c08c317b22bfe17","first_seen":"2026-01-10T21:08:37.479994Z","last_seen":"2026-02-14T00:24:47.943023Z","times_seen":6,"resource_available":false,"data":null}},"time_used":70,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":70,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-01-10","alert":"Sinkholed","trigger":"darkchange.io","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"darkchange.io/illustrations/monero-exchange.png","fqdn":"darkchange.io","domain":"darkchange.io","tld":"io"},"ip":{"addr":"188.114.97.1","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://darkchange.io/","date":"2026-01-10T21:08:08.636Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"darkchange.io","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Thu, 20 Nov 2025 02:05:49 GMT","end":"Wed, 18 Feb 2026 03:03:26 GMT"},"fingerprint":{"sha1":"D9:05:E0:7A:C5:10:1D:91:FE:1C:0E:8E:3B:5A:C6:2E:53:6E:71:26","sha256":"77:91:00:F2:25:D2:53:58:51:3C:40:EE:E6:DD:C1:A6:D3:EE:B5:16:F1:6E:C2:19:CF:54:27:61:9E:46:C7:AF"}}},"request":{"raw":"GET /illustrations/monero-exchange.png HTTP/1.1\r\nHost: darkchange.io\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://darkchange.io/\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\ndate: Sat, 10 Jan 2026 21:08:08 GMT\r\ncontent-type: image/png\r\nvary: Origin, accept-encoding\r\naccess-control-allow-credentials: true\r\naccess-control-expose-headers: Content-Length,X-Total-Count\r\nx-frame-options: DENY\r\nx-content-type-options: nosniff\r\nx-xss-protection: 1; mode=block\r\nreferrer-policy: strict-origin-when-cross-origin\r\nstrict-transport-security: max-age=31536000; includeSubDomains\r\ncontent-security-policy: default-src 'self'; script-src 'self'; style-src 'self' https://fonts.googleapis.com; font-src 'self' https://fonts.gstatic.com; img-src 'self' data: https:; connect-src 'self' https:; frame-ancestors 'none';\r\npermissions-policy: geolocation=(), microphone=(), camera=()\r\nage: 0\r\ncache-control: max-age=14400\r\ncf-cache-status: HIT\r\nlast-modified: Sat, 10 Jan 2026 21:08:08 GMT\r\npriority: u=4,i=?0\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=KWL1rJqnBD%2BmAbWJ6sOhaZI1hbIQu7JNxY8EuI6ZbNgVkoode7%2Fslqtcnpga%2B%2F4YL%2FbKXizuJSLRmOJC%2FO2bkP2g9Q%2BN7cB6WC3iSbA%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nserver: cloudflare\r\ncf-ray: 9bbf25e20dcba0f0-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":48718,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 530 x 250, 8-bit/color RGBA, non-interlaced","md5":"4e7271e4d05843ccbf6c2c98a3e8cdca","sha1":"cb2fc166d2af582ed84731473d4316cf4e95c41e","sha256":"2a572c6a0355c5218ccf69724a328dd0d1ea2efea18b4166d85035c00fb35fac","sha512":"e8d287557f46c998c5c9b80ab7770ef917f1fe6f6851aaa258a5e0fc59cf0cc65f0211ec390770d228ceaf729d92429fbd86d61202609233a40ffb82e81df82e","ssdeep":"768:vN4svRdiiKG2ChsW6y3puA6FmZDDZHm7fUQMTldqOWj9Fn6QYguQiU6AS:vN4sDvKSOpy5YMNtHm7f7OWxF6QYggUk","tlshash":"4023f1a6be38843bb9838f6025c21f4a153192d05bbdac07d105c97c3f5e27e7a69375","first_seen":"2025-11-20T12:33:06.969884Z","last_seen":"2026-02-14T00:24:47.932019Z","times_seen":7,"resource_available":false,"data":null}},"time_used":6,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":6,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-01-10","alert":"Sinkholed","trigger":"darkchange.io","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"darkchange.io/crypto-icons/bitcoin.svg","fqdn":"darkchange.io","domain":"darkchange.io","tld":"io"},"ip":{"addr":"188.114.97.1","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://darkchange.io/","date":"2026-01-10T21:08:08.639Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"darkchange.io","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Thu, 20 Nov 2025 02:05:49 GMT","end":"Wed, 18 Feb 2026 03:03:26 GMT"},"fingerprint":{"sha1":"D9:05:E0:7A:C5:10:1D:91:FE:1C:0E:8E:3B:5A:C6:2E:53:6E:71:26","sha256":"77:91:00:F2:25:D2:53:58:51:3C:40:EE:E6:DD:C1:A6:D3:EE:B5:16:F1:6E:C2:19:CF:54:27:61:9E:46:C7:AF"}}},"request":{"raw":"GET /crypto-icons/bitcoin.svg HTTP/1.1\r\nHost: darkchange.io\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://darkchange.io/\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\ndate: Sat, 10 Jan 2026 21:08:08 GMT\r\ncontent-type: image/svg+xml\r\nvary: Origin, accept-encoding\r\naccess-control-allow-credentials: true\r\naccess-control-expose-headers: Content-Length,X-Total-Count\r\nx-frame-options: DENY\r\nx-content-type-options: nosniff\r\nx-xss-protection: 1; mode=block\r\nreferrer-policy: strict-origin-when-cross-origin\r\nstrict-transport-security: max-age=31536000; includeSubDomains\r\ncontent-security-policy: default-src 'self'; script-src 'self'; style-src 'self' https://fonts.googleapis.com; font-src 'self' https://fonts.gstatic.com; img-src 'self' data: https:; connect-src 'self' https:; frame-ancestors 'none';\r\npermissions-policy: geolocation=(), microphone=(), camera=()\r\nage: 0\r\ncache-control: max-age=14400\r\ncf-cache-status: HIT\r\nlast-modified: Sat, 10 Jan 2026 21:08:08 GMT\r\npriority: u=4,i=?0\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=fEwh3NkA%2Fily%2FTs%2FflQ3hmpUL2fy3iQcxR%2BuO9Q2%2FnQ8aHn4plc%2FobFaQrgTPAoNqPJN6zeo26NGLNeiEOH15W4sKFQwsy33Lhi4Yxw%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncontent-encoding: br\r\nserver: cloudflare\r\ncf-ray: 9bbf25e20dd3a0f0-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":1860,"size_decoded":0,"mime_type":"image/svg+xml","magic":"SVG Scalable Vector Graphics image","md5":"8b8ebabff78fc0e1e27c86e0acd5689b","sha1":"362e6b1262d4bbf6804b7b20416f8defea0225c7","sha256":"2e74fab94b80eea9ac10b062442b5c050f1bf201d561eef1839cc37ff8b723b1","sha512":"a79ae1df58409deb5051280b378bad6edf5e3c6d3401f5c3c3e2db7c7b1728f801dbcbdae3669fd17482a1ae40623354265d4430dc091cce65495c8b7cfcda5f","ssdeep":"","tlshash":"aa3151ffe7c061f0d64ac378ee2684f8b84330792b6717da48906e9a63b115885cdcd0","first_seen":"2025-11-20T12:33:07.038409Z","last_seen":"2026-02-14T00:24:47.92679Z","times_seen":7,"resource_available":false,"data":null}},"time_used":5,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":5,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-01-10","alert":"Sinkholed","trigger":"darkchange.io","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"darkchange.io/assets/index-CjBsp-NA.js","fqdn":"darkchange.io","domain":"darkchange.io","tld":"io"},"ip":{"addr":"188.114.97.1","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://darkchange.io/","date":"2026-01-10T21:08:07.866Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"darkchange.io","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Thu, 20 Nov 2025 02:05:49 GMT","end":"Wed, 18 Feb 2026 03:03:26 GMT"},"fingerprint":{"sha1":"D9:05:E0:7A:C5:10:1D:91:FE:1C:0E:8E:3B:5A:C6:2E:53:6E:71:26","sha256":"77:91:00:F2:25:D2:53:58:51:3C:40:EE:E6:DD:C1:A6:D3:EE:B5:16:F1:6E:C2:19:CF:54:27:61:9E:46:C7:AF"}}},"request":{"raw":"GET /assets/index-CjBsp-NA.js HTTP/1.1\r\nHost: darkchange.io\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://darkchange.io/\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\ndate: Sat, 10 Jan 2026 21:08:07 GMT\r\ncontent-type: text/javascript; charset=utf-8\r\nvary: Origin, accept-encoding\r\naccess-control-allow-credentials: true\r\naccess-control-expose-headers: Content-Length,X-Total-Count\r\nx-frame-options: DENY\r\nx-content-type-options: nosniff\r\nx-xss-protection: 1; mode=block\r\nreferrer-policy: strict-origin-when-cross-origin\r\nstrict-transport-security: max-age=31536000; includeSubDomains\r\ncontent-security-policy: default-src 'self'; script-src 'self'; style-src 'self' https://fonts.googleapis.com; font-src 'self' https://fonts.gstatic.com; img-src 'self' data: https:; connect-src 'self' https:; frame-ancestors 'none';\r\npermissions-policy: geolocation=(), microphone=(), camera=()\r\ncache-control: max-age=14400\r\ncf-cache-status: MISS\r\nlast-modified: Sat, 10 Jan 2026 21:08:07 GMT\r\npriority: u=3,i=?0\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=tLQoHTl%2FlbFHDRh6GlXrSvQhU5RcdC89PGa37qtpze1eLYcNVX48ZO%2FucOtUzNXIpVGELTOc0jpB52HQKiYpD8U6Fpd%2FOZXSr8%2FwQec%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncontent-encoding: br\r\nserver: cloudflare\r\ncf-ray: 9bbf25dd3846a0f0-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":469986,"size_decoded":0,"mime_type":"text/javascript; charset=utf-8","magic":"JavaScript source, ASCII text, with very long lines (39664)","md5":"a59c698990dfcd544b4ebe49092f9418","sha1":"f7e19d615ed34a34f4ed056d007eee24236840a2","sha256":"00889a47e4c4455bae116fdb029bee5c4a27a674303264de68aacd0a3ab63cb5","sha512":"a98dab05cd5c051eb3fbd7017e09a6bfc13ea09f47ee706b8d5563ee9e46b8df4d63289412164185f7822a337e9d52d80cf46cf1900acc658fcf591ca4de256e","ssdeep":"12288:FBMbZLUk1FUakPil+Axmvt4Oncspg0GsIrPfhfFjRB5IW5Rf7TrjOyfGkBXmsi/:FsfDUakPil+AxY2Oncspg0GsIrPfhfFQ","tlshash":"3fa43bd872a9b1255be345e4407f0203b2392966740c88a4f13dedeb3a7544a51bbffe","first_seen":"2026-01-10T21:08:37.483545Z","last_seen":"2026-01-10T21:11:27.894906Z","times_seen":2,"resource_available":true,"data":null}},"time_used":216,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":75,"receive":141,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-01-10","alert":"Sinkholed","trigger":"darkchange.io","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"darkchange.io/assets/index-DKSPX2TN.css","fqdn":"darkchange.io","domain":"darkchange.io","tld":"io"},"ip":{"addr":"188.114.97.1","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://darkchange.io/","date":"2026-01-10T21:08:07.867Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"darkchange.io","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Thu, 20 Nov 2025 02:05:49 GMT","end":"Wed, 18 Feb 2026 03:03:26 GMT"},"fingerprint":{"sha1":"D9:05:E0:7A:C5:10:1D:91:FE:1C:0E:8E:3B:5A:C6:2E:53:6E:71:26","sha256":"77:91:00:F2:25:D2:53:58:51:3C:40:EE:E6:DD:C1:A6:D3:EE:B5:16:F1:6E:C2:19:CF:54:27:61:9E:46:C7:AF"}}},"request":{"raw":"GET /assets/index-DKSPX2TN.css HTTP/1.1\r\nHost: darkchange.io\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://darkchange.io/\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\ndate: Sat, 10 Jan 2026 21:08:07 GMT\r\ncontent-type: text/css; charset=utf-8\r\nvary: Origin, accept-encoding\r\naccess-control-allow-credentials: true\r\naccess-control-expose-headers: Content-Length,X-Total-Count\r\nx-frame-options: DENY\r\nx-content-type-options: nosniff\r\nx-xss-protection: 1; mode=block\r\nreferrer-policy: strict-origin-when-cross-origin\r\nstrict-transport-security: max-age=31536000; includeSubDomains\r\ncontent-security-policy: default-src 'self'; script-src 'self'; style-src 'self' https://fonts.googleapis.com; font-src 'self' https://fonts.gstatic.com; img-src 'self' data: https:; connect-src 'self' https:; frame-ancestors 'none';\r\npermissions-policy: geolocation=(), microphone=(), camera=()\r\ncache-control: max-age=14400\r\ncf-cache-status: EXPIRED\r\nlast-modified: Sat, 10 Jan 2026 21:08:07 GMT\r\npriority: u=2,i=?0\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=D7vt84cQ7xWxc9mEgHTNi%2BpzDKw4fbu7W82HtD5v9nBmxofeeDJU6rhFgZupy%2FtoFnfCMGc2UwZY6MJ8gG2phRVnYfpNNfVA1y9jC1Q%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncontent-encoding: br\r\nserver: cloudflare\r\ncf-ray: 9bbf25dd3848a0f0-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":100444,"size_decoded":0,"mime_type":"text/css; charset=utf-8","magic":"ASCII text, with very long lines (65536), with no line terminators","md5":"89719c98189efe351b650ffca8cdee64","sha1":"6d058c9178604026ea851ff1cbe569ae30f94efb","sha256":"516a25388c9dd5497ab5d322db3fd2261dcba27e5e0b7093367e0e01311765da","sha512":"1a829bf01ab5078102428dad541f82fe8ef71811fb446caf4f4041bd34eee0f190e604be1c9cc821b932b146e96449dc1eaf546f5348edcacb9f7fe43e1c0f55","ssdeep":"1536:OFSkIaxhvG8cjWHRCWaFsEh6/QPudLAO0uql83K5ah2w:eIaxhvG8cjWHRCWaFN6eudLAOxql8a5g","tlshash":"6fa39360f225d53bbd23b9bd63acf44ca21aa1c1de5297edfa22601153c36f62863614","first_seen":"2026-01-10T21:08:37.484893Z","last_seen":"2026-02-14T00:24:47.929519Z","times_seen":6,"resource_available":false,"data":null}},"time_used":157,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":75,"receive":82,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-01-10","alert":"Sinkholed","trigger":"darkchange.io","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"darkchange.io/illustrations/hexagon-network.svg","fqdn":"darkchange.io","domain":"darkchange.io","tld":"io"},"ip":{"addr":"188.114.97.1","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://darkchange.io/","date":"2026-01-10T21:08:08.584Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"darkchange.io","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Thu, 20 Nov 2025 02:05:49 GMT","end":"Wed, 18 Feb 2026 03:03:26 GMT"},"fingerprint":{"sha1":"D9:05:E0:7A:C5:10:1D:91:FE:1C:0E:8E:3B:5A:C6:2E:53:6E:71:26","sha256":"77:91:00:F2:25:D2:53:58:51:3C:40:EE:E6:DD:C1:A6:D3:EE:B5:16:F1:6E:C2:19:CF:54:27:61:9E:46:C7:AF"}}},"request":{"raw":"GET /illustrations/hexagon-network.svg HTTP/1.1\r\nHost: darkchange.io\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://darkchange.io/\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\ndate: Sat, 10 Jan 2026 21:08:08 GMT\r\ncontent-type: image/svg+xml\r\nvary: Origin, accept-encoding\r\naccess-control-allow-credentials: true\r\naccess-control-expose-headers: Content-Length,X-Total-Count\r\nx-frame-options: DENY\r\nx-content-type-options: nosniff\r\nx-xss-protection: 1; mode=block\r\nreferrer-policy: strict-origin-when-cross-origin\r\nstrict-transport-security: max-age=31536000; includeSubDomains\r\ncontent-security-policy: default-src 'self'; script-src 'self'; style-src 'self' https://fonts.googleapis.com; font-src 'self' https://fonts.gstatic.com; img-src 'self' data: https:; connect-src 'self' https:; frame-ancestors 'none';\r\npermissions-policy: geolocation=(), microphone=(), camera=()\r\ncache-control: max-age=14400\r\ncf-cache-status: EXPIRED\r\nlast-modified: Sat, 10 Jan 2026 21:08:08 GMT\r\npriority: u=4,i=?0\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=Caakh4hBI6DH66ZdRiwLCiC5qPR3jxxH5WFJG77BFdNz54eHaZ4BaXtVoehA2aXGP3N%2F8Xp8%2FC9ZywSQDI03SPnI3oe5xUy7W5WAohg%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncontent-encoding: br\r\nserver: cloudflare\r\ncf-ray: 9bbf25e1bd00a0f0-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":129775,"size_decoded":0,"mime_type":"image/svg+xml","magic":"SVG Scalable Vector Graphics image","md5":"6e9ee331975c0d3743dd79824b2dfc92","sha1":"083bbc9fa832080c3fd1a036c0ec0aaeb2b881a7","sha256":"745b4113dd37d7bf4b348fd2c27588acf413c4e865416e59f0c28154497f8d3a","sha512":"07bc44670dcf0f36c297e95c90bac8bdcb8e3d1ca8f30edea4bd1e7f5aa0e5c071b79edebfcbb58bc531be2071c94f3dab0a1b35da784efe34ffbed1e8cfdd16","ssdeep":"1536:nS5PTpMs3/ZMGfMGnMGrMGQMGjFQojGxU:aK","tlshash":"0dc352adb764ac9edb99c2c8ef80c4a9161e81b7e5c14180c35c7b2f5878d85a93f2d1","first_seen":"2025-11-20T12:33:07.021041Z","last_seen":"2026-02-14T00:24:47.937981Z","times_seen":7,"resource_available":false,"data":null}},"time_used":154,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":68,"receive":86,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-01-10","alert":"Sinkholed","trigger":"darkchange.io","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"fonts.gstatic.com/s/instrumentsans/v4/pxiTypc9vsFDm051Uf6KVwgkfoSxQ0GsQv8ToedPibnr0SZe1Q.woff2","fqdn":"fonts.gstatic.com","domain":"gstatic.com","tld":"com"},"ip":{"addr":"142.250.74.3","port":443,"asn":15169,"as":"GOOGLE","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"font","requested_by":"https://darkchange.io/","date":"2026-01-10T21:08:08.720Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.gstatic.com","organization":""},"issuer":{"commonName":"WR2","organization":"Google Trust Services"},"validity":{"start":"Wed, 03 Dec 2025 15:53:13 GMT","end":"Wed, 25 Feb 2026 15:53:12 GMT"},"fingerprint":{"sha1":"5A:E3:E3:B6:18:F9:10:0B:5B:11:FA:CB:BF:0C:9B:5C:0E:34:70:78","sha256":"FC:46:B0:C1:1E:B2:21:60:D9:7E:6A:ED:42:56:B2:CF:2A:E4:D2:F1:1C:63:63:98:2B:A3:0F:6C:4A:98:74:D6"}}},"request":{"raw":"GET /s/instrumentsans/v4/pxiTypc9vsFDm051Uf6KVwgkfoSxQ0GsQv8ToedPibnr0SZe1Q.woff2 HTTP/1.1\r\nHost: fonts.gstatic.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: identity\r\nOrigin: https://darkchange.io\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://fonts.googleapis.com/\r\nSec-Fetch-Dest: font\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\naccept-ranges: bytes\r\naccess-control-allow-origin: *\r\ncontent-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes\r\ncross-origin-resource-policy: cross-origin\r\ncross-origin-opener-policy: same-origin; report-to=\"apps-themes\"\r\nreport-to: {\"group\":\"apps-themes\",\"max_age\":2592000,\"endpoints\":[{\"url\":\"https://csp.withgoogle.com/csp/report-to/apps-themes\"}]}\r\ntiming-allow-origin: *\r\ncontent-length: 30092\r\nx-content-type-options: nosniff\r\nserver: sffe\r\nx-xss-protection: 0\r\ndate: Sat, 10 Jan 2026 10:57:43 GMT\r\nexpires: Sun, 10 Jan 2027 10:57:43 GMT\r\ncache-control: public, max-age=31536000\r\nage: 36625\r\nlast-modified: Thu, 04 Sep 2025 17:26:18 GMT\r\ncontent-type: font/woff2\r\nalt-svc: h3=\":443\"; ma=2592000,h3-29=\":443\"; ma=2592000\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":null,"data":{"size":30092,"size_decoded":0,"mime_type":"font/woff2","magic":"Web Open Font Format (Version 2), TrueType, length 30092, version 1.0","md5":"fa41c43a3d8e68fafc0ec15acca8b6fd","sha1":"adbdfd9a78699a96a9705fbeb3470c2c653dedf0","sha256":"2ee17598a98d8a59e4df8152d015bec9ab8e4d5672cc0ab42bef806b568e3971","sha512":"936da7cff6f59919a72f564c6f1d3b78e1a3be000fb1ca712abea3266687846d53c25dcf1d1b78221c985d4e96dda91ced26a221d85e4521e3d661c71affa216","ssdeep":"768:eHpJRc2xEL2BUo6ulIYw1wXomue+I4oOf8oSY6fg:gp62Uo6kuOYmuTaOfwYmg","tlshash":"ccd2f18a71f9a1f874695de0b8ee9b54bf8ee3221ae7745610d10781d6e13083bbcc35","first_seen":"2025-06-04T20:20:25.58114Z","last_seen":"2026-08-12T15:36:36.713319Z","times_seen":3052,"resource_available":false,"data":null}},"time_used":178,"timings":{"blocked":80,"dns":1,"connect":7,"send":0,"wait":9,"receive":8,"ssl":68},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"darkchange.io/crypto-logos/tron.svg","fqdn":"darkchange.io","domain":"darkchange.io","tld":"io"},"ip":{"addr":"188.114.97.1","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"lazy-img","requested_by":"https://darkchange.io/","date":"2026-01-10T21:08:08.872Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"darkchange.io","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Thu, 20 Nov 2025 02:05:49 GMT","end":"Wed, 18 Feb 2026 03:03:26 GMT"},"fingerprint":{"sha1":"D9:05:E0:7A:C5:10:1D:91:FE:1C:0E:8E:3B:5A:C6:2E:53:6E:71:26","sha256":"77:91:00:F2:25:D2:53:58:51:3C:40:EE:E6:DD:C1:A6:D3:EE:B5:16:F1:6E:C2:19:CF:54:27:61:9E:46:C7:AF"}}},"request":{"raw":"GET /crypto-logos/tron.svg HTTP/1.1\r\nHost: darkchange.io\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://darkchange.io/\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\ndate: Sat, 10 Jan 2026 21:08:08 GMT\r\ncontent-type: image/svg+xml\r\nvary: Origin, accept-encoding\r\naccess-control-allow-credentials: true\r\naccess-control-expose-headers: Content-Length,X-Total-Count\r\nx-frame-options: DENY\r\nx-content-type-options: nosniff\r\nx-xss-protection: 1; mode=block\r\nreferrer-policy: strict-origin-when-cross-origin\r\nstrict-transport-security: max-age=31536000; includeSubDomains\r\ncontent-security-policy: default-src 'self'; script-src 'self'; style-src 'self' https://fonts.googleapis.com; font-src 'self' https://fonts.gstatic.com; img-src 'self' data: https:; connect-src 'self' https:; frame-ancestors 'none';\r\npermissions-policy: geolocation=(), microphone=(), camera=()\r\ncache-control: max-age=14400\r\ncf-cache-status: EXPIRED\r\nlast-modified: Sat, 10 Jan 2026 21:08:08 GMT\r\npriority: u=4,i=?0\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=Oy9va1G17801QGzV4X9VZwqy4vnhpj2AZc%2Bs7OGunAkCwW1PsaPcZYSDdwaSZcwdn3sFRu90f9GXFKgWrqdah7jdSC4LLA315NTrpWY%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncontent-encoding: br\r\nserver: cloudflare\r\ncf-ray: 9bbf25e37962a0f0-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":2111,"size_decoded":0,"mime_type":"image/svg+xml","magic":"SVG Scalable Vector Graphics image","md5":"50b335796a43739f53b9732e9b167c99","sha1":"c26fd4cfa54526cecb12424858e57976b46f379f","sha256":"bb42d2e24070425d1df58e434487095c19880bf0279137eee2948ce03854016b","sha512":"3904f93cae000daa5ca9599468c2b9f2fe40069d34c12152bcac406f5d2a3b2b264b7d1140797d80f36eff8807680b3f14fefb08a65d19d5a74c427a19b2407e","ssdeep":"","tlshash":"cd4105a94344a3d84901c7a8c83c5961713f31ea7fa4cea1ce52b74ba21e19e1dedcc0","first_seen":"2025-11-20T12:33:06.995862Z","last_seen":"2026-02-14T00:24:47.928876Z","times_seen":7,"resource_available":false,"data":null}},"time_used":73,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":73,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-01-10","alert":"Sinkholed","trigger":"darkchange.io","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"darkchange.io/crypto-logos/usdc.svg","fqdn":"darkchange.io","domain":"darkchange.io","tld":"io"},"ip":{"addr":"188.114.97.1","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"lazy-img","requested_by":"https://darkchange.io/","date":"2026-01-10T21:08:08.878Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"darkchange.io","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Thu, 20 Nov 2025 02:05:49 GMT","end":"Wed, 18 Feb 2026 03:03:26 GMT"},"fingerprint":{"sha1":"D9:05:E0:7A:C5:10:1D:91:FE:1C:0E:8E:3B:5A:C6:2E:53:6E:71:26","sha256":"77:91:00:F2:25:D2:53:58:51:3C:40:EE:E6:DD:C1:A6:D3:EE:B5:16:F1:6E:C2:19:CF:54:27:61:9E:46:C7:AF"}}},"request":{"raw":"GET /crypto-logos/usdc.svg HTTP/1.1\r\nHost: darkchange.io\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://darkchange.io/\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\ndate: Sat, 10 Jan 2026 21:08:08 GMT\r\ncontent-type: image/svg+xml\r\nvary: Origin, accept-encoding\r\naccess-control-allow-credentials: true\r\naccess-control-expose-headers: Content-Length,X-Total-Count\r\nx-frame-options: DENY\r\nx-content-type-options: nosniff\r\nx-xss-protection: 1; mode=block\r\nreferrer-policy: strict-origin-when-cross-origin\r\nstrict-transport-security: max-age=31536000; includeSubDomains\r\ncontent-security-policy: default-src 'self'; script-src 'self'; style-src 'self' https://fonts.googleapis.com; font-src 'self' https://fonts.gstatic.com; img-src 'self' data: https:; connect-src 'self' https:; frame-ancestors 'none';\r\npermissions-policy: geolocation=(), microphone=(), camera=()\r\ncache-control: max-age=14400\r\ncf-cache-status: EXPIRED\r\nlast-modified: Sat, 10 Jan 2026 21:08:08 GMT\r\npriority: u=4,i=?0\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=Q9c1oE7nH6d3MJtVt%2FzLeLUUqhMYE47ndNc87TjmjXewg2xvcemLbiHyxi2sBFKj9iVUBDRuyoQSw4zzMhXtg%2BzXw9iZhhGTPnuSOdQ%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncontent-encoding: br\r\nserver: cloudflare\r\ncf-ray: 9bbf25e3796da0f0-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":5389,"size_decoded":0,"mime_type":"image/svg+xml","magic":"SVG Scalable Vector Graphics image","md5":"3efa829825e0aafe584dc38340df3521","sha1":"419b9a5a76c7514d53b6a8bb28166596a240073b","sha256":"ff91257f6dbb041edb366426d8212025de30e743d12551b138a661ef3d79d51c","sha512":"f6409425daf0e428dad695ecf183a7c4ca3bff043c5214e796eac65d8db5acecfedb3465ef3d5629fc5be9dad00de2f0b21c8b51633f8b65e8c03486eca641f3","ssdeep":"96:Kj7E2ORa823AvAL67FCkEc/Pa6jmWx/nCWyTKhtjd3J7RCIhd:KjY2N823AIL67F/Ec/Pnj9x6hOhtZZ1p","tlshash":"32b176e163e4b3f4960af7e4d9189425797b24fa7f92cfa4c365bd44a15101e88dccc4","first_seen":"2025-11-20T12:33:06.972648Z","last_seen":"2026-02-14T00:24:47.941773Z","times_seen":7,"resource_available":false,"data":null}},"time_used":70,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":70,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-01-10","alert":"Sinkholed","trigger":"darkchange.io","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"darkchange.io/api/auth/get-session","fqdn":"darkchange.io","domain":"darkchange.io","tld":"io"},"ip":{"addr":"188.114.97.1","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"fetch","requested_by":"https://darkchange.io/","date":"2026-01-10T21:08:09.178Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"darkchange.io","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Thu, 20 Nov 2025 02:05:49 GMT","end":"Wed, 18 Feb 2026 03:03:26 GMT"},"fingerprint":{"sha1":"D9:05:E0:7A:C5:10:1D:91:FE:1C:0E:8E:3B:5A:C6:2E:53:6E:71:26","sha256":"77:91:00:F2:25:D2:53:58:51:3C:40:EE:E6:DD:C1:A6:D3:EE:B5:16:F1:6E:C2:19:CF:54:27:61:9E:46:C7:AF"}}},"request":{"raw":"GET /api/auth/get-session HTTP/1.1\r\nHost: darkchange.io\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://darkchange.io/\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\ndate: Sat, 10 Jan 2026 21:08:09 GMT\r\ncontent-type: application/json\r\naccess-control-allow-credentials: true\r\naccess-control-expose-headers: Content-Length,X-Total-Count\r\ncontent-security-policy: default-src 'self'; script-src 'self'; style-src 'self' https://fonts.googleapis.com; font-src 'self' https://fonts.gstatic.com; img-src 'self' data: https:; connect-src 'self' https:; frame-ancestors 'none';\r\nreferrer-policy: strict-origin-when-cross-origin\r\nstrict-transport-security: max-age=31536000; includeSubDomains\r\nvary: Origin\r\nx-content-type-options: nosniff\r\nx-frame-options: DENY\r\nx-xss-protection: 1; mode=block\r\npermissions-policy: geolocation=(), microphone=(), camera=()\r\ncf-cache-status: DYNAMIC\r\npriority: u=4,i=?0\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=S0BTmxyasmfhfolMgzWJS0XFzTEJyF4MtZqvVP3d2EIMVBlgIyTfC3XJ83pNO3fhBgTfOcoMcHYQb9oIWJ5REEGvpj2uV0VVVdsDwtw%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncontent-encoding: br\r\nserver: cloudflare\r\ncf-ray: 9bbf25e56e79a0f0-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":4,"size_decoded":0,"mime_type":"application/json","magic":"ASCII text, with no line terminators","md5":"37a6259cc0c1dae299a7866489dff0bd","sha1":"2be88ca4242c76e8253ac62474851065032d6833","sha256":"74234e98afe7498fb5daf1f36ac2d78acc339464f950703b8c019892f982b90b","sha512":"04f8ff2682604862e405bf88de102ed7710ac45c1205957625e4ee3e5f5a2241e453614acc451345b91bafc88f38804019c7492444595674e94e8cf4be53817f","ssdeep":"","tlshash":"b9300000000000000000000000000000000300000000000000000000000c0000000000","first_seen":"2023-03-07T01:02:14Z","last_seen":"2026-08-12T15:39:32.058998Z","times_seen":283303,"resource_available":true,"data":null}},"time_used":34,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":34,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-01-10","alert":"Sinkholed","trigger":"darkchange.io","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"darkchange.io/illustrations/kyc-free.png","fqdn":"darkchange.io","domain":"darkchange.io","tld":"io"},"ip":{"addr":"188.114.97.1","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://darkchange.io/","date":"2026-01-10T21:08:08.497Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"darkchange.io","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Thu, 20 Nov 2025 02:05:49 GMT","end":"Wed, 18 Feb 2026 03:03:26 GMT"},"fingerprint":{"sha1":"D9:05:E0:7A:C5:10:1D:91:FE:1C:0E:8E:3B:5A:C6:2E:53:6E:71:26","sha256":"77:91:00:F2:25:D2:53:58:51:3C:40:EE:E6:DD:C1:A6:D3:EE:B5:16:F1:6E:C2:19:CF:54:27:61:9E:46:C7:AF"}}},"request":{"raw":"GET /illustrations/kyc-free.png HTTP/1.1\r\nHost: darkchange.io\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://darkchange.io/\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\ndate: Sat, 10 Jan 2026 21:08:08 GMT\r\ncontent-type: image/png\r\nvary: Origin, accept-encoding\r\naccess-control-allow-credentials: true\r\naccess-control-expose-headers: Content-Length,X-Total-Count\r\nx-frame-options: DENY\r\nx-content-type-options: nosniff\r\nx-xss-protection: 1; mode=block\r\nreferrer-policy: strict-origin-when-cross-origin\r\nstrict-transport-security: max-age=31536000; includeSubDomains\r\ncontent-security-policy: default-src 'self'; script-src 'self'; style-src 'self' https://fonts.googleapis.com; font-src 'self' https://fonts.gstatic.com; img-src 'self' data: https:; connect-src 'self' https:; frame-ancestors 'none';\r\npermissions-policy: geolocation=(), microphone=(), camera=()\r\ncache-control: max-age=14400\r\ncf-cache-status: EXPIRED\r\nlast-modified: Sat, 10 Jan 2026 21:08:08 GMT\r\npriority: u=4,i=?0\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=m5xWZjr0sSSbZqDHHmkmefb3XitdEFGNxIqsRGmRUIjTDBsnhduu12rocXS8RGP%2BXkZ6pViAAA4IfYvn0q3NpkyyVeV7xt6%2FAaizIdM%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nserver: cloudflare\r\ncf-ray: 9bbf25e12b79a0f0-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":39058,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 530 x 250, 8-bit/color RGBA, non-interlaced","md5":"4bbf212972386f729357f3b66b76c4ac","sha1":"446f072a3ccc1364ab1d5948c75674e521d48d28","sha256":"e9ba59afd712f7cfa34944a20732d5e8fe2fa6423a428e50050463711bd625cb","sha512":"94a63efc14ebb3f1080515ce65215c9cbeeeea2572d447a887f794202f507abebabf85c8c5f4b3a15c7e4430cdfb40fa5f436e4e6d4ac5a8b90571c77174bc2f","ssdeep":"768:EqnAH3O900rYwY5zDZGubkEF/i4YyCINxG3n2kYyW1ZvhsWrcZNOm+K+psa:tnAH3Q/r1YTPwX9Iy27yoxhrraONK+pb","tlshash":"d703027123081caf6abf6f98cf925337b357109b51f42a9a3c7cc925af40c69a6849c0","first_seen":"2026-01-10T21:08:37.491523Z","last_seen":"2026-02-01T12:31:39.36001Z","times_seen":2,"resource_available":false,"data":null}},"time_used":123,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":75,"receive":48,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-01-10","alert":"Sinkholed","trigger":"darkchange.io","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"darkchange.io/crypto-icons/monero.svg","fqdn":"darkchange.io","domain":"darkchange.io","tld":"io"},"ip":{"addr":"188.114.97.1","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://darkchange.io/","date":"2026-01-10T21:08:08.638Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"darkchange.io","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Thu, 20 Nov 2025 02:05:49 GMT","end":"Wed, 18 Feb 2026 03:03:26 GMT"},"fingerprint":{"sha1":"D9:05:E0:7A:C5:10:1D:91:FE:1C:0E:8E:3B:5A:C6:2E:53:6E:71:26","sha256":"77:91:00:F2:25:D2:53:58:51:3C:40:EE:E6:DD:C1:A6:D3:EE:B5:16:F1:6E:C2:19:CF:54:27:61:9E:46:C7:AF"}}},"request":{"raw":"GET /crypto-icons/monero.svg HTTP/1.1\r\nHost: darkchange.io\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://darkchange.io/\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\ndate: Sat, 10 Jan 2026 21:08:08 GMT\r\ncontent-type: image/svg+xml\r\nvary: Origin, accept-encoding\r\naccess-control-allow-credentials: true\r\naccess-control-expose-headers: Content-Length,X-Total-Count\r\nx-frame-options: DENY\r\nx-content-type-options: nosniff\r\nx-xss-protection: 1; mode=block\r\nreferrer-policy: strict-origin-when-cross-origin\r\nstrict-transport-security: max-age=31536000; includeSubDomains\r\ncontent-security-policy: default-src 'self'; script-src 'self'; style-src 'self' https://fonts.googleapis.com; font-src 'self' https://fonts.gstatic.com; img-src 'self' data: https:; connect-src 'self' https:; frame-ancestors 'none';\r\npermissions-policy: geolocation=(), microphone=(), camera=()\r\nage: 0\r\ncache-control: max-age=14400\r\ncf-cache-status: HIT\r\nlast-modified: Sat, 10 Jan 2026 21:08:08 GMT\r\npriority: u=4,i=?0\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=FNR94JcOjnZ8bnF95Sj9OhDHEdATDPMpSasv%2B2lb5wqP8IeyMygOXyar%2BKiqThfPUnavHtKkIISyG3dmhcn9fyXEBEC8D52%2BHX4A33o%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncontent-encoding: br\r\nserver: cloudflare\r\ncf-ray: 9bbf25e20dcda0f0-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":684,"size_decoded":0,"mime_type":"image/svg+xml","magic":"SVG Scalable Vector Graphics image","md5":"0464d3fc8854d5aac9aed51e4dd925ab","sha1":"4310eef588596e0c745868e6726795c055bc29a3","sha256":"01359ad46a5603d37dcb4c061717ee9e9d5bcbd56f86b21ce170f98d6531cdd3","sha512":"1a2648379029e852f88cef0ffd133ca87b89efa4ef0837381393241e08b407ed68de18b1d7e03c85a1ebe3927e89d48ffafb56380c72b2f092bf2b93f4afdc87","ssdeep":"","tlshash":"83019ee073980f1cc71647bd4f0c297957feb1efba6e5480b9493557a98c03ba8c9880","first_seen":"2025-11-20T12:33:07.007615Z","last_seen":"2026-02-14T00:24:47.926149Z","times_seen":7,"resource_available":false,"data":null}},"time_used":5,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":5,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-01-10","alert":"Sinkholed","trigger":"darkchange.io","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}}]}